db29.exe. kommt immer wieder trotz virenscan und quarantäne

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 14-02-2015
Ran by Kerstin (administrator) on KERSTIN-PC on 14-02-2015 22:08:13
Running from C:\Users\Kerstin\Downloads
Loaded Profiles: Kerstin (Available profiles: Kerstin)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Spotify Ltd) C:\Users\Kerstin\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe
() C:\Program Files\004\rqpbhevlkc64.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_305.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_305.exe
() C:\Users\Kerstin\Desktop\Defogger.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\update.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\updrgui.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\update.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13374568 2011-12-13] (Realtek Semiconductor)
HKLM\...\Run: [ESET-Phase2] => C:\ProgramData\ESET\ESET-phase2.exe [1100656 2010-11-10] ()
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [169768 2015-01-27] (Apple Inc.)
HKLM-x32\...\Run: [fst_de_7] => [X]
HKLM-x32\...\Run: [Registry Helper] => "C:\Program Files (x86)\Registry Helper\RegistryHelper.Exe" /boot
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2010-11-05] (Intel Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [702768 2014-12-11] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [126712 2015-01-19] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-2890383179-3499982190-3409672644-1001\...\Run: [Browser Infrastructure Helper] => C:\Users\Kerstin\AppData\Local\Smartbar\Application\SnapDo.exe startup
HKU\S-1-5-21-2890383179-3499982190-3409672644-1001\...\Run: [Spotify Web Helper] => C:\Users\Kerstin\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1176632 2014-06-16] (Spotify Ltd)
HKU\S-1-5-21-2890383179-3499982190-3409672644-1001\...\Run: [Spotify] => C:\Users\Kerstin\AppData\Roaming\Spotify\spotify.exe [6170168 2014-06-16] (Spotify Ltd)
HKU\S-1-5-21-2890383179-3499982190-3409672644-1001\...\MountPoints2: {1359343c-d41d-11e3-9b93-00224d7b4b93} - E:\Startme.exe
HKU\S-1-5-21-2890383179-3499982190-3409672644-1001\...\MountPoints2: {36cd75b7-d3b9-11e3-8ef6-806e6f6e6963} - D:\auto.exe
HKU\S-1-5-21-2890383179-3499982190-3409672644-1001\...\MountPoints2: {e61beb75-02d0-11e4-b082-00224d7b4b93} - E:\AutoRun.exe {D2D77DC2-8299-11D1-8949-444553540000} 5.2066.1.A11B02 PID_0083
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-2890383179-3499982190-3409672644-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPAMW02fR3s5PAVMZpZbM61lWNTdgwQHuH_howCorPPPyzMfc8qrgBOhqWBn7kuAVVgEJVs0L86QrR_l8h9uutX0rgf97u6zEC5OFGSB1d7wjH6Oarpbx1exyiHUnMhhXy_o6EJJs4zfSUIz50GIpXGRBEJ1UbqhJFPvkmIaXdKWcFm&q={searchTerms}
HKU\S-1-5-21-2890383179-3499982190-3409672644-1001\Software\Microsoft\Internet Explorer\Main,Start Page = Search
HKU\S-1-5-21-2890383179-3499982190-3409672644-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = webssearches
HKU\S-1-5-21-2890383179-3499982190-3409672644-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://syb.msn.com
GIGA ANDROID | Android News, Tests und Anleitungen | androidnews.de
HKU\S-1-5-21-2890383179-3499982190-3409672644-1001\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://syb.msn.com
HKU\S-1-5-21-2890383179-3499982190-3409672644-1001\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPAMW02fR3s5PAVMZpZbM61lWNTdgwQHuH_howCorPPPyzMfc8qrgBOhqWBn7kuAVVgEJVs0L86QrR_l8h9uutX0rgf97u6zEC5OFGSB1d7wjH6Oarpbx1exyiHUnMhhXy_o6EJJs4zfSUIz50GIpXGRBEJ1UbqhJFPvkmIaXdKWcFm&q={searchTerms}
SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = 
SearchScopes: HKLM -> {05B62290-31C8-45EC-99C6-F05963923521} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSBTDF&pc=MASB&src=IE-SearchBox
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2492} URL = hxxp://www.default-search.net/search?sid=492&aid=103&itype=a&ver=12521&tm=339&src=ds&p={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPAMW02fR3s5PAVMZpZbM61lWNTdgwQHuH_howCorPPPyzMfc8qrgBOhqWBn7kuAVVgEJVs0L86QrR_l8h9uutX0rgf97u6zEC5OFGSB1d7wjH6Oarpbx1exyiHUnMhhXy_o6EJJs4zfSUIz50GIpXGRBEJ1UbqhJFPvkmIaXdKWcFl&q={searchTerms}
SearchScopes: HKLM-x32 -> {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPAMW02fR3s5PAVMZpZbM61lWNTdgwQHuH_howCorPPPyzMfc8qrgBOhqWBn7kuAVVgEJVs0L86QrR_l8h9uutX0rgf97u6zEC5OFGSB1d7wjH6Oarpbx1exyiHUnMhhXy_o6EJJs4zfSUIz50GIpXGRBEJ1UbqhJFPvkmIaXdKWcFl&q={searchTerms}
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-2890383179-3499982190-3409672644-1001 -> DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPAMW02fR3s5PAVMZpZbM61lWNTdgwQHuH_howCorPPPyzMfc8qrgBOhqWBn7kuAVVgEJVs0L86QrR_l8h9uutX0rgf97u6zEC5OFGSB1d7wjH6Oarpbx1exyiHUnMhhXy_o6EJJs4zfSUIz50GIpXGRBEJ1UbqhJFPvkmIaXdKWcFm&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2890383179-3499982190-3409672644-1001 -> {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPAMW02fR3s5PAVMZpZbM61lWNTdgwQHuH_howCorPPPyzMfc8qrgBOhqWBn7kuAVVgEJVs0L86QrR_l8h9uutX0rgf97u6zEC5OFGSB1d7wjH6Oarpbx1exyiHUnMhhXy_o6EJJs4zfSUIz50GIpXGRBEJ1UbqhJFPvkmIaXdKWcFm&q={searchTerms}
BHO: Snap.DoEngine -> {31ad400d-1b06-4e33-a59a-90c2c140cba0} -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: CouponDownloader -> {10AD2C61-0898-4348-8600-14A342F22AC3} -> C:\Program Files (x86)\Coupon Downloader\Coupon Downloader.dll ()
BHO-x32: Snap.DoEngine -> {31ad400d-1b06-4e33-a59a-90c2c140cba0} -> C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: No Name -> {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} ->  No File
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Snap.Do - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\Windows\system32\mscoree.dll (Microsoft Corporation)
Toolbar: HKLM-x32 - Snap.Do - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe webssearches

FireFox:
========
FF ProfilePath: C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\vokiukc3.default
FF SearchEngineOrder.1: default-search.net
FF Homepage: hxxp://go.1und1.de/tb/mff_startpage|hxxp://www.giga.de/androidnews/
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-2890383179-3499982190-3409672644-1001: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Kerstin\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin HKU\S-1-5-21-2890383179-3499982190-3409672644-1001: pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF user.js: detected! => C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\vokiukc3.default\user.js
FF SearchPlugin: C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\vokiukc3.default\searchplugins\ask-search.xml
FF SearchPlugin: C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\vokiukc3.default\searchplugins\google-images.xml
FF SearchPlugin: C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\vokiukc3.default\searchplugins\google-maps.xml
FF SearchPlugin: C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\vokiukc3.default\searchplugins\Web Search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\default-search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\webssearches.xml
FF Extension: Med Play Air ++ - C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\vokiukc3.default\Extensions\faf73efe-d6aa-46eb-8014-e0b47ac07ead@a90d6ab4-be69-4e96-a979-1fd9c1ae6f92.com [2015-01-01]
FF Extension: SparPilot - Gutscheine &amp; mehr... - C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\vokiukc3.default\Extensions\sparpilot@sparpilot.com [2015-02-10]
FF Extension: WEB.DE MailCheck - C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\vokiukc3.default\Extensions\toolbar@web.de [2015-02-10]
FF Extension: anonymoX - C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\vokiukc3.default\Extensions\client@anonymox.net.xpi [2014-05-08]
FF Extension: Trusted Shops Add-On für Firefox - C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\vokiukc3.default\Extensions\jid1-PBNne26X1Kn6hQ@jetpack.xpi [2014-08-05]
FF Extension: {0db9152f-2c09-4a6a-b006-6852e1787975} - C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\vokiukc3.default\Extensions\{0db9152f-2c09-4a6a-b006-6852e1787975}.xpi [2015-02-10]
FF HKLM\...\Firefox\Extensions: [{21EAF666-26B3-4a3c-ABD0-CA2F5A326744}] - C:\Program Files\V-bates\Firefox
FF HKLM\...\Firefox\Extensions: [{01856272-60D2-48c0-8F8F-852C369B15A1}] - C:\Program Files\Slotomania Coin Expansion Pack\Firefox
FF HKLM-x32\...\Firefox\Extensions: [{21EAF666-26B3-4a3c-ABD0-CA2F5A326744}] - C:\Program Files\V-bates\Firefox
FF HKLM-x32\...\Firefox\Extensions: [{01856272-60D2-48c0-8F8F-852C369B15A1}] - C:\Program Files\Slotomania Coin Expansion Pack\Firefox
FF HKU\S-1-5-21-2890383179-3499982190-3409672644-1001\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\vokiukc3.default\extensions\cliqz@cliqz.com

Chrome: 
=======
CHR HomePage: Default -> hxxp://istart.webssearches.com/?type=hppp&ts=1402753960&from=tugs&uid=WDCXWD3200AZDX-00SC2B0_WD-WMC1U125506255062
CHR StartupUrls: Default -> "hxxp://istart.webssearches.com/?type=hppp&ts=1402753960&from=tugs&uid=WDCXWD3200AZDX-00SC2B0_WD-WMC1U125506255062"
CHR DefaultSearchKeyword: Default -> webssearches
CHR DefaultSearchURL: Default -> hxxp://istart.webssearches.com/web/?type=dspp&ts=1402826947&from=tugs&uid=WDCXWD3200AZDX-00SC2B0_WD-WMC1U125506255062&q={searchTerms}
CHR DefaultSuggestURL: Default -> 
CHR Profile: C:\Users\Kerstin\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Kerstin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-05-16]
CHR Extension: (Google Drive) - C:\Users\Kerstin\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-05-16]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Kerstin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-08-27]
CHR Extension: (YouTube) - C:\Users\Kerstin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-05-16]
CHR Extension: (Slotomania Coin Expansion Pack) - C:\Users\Kerstin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bmonpfhhpdjphhlanhockbccaakgahgh [2014-05-28]
CHR Extension: (Google-Suche) - C:\Users\Kerstin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-05-16]
CHR Extension: (Mediaa_Play_AIR_1.4) - C:\Users\Kerstin\AppData\Local\Google\Chrome\User Data\Default\Extensions\mfhkgfigejkhikbkfkkglinnkfojkdek [2014-06-14]
CHR Extension: (Google Wallet) - C:\Users\Kerstin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-05-16]
CHR Extension: (MapsGalaxy) - C:\Users\Kerstin\AppData\Local\Google\Chrome\User Data\Default\Extensions\obhjnggbngfbgghjfkmpcnihbgnehgeo [2014-11-08]
CHR Extension: (Google Mail) - C:\Users\Kerstin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-05-16]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-12-11] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-12-11] (Avira Operations GmbH & Co. KG)
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-01-19] (Apple Inc.)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [182520 2015-01-19] (Avira Operations GmbH & Co. KG)
R2 rqpbhevlkc64; C:\Program Files\004\rqpbhevlkc64.exe [709120 2014-05-06] () [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-07] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-10-07] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-05-09] (Avira Operations GmbH & Co. KG)
R3 igddim64; C:\Windows\System32\DRIVERS\igddim64.sys [1703936 2011-08-30] (Intel Corporation)
R3 imgkmd64; C:\Windows\System32\DRIVERS\imgkmd64.sys [479232 2011-08-30] (Imagination Technologies)
S3 s1029bus; C:\Windows\System32\DRIVERS\s1029bus.sys [116264 2009-05-25] (MCCI Corporation)
S3 s1029mdfl; C:\Windows\System32\DRIVERS\s1029mdfl.sys [19496 2009-05-25] (MCCI Corporation)
S3 s1029mdm; C:\Windows\System32\DRIVERS\s1029mdm.sys [158760 2009-05-25] (MCCI Corporation)
S3 s1029mgmt; C:\Windows\System32\DRIVERS\s1029mgmt.sys [139304 2009-05-25] (MCCI Corporation)
S3 s1029nd5; C:\Windows\System32\DRIVERS\s1029nd5.sys [34856 2009-05-25] (MCCI Corporation)
S3 s1029obex; C:\Windows\System32\DRIVERS\s1029obex.sys [135208 2009-05-25] (MCCI Corporation)
S3 s1029unic; C:\Windows\System32\DRIVERS\s1029unic.sys [151592 2009-05-25] (MCCI Corporation)
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
S3 massfilter_hs; \??\C:\Windows\system32\drivers\massfilter_hs.sys [X]
S3 VBoxNetFlt; system32\DRIVERS\VBoxNetFlt.sys [X]
S3 X6va015; \??\C:\Windows\SysWOW64\Drivers\X6va015 [X]
S3 zghsmdm; system32\DRIVERS\zghsmdm.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-14 22:08 - 2015-02-14 22:10 - 00021991 _____ () C:\Users\Kerstin\Downloads\FRST.txt
2015-02-14 22:08 - 2015-02-14 22:08 - 00000000 ____D () C:\FRST
2015-02-14 22:06 - 2015-02-14 22:06 - 02134528 _____ (Farbar) C:\Users\Kerstin\Downloads\FRST64.exe
2015-02-14 22:01 - 2015-02-14 22:01 - 00000476 _____ () C:\Users\Kerstin\Desktop\defogger_disable.log
2015-02-14 22:01 - 2015-02-14 22:01 - 00000000 _____ () C:\Users\Kerstin\defogger_reenable
2015-02-14 21:58 - 2015-02-14 21:58 - 00050477 _____ () C:\Users\Kerstin\Desktop\Defogger.exe
2015-02-14 01:41 - 2015-02-14 01:41 - 00000000 ____D () C:\ProgramData\Samsung
2015-02-14 00:50 - 2015-02-14 01:42 - 00000000 ____D () C:\Users\Kerstin\Documents\samsung
2015-02-14 00:50 - 2015-02-14 00:50 - 00000000 ____D () C:\Users\Public\Documents\NativeFus_Log
2015-02-14 00:50 - 2015-02-14 00:50 - 00000000 ____D () C:\Users\Kerstin\Documents\SelfMV
2015-02-14 00:49 - 2015-02-14 00:50 - 00000000 ____D () C:\Users\Kerstin\AppData\Roaming\Samsung
2015-02-14 00:49 - 2015-02-14 00:49 - 00001973 _____ () C:\Users\Public\Desktop\Samsung Kies 3.lnk
2015-02-14 00:49 - 2015-02-14 00:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung
2015-02-14 00:49 - 2015-02-14 00:49 - 00000000 ____D () C:\Program Files (x86)\Samsung
2015-02-14 00:49 - 2014-05-07 17:42 - 00144664 _____ (MAPILab Ltd. & Add-in Express Ltd.) C:\Windows\SysWOW64\secman.dll
2015-02-14 00:39 - 2015-02-14 00:40 - 42498888 _____ (Samsung Electronics Co., Ltd.) C:\Users\Kerstin\Downloads\Kies3Setup.exe
2015-02-14 00:00 - 2015-02-14 00:00 - 00000000 ____D () C:\Users\Kerstin\AppData\Roaming\MyPhoneExplorer
2015-02-13 23:59 - 2015-02-13 23:59 - 00002061 _____ () C:\Users\Public\Desktop\MyPhoneExplorer.lnk
2015-02-13 23:59 - 2015-02-13 23:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MyPhoneExplorer
2015-02-13 23:58 - 2015-02-13 23:59 - 00000000 ____D () C:\Program Files (x86)\MyPhoneExplorer
2015-02-13 23:40 - 2015-02-13 23:40 - 00659464 _____ () C:\Users\Kerstin\Downloads\myphoneexplorer.exe
2015-02-12 18:28 - 2014-12-05 11:32 - 139196615 _____ () C:\Users\Kerstin\20141205_113135.mp4
2015-02-12 18:28 - 2014-12-01 11:24 - 232466986 _____ () C:\Users\Kerstin\20141201_112247.mp4
2015-02-12 18:28 - 2014-11-30 11:30 - 275072892 _____ () C:\Users\Kerstin\20141130_112831.mp4
2015-02-12 18:27 - 2014-11-23 22:31 - 208943022 _____ () C:\Users\Kerstin\20141123_222952.mp4
2015-02-12 18:27 - 2014-11-14 19:52 - 136757681 _____ () C:\Users\Kerstin\20141114_195143.mp4
2015-02-12 18:27 - 2014-11-14 13:46 - 311908025 _____ () C:\Users\Kerstin\20141114_134342.mp4
2015-02-12 18:26 - 2015-01-26 08:34 - 143517436 _____ () C:\Users\Kerstin\20150126_083313.mp4
2015-02-12 18:26 - 2015-01-12 22:21 - 346180627 _____ () C:\Users\Kerstin\20150112_221907.mp4
2015-02-12 18:26 - 2015-01-01 00:11 - 00351735 _____ () C:\Users\Kerstin\20150101_001052.mp4
2015-02-12 18:26 - 2014-12-27 15:34 - 74917974 _____ () C:\Users\Kerstin\20141227_153416.mp4
2015-02-12 18:26 - 2014-12-27 15:32 - 41031175 _____ () C:\Users\Kerstin\20141227_153210.mp4
2015-02-12 18:26 - 2014-12-25 21:13 - 157444083 _____ () C:\Users\Kerstin\20141225_211203.mp4
2015-02-12 18:26 - 2014-11-09 18:32 - 356998952 _____ () C:\Users\Kerstin\20141109_182926.mp4
2015-02-12 18:25 - 2014-12-25 21:11 - 180618452 _____ () C:\Users\Kerstin\20141225_211021.mp4
2015-02-12 18:25 - 2014-12-25 14:36 - 207078718 _____ () C:\Users\Kerstin\20141225_143453.mp4
2015-02-12 18:25 - 2014-12-24 18:41 - 06138834 _____ () C:\Users\Kerstin\20141224_184113.mp4
2015-02-12 18:25 - 2014-12-20 14:14 - 239835541 _____ () C:\Users\Kerstin\20141220_141233.mp4
2015-02-12 18:25 - 2014-12-19 19:42 - 101770616 _____ () C:\Users\Kerstin\20141219_194114.mp4
2015-02-12 18:24 - 2014-12-15 19:04 - 244473975 _____ () C:\Users\Kerstin\20141215_190217.mp4
2015-02-12 18:24 - 2014-12-14 19:26 - 211934675 _____ () C:\Users\Kerstin\20141214_192449.mp4
2015-02-12 17:00 - 2015-02-12 17:00 - 00001753 _____ () C:\Users\Public\Desktop\iTunes.lnk
2015-02-12 17:00 - 2015-02-12 17:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2015-02-12 16:57 - 2015-02-12 16:59 - 00000000 ____D () C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7
2015-02-12 16:57 - 2015-02-12 16:59 - 00000000 ____D () C:\Program Files\iTunes
2015-02-12 16:57 - 2015-02-12 16:57 - 00000000 ____D () C:\Program Files\iPod
2015-02-12 16:57 - 2015-02-12 16:57 - 00000000 ____D () C:\Program Files (x86)\iTunes
2015-02-11 20:51 - 2015-02-11 20:51 - 00000000 ____D () C:\Users\Kerstin\AppData\Local\{B4A2C882-B21E-4B65-B513-4C4DDE94450C}
2015-02-11 14:47 - 2015-02-11 14:47 - 00000000 _____ () C:\Windows\SysWOW64\sho8A0A.tmp
2015-02-10 19:38 - 2015-02-10 19:54 - 00000000 ____D () C:\Users\Kerstin\AppData\Local\Genymobile
2015-02-10 19:38 - 2015-02-10 19:50 - 00000000 ____D () C:\Users\Kerstin\.VirtualBox
2015-02-10 19:36 - 2013-04-12 11:41 - 00237840 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxDrv.sys
2015-02-10 19:33 - 2013-04-12 11:40 - 00120080 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxUSBMon.sys
2015-02-10 19:31 - 2015-02-10 19:31 - 00000000 ____D () C:\Program Files\Genymobile
2015-02-10 19:29 - 2015-02-10 19:29 - 00000000 ____D () C:\Users\Kerstin\AppData\Local\Temp515a80549b13c62719b8b0be014862d3
2015-02-10 19:28 - 2015-02-10 19:28 - 01045496 _____ () C:\Users\Kerstin\Downloads\Genymotion-lnstall.exe
2015-02-10 16:37 - 2015-02-10 17:55 - 00002004 _____ () C:\Users\Kerstin\Desktop\WhatsApp.lnk
2015-02-10 16:14 - 2015-02-10 16:14 - 01198368 _____ () C:\Users\Kerstin\Downloads\BlueStacks App Player - CHIP-Installer(1).exe
2015-01-31 22:17 - 2015-01-31 22:17 - 00000000 _____ () C:\Windows\SysWOW64\sho83D.tmp
2015-01-31 11:58 - 2015-02-11 11:41 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-25 00:12 - 2015-01-25 00:12 - 00000000 _____ () C:\Windows\SysWOW64\sho29F1.tmp
2015-01-22 17:03 - 2015-01-22 17:03 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Macromedia
2015-01-22 17:03 - 2015-01-22 17:03 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Adobe
2015-01-22 17:03 - 2015-01-22 17:03 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Macromedia
2015-01-22 17:03 - 2015-01-22 17:03 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Adobe
2015-01-21 19:55 - 2015-01-21 19:55 - 00386448 _____ () C:\Windows\Minidump\012115-17035-01.dmp

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-14 22:01 - 2014-05-04 19:33 - 00000000 ____D () C:\Users\Kerstin
2015-02-14 21:51 - 2014-06-14 14:51 - 00002272 _____ () C:\Windows\Tasks\0f35c805-0126-47dc-bc26-393cdbd9833d-4.job
2015-02-14 21:27 - 2009-07-14 05:45 - 00028896 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-14 21:27 - 2009-07-14 05:45 - 00028896 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-14 21:16 - 2014-05-16 19:46 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-02-14 20:04 - 2014-06-16 19:24 - 00000000 ____D () C:\Users\Kerstin\AppData\Roaming\Spotify
2015-02-14 20:03 - 2014-06-16 19:25 - 00000000 ____D () C:\Users\Kerstin\AppData\Local\Spotify
2015-02-14 20:02 - 2009-07-14 05:51 - 00049684 _____ () C:\Windows\setupact.log
2015-02-14 19:23 - 2014-05-04 19:26 - 01723057 _____ () C:\Windows\WindowsUpdate.log
2015-02-14 19:19 - 2014-05-04 20:18 - 01096056 _____ () C:\Users\Kerstin\Documents\ESET-installation-phase2.log
2015-02-14 19:19 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-02-14 19:18 - 2010-11-21 04:47 - 00199286 _____ () C:\Windows\PFRO.log
2015-02-14 19:14 - 2015-01-14 18:25 - 00000112 _____ () C:\ProgramData\5uKMmosV2.dat
2015-02-14 18:37 - 2015-01-14 18:19 - 00000000 ____D () C:\Users\Kerstin\AppData\Roaming\Compatibility Verifier
2015-02-14 18:29 - 2014-05-04 20:14 - 00000000 ____D () C:\ProgramData\ESET
2015-02-14 01:55 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Public\Libraries
2015-02-14 00:49 - 2014-05-04 19:55 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-02-12 18:29 - 2014-06-14 23:45 - 00792576 ___SH () C:\Users\Kerstin\Thumbs.db
2015-02-12 17:46 - 2010-11-21 07:50 - 00699386 _____ () C:\Windows\system32\perfh007.dat
2015-02-12 17:46 - 2010-11-21 07:50 - 00149268 _____ () C:\Windows\system32\perfc007.dat
2015-02-12 17:46 - 2009-07-14 06:13 - 01620248 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-02-12 16:57 - 2014-08-24 18:38 - 00000000 ____D () C:\Program Files\Common Files\Apple
2015-02-12 16:55 - 2014-08-24 18:40 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2015-02-11 21:17 - 2014-05-04 19:33 - 00001659 _____ () C:\Users\Kerstin\Desktop\Internet Explorer.lnk
2015-02-11 21:05 - 2014-05-04 19:33 - 00000000 ____D () C:\Users\Kerstin\AppData\Local\Windows Live
2015-02-10 16:41 - 2014-05-21 09:54 - 00000000 ____D () C:\ProgramData\BlueStacksSetup
2015-02-09 14:19 - 2014-05-16 10:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-02-09 14:19 - 2014-05-16 10:01 - 00000000 ____D () C:\Program Files (x86)\Avira
2015-02-09 14:19 - 2014-05-13 22:59 - 00000000 ____D () C:\ProgramData\Package Cache
2015-02-07 21:11 - 2014-05-16 19:46 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-02-07 21:11 - 2014-05-16 19:46 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-02-07 21:11 - 2014-05-16 19:46 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-02-07 19:29 - 2014-08-22 07:58 - 00000000 ____D () C:\Users\Kerstin\AppData\Local\Adobe
2015-02-07 19:29 - 2014-05-04 21:42 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-02-07 19:29 - 2014-05-04 21:42 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-02-07 00:15 - 2014-05-16 19:47 - 00002403 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-01-31 22:17 - 2014-05-04 22:58 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-01-24 20:10 - 2014-05-16 19:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-01-24 20:10 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\registration
2015-01-21 19:55 - 2014-06-20 16:18 - 00000000 ____D () C:\Windows\Minidump
2015-01-21 19:55 - 2014-05-14 21:26 - 196421006 _____ () C:\Windows\MEMORY.DMP
2015-01-19 12:03 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF
2015-01-15 23:09 - 2014-05-29 20:56 - 00000000 ____D () C:\Users\Kerstin\AppData\Roaming\SoftGrid Client
2015-01-15 14:14 - 2015-01-14 23:09 - 00000000 ____D () C:\Users\Kerstin\AppData\Local\Facebook

==================== Files in the root of some directories =======

2014-05-06 10:38 - 2014-05-06 11:10 - 0000312 _____ () C:\Users\Kerstin\AppData\Roaming\aps.uninstall.scan.results
2014-05-06 21:56 - 2014-05-06 21:56 - 0000046 _____ () C:\Users\Kerstin\AppData\Roaming\WB.CFG
2014-05-06 11:06 - 2014-05-06 14:02 - 1727775 _____ (AnyProtect.com) C:\Users\Kerstin\AppData\Local\AnyProtectScannerSetup.exe
2014-05-06 10:37 - 2014-05-06 10:37 - 1745608 _____ (AnyProtect.com) C:\Users\Kerstin\AppData\Local\nso4FB.tmp
2015-01-14 18:25 - 2015-02-14 19:14 - 0000112 _____ () C:\ProgramData\5uKMmosV2.dat
2014-05-13 21:56 - 2014-05-13 21:56 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

Files to move or delete:
====================
C:\ProgramData\5uKMmosV2.dat


Some content of TEMP:
====================
C:\Users\Kerstin\AppData\Local\Temp\avgnt.exe
C:\Users\Kerstin\AppData\Local\Temp\genymotion-2.3.0-vbox.exe
C:\Users\Kerstin\AppData\Local\Temp\mailcheck_ff_2014_12_02.exe
C:\Users\Kerstin\AppData\Local\Temp\sdan.exe
C:\Users\Kerstin\AppData\Local\Temp\sdapk.exe
C:\Users\Kerstin\AppData\Local\Temp\sdaspwn.exe
C:\Users\Kerstin\AppData\Local\Temp\_is7BE3.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-02-05 11:43

==================== End Of Log ===========================
         

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 14-02-2015
Ran by Kerstin at 2015-02-14 22:12:30
Running from C:\Users\Kerstin\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.246 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Apple Application Support (32-Bit) (HKLM-x32\...\{2FE00055-C4F3-4F7A-AEDD-E198D54CF12F}) (Version: 3.1.1 - Apple Inc.)
Apple Application Support (64-Bit) (HKLM\...\{28791292-D18D-42FA-AE66-3D3D20AA8618}) (Version: 3.1.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{5ED7462B-EF58-4757-B609-53755021EC34}) (Version: 8.1.0.18 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Avira (HKLM-x32\...\{bd538030-07d4-4999-a525-7fafa2483f56}) (Version: 1.1.30.21727 - Avira Operations & Co. KG)
Avira (x32 Version: 1.1.30.21727 - Avira Operations & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.7.468 - Avira)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
CDBurnerXP (HKLM\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.3.8.2523 - CDBurnerXP)
Cliqz (HKLM-x32\...\{5A0C0737-6AFE-4DC6-A8B4-6DFE509ACD75}_is1) (Version: 0.5.31 - Cliqz.com)
CouponDownloader (Version: 1.0.0.0 - CouponDownloader) Hidden <==== ATTENTION
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 40.0.2214.111 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
Intel(R) AppUp (HKLM-x32\...\{0A7596DE-9737-44D2-AAFA-58FA9BBCA0AC}) (Version: 1.0.0 - Intel Corporation)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Graphics Media Accelerator Driver (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.8.1050 - Intel Corporation)
Intel(R) Integrator Assistant (HKLM-x32\...\{D1A35687-AEA9-422C-B237-FC4F8136B6F6}) (Version: 1.0.0 - Intel Corporation)
Intel(R) Network Connections 18.4.59.0 (HKLM\...\PROSetDX) (Version: 18.4.59.0 - Intel)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 10.1.0.1008 - Intel Corporation)
Intel® Chipsatz-Gerätesoftware (x32 Version: 10.0.13 - Intel(R) Corporation) Hidden
iTunes (HKLM\...\{7B8D4E8A-EA2B-4A71-BFEB-A4AAAB87C5D0}) (Version: 12.1.0.71 - Apple Inc.)
Java 7 Update 67 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217055FF}) (Version: 7.0.670 - Oracle)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Klick-und-Los 2010 (HKLM-x32\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Starter 2010 - Deutsch (HKLM-x32\...\{90140011-0066-0407-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft-Maus- und Tastatur-Center (HKLM\...\Microsoft Mouse and Keyboard Center) (Version: 2.3.188.0 - Microsoft Corporation)
Mozilla Firefox 35.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 35.0.1 (x86 de)) (Version: 35.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP2 Parser and SDK (HKLM-x32\...\{716E0306-8318-4364-8B8F-0CC4E9376BAC}) (Version: 4.20.9818.0 - Microsoft Corporation)
MyPhoneExplorer (HKLM-x32\...\MPE) (Version: 1.8.6 - F.J. Wechselberger)
Pando Media Booster (HKLM-x32\...\{980A182F-E0A2-4A40-94C1-AE0C1235902E}) (Version: 2.6.0.7 - Pando Networks Inc.)
PCmover OEM Express (HKLM-x32\...\{1EE14CC2-ED85-4EEA-8714-A31C86AF3769}) (Version: 5.00.617 - Laplink Software, Inc.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6526 - Realtek Semiconductor Corp.)
Samsung Kies3 (HKLM-x32\...\InstallShield_{88547073-C566-4895-9005-EBE98EA3F7C7}) (Version: 3.2.15013.17 - Samsung Electronics Co., Ltd.)
Samsung Kies3 (x32 Version: 3.2.15013.17 - Samsung Electronics Co., Ltd.) Hidden
Screen+ version Screen+ 1.0.4 (HKLM-x32\...\{5B7AF05A-1962-489C-B00A-F12D49889FC9}_is1) (Version: Screen+ 1.0.4 - AOC)
Snap.Do (HKLM-x32\...\{F97A8857-2A38-4CE9-A53A-F07E491F2DA8}) (Version: 11.77.1.17697 - ReSoft Ltd.) <==== ATTENTION
Sony Ericsson PC Suite (HKLM-x32\...\{2FFE93F0-BB72-4E52-8761-354D1AAA9387}) (Version:  - )
Spotify (HKU\S-1-5-21-2890383179-3499982190-3409672644-1001\...\Spotify) (Version: 0.9.10.14.g578d350b - Spotify AB)
System Requirements Lab for Intel (HKLM-x32\...\{1EBDF6D2-CEA0-484C-A23E-2DDAD7FD0DD0}) (Version: 4.5.22.0 - Husdawg, LLC)
Unity Web Player (HKU\S-1-5-21-2890383179-3499982190-3409672644-1001\...\UnityWebPlayer) (Version: 4.5.2f1 - Unity Technologies ApS)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3508.1109 - Microsoft Corporation)
Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
WinRAR 4.20 (64-bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

11-02-2015 11:00:12 Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005
12-02-2015 11:02:57 Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005
12-02-2015 17:22:25 Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005
12-02-2015 20:10:08 Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005
12-02-2015 20:57:16 Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005
13-02-2015 09:53:53 Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005
13-02-2015 09:55:28 Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005
13-02-2015 18:38:40 Removed BlueStacks Notification Center
14-02-2015 00:46:10 Installed Samsung Kies3
14-02-2015 01:27:54 Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005
14-02-2015 01:47:44 Removed BlueStacks Notification Center
14-02-2015 10:18:44 Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005
14-02-2015 18:34:11 Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005
14-02-2015 18:34:11 Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {00563FF1-94B2-4ACF-9C5B-C74614DBEB35} - System32\Tasks\{787E8A7B-C4E2-48E0-ACF9-3461BABB54B6} => pcalua.exe -a C:\Users\Kerstin\Downloads\uninstall(3).exe -d C:\Users\Kerstin\Downloads
Task: {08857CFB-1827-4BC8-AE12-B859848CE7D0} - System32\Tasks\{F737814D-3683-47E5-AF0C-4E1D320A9951} => pcalua.exe -a C:\Users\Kerstin\Downloads\Player_Setup.exe -d C:\Users\Kerstin\Downloads
Task: {08D094D6-0BBD-4B04-9CF4-8DBA255610ED} - System32\Tasks\Microsoft_MKC_Logon_Task_itype.exe => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2014-03-19] (Microsoft Corporation)
Task: {10CBE9BC-8EFE-4053-A7DC-8644AF78EB41} - System32\Tasks\FoxTab => C:\Users\Kerstin\AppData\Roaming\FoxTab\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: {25D8C43E-6604-4F17-8EE7-9FEBD69EE07D} - System32\Tasks\APSnotifierPP2 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {2B1D12A8-48EB-41F9-95C7-12000B4CE960} - System32\Tasks\{67881B7B-FF02-4B3C-9821-7909B874027B} => pcalua.exe -a C:\Users\Kerstin\Downloads\uninstall.exe -d C:\Users\Kerstin\Downloads
Task: {3187A450-53D4-4CCD-A8FF-2D5366B0CAE2} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-05-16] (Google Inc.)
Task: {3B7260BD-1C98-42DA-98F7-6297611EBF41} - System32\Tasks\Microsoft_MKC_Logon_Task_ipoint.exe => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2014-03-19] (Microsoft Corporation)
Task: {4553E21B-6E77-4D64-BF94-B5B28819CC49} - System32\Tasks\Driver Booster SkipUAC (Kerstin) => C:\Program Files (x86)\IObit\Driver Booster\DriverBooster.exe
Task: {5916A9E4-39AF-43E3-942A-A24BAF65DBF1} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2014-03-19] (Microsoft Corporation)
Task: {5BDEFC53-C2D7-4389-BFFB-D1D157331367} - System32\Tasks\APSnotifierPP1 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {5BF6E004-22A9-4C7A-87E2-C78452737D12} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-05-16] (Google Inc.)
Task: {606150B2-4484-4DEA-BEDD-A1D0283FDEED} - System32\Tasks\{E37A25D8-8838-41A3-BC93-DCE5FECBEFB5} => C:\Program Files (x86)\Google\Google Earth\client\googleearth.exe
Task: {95700BD4-E422-4E57-8939-53CAA09C99FF} - System32\Tasks\APSnotifierPP3 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {96424FAA-C6E4-466F-9128-3F0E137581E2} - System32\Tasks\FF Watcher {702CC857-65AF-49A7-833D-5615C60C637D} => C:\Program Files\V-bates\PrefHelper.exe <==== ATTENTION
Task: {A42B3360-11B3-4D6F-B56E-91078D0A055F} - System32\Tasks\{5DA50788-7ECC-4844-B7B1-A78E3EFBAFCA} => pcalua.exe -a C:\Users\Kerstin\AppData\Roaming\webssearches\UninstallManager.exe -c  -ptid=tugs <==== ATTENTION
Task: {A4E92CE6-2AB9-423E-B8B8-B74FB98C7932} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {A53C14D2-FE20-4182-9B0D-0B268780F4C4} - System32\Tasks\{74687C69-1F44-40E3-AF30-79BED7BB4D94} => C:\Users\Kerstin\Downloads\Takania2-Revolution1.3\metin2client_normal.exe
Task: {A784D041-1160-4F06-A792-D939E6FCDE03} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {C5D81029-EB29-4F25-8889-B846207F16A8} - System32\Tasks\{CAD0AD2B-781C-4CFF-B7F2-42D9DC4C3AB4} => C:\Users\Kerstin\Downloads\Takania2-Revolution1.3\metin2client_normal.exe
Task: {CC04BE37-473F-42B7-9334-71F9FC4BF5BD} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2014-03-19] (Microsoft Corporation)
Task: {CCAB2C81-7B17-49A3-88B8-531CB8D975B9} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\mousekeyboardcenter.exe [2014-03-19] (Microsoft)
Task: {D502C482-67D8-4EDC-A288-3AA008B3729B} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {DB88C28E-7CF1-47A7-A440-C9B0EE3C51F4} - System32\Tasks\0f35c805-0126-47dc-bc26-393cdbd9833d-4 => C:\Program Files (x86)\Mediaa_Play_AIR_1.4\0f35c805-0126-47dc-bc26-393cdbd9833d-4.exe <==== ATTENTION
Task: {ECCE2458-3451-47D7-836C-F668C20E8D89} - System32\Tasks\FF Watcher {900BD071-9C0E-4A65-A289-3F4BDE1F81B6} => C:\Program Files\Slotomania Coin Expansion Pack\g56yreg.exe <==== ATTENTION
Task: C:\Windows\Tasks\0f35c805-0126-47dc-bc26-393cdbd9833d-4.job => C:\Program Files (x86)\Mediaa_Play_AIR_1.4\0f35c805-0126-47dc-bc26-393cdbd9833d-4.exe <==== ATTENTION
Task: C:\Windows\Tasks\APSnotifierPP1.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\Windows\Tasks\APSnotifierPP2.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\Windows\Tasks\APSnotifierPP3.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\Windows\Tasks\FF Watcher {702CC857-65AF-49A7-833D-5615C60C637D}.job => C:\Program Files\V-bates\PrefHelper.exe <==== ATTENTION
Task: C:\Windows\Tasks\FF Watcher {900BD071-9C0E-4A65-A289-3F4BDE1F81B6}.job => C:\Program Files\Slotomania Coin Expansion Pack\g56yreg.exe <==== ATTENTION
Task: C:\Windows\Tasks\FoxTab.job => C:\Users\Kerstin\AppData\Roaming\FoxTab\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) ==============

2015-01-20 22:35 - 2015-01-20 22:35 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-01-20 22:35 - 2015-01-20 22:35 - 01346344 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2014-05-06 21:31 - 2014-05-06 21:31 - 00709120 _____ () C:\Program Files\004\rqpbhevlkc64.exe
2015-02-14 21:58 - 2015-02-14 21:58 - 00050477 _____ () C:\Users\Kerstin\Desktop\Defogger.exe
2014-10-18 10:12 - 2014-10-18 10:12 - 00169472 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\93182e9779b8be0f688fd0784df6d7fb\IsdiInterop.ni.dll
2014-05-13 23:42 - 2010-11-05 23:50 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2015-01-31 11:58 - 2015-01-31 11:58 - 03925104 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2015-02-07 19:29 - 2015-02-07 19:29 - 16852144 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData\TEMP:373E1720

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2890383179-3499982190-3409672644-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Kerstin\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.0.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== Accounts: =============================

Administrator (S-1-5-21-2890383179-3499982190-3409672644-500 - Administrator - Disabled)
Gast (S-1-5-21-2890383179-3499982190-3409672644-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2890383179-3499982190-3409672644-1002 - Limited - Enabled)
Kerstin (S-1-5-21-2890383179-3499982190-3409672644-1001 - Administrator - Enabled) => C:\Users\Kerstin

==================== Faulty Device Manager Devices =============

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (02/14/2015 07:20:21 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/14/2015 06:30:14 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/14/2015 11:40:42 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: compatibilitycheck.exe, Version: 0.0.0.0, Zeitstempel: 0x54da5ad7
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea8e7
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000222d2
ID des fehlerhaften Prozesses: 0xfa4
Startzeit der fehlerhaften Anwendung: 0xcompatibilitycheck.exe0
Pfad der fehlerhaften Anwendung: compatibilitycheck.exe1
Pfad des fehlerhaften Moduls: compatibilitycheck.exe2
Berichtskennung: compatibilitycheck.exe3

Error: (02/14/2015 10:03:08 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/14/2015 01:12:33 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/14/2015 00:55:14 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: compatibilitycheck.exe, Version: 0.0.0.0, Zeitstempel: 0x54da5ad7
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea8e7
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000222d2
ID des fehlerhaften Prozesses: 0x94
Startzeit der fehlerhaften Anwendung: 0xcompatibilitycheck.exe0
Pfad der fehlerhaften Anwendung: compatibilitycheck.exe1
Pfad des fehlerhaften Moduls: compatibilitycheck.exe2
Berichtskennung: compatibilitycheck.exe3

Error: (02/13/2015 09:35:00 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: compatibilitycheck.exe, Version: 0.0.0.0, Zeitstempel: 0x54da5ad7
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea8e7
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000222d2
ID des fehlerhaften Prozesses: 0xad0
Startzeit der fehlerhaften Anwendung: 0xcompatibilitycheck.exe0
Pfad der fehlerhaften Anwendung: compatibilitycheck.exe1
Pfad des fehlerhaften Moduls: compatibilitycheck.exe2
Berichtskennung: compatibilitycheck.exe3

Error: (02/13/2015 06:25:47 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/13/2015 09:38:08 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/12/2015 09:28:12 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: compatibilitycheck.exe, Version: 0.0.0.0, Zeitstempel: 0x54da5ad7
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea8e7
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000222d2
ID des fehlerhaften Prozesses: 0xa84
Startzeit der fehlerhaften Anwendung: 0xcompatibilitycheck.exe0
Pfad der fehlerhaften Anwendung: compatibilitycheck.exe1
Pfad des fehlerhaften Moduls: compatibilitycheck.exe2
Berichtskennung: compatibilitycheck.exe3


System errors:
=============
Error: (02/14/2015 01:55:15 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "BlueStacks Updater Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (02/12/2015 08:46:50 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Microsoft-Softwareschattenkopie-Anbieter" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (02/12/2015 08:46:50 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Microsoft-Softwareschattenkopie-Anbieter erreicht.

Error: (02/12/2015 08:46:51 PM) (Source: DCOM) (EventID: 10005) (User: )
Description: 1053swprv{65EE1DBA-8FF4-4A58-AC1C-3470EE2F376A}

Error: (02/12/2015 05:44:22 PM) (Source: Disk) (EventID: 7) (User: )
Description: Fehlerhafter Block bei Gerät \Device\Harddisk1\DR2.

Error: (02/12/2015 05:44:10 PM) (Source: Disk) (EventID: 7) (User: )
Description: Fehlerhafter Block bei Gerät \Device\Harddisk1\DR2.

Error: (02/12/2015 05:44:10 PM) (Source: Disk) (EventID: 7) (User: )
Description: Fehlerhafter Block bei Gerät \Device\Harddisk1\DR2.

Error: (02/12/2015 05:44:10 PM) (Source: Disk) (EventID: 7) (User: )
Description: Fehlerhafter Block bei Gerät \Device\Harddisk1\DR2.

Error: (02/12/2015 05:41:36 PM) (Source: Disk) (EventID: 7) (User: )
Description: Fehlerhafter Block bei Gerät \Device\Harddisk1\DR1.

Error: (02/12/2015 05:41:35 PM) (Source: Disk) (EventID: 7) (User: )
Description: Fehlerhafter Block bei Gerät \Device\Harddisk1\DR1.


Microsoft Office Sessions:
=========================
Error: (02/14/2015 07:20:21 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/14/2015 06:30:14 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/14/2015 11:40:42 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: compatibilitycheck.exe0.0.0.054da5ad7ntdll.dll6.1.7601.18247521ea8e7c0000005000222d2fa401d04842a591c30aC:\Users\Kerstin\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exeC:\Windows\SysWOW64\ntdll.dllec17769d-b435-11e4-b7e1-00224d7b4b93

Error: (02/14/2015 10:03:08 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/14/2015 01:12:33 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/14/2015 00:55:14 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: compatibilitycheck.exe0.0.0.054da5ad7ntdll.dll6.1.7601.18247521ea8e7c0000005000222d29401d047e878f1eaebC:\Users\Kerstin\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exeC:\Windows\SysWOW64\ntdll.dllc00f31a6-b3db-11e4-a9bf-00224d7b4b93

Error: (02/13/2015 09:35:00 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: compatibilitycheck.exe0.0.0.054da5ad7ntdll.dll6.1.7601.18247521ea8e7c0000005000222d2ad001d047cc7ec2f3daC:\Users\Kerstin\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exeC:\Windows\SysWOW64\ntdll.dllc7515c2d-b3bf-11e4-a9bf-00224d7b4b93

Error: (02/13/2015 06:25:47 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/13/2015 09:38:08 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/12/2015 09:28:12 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: compatibilitycheck.exe0.0.0.054da5ad7ntdll.dll6.1.7601.18247521ea8e7c0000005000222d2a8401d047025e8cf1b1C:\Users\Kerstin\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exeC:\Windows\SysWOW64\ntdll.dlla9a828f3-b2f5-11e4-9f0b-00224d7b4b93


==================== Memory info =========================== 

Processor: Intel(R) Atom(TM) CPU D2500 @ 1.86GHz
Percentage of memory in use: 67%
Total physical RAM: 2036.66 MB
Available physical RAM: 658.86 MB
Total Pagefile: 4073.31 MB
Available Pagefile: 2079.84 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:297.99 GB) (Free:163.12 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: 909528BB)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=298 GB) - (Type=07 NTFS)

==================== End Of Log ============================