Ständig öffnen sich werbeseiten und Popups!

Kampffisch · 20.02.2015, 21:27

Hallo, habe seit ein paar Wochen problemme mit Werbeseiten die sich ungefragt öffnen, habe es mit Malewarebytes versuch, dies hat aber nichts gebracht krieg die dinger grade so mit Noscript in den griff, kann dan aber auf der Webseite nicht alles sehen.

mfg

Kampffisch

cosinus · 20.02.2015, 21:29

Hallo und

Hast du noch weitere Logs (mit Funden)? Malwarebytes und/oder andere Virenscanner, sind die mal fündig geworden?

Ich frage deswegen nach => http://www.trojaner-board.de/125889-...tml#post941520

Bitte keine neuen Virenscans machen sondern erst nur schon vorhandene Logs in CODE-Tags posten!
Relevant sind nur Logs der letzten 7 Tage bzw. seitdem das Problem besteht!

Zudem bitte auch ein Log mit Farbars Tool machen:

Scan mit Farbar's Recovery Scan Tool (FRST)

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit.
Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten.
Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

Kampffisch · 20.02.2015, 22:06

ier einer vom 15.2

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 15.02.2015
Suchlauf-Zeit: 10:53:32
Logdatei: junkjnk.txt
Administrator: Ja

Version: 2.00.4.1028
Malware Datenbank: v2015.02.13.08
Rootkit Datenbank: v2015.02.03.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 8.1
CPU: x64
Dateisystem: NTFS
Benutzer: Andi

Suchlauf-Art: Benutzerdefinierter Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 536890
Verstrichene Zeit: 1 Std, 18 Min, 23 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Aktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 1
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe, 3224, Löschen bei Neustart, [23efa8724842e0568e624f6427da4ab6]

Module: 0
(Keine schädliche Elemente erkannt)

Registrierungsschlüssel: 6
PUP.Optional.SearchProtect.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\CltMngSvc, In Quarantäne, [23efa8724842e0568e624f6427da4ab6], 
PUP.Optional.SearchProtect.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\SearchProtect, In Quarantäne, [ae64a674b6d43501747c545f14ed2dd3], 
PUP.Optional.SearchProtect, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\INSTALLEDSDB\{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}, In Quarantäne, [b06258c2711970c69949888827deb34d], 
PUP.Optional.SearchProtect, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\INSTALLEDSDB\{cf2797aa-b7ec-e311-8ed9-005056c00008}, In Quarantäne, [0f03b763f59590a67e637c94b64f916f], 
PUP.Optional.SearchProtect.A, HKLM\SOFTWARE\WOW6432NODE\SEARCHPROTECT, In Quarantäne, [ce4441d998f21e188dec13a16d96f10f], 
PUP.Optional.SearchProtect, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\SPPD, In Quarantäne, [ed25f723e4a69e988492971710f31de3], 

Registrierungswerte: 2
PUP.Optional.SearchProtect.A, HKLM\SOFTWARE\WOW6432NODE\SEARCHPROTECT|InstallDir, C:\PROGRA~2\SearchProtect, In Quarantäne, [ce4441d998f21e188dec13a16d96f10f]
PUP.Optional.SearchProtect, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\SPPD|ImagePath, \??\C:\Windows\system32\drivers\SPPD.sys, In Quarantäne, [ed25f723e4a69e988492971710f31de3]

Registrierungsdaten: 2
PUP.Optional.SearchProtect.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS|AppInit_DLLs, C:\PROGRA~2\SearchProtect\SearchProtect\bin\VC64Loader.dll, Gut: (), Schlecht: (C:\PROGRA~2\SearchProtect\SearchProtect\bin\VC64Loader.dll),Ersetzt,[8c867f9b3d4d2d09f1ff288b4fb2f20e]
PUP.Optional.SearchProtect.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS|AppInit_DLLs, C:\PROGRA~2\SEARCH~1\SEARCH~1\bin\VC32LO~1.DLL , Gut: (), Schlecht: (C:\PROGRA~2\SEARCH~1\SEARCH~1\bin\VC32LO~1.DLL),Ersetzt,[c0525bbfee9cfe38b43cf7bcfd04d42c]

Ordner: 25
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main\bin, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main\rep, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect\bin, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect\rep, In Quarantäne, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\bin, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Consent, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\libs, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protection, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protectionDS, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\settings, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\uninstall, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\rep, In Quarantäne, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Users\Andi\AppData\Local\SearchProtect, Löschen bei Neustart, [937f4bcfa6e4082e695c3038e41f8b75], 
PUP.Optional.SearchProtect.A, C:\Users\Andi\AppData\Local\SearchProtect\SearchProtect, Löschen bei Neustart, [937f4bcfa6e4082e695c3038e41f8b75], 
PUP.Optional.SearchProtect.A, C:\Users\Andi\AppData\Local\SearchProtect\SearchProtect\rep, Löschen bei Neustart, [937f4bcfa6e4082e695c3038e41f8b75], 
PUP.Optional.SearchProtect.A, C:\Users\Andi\AppData\Local\SearchProtect\SearchProtect\STG, In Quarantäne, [937f4bcfa6e4082e695c3038e41f8b75], 
PUP.Optional.SearchProtect.A, C:\Users\Andi\AppData\Local\SearchProtect\UI, Löschen bei Neustart, [937f4bcfa6e4082e695c3038e41f8b75], 
PUP.Optional.SearchProtect.A, C:\Users\Andi\AppData\Local\SearchProtect\UI\rep, Löschen bei Neustart, [937f4bcfa6e4082e695c3038e41f8b75], 
PUP.Optional.SearchProtect.A, C:\Users\Andi\AppData\Local\avaxvyyvyf, In Quarantäne, [fe14a9710882082e630b256663a05ea2], 

Dateien: 121
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe, Löschen bei Neustart, [23efa8724842e0568e624f6427da4ab6], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect\bin\cltmng.exe, Löschen bei Neustart, [cc469783d0ba2e0821cfddd67e83738d], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\bin\cltmngui.exe, Löschen bei Neustart, [46cc34e67e0c0135d51b5a59c93815eb], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect\bin\VC64Loader.dll, Löschen bei Neustart, [8c867f9b3d4d2d09f1ff288b4fb2f20e], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect\bin\VC32Loader.dll, Löschen bei Neustart, [c0525bbfee9cfe38b43cf7bcfd04d42c], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main\bin\SPtool.dll, Löschen bei Neustart, [0e04c753c6c468ce856b0fa402ffb947], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main\bin\uninstall.exe, Löschen bei Neustart, [ae64a674b6d43501747c545f14ed2dd3], 
PUP.Optional.SearchProtect, C:\Program Files (x86)\SearchProtect\Main\bin\uninstall.pun, Löschen bei Neustart, [070b8c8edab07abc67fe8192f70bf30d], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect\bin\RN32.dll, Löschen bei Neustart, [749e1dfd137759ddc62acde60100f808], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect\bin\SPtool64.exe, Löschen bei Neustart, [e2308b8f97f344f2549c644f6998bf41], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect\bin\VC32.dll, Löschen bei Neustart, [2ae8ac6ebecc3afcb63a278cb948d12f], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect\bin\VC64.dll, Löschen bei Neustart, [f31fde3c55352d09a34d565d010060a0], 
PUP.Optional.SearchProtect.A, C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe.vir, In Quarantäne, [3cd603175b2fb680f6fafdb6b64b4eb2], 
PUP.Optional.SearchProtect.A, C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\SPtool.dll.vir, In Quarantäne, [55bd8b8fbbcfd363658b288bcf322bd5], 
PUP.Optional.SearchProtect.A, C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\uninstall.exe.vir, In Quarantäne, [c84a6fab03870e2850a0c0f30ef33dc3], 
PUP.Optional.SearchProtect, C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\uninstall.pun.vir, In Quarantäne, [898921f9acde3204b4b12be814eee61a], 
PUP.Optional.SearchProtect.A, C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\cltmng.exe.vir, In Quarantäne, [e929f723dbaf0333ca26466dfa07fc04], 
PUP.Optional.SearchProtect.A, C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\RN32.dll.vir, In Quarantäne, [070b5fbb078338fe03ed5261758cad53], 
PUP.Optional.SearchProtect.A, C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\SPtool64.exe.vir, In Quarantäne, [eb27041686045fd79759cee5a45d27d9], 
PUP.Optional.SearchProtect.A, C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\VC32.dll.vir, In Quarantäne, [8f835ebcd8b2003610e0a70cbc4554ac], 
PUP.Optional.SearchProtect.A, C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\VC32Loader.dll.vir, In Quarantäne, [20f24ecc701a2115d11fd0e3936e629e], 
PUP.Optional.SearchProtect.A, C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\VC64.dll.vir, In Quarantäne, [5fb394863f4bea4c1ad6f0c3b150bf41], 
PUP.Optional.SearchProtect.A, C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\VC64Loader.dll.vir, In Quarantäne, [3bd75dbd7c0e0333f9f7d1e229d80af6], 
PUP.Optional.SearchProtect.A, C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\UI\bin\cltmngui.exe.vir, In Quarantäne, [030fbd5d2466e1555f91edc6cb3641bf], 
PUP.Optional.SearchProtect, C:\Users\Andi\AppData\Local\avaxvyyvyf\avaxvyyvyf.exe, In Quarantäne, [789ae13993f70c2a4025d2419171a957], 
PUP.Optional.SearchProtect.A, C:\Users\Andi\AppData\Local\avaxvyyvyf\pbqrmvbub, In Quarantäne, [39d99882eb9f9b9b767ae9cac73ad62a], 
PUP.Optional.SearchProtect.A, C:\Users\Andi\AppData\Local\Microsoft\Windows\INetCache\IE\3L0UTDF0\Stub[1].exe, In Quarantäne, [e131b9613951a4928d31189042bf7090], 
PUP.Optional.SearchProtect.A, C:\Users\Andi\AppData\Local\Microsoft\Windows\INetCache\IE\MXZRN0CL\Setup[1].exe, In Quarantäne, [31e124f66a204fe79a5662513ac7946c], 
PUP.Optional.SearchProtect.A, C:\Users\Andi\AppData\Local\Temp\utt6E36.tmp.exe, In Quarantäne, [7d9556c40585979f3c82dbcdd32e0000], 
PUP.Optional.SoftPulse.gen, C:\Users\Andi\AppData\Local\Temp\eFU5kk9g.exe.part, In Quarantäne, [24eed743484257dff96325f3a161b947], 
PUP.Adware.Agent, C:\Users\Andi\AppData\Local\Temp\PositiveFinds\Setup.exe, In Quarantäne, [8b8789915337df57ab1fa363de22a65a], 
PUP.Optional.SearchProtect.A, C:\Windows\apppatch\apppatch64\VCLdr64.dll, Löschen bei Neustart, [18fa60ba414921153db35d569869cd33], 
PUP.Optional.SearchProtect.A, C:\Windows\apppatch\nbin\VC32Loader.dll, Löschen bei Neustart, [8c8618028efc80b636ba7340837e3cc4], 
PUP.Optional.Trovi.A, C:\Users\Andi\AppData\Roaming\Mozilla\Firefox\Profiles\y8szgoz2.default\searchplugins\trovi.xml, In Quarantäne, [e32f14060486d6603b255638030040c0], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\EULA.txt, In Quarantäne, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main\rep\cfi.bin, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main\rep\edk.bin, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main\rep\pni.bin, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main\rep\SystemRepository.dat, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main\rep\trn.bin, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\settings.html, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\style.css, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Consent\consent.css, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Consent\consent.html, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Consent\consent.js, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Consent\defaults.js, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\bgUninstall.png, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\hez-def-grey.png, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\Apply-default.png, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\Apply-onclick.png, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\Apply-Rollover.png, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\bg-dia.png, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\bg-uninstall.png, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\bg-with-logo.png, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\bg.png, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\bgNotif.png, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\bgSettings.png, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\bgSettingsDS.png, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\btnBlue.png, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\btnClose.png, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\btnSilver.png, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\button-bg.png, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\checkbox.png, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\checkbox_checked.png, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\checkbox_def.png, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\close-win-def.png, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\close-win-over-click.png, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\gray-bg.png, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\hez-def.png, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\hez-selected.png, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\hez.png, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\icon-win.png, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\info-icon.png, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\menu-rollover.png, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\menu-selected.png, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\radio-button-def.png, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\radio-button-selected.png, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\radio-button.png, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\radio-button2.png, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\Settings-icon.png, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\SP_DialogBG.png, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\text-field.png, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\v.png, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\x.png, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\libs\defaults.js, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\libs\DialogAPI.js, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\libs\dialogUtils.js, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\libs\jquery.1.7.1.min.js, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\libs\json2.min.js, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\libs\main.js, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protection\defaults.js, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protection\protection.css, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protection\protection.html, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protection\protection.js, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protectionDS\defaults.js, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protectionDS\protectionDS.css, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protectionDS\protectionDS.html, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protectionDS\protectionDS.js, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\settings\defaults.js, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\settings\settings.css, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\settings\settings.html, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\settings\settings.js, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\uninstall\defaults.js, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\uninstall\uninstall.css, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\uninstall\uninstall.html, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\uninstall\uninstall.js, Löschen bei Neustart, [3fd3d7435d2dd26470bd9c5b28dc4eb2], 
PUP.Optional.SearchProtect, C:\Windows\apppatch\Custom\Custom64\{cf2797aa-b7ec-e311-8ed9-005056c00008}.sdb, Löschen bei Neustart, [46ccb06a92f8ab8b74714dc310f55fa1], 
PUP.Optional.Avaxvavya.A, C:\Windows\System32\Tasks\avaxvyyvyf, In Quarantäne, [878b59c1503aa096f54fa3762dd8916f], 
PUP.Optional.SearchProtect.A, C:\Users\Andi\AppData\Local\SearchProtect\SearchProtect\rep\UserRepository.dat, Löschen bei Neustart, [937f4bcfa6e4082e695c3038e41f8b75], 
PUP.Optional.SearchProtect.A, C:\Users\Andi\AppData\Local\SearchProtect\SearchProtect\rep\UserSettings.dat, Löschen bei Neustart, [937f4bcfa6e4082e695c3038e41f8b75], 
PUP.Optional.SearchProtect.A, C:\Users\Andi\AppData\Local\SearchProtect\UI\rep\UIRepository.dat, Löschen bei Neustart, [937f4bcfa6e4082e695c3038e41f8b75], 
PUP.Optional.SearchProtect.A, C:\Users\Andi\AppData\Local\avaxvyyvyf\bahvxfk, In Quarantäne, [fe14a9710882082e630b256663a05ea2], 
PUP.Optional.SearchProtect.A, C:\Users\Andi\AppData\Local\avaxvyyvyf\mkfvxfk, In Quarantäne, [fe14a9710882082e630b256663a05ea2], 
PUP.Optional.SearchProtect.A, C:\Users\Andi\AppData\Local\avaxvyyvyf\pvpqbjobmlpfqlovvawq, In Quarantäne, [fe14a9710882082e630b256663a05ea2], 
PUP.Optional.SearchProtect.A, C:\Users\Andi\AppData\Local\avaxvyyvyf\qokvxfk, In Quarantäne, [fe14a9710882082e630b256663a05ea2], 
PUP.Optional.SearchProtect.A, C:\Users\Andi\AppData\Local\avaxvyyvyf\rfobmlpfqlovvawq, In Quarantäne, [fe14a9710882082e630b256663a05ea2], 
PUP.Optional.SearchProtect.A, C:\Users\Andi\AppData\Local\avaxvyyvyf\rpboobmlpfqlovvawq, In Quarantäne, [fe14a9710882082e630b256663a05ea2], 
PUP.Optional.SearchProtect.A, C:\Users\Andi\AppData\Local\avaxvyyvyf\stb.dat, In Quarantäne, [fe14a9710882082e630b256663a05ea2], 
PUP.Optional.SearchProtect.A, C:\Users\Andi\AppData\Local\avaxvyyvyf\ycfvxfk, In Quarantäne, [fe14a9710882082e630b256663a05ea2], 
PUP.Optional.Trovi.A, C:\Users\Andi\AppData\Roaming\Mozilla\Firefox\Profiles\y8szgoz2.default\prefs.js, Gut: (), Schlecht: (user_pref("browser.startup.homepage", "hxxp://www.trovi.com/?gd=&ctid=CT3330189&octid=EB_ORIGINAL_CTID&ISID=MF4791797-2CB9-4962-B1EC-E7743A74D1CD&SearchSource=55&CUI=&UM=8&UP=SP83C8C27E-46A1-4506-ABC6-6333AB03F494&SSPV=");), Ersetzt,[b55d7f9b0b7f1026e145d9220203966a]
PUP.Optional.Trovi.A, C:\Users\Andi\AppData\Roaming\Mozilla\Firefox\Profiles\y8szgoz2.default\prefs.js, Gut: (), Schlecht: (user_pref("browser.newtab.url", "hxxp://www.trovi.com/?gd=&ctid=CT3330189&octid=EB_ORIGINAL_CTID&ISID=MF4791797-2CB9-4962-B1EC-E7743A74D1CD&SearchSource=69&CUI=&SSPV=&Lay=1&UM=8&UP=SP83C8C27E-46A1-4506-ABC6-6333AB03F494");), Ersetzt,[54be9f7b66240a2cdf4817e408fdfa06]

Physische Sektoren: 0
(Keine schädliche Elemente erkannt)


(end)

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 18-02-2015 01
Ran by Andi (administrator) on DEISTER on 20-02-2015 22:10:11
Running from C:\Users\Andi\Desktop
Loaded Profiles: Andi (Available profiles: Andi)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
() C:\Program Files (x86)\PHotkey\PGFNEXSrv.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\ibtsiva.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Time Lapse Solutions) C:\ProgramData\rJDRDPLhi\lhOYKYn.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
() C:\Program Files (x86)\PHotkey\PHotkey.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Dolby Laboratories Inc.) C:\Program Files\Dolby Digital Plus\ddp.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Intel Corporation) C:\Windows\System32\igfxTray.exe
() C:\Program Files (x86)\PHotkey\MsgTranAgt.exe
() C:\Program Files (x86)\PHotkey\MsgTranAgt64.exe
() C:\Program Files (x86)\PHotkey\Atouch64.exe
() C:\Program Files (x86)\PHotkey\GPMTray.exe
() C:\Program Files (x86)\PHotkey\KeyboardMonitorTool.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe
() C:\Program Files (x86)\PHotkey\Dolbyosd.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Farbar) C:\Users\Andi\Desktop\FRST64(1).exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [320360 2014-06-25] (Intel Corporation)
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [3278088 2014-07-01] (ELAN Microelectronics Corp.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13674712 2014-08-15] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1393520 2014-08-15] (Realtek Semiconductor)
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll",TrayApp
HKLM-x32\...\Run: [CLMLServer_For_P2G8] => C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111576 2013-08-05] (CyberLink)
HKLM-x32\...\Run: [CLVirtualDrive] => C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [490760 2013-11-26] (CyberLink Corp.)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [95192 2013-03-11] (CyberLink Corp.)
HKLM-x32\...\Run: [YouCam Service] => C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe [267224 2013-09-18] (CyberLink Corp.)
HKLM\...\Policies\Explorer: [ConfirmFileDelete] 1
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKLM\...\Policies\Explorer: [NoFolderOptions] 0
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
SearchScopes: HKLM -> {DC91FAFB-6CEA-49E5-BB74-9CEE75D09B77} URL = 
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: buyyandbirrowaSe -> {d251ad2b-1095-4530-9785-a87e719e24ac} -> C:\Program Files (x86)\buyyandbirrowaSe\covq6NwOrKB6UE.dll ()
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
StartMenuInternet: IEXPLORE.EXE - iexplore.exe

FireFox:
========
FF ProfilePath: C:\Users\Andi\AppData\Roaming\Mozilla\Firefox\Profiles\y8szgoz2.default
FF DefaultSearchEngine: webssearches
FF SelectedSearchEngine: webssearches
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_296.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_296.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Users\Andi\AppData\Roaming\Mozilla\Firefox\Profiles\y8szgoz2.default\searchplugins\webssearches.xml
FF Extension: MedPlayV3.1 - C:\Users\Andi\AppData\Roaming\Mozilla\Firefox\Profiles\y8szgoz2.default\Extensions\b6e4f54065ff48dd97db30ca@c9b45f807bf54a45a4669e51c.com [2015-02-15]
FF Extension: Xmarks - C:\Users\Andi\AppData\Roaming\Mozilla\Firefox\Profiles\y8szgoz2.default\Extensions\foxmarks@kei.com [2015-01-14]
FF Extension: PlusBrowSRAps2.5 - C:\Users\Andi\AppData\Roaming\Mozilla\Firefox\Profiles\y8szgoz2.default\Extensions\NAUPP49116685@MVOEOKE10798312.com [2015-02-15]
FF Extension: Search Enginer - C:\Users\Andi\AppData\Roaming\Mozilla\Firefox\Profiles\y8szgoz2.default\Extensions\searchengine@gmail.com [2015-02-15]
FF Extension: thefoxonlybetterquicksaver - C:\Users\Andi\AppData\Roaming\Mozilla\Firefox\Profiles\y8szgoz2.default\Extensions\thefoxonlybetter@quicksaver [2015-02-19]
FF Extension: youtubeunblockerunblockeryt - C:\Users\Andi\AppData\Roaming\Mozilla\Firefox\Profiles\y8szgoz2.default\Extensions\youtubeunblocker@unblocker.yt [2015-02-19]
FF Extension: buuYandbrowwSSE - C:\Users\Andi\AppData\Roaming\Mozilla\Firefox\Profiles\y8szgoz2.default\Extensions\yuR@D.net [2015-02-02]
FF Extension: c151d79ee61b4a90a8875a46d38fba99 - C:\Users\Andi\AppData\Roaming\Mozilla\Firefox\Profiles\y8szgoz2.default\Extensions\{c151d79e-e61b-4a90-a887-5a46d38fba99} [2015-02-19]
FF Extension: NoScript - C:\Users\Andi\AppData\Roaming\Mozilla\Firefox\Profiles\y8szgoz2.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2015-02-02]
FF Extension: Adblock Plus - C:\Users\Andi\AppData\Roaming\Mozilla\Firefox\Profiles\y8szgoz2.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-01-13]
FF Extension: Positive Finds - C:\Users\Andi\AppData\Roaming\Mozilla\Firefox\Profiles\y8szgoz2.default\Extensions\{f47391f8-d25a-4213-814d-d386acf92dcf}.xpi [2015-02-12]
FF HKLM-x32\...\Firefox\Extensions: [searchengine@gmail.com] - C:\Users\Andi\AppData\Roaming\Mozilla\Firefox\Profiles\y8szgoz2.default\extensions\searchengine@gmail.com

Chrome: 
=======
CHR HomePage: Default -> hxxp://www.istartsurf.com/?type=hppp&ts=1424032548&from=tugs&uid=HGSTXHTS725050A7E630_RC250ACB0D8S9J0D8S9JX
CHR StartupUrls: Default -> "hxxp://www.istartsurf.com/?type=hppp&ts=1424032548&from=tugs&uid=HGSTXHTS725050A7E630_RC250ACB0D8S9J0D8S9JX"
CHR DefaultSearchKeyword: Default -> istartsurf
CHR DefaultSuggestURL: Default -> 
CHR Profile: C:\Users\Andi\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\Andi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-02-15]
CHR Extension: (Google Docs) - C:\Users\Andi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-15]
CHR Extension: (Google Drive) - C:\Users\Andi\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-02-15]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Andi\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2015-02-15]
CHR Extension: (YouTube) - C:\Users\Andi\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-02-15]
CHR Extension: (Google Search) - C:\Users\Andi\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-02-15]
CHR Extension: (Google Sheets) - C:\Users\Andi\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-02-15]
CHR Extension: (gmimocjjppdelmhpcmpkhekmpoddgima) - C:\Users\Andi\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmimocjjppdelmhpcmpkhekmpoddgima [2015-02-20]
CHR Extension: (lafgkmgbfkfpbhepoolagpahghdhmaop) - C:\Users\Andi\AppData\Local\Google\Chrome\User Data\Default\Extensions\lafgkmgbfkfpbhepoolagpahghdhmaop [2015-02-19]
CHR Extension: (Google Wallet) - C:\Users\Andi\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-02-15]
CHR Extension: (paegkacdgdffjjiepbbdcgkfgnjcdonl) - C:\Users\Andi\AppData\Local\Google\Chrome\User Data\Default\Extensions\paegkacdgdffjjiepbbdcgkfgnjcdonl [2015-02-19]
CHR Extension: (Gmail) - C:\Users\Andi\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-02-15]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2449592 2014-11-12] (Microsoft Corporation)
R2 CyberLink PowerDVD 10 MS Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe [74712 2013-03-11] (CyberLink)
R2 CyberLink PowerDVD 10 MS Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe [316376 2013-03-11] (CyberLink)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [16232 2014-06-25] (Intel Corporation)
R2 iBtSiva; C:\Program Files (x86)\Intel\Bluetooth\ibtsiva.exe [121304 2014-08-07] (Intel Corporation)
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [324568 2014-07-25] (Intel Corporation)
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [887256 2014-05-13] (Intel(R) Corporation)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [131544 2014-06-24] (Intel Corporation)
S3 iumsvc; C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [174368 2014-04-09] ()
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [154584 2014-06-24] (Intel Corporation)
R2 lhOYKYn; C:\ProgramData\rJDRDPLhi\lhOYKYn.exe [2733544 2015-02-15] (Time Lapse Solutions)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [284912 2014-05-29] ()
R2 PGFNEXSrv; C:\Program Files (x86)\PHotkey\PGFNEXSrv.exe [136192 2014-03-04] () [File not signed]
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [389896 2013-03-06] ()
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3816176 2014-05-29] (Intel® Corporation)
S2 cae99edb; "C:\Windows\system32\rundll32.exe" "c:\Program Files (x86)\Super Optimizer\SupOptCrash.dll",ENT
S2 SpyHunter 4 Service; C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-03-18] (Microsoft Corporation)
R3 btmaux; C:\Windows\system32\DRIVERS\btmaux.sys [141624 2014-05-13] (Motorola Solutions, Inc.)
R3 btmhsf; C:\Windows\system32\DRIVERS\btmhsf.sys [1424184 2014-06-17] (Motorola Solutions, Inc.)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [91712 2013-03-05] (CyberLink)
S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2015-02-13] ()
R3 ETDSMBus; C:\Windows\system32\DRIVERS\ETDSMBus.sys [23816 2014-07-01] (ELAN Microelectronic Corp.)
R3 iaLPSS_GPIO; C:\Windows\System32\drivers\iaLPSS_GPIO.sys [35832 2014-06-10] (Intel Corporation)
R3 ibtusb; C:\Windows\system32\DRIVERS\ibtusb.sys [220104 2014-08-07] (Intel Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-02-20] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [125952 2014-06-24] (Intel Corporation)
R3 NETwNb64; C:\Windows\system32\DRIVERS\Netwbw02.sys [3446240 2014-06-18] (Intel Corporation)
S3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew02.sys [4649440 2013-06-18] (Intel Corporation)
R2 PEGAGFN; C:\Program Files (x86)\PHotkey\PEGAGFN.sys [14344 2009-09-11] (PEGATRON)
R3 PegaRadioSwitch; C:\Windows\System32\drivers\PegaRadioSwitch.sys [23552 2013-08-22] (Windows (R) Win 7 DDK provider)
S3 RtlWlanu; C:\Windows\system32\DRIVERS\rtwlanu.sys [2968280 2014-01-15] (Realtek Semiconductor Corporation                           )
R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-20 22:10 - 2015-02-20 22:10 - 00018129 _____ () C:\Users\Andi\Desktop\FRST.txt
2015-02-20 22:09 - 2015-02-20 22:10 - 00000000 ____D () C:\FRST
2015-02-20 22:08 - 2015-02-20 22:08 - 02086912 _____ (Farbar) C:\Users\Andi\Desktop\FRST64(1).exe
2015-02-20 21:56 - 2015-02-20 21:56 - 00026027 _____ () C:\Users\Andi\Desktop\junkjnk.txt
2015-02-20 21:54 - 2015-02-20 21:54 - 00004065 _____ () C:\Users\Andi\Desktop\ghgj.txt
2015-02-20 21:54 - 2015-02-20 21:54 - 00000336 _____ () C:\Users\Andi\Desktop\jj.txt
2015-02-17 21:02 - 2015-02-20 21:12 - 00000000 ____D () C:\Users\Andi\AppData\Local\ZombieInvasion
2015-02-17 20:11 - 2015-02-17 20:11 - 00243664 _____ () C:\Users\Andi\Downloads\Firefox Setup Stub 35.0.1.exe
2015-02-17 14:03 - 2015-02-17 17:04 - 00001957 _____ () C:\Users\Public\Desktop\Google  Chrome.lnk
2015-02-15 21:48 - 2015-02-15 21:48 - 00001284 _____ () C:\Users\Andi\Desktop\Revo Uninstaller.lnk
2015-02-15 21:44 - 2015-02-15 21:48 - 00000000 ____D () C:\ProgramData\rJDRDPLhi
2015-02-15 21:43 - 2015-02-15 21:45 - 00000000 ____D () C:\Program Files (x86)\Cinemax Plus 1.9cV15.02
2015-02-15 21:43 - 2015-02-15 21:43 - 00000000 ____D () C:\Program Files (x86)\4bf237b8-803c-4cad-8ece-2db7514c4a71
2015-02-15 21:42 - 2015-02-15 21:42 - 00000000 ____D () C:\ProgramData\{8841397d-393c-30ac-8841-1397d393e5f4}
2015-02-15 21:36 - 2015-02-15 21:49 - 00000000 ___HD () C:\Users\Public\Temp
2015-02-15 21:35 - 2015-02-17 17:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-02-15 21:34 - 2015-02-15 21:58 - 00000000 ____D () C:\Program Files (x86)\PlusBrowSRAps2.5
2015-02-15 21:34 - 2015-02-15 21:35 - 00000000 ____D () C:\Program Files (x86)\MedPlayV3.1
2015-02-15 21:34 - 2015-02-15 21:34 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_webTinst_01009.Wdf
2015-02-15 21:33 - 2015-02-20 21:38 - 00000910 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-02-15 21:33 - 2015-02-20 21:38 - 00000906 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-02-15 21:33 - 2015-02-15 21:36 - 00000000 ____D () C:\Users\Andi\AppData\Local\Google
2015-02-15 21:33 - 2015-02-15 21:35 - 00000000 ____D () C:\Program Files (x86)\Google
2015-02-15 21:33 - 2015-02-15 21:33 - 00003882 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-02-15 21:33 - 2015-02-15 21:33 - 00003646 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-02-15 21:32 - 2015-02-15 21:32 - 00695760 _____ () C:\Users\Andi\Downloads\ChromeSetup.exe
2015-02-15 21:18 - 2015-02-15 21:18 - 00001520 _____ () C:\Users\Andi\Desktop\JRT.txt
2015-02-15 21:18 - 2015-02-15 21:18 - 00000000 ____D () C:\Program Files\McAfee
2015-02-15 21:10 - 2015-02-15 21:11 - 01388274 _____ (Thisisu) C:\Users\Andi\Downloads\JRT.exe
2015-02-15 21:05 - 2015-02-15 21:48 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2015-02-15 21:05 - 2015-02-15 21:05 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Andi\Desktop\revosetup95.exe
2015-02-15 20:52 - 2015-02-15 21:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
2015-02-15 16:50 - 2015-02-15 16:50 - 00022512 _____ () C:\Windows\system32\Drivers\SPPD.sys
2015-02-15 10:46 - 2015-02-15 10:46 - 02134528 _____ (Farbar) C:\Users\Andi\Downloads\FRST64.exe
2015-02-14 20:40 - 2015-02-14 20:40 - 00000000 ____D () C:\Users\Andi\AppData\Roaming\WinRAR
2015-02-14 20:40 - 2008-05-11 00:01 - 701775872 _____ () C:\Users\Andi\Desktop\lidl-winxp7in1.iso
2015-02-14 20:39 - 2015-02-15 21:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2015-02-14 20:39 - 2015-02-14 20:39 - 02059896 _____ () C:\Users\Andi\Downloads\winrar-x64-520d.exe
2015-02-14 20:39 - 2015-02-14 20:39 - 00000000 ____D () C:\Program Files\WinRAR
2015-02-13 23:57 - 2015-02-17 20:52 - 00000000 ____D () C:\AdwCleaner
2015-02-13 23:56 - 2015-02-13 23:57 - 02112512 _____ () C:\Users\Andi\Desktop\AdwCleaner_4.110.exe
2015-02-13 23:31 - 2015-02-13 23:31 - 00000000 ____D () C:\Users\Andi\Downloads\David Cross_ HITS_
2015-02-13 23:25 - 2015-02-13 23:25 - 00000000 _____ () C:\autoexec.bat
2015-02-13 23:24 - 2015-02-13 23:24 - 00003320 _____ () C:\Windows\System32\Tasks\SpyHunter4Startup
2015-02-13 23:24 - 2015-02-13 23:24 - 00000000 ____D () C:\sh4ldr
2015-02-13 23:23 - 2015-02-15 21:20 - 00000000 ____D () C:\Program Files\Enigma Software Group
2015-02-13 23:23 - 2015-02-13 23:23 - 00022704 _____ () C:\Windows\system32\Drivers\EsgScanner.sys
2015-02-13 23:22 - 2015-02-13 23:22 - 03044736 _____ (Enigma Software Group USA, LLC.) C:\Users\Andi\Downloads\SpyHunter-Installer.exe
2015-02-12 14:12 - 2015-01-23 05:41 - 06041600 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-02-12 14:12 - 2015-01-23 04:17 - 04300800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-02-12 00:15 - 2015-02-15 10:48 - 00000000 ____D () C:\Users\Andi\Downloads\backups
2015-02-12 00:14 - 2015-02-15 10:41 - 00012415 _____ () C:\Users\Andi\Downloads\hijackthis.log
2015-02-12 00:13 - 2015-02-12 00:13 - 00388608 _____ (Trend Micro Inc.) C:\Users\Andi\Downloads\HijackThis.exe
2015-02-12 00:07 - 2015-02-14 13:52 - 00000000 ____D () C:\Users\Andi\Downloads\Microsoft.Windows.XP.7in1.German.inkl.SP3-Lidl
2015-02-12 00:06 - 2015-02-12 00:06 - 00000000 ____D () C:\Users\Andi\Downloads\Sour Soul Bundle
2015-02-12 00:05 - 2015-02-12 00:05 - 00000899 _____ () C:\Users\Andi\Desktop\µTorrent.lnk
2015-02-12 00:05 - 2015-02-12 00:05 - 00000879 _____ () C:\Users\Andi\AppData\Roaming\Microsoft\Windows\Start Menu\µTorrent.lnk
2015-02-12 00:04 - 2015-02-15 10:46 - 00000000 ____D () C:\Users\Andi\AppData\Roaming\uTorrent
2015-02-12 00:04 - 2015-02-12 00:04 - 01740880 _____ (BitTorrent Inc.) C:\Users\Andi\Downloads\uTorrent.exe
2015-02-11 23:59 - 2015-02-11 23:59 - 00000000 ____D () C:\Users\Andi\AppData\Roaming\DesktopIconGoodgame
2015-02-11 23:27 - 2015-02-11 23:47 - 32358400 _____ () C:\Users\Andi\Downloads\XP.Home.Edition.OEM.SP3.GER-RHB.rar.part
2015-02-11 19:57 - 2015-02-11 19:57 - 00000000 ____D () C:\ProgramData\Canneverbe Limited
2015-02-11 19:56 - 2015-02-11 19:56 - 00001171 _____ () C:\Users\Public\Desktop\CDBurnerXP.lnk
2015-02-11 19:56 - 2015-02-11 19:56 - 00001121 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk
2015-02-11 19:56 - 2015-02-11 19:56 - 00000000 ____D () C:\Users\Andi\AppData\Roaming\Canneverbe Limited
2015-02-11 19:56 - 2015-02-11 19:56 - 00000000 ____D () C:\Program Files (x86)\CDBurnerXP
2015-02-11 19:55 - 2015-02-11 19:55 - 05409016 _____ (Canneverbe Limited ) C:\Users\Andi\Downloads\cdbxp_setup_4.5.4.5306_minimal(1).exe
2015-02-11 19:54 - 2015-02-11 19:55 - 05409016 _____ (Canneverbe Limited ) C:\Users\Andi\Downloads\cdbxp_setup_4.5.4.5306_minimal.exe
2015-02-11 19:43 - 2015-02-11 20:13 - 666894336 _____ () C:\Users\Andi\Downloads\xp_deutsch_32.iso
2015-02-11 01:05 - 2015-01-15 23:43 - 00563504 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-02-11 01:05 - 2015-01-15 23:43 - 00177984 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-02-11 01:05 - 2015-01-14 05:22 - 00445440 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-02-11 01:05 - 2015-01-14 04:53 - 00324096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2015-02-11 01:05 - 2015-01-10 10:10 - 07472960 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-02-11 01:05 - 2015-01-10 08:00 - 00430080 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-02-11 01:05 - 2015-01-10 07:38 - 00359424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-02-11 01:05 - 2014-12-19 09:57 - 00788680 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2015-02-11 01:05 - 2014-12-19 09:25 - 00602776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2015-02-11 01:05 - 2014-12-09 04:45 - 00393728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll
2015-02-11 01:05 - 2014-12-09 02:56 - 00538624 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll
2015-02-11 01:05 - 2014-12-09 00:12 - 00391526 _____ () C:\Windows\system32\ApnDatabase.xml
2015-02-11 01:05 - 2014-10-29 03:51 - 00154112 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-02-11 01:05 - 2014-10-29 03:50 - 00736768 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-02-11 01:05 - 2014-10-29 03:06 - 00736768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-02-11 01:05 - 2014-10-29 03:06 - 00154112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-02-11 01:05 - 2014-10-29 02:31 - 01441792 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-02-11 01:04 - 2015-02-04 00:38 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-02-11 01:04 - 2015-02-04 00:08 - 00761856 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-02-11 01:04 - 2015-02-04 00:08 - 00414208 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-02-11 01:04 - 2015-02-03 00:11 - 01098752 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-02-11 01:04 - 2015-02-03 00:11 - 00894464 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-02-11 01:04 - 2015-02-03 00:11 - 00609280 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-02-11 01:04 - 2015-01-19 19:42 - 01487976 _____ (Microsoft Corporation) C:\Windows\system32\sppobjs.dll
2015-02-11 01:04 - 2015-01-13 23:11 - 01762840 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-02-11 01:04 - 2015-01-13 23:04 - 01489072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2015-02-11 01:04 - 2015-01-12 04:09 - 25056256 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-02-11 01:04 - 2015-01-12 03:48 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-02-11 01:04 - 2015-01-12 03:48 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-02-11 01:04 - 2015-01-12 03:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-02-11 01:04 - 2015-01-12 03:34 - 00816128 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-02-11 01:04 - 2015-01-12 03:25 - 19740160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-02-11 01:04 - 2015-01-12 03:21 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-02-11 01:04 - 2015-01-12 03:08 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-02-11 01:04 - 2015-01-12 03:07 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-02-11 01:04 - 2015-01-12 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-02-11 01:04 - 2015-01-12 03:02 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-02-11 01:04 - 2015-01-12 02:58 - 01032704 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2015-02-11 01:04 - 2015-01-12 02:55 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-02-11 01:04 - 2015-01-12 02:51 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2015-02-11 01:04 - 2015-01-12 02:48 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-02-11 01:04 - 2015-01-12 02:48 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-02-11 01:04 - 2015-01-12 02:48 - 00374272 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-02-11 01:04 - 2015-01-12 02:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-02-11 01:04 - 2015-01-12 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-02-11 01:04 - 2015-01-12 02:43 - 14401024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-02-11 01:04 - 2015-01-12 02:34 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2015-02-11 01:04 - 2015-01-12 02:30 - 00880128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2015-02-11 01:04 - 2015-01-12 02:27 - 02865152 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll
2015-02-11 01:04 - 2015-01-12 02:27 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-02-11 01:04 - 2015-01-12 02:25 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2015-02-11 01:04 - 2015-01-12 02:23 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-02-11 01:04 - 2015-01-12 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-02-11 01:04 - 2015-01-12 02:23 - 00327168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-02-11 01:04 - 2015-01-12 02:14 - 12829184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-02-11 01:04 - 2015-01-12 02:14 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-02-11 01:04 - 2015-01-12 02:02 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-02-11 01:04 - 2015-01-12 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-02-11 01:04 - 2015-01-12 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-02-11 01:04 - 2015-01-12 01:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-02-11 01:04 - 2015-01-10 10:10 - 01733440 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-02-11 01:04 - 2015-01-10 09:28 - 01498360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-02-11 01:04 - 2015-01-10 09:22 - 04175872 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-02-11 01:04 - 2014-10-29 03:02 - 00285184 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-02-11 01:04 - 2014-10-29 03:02 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-02-11 01:04 - 2014-10-29 02:57 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-02-11 01:04 - 2014-10-29 02:15 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-02-11 01:04 - 2014-10-29 02:15 - 00005632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-02-11 01:04 - 2014-10-29 02:14 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-02-11 01:04 - 2014-10-29 02:13 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-02-11 01:04 - 2014-10-29 02:13 - 00008704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-02-06 12:04 - 2015-02-01 15:46 - 00030720 ____H () C:\Users\Andi\Desktop\~WRL0001.tmp
2015-02-03 14:50 - 2015-02-03 14:50 - 00000000 ____D () C:\ProgramData\coupcoup
2015-02-02 09:00 - 2015-02-15 21:43 - 00000000 ____D () C:\Program Files (x86)\buyyandbirrowaSe
2015-02-02 09:00 - 2015-02-02 21:34 - 00000000 ____D () C:\Program Files (x86)\Proofread Bot  Grammar and Style Checker
2015-02-02 09:00 - 2015-02-02 21:34 - 00000000 ____D () C:\Program Files (x86)\Free2youe
2015-02-02 09:00 - 2015-02-02 21:34 - 00000000 ____D () C:\Program Files (x86)\buuYandbrowwSSE
2015-02-01 16:42 - 2015-02-01 16:42 - 00000000 __SHD () C:\Users\Andi\AppData\Local\EmieBrowserModeList
2015-02-01 11:36 - 2015-02-01 11:36 - 00000000 ____D () C:\Users\Andi\Documents\Benutzerdefinierte Office-Vorlagen
2015-02-01 11:15 - 2015-02-01 11:15 - 00003092 _____ () C:\Windows\System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-1040584371-3716677195-284654461-1001
2015-02-01 11:15 - 2015-02-01 11:15 - 00000000 ___RD () C:\Users\Andi\OneDrive
2015-02-01 11:14 - 2015-02-01 11:14 - 00000000 ____D () C:\ProgramData\Microsoft OneDrive
2015-02-01 11:07 - 2015-02-01 11:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2015-02-01 11:06 - 2015-02-08 11:20 - 00000000 ____D () C:\Program Files\Microsoft Office 15
2015-02-01 11:05 - 2015-02-01 11:05 - 01064632 _____ (Microsoft Corporation) C:\Users\Andi\Downloads\Setup.X86.de-DE_O365HomePremRetail_475a790f-447c-40a6-b22a-bd08a3094428_TX_DB_.exe
2015-02-01 11:05 - 2015-02-01 11:05 - 00000000 ___HD () C:\ProgramData\CanonBJ
2015-02-01 11:05 - 2008-04-21 20:00 - 00279040 _____ (CANON INC.) C:\Windows\system32\CNMLM9C.DLL
2015-01-27 03:33 - 2015-02-17 20:13 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-25 21:34 - 2015-01-25 21:34 - 00000000 ____D () C:\Users\Andi\Documents\CyberLink
2015-01-25 21:34 - 2015-01-25 21:34 - 00000000 ____D () C:\Users\Andi\AppData\Roaming\CyberLink
2015-01-23 20:58 - 2015-02-20 21:45 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-01-23 20:58 - 2015-01-23 20:58 - 00001118 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-01-23 20:58 - 2015-01-23 20:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-01-23 20:58 - 2015-01-23 20:58 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-01-23 20:58 - 2015-01-23 20:58 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-01-23 20:58 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-01-23 20:58 - 2014-11-21 06:14 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-01-23 20:58 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-01-23 20:57 - 2015-01-23 20:58 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Andi\Downloads\mbam-setup-2.0.4.1028.exe
2015-01-23 20:44 - 2015-02-03 20:31 - 00714720 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-01-23 20:44 - 2015-02-03 20:31 - 00106976 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-23 18:25 - 2015-01-23 18:25 - 00001013 _____ () C:\Users\Andi\Downloads\6aHWXAJf

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-20 22:09 - 2015-01-14 14:26 - 01747897 _____ () C:\Windows\WindowsUpdate.log
2015-02-20 22:00 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\sru
2015-02-20 20:58 - 2015-01-13 22:15 - 00000000 ____D () C:\Users\Andi\Documents\Youcam
2015-02-20 20:58 - 2014-08-20 10:06 - 00000000 ____D () C:\Windows\System32\Tasks\Lenovo
2015-02-20 17:31 - 2014-07-09 12:34 - 00766620 _____ () C:\Windows\system32\perfh007.dat
2015-02-20 17:31 - 2014-07-09 12:34 - 00159902 _____ () C:\Windows\system32\perfc007.dat
2015-02-20 17:31 - 2014-03-18 16:26 - 01780340 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-02-20 16:51 - 2015-01-13 22:22 - 00003922 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{96030ECB-8FB8-445B-80F5-496E1C075584}
2015-02-20 12:13 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\AppReadiness
2015-02-18 09:20 - 2015-01-13 22:19 - 00003598 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1040584371-3716677195-284654461-1001
2015-02-17 20:55 - 2014-08-20 05:56 - 00101058 _____ () C:\Windows\SysWOW64\Gms.log
2015-02-17 20:52 - 2015-01-17 15:41 - 00086072 _____ () C:\Windows\PFRO.log
2015-02-17 20:52 - 2015-01-16 14:01 - 00004623 _____ () C:\Windows\setupact.log
2015-02-17 20:52 - 2015-01-13 22:28 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-02-17 20:52 - 2013-08-22 15:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-02-17 20:52 - 2013-08-22 14:25 - 00262144 ___SH () C:\Windows\system32\config\BBI
2015-02-17 20:13 - 2015-01-13 22:28 - 00001175 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-02-17 20:13 - 2015-01-13 22:28 - 00001163 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-02-17 20:09 - 2015-01-13 22:13 - 00002329 _____ () C:\Users\Andi\Desktop\ALDI Süd Blumen Service.lnk
2015-02-17 20:09 - 2015-01-13 22:13 - 00002281 _____ () C:\Users\Andi\Desktop\ALDI Süd Reisen.lnk
2015-02-17 20:09 - 2015-01-13 22:13 - 00002193 _____ () C:\Users\Andi\Desktop\ALDI Talk.lnk
2015-02-17 20:09 - 2015-01-13 22:13 - 00002153 _____ () C:\Users\Andi\Desktop\ALDI Süd Startseite.lnk
2015-02-17 17:04 - 2015-01-13 22:13 - 00002081 _____ () C:\Users\Default\Desktop\ALDI Süd Blumen Service.lnk
2015-02-17 17:04 - 2015-01-13 22:13 - 00002081 _____ () C:\Users\Default User\Desktop\ALDI Süd Blumen Service.lnk
2015-02-17 17:04 - 2015-01-13 22:13 - 00002057 _____ () C:\Users\Default\Desktop\ALDI Süd Reisen.lnk
2015-02-17 17:04 - 2015-01-13 22:13 - 00002057 _____ () C:\Users\Default User\Desktop\ALDI Süd Reisen.lnk
2015-02-17 17:04 - 2015-01-13 22:13 - 00002013 _____ () C:\Users\Default\Desktop\ALDI Talk.lnk
2015-02-17 17:04 - 2015-01-13 22:13 - 00002013 _____ () C:\Users\Default User\Desktop\ALDI Talk.lnk
2015-02-17 17:04 - 2015-01-13 22:13 - 00001993 _____ () C:\Users\Default\Desktop\ALDI Süd Startseite.lnk
2015-02-17 17:04 - 2015-01-13 22:13 - 00001993 _____ () C:\Users\Default User\Desktop\ALDI Süd Startseite.lnk
2015-02-17 17:04 - 2014-08-20 07:53 - 00001961 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Welcome.lnk
2015-02-17 17:04 - 2014-08-20 07:52 - 00001967 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MEDIONhome.lnk
2015-02-15 21:20 - 2014-04-25 09:12 - 00000000 ____D () C:\ProgramData\McAfee
2015-02-15 21:20 - 2013-08-22 15:44 - 00491720 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-02-15 21:16 - 2013-08-22 16:36 - 00000000 ___HD () C:\Windows\ELAMBKUP
2015-02-15 21:13 - 2014-07-09 12:36 - 00000000 ____D () C:\Program Files\CyberLink
2015-02-15 16:53 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\NDF
2015-02-14 18:51 - 2015-01-15 23:38 - 00000000 ____D () C:\Windows\system32\MRT
2015-02-14 14:12 - 2014-04-24 17:12 - 116773704 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-02-13 23:24 - 2015-01-13 22:13 - 00000000 ____D () C:\Users\Andi
2015-02-12 19:27 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\rescache
2015-02-12 19:14 - 2013-08-22 16:20 - 00000000 ____D () C:\Windows\CbsTemp
2015-02-12 00:24 - 2013-08-22 14:25 - 00262144 ___SH () C:\Windows\system32\config\ELAM
2015-02-12 00:20 - 2015-01-17 15:42 - 00000000 ___SD () C:\Windows\system32\CompatTel
2015-02-12 00:20 - 2015-01-17 15:42 - 00000000 ____D () C:\Windows\system32\appraiser
2015-02-12 00:13 - 2015-01-13 22:13 - 00000000 ____D () C:\Users\Andi\AppData\Local\VirtualStore
2015-02-02 16:14 - 2015-01-18 17:55 - 00000000 ____D () C:\Users\Andi\AppData\Local\Adobe
2015-01-25 21:35 - 2015-01-13 22:15 - 00000000 ____D () C:\Users\Andi\AppData\Local\CyberLink
2015-01-23 21:17 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\Speech
2015-01-23 21:16 - 2015-01-19 10:38 - 00000000 ____D () C:\Users\Andi\AppData\Roaming\BRT
2015-01-23 21:16 - 2013-08-22 14:25 - 00000226 _____ () C:\Windows\win.ini
2015-01-23 20:50 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\LiveKernelReports
2015-01-23 20:41 - 2014-03-18 16:10 - 00000000 ____D () C:\Program Files\Windows Journal
2015-01-23 20:41 - 2014-03-18 15:58 - 00000000 ____D () C:\Windows\SysWOW64\winrm
2015-01-23 20:41 - 2014-03-18 15:58 - 00000000 ____D () C:\Windows\SysWOW64\WCN
2015-01-23 20:41 - 2014-03-18 15:58 - 00000000 ____D () C:\Windows\SysWOW64\slmgr
2015-01-23 20:41 - 2014-03-18 15:58 - 00000000 ____D () C:\Windows\SysWOW64\Printing_Admin_Scripts
2015-01-23 20:41 - 2014-03-18 15:58 - 00000000 ____D () C:\Windows\system32\winrm
2015-01-23 20:41 - 2014-03-18 15:58 - 00000000 ____D () C:\Windows\system32\WCN
2015-01-23 20:41 - 2014-03-18 15:58 - 00000000 ____D () C:\Windows\system32\slmgr
2015-01-23 20:41 - 2014-03-18 15:58 - 00000000 ____D () C:\Windows\system32\Printing_Admin_Scripts
2015-01-23 20:41 - 2014-03-18 15:58 - 00000000 ____D () C:\Windows\en-GB
2015-01-23 20:41 - 2013-08-22 16:36 - 00000000 ___SD () C:\Windows\system32\dsc
2015-01-23 20:41 - 2013-08-22 16:36 - 00000000 ___RD () C:\Windows\ImmersiveControlPanel
2015-01-23 20:41 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\WinStore
2015-01-23 20:41 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\SysWOW64\en-GB
2015-01-23 20:41 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\SystemResetPlatform
2015-01-23 20:41 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\migwiz
2015-01-23 20:41 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\en-GB
2015-01-23 20:41 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\PolicyDefinitions
2015-01-23 20:41 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\Help
2015-01-23 20:41 - 2013-08-22 16:36 - 00000000 ____D () C:\Program Files\Windows Photo Viewer
2015-01-23 20:41 - 2013-08-22 16:36 - 00000000 ____D () C:\Program Files\Windows Defender
2015-01-23 20:41 - 2013-08-22 16:36 - 00000000 ____D () C:\Program Files\Common Files\System
2015-01-23 20:41 - 2013-08-22 16:36 - 00000000 ____D () C:\Program Files (x86)\Windows Photo Viewer
2015-01-23 20:41 - 2013-08-22 16:36 - 00000000 ____D () C:\Program Files (x86)\Windows Defender
2015-01-23 20:41 - 2013-08-22 14:36 - 00000000 ____D () C:\Windows\SysWOW64\oobe
2015-01-23 20:41 - 2013-08-22 14:36 - 00000000 ____D () C:\Windows\system32\oobe

==================== Files in the root of some directories =======

2015-01-13 23:24 - 2015-01-14 13:24 - 0000064 _____ () C:\Users\Andi\AppData\Roaming\WB.CFG
2014-08-20 07:39 - 2014-08-20 07:39 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2014-07-09 12:41 - 2014-07-09 12:42 - 0000104 _____ () C:\ProgramData\{01FB4998-33C4-4431-85ED-079E3EEFE75D}.log
2014-07-09 12:42 - 2014-07-09 12:42 - 0000119 _____ () C:\ProgramData\{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}.log
2014-07-09 12:38 - 2014-07-09 12:39 - 0000106 _____ () C:\ProgramData\{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}.log
2014-07-09 12:41 - 2014-07-09 12:41 - 0000111 _____ () C:\ProgramData\{44510C84-AE2A-4079-A75B-D44E68D73B9A}.log
2014-07-09 12:40 - 2014-07-09 12:40 - 0000032 _____ () C:\ProgramData\{551F492A-01B0-4DC4-866F-875EC4EDC0A8}.log
2014-07-09 12:37 - 2014-07-09 12:37 - 0000107 _____ () C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log
2014-07-09 12:40 - 2014-07-09 12:41 - 0000108 _____ () C:\ProgramData\{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}.log
2014-07-09 12:37 - 2014-07-09 12:38 - 0000110 _____ () C:\ProgramData\{E3739848-5329-48E3-8D28-5BBD6E8BE384}.log
2014-07-09 12:39 - 2014-07-09 12:39 - 0000110 _____ () C:\ProgramData\{E3D04529-6EDB-11D8-A372-0050BAE317E1}.log

Some content of TEMP:
====================
C:\Users\Andi\AppData\Local\Temp\1C35A9D4-C736-5B1C-AD23-E3A07B57F7EF.dll
C:\Users\Andi\AppData\Local\Temp\1C35A9D4-C736-5B1C-AD23-E3A07B57F7EF.exe
C:\Users\Andi\AppData\Local\Temp\93B8ADA9-4755-E096-0175-EC1BBC79044E.exe
C:\Users\Andi\AppData\Local\Temp\AppLauncher.exe
C:\Users\Andi\AppData\Local\Temp\optprosetup.exe
C:\Users\Andi\AppData\Local\Temp\Quarantine.exe
C:\Users\Andi\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-02-18 16:02

==================== End Of Log ============================

--- --- ---

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 18-02-2015 01
Ran by Andi at 2015-02-20 22:11:28
Running from C:\Users\Andi\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

µTorrent (HKU\S-1-5-21-1040584371-3716677195-284654461-1001\...\uTorrent) (Version: 3.4.2.38656 - BitTorrent Inc.)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.296 - Adobe Systems Incorporated)
Ashampoo AppLauncher (Medion) v.1.0.0 (HKLM-x32\...\Ashampoo AppLauncher (Medion)_is1) (Version: 1.0.0 - Ashampoo GmbH & Co. KG)
CCleaner (HKLM\...\CCleaner) (Version: 5.01 - Piriform)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.4.5306 - CDBurnerXP)
CyberLink Home Cinema 10 (HKLM-x32\...\InstallShield_{8F14AA37-5193-4A14-BD5B-BDF9B361AEF7}) (Version: 10.0 - CyberLink Corp.)
CyberLink PowerDirector 11 (Version: 11.0.0.3714 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dolby Digital Plus Advanced Audio (HKLM\...\{B0BFC63F-EA07-419E-960B-3FB2ED5DD0B2}) (Version: 7.6.3.1 - Dolby Laboratories Inc)
ELAN Touchpad 11.10.26.3_X64_WHQL (HKLM\...\Elantech) (Version: 11.10.26.3 - ELAN Microelectronic Corp.)
Fotogalerie (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Galerie de photos (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 40.0.2214.111 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Intel(R) Chipset Device Software (x32 Version: 10.0.17 - Intel(R) Corporation) Hidden
Intel(R) Management Engine Components (HKLM\...\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 10.0.25.1048 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3871 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 13.2.0.1016 - Intel Corporation)
Intel(R) Serial IO (HKLM\...\{9FD91C5C-44AE-4D9D-85BE-AE52816B0294}) (Version: 1.1.226.0 - Intel Corporation)
Intel(R) Update Manager (HKLM-x32\...\{84A2B59B-6A7B-4C01-8592-15C9BFE6AC36}) (Version: 2.4.3 - Intel Corporation)
Intel(R) Wireless Bluetooth(R)(patch version 17.1.1431.1) (HKLM\...\{302600C1-6BDF-4FD1-1407-148929CC1385}) (Version: 17.1.1407.0480 - Intel Corporation)
Intel® PROSet/Wireless Software (HKLM-x32\...\{85b9d34f-7397-4e39-8600-07942ef6ca04}) (Version: 17.0.5 - Intel Corporation)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
MedPlayV3.1 (HKLM-x32\...\MedPlayV3.1) (Version: 1.36.01.22 - PlayersMComp)
Microsoft Office 365 - de-de (HKLM\...\O365HomePremRetail - de-de) (Version: 15.0.4675.1003 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-1040584371-3716677195-284654461-1001\...\OneDriveSetup.exe) (Version: 17.3.1171.0714 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 35.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 35.0.1 (x86 de)) (Version: 35.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 35.0.1 - Mozilla)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4675.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4675.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4675.1003 - Microsoft Corporation) Hidden
PHotkey (HKLM-x32\...\{E50C224A-BBF2-428D-9DCF-DBF9DF85C40E}) (Version: 1.00.0105 - Pegatron Corporation)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9600.39054 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.19.726.2013 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7318 - Realtek Semiconductor Corp.)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
WinRAR 5.20 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.20.0 - win.rar GmbH)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-1040584371-3716677195-284654461-1001_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Andi\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714\amd64\FileSyncApi64.dll (Microsoft Corporation)

==================== Restore Points  =========================

29-01-2015 02:47:19 Windows Update
08-02-2015 13:21:16 Geplanter Prüfpunkt
12-02-2015 19:13:37 Windows Update
15-02-2015 21:06:44 Revo Uninstaller's restore point - CHIP Best Deal

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 14:25 - 2013-08-22 14:25 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {1154D2C2-E364-4C37-BBAB-026E67DFB79D} - System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-1040584371-3716677195-284654461-1001 => %localappdata%\Microsoft\SkyDrive\SkyDrive.exe
Task: {3CFA2605-3644-4A52-A8B4-0D82A76417A0} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473 => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [2014-04-09] ()
Task: {4E205356-4008-4EFE-8857-DDEFF3202725} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473-Logon => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [2014-04-09] ()
Task: {5C9944EA-E447-4204-918D-27A756562761} - System32\Tasks\SpyHunter4Startup => C:\Program Files\Enigma Software Group\SpyHunter\Spyhunter4.exe
Task: {652E6E3A-2BC8-417D-9C8A-4F50D409188E} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2015-02-14] (Microsoft Corporation)
Task: {6DE1B0F0-4A78-4BAD-8E35-0291BF5300D3} - \avaxvyyvyf No Task File <==== ATTENTION
Task: {6E5449D3-7E1E-4C56-9183-D81B2330AD80} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-02-15] (Google Inc.)
Task: {949B7E89-3B24-47FD-95B1-FB45CFA03C82} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-12-12] (Piriform Ltd)
Task: {AFF5A446-7B90-45EA-AB31-1CB6A9B0969E} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2014-11-04] (Microsoft Corporation)
Task: {C46EBA3E-4D7C-4A8D-8617-1026E718B277} - System32\Tasks\DolbySelectorTask => C:\Program Files\Dolby Digital Plus\ddp.exe [2014-04-07] (Dolby Laboratories Inc.)
Task: {D96A0A33-467A-463B-852F-EE1D38E67226} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2015-02-01] (Microsoft Corporation)
Task: {F23CFA49-C485-4565-B000-F85A7E5797C4} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-02-15] (Google Inc.)
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) ==============

2014-08-20 10:05 - 2014-03-04 16:58 - 00136192 _____ () C:\Program Files (x86)\PHotkey\PGFNEXSrv.exe
2015-02-01 11:06 - 2014-05-20 08:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2014-07-09 12:40 - 2013-03-06 14:42 - 00389896 _____ () C:\Program Files\CyberLink\Shared files\RichVideo64.exe
2014-08-20 10:05 - 2014-07-11 17:15 - 02222592 _____ () C:\Program Files (x86)\PHotkey\PHotkey.exe
2014-04-07 16:13 - 2014-04-07 16:13 - 00052096 _____ () C:\Program Files\Dolby Digital Plus\Dolby.DDP.Controls_Desktop.dll
2014-08-20 10:05 - 2010-01-12 17:36 - 00117256 _____ () C:\Program Files (x86)\PHotkey\MsgTranAgt.exe
2014-08-20 10:05 - 2010-01-12 17:36 - 00121864 _____ () C:\Program Files (x86)\PHotkey\MsgTranAgt64.exe
2014-08-20 10:05 - 2010-12-17 14:04 - 00449032 _____ () C:\Program Files (x86)\PHotkey\ATouch64.exe
2014-08-20 10:05 - 2014-02-21 17:19 - 08857088 _____ () C:\Program Files (x86)\PHotkey\GPMTray.exe
2014-08-20 10:05 - 2014-07-08 14:39 - 03006464 _____ () C:\Program Files (x86)\PHotkey\KeyboardMonitorTool.exe
2014-08-20 10:05 - 2014-03-18 21:54 - 05644800 _____ () C:\Program Files (x86)\PHotkey\Dolbyosd.exe
2014-06-24 16:08 - 2014-06-24 16:08 - 01241560 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
2014-08-20 10:05 - 2009-12-18 15:36 - 00973432 _____ () C:\Program Files (x86)\PHotkey\acAuth.dll
2014-08-20 10:05 - 2013-09-17 23:23 - 00108032 _____ () C:\Program Files (x86)\PHotkey\PGFNEX.dll
2014-07-09 12:39 - 2013-08-05 08:49 - 00627672 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMediaLibrary.dll
2013-08-05 15:48 - 2013-08-05 15:48 - 00016856 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvcPS.dll
2015-01-27 03:33 - 2015-01-23 11:37 - 03925104 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""

==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1040584371-3716677195-284654461-1001\Control Panel\Desktop\\Wallpaper -> C:\Windows\web\wallpaper\MEDION\wallpaper.jpg
DNS Servers: 192.168.178.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

HKLM\...\StartupApproved\Run: => "mcpltui_exe"
HKU\S-1-5-21-1040584371-3716677195-284654461-1001\...\StartupApproved\Run: => "Super Optimizer"

==================== Accounts: =============================

Administrator (S-1-5-21-1040584371-3716677195-284654461-500 - Administrator - Disabled)
Andi (S-1-5-21-1040584371-3716677195-284654461-1001 - Administrator - Enabled) => C:\Users\Andi
Gast (S-1-5-21-1040584371-3716677195-284654461-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1040584371-3716677195-284654461-1003 - Limited - Enabled)

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (02/19/2015 10:32:00 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 35.0.1.5500, Zeitstempel: 0x54c1f9f3
Name des fehlerhaften Moduls: mozalloc.dll, Version: 35.0.1.5500, Zeitstempel: 0x54c1f224
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001425
ID des fehlerhaften Prozesses: 0x1f20
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3
Vollständiger Name des fehlerhaften Pakets: plugin-container.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: plugin-container.exe5

Error: (02/19/2015 10:31:59 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm firefox.exe, Version 35.0.1.5500 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 2f8

Startzeit: 01d04c7119f5df5e

Endzeit: 4294967295

Anwendungspfad: C:\Program Files (x86)\Mozilla Firefox\firefox.exe

Berichts-ID: b7e5d0db-b87e-11e4-829b-303a64c67d6f

Vollständiger Name des fehlerhaften Pakets: 

Anwendungs-ID, die relativ zum fehlerhaften Paket ist:

Error: (02/19/2015 07:51:30 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005

Error: (02/19/2015 03:08:51 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.

Error: (02/19/2015 03:05:00 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.

Error: (02/19/2015 01:59:03 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 35.0.1.5500, Zeitstempel: 0x54c1f9f3
Name des fehlerhaften Moduls: mozalloc.dll, Version: 35.0.1.5500, Zeitstempel: 0x54c1f224
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001425
ID des fehlerhaften Prozesses: 0x8f0
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3
Vollständiger Name des fehlerhaften Pakets: plugin-container.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: plugin-container.exe5

Error: (02/19/2015 11:14:05 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 35.0.1.5500, Zeitstempel: 0x54c1f9f3
Name des fehlerhaften Moduls: mozalloc.dll, Version: 35.0.1.5500, Zeitstempel: 0x54c1f224
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001425
ID des fehlerhaften Prozesses: 0xe30
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3
Vollständiger Name des fehlerhaften Pakets: plugin-container.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: plugin-container.exe5

Error: (02/19/2015 11:09:00 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.

Error: (02/19/2015 09:13:31 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.

Error: (02/19/2015 09:09:02 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.


System errors:
=============
Error: (02/19/2015 10:15:43 PM) (Source: NetBT) (EventID: 4321) (User: )
Description: Der Name "WORKGROUP      :1d" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.178.30
registriert werden. Der Computer mit IP-Adresse 192.168.178.1 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.

Error: (02/19/2015 09:35:32 PM) (Source: NetBT) (EventID: 4321) (User: )
Description: Der Name "WORKGROUP      :1d" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.178.30
registriert werden. Der Computer mit IP-Adresse 192.168.178.1 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.

Error: (02/19/2015 08:58:34 PM) (Source: NetBT) (EventID: 4321) (User: )
Description: Der Name "WORKGROUP      :1d" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.178.30
registriert werden. Der Computer mit IP-Adresse 192.168.178.1 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.

Error: (02/19/2015 07:58:02 PM) (Source: NetBT) (EventID: 4321) (User: )
Description: Der Name "WORKGROUP      :1d" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.178.30
registriert werden. Der Computer mit IP-Adresse 192.168.178.1 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.

Error: (02/19/2015 07:02:28 PM) (Source: NetBT) (EventID: 4321) (User: )
Description: Der Name "WORKGROUP      :1d" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.178.30
registriert werden. Der Computer mit IP-Adresse 192.168.178.1 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.

Error: (02/19/2015 03:05:29 PM) (Source: DCOM) (EventID: 10010) (User: Deister)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}

Error: (02/19/2015 03:04:59 PM) (Source: DCOM) (EventID: 10010) (User: Deister)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}

Error: (02/19/2015 11:09:53 AM) (Source: DCOM) (EventID: 10010) (User: Deister)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}

Error: (02/19/2015 11:09:23 AM) (Source: DCOM) (EventID: 10010) (User: Deister)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}

Error: (02/19/2015 10:46:53 AM) (Source: DCOM) (EventID: 10010) (User: Deister)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}


Microsoft Office Sessions:
=========================
Error: (02/19/2015 10:32:00 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe35.0.1.550054c1f9f3mozalloc.dll35.0.1.550054c1f22480000003000014251f2001d04c7b63c80c14C:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dllbcb2e842-b87e-11e4-829b-303a64c67d6f

Error: (02/19/2015 10:31:59 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: firefox.exe35.0.1.55002f801d04c7119f5df5e4294967295C:\Program Files (x86)\Mozilla Firefox\firefox.exeb7e5d0db-b87e-11e4-829b-303a64c67d6f

Error: (02/19/2015 07:51:30 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005

Error: (02/19/2015 03:08:51 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestc:\program files\CCleaner\CCleaner.exe

Error: (02/19/2015 03:05:00 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestc:\program files\CCleaner\CCleaner.exe

Error: (02/19/2015 01:59:03 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe35.0.1.550054c1f9f3mozalloc.dll35.0.1.550054c1f22480000003000014258f001d04c2d2a61455bC:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dll13d358cb-b837-11e4-829b-303a64c67d6f

Error: (02/19/2015 11:14:05 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe35.0.1.550054c1f9f3mozalloc.dll35.0.1.550054c1f2248000000300001425e3001d04bab93ced952C:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dll0885572a-b820-11e4-829b-303a64c67d6f

Error: (02/19/2015 11:09:00 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestc:\program files\CCleaner\CCleaner.exe

Error: (02/19/2015 09:13:31 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestc:\program files\CCleaner\CCleaner.exe

Error: (02/19/2015 09:09:02 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestc:\program files\CCleaner\CCleaner.exe


==================== Memory info =========================== 

Processor: Intel(R) Pentium(R) 3558U @ 1.70GHz
Percentage of memory in use: 59%
Total physical RAM: 4013 MB
Available physical RAM: 1619.83 MB
Total Pagefile: 5037 MB
Available Pagefile: 2214.21 MB
Total Virtual: 131072 MB
Available Virtual: 131071.84 MB

==================== Drives ================================

Drive c: (Boot) (Fixed) (Total:404.05 GB) (Free:366.55 GB) NTFS
Drive d: (Recover) (Fixed) (Total:60 GB) (Free:45.13 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: 488DA0F9)

Partition: GPT Partition Type.

==================== End Of Log ============================

cosinus · 21.02.2015, 16:00

Adware/Junkware/Toolbars entfernen

Alte Versionen von adwCleaner und falls vorhanden JRT vorher löschen, danach neu runterladen auf den Desktop!
Virenscanner jetzt vor dem Einsatz dieser Tools bitte komplett deaktivieren!

1. Schritt: adwCleaner

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

2. Schritt: JRT - Junkware Removal Tool

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

3. Schritt: Frisches Log mit FRST

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Kampffisch · 25.02.2015, 21:02

Code:

ATTFilter

# AdwCleaner v4.110 - Bericht erstellt 25/02/2015 um 20:32:22
# Aktualisiert 05/02/2015 von Xplode
# Datenbank : 2015-02-05.2 [Lokal]
# Betriebssystem : Windows 8.1  (x64)
# Benutzername : Andi - DEISTER
# Gestarted von : C:\Users\Andi\Desktop\AdwCleaner_4.110.exe
# Option : Suchlauf

***** [ Dienste ] *****

Dienst Gefunden : globalUpdate
Dienst Gefunden : globalUpdatem

***** [ Dateien / Ordner ] *****

Datei Gefunden : C:\Users\Andi\AppData\Roaming\Mozilla\Firefox\Profiles\y8szgoz2.default\searchplugins\webssearches.xml
Datei Gefunden : C:\Users\Public\Desktop\PC Mechanic.lnk
Ordner Gefunden : C:\Program Files (x86)\globalUpdate
Ordner Gefunden : C:\Program Files (x86)\Uniblue
Ordner Gefunden : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Uniblue
Ordner Gefunden : C:\Users\Andi\AppData\Local\globalUpdate
Ordner Gefunden : C:\Users\Andi\AppData\Local\ZombieInvasion
Ordner Gefunden : C:\Users\Andi\AppData\Roaming\Mozilla\Firefox\Profiles\y8szgoz2.default\Extensions\thefoxonlybetter@quicksaver
Ordner Gefunden : C:\Users\Andi\AppData\Roaming\RHEng
Ordner Gefunden : C:\Users\Andi\AppData\Roaming\Uniblue

***** [ Geplante Tasks ] *****

Task Gefunden : globalUpdateUpdateTaskMachineCore
Task Gefunden : globalUpdateUpdateTaskMachineUA
Task Gefunden : PC-Mechanic Startup
Task Gefunden : PC-Mechanic Maintenance
Task Gefunden : 9466407f-23e0-4aaf-8a1d-106c65917ab5-1-6
Task Gefunden : 9466407f-23e0-4aaf-8a1d-106c65917ab5-1-7
Task Gefunden : 9466407f-23e0-4aaf-8a1d-106c65917ab5-10_user
Task Gefunden : 9466407f-23e0-4aaf-8a1d-106c65917ab5-4
Task Gefunden : 9466407f-23e0-4aaf-8a1d-106c65917ab5-5
Task Gefunden : 9466407f-23e0-4aaf-8a1d-106c65917ab5-5_user
Task Gefunden : 9466407f-23e0-4aaf-8a1d-106c65917ab5-6
Task Gefunden : 9466407f-23e0-4aaf-8a1d-106c65917ab5-7

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\Crossrider
Schlüssel Gefunden : HKCU\Software\GlobalUpdate
Schlüssel Gefunden : HKCU\Software\InstalledBrowserExtensions
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gefunden : [x64] HKCU\Software\GlobalUpdate
Schlüssel Gefunden : [x64] HKCU\Software\InstalledBrowserExtensions
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{3278F5CF-48F3-4253-A6BB-004CE84AF492}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{577975B8-C40E-43E6-B0DE-4C6B44088B52}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{02A96331-0CA6-40E2-A87D-C224601985EB}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{3278F5CF-48F3-4253-A6BB-004CE84AF492}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{3B5702BA-7F4C-4D1A-B026-1E9A01D43978}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{5645E0E7-FC12-43BF-A6E4-F9751942B298}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{577975B8-C40E-43E6-B0DE-4C6B44088B52}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{5E89ACE9-E16B-499A-87B4-0DBF742404C1}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{69F256DF-BA98-45E9-86EA-FC3CFECF9D30}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{6E87FC94-9866-49B9-8E93-5736D6DE3DD7}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{7E49F793-B3CD-4BF7-8419-B34B8BD30E61}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{834469E3-CA2B-4F21-A5CA-4F6F4DBCDE87}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{8529FAA3-5BFD-43C1-AB35-B53C4B96C6E5}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{ADBC39BE-3D20-4333-8D99-E91EB1B62474}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{CFC47BB5-5FB5-4AD0-8427-6AA04334A3FC}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{E06CA7F5-BA34-4FF6-8D24-B1BDC594D91F}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{E0ADB535-D7B5-4D8B-B15D-578BDD20D76A}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{F6421EE5-A5BE-4D31-81D5-C16B7BF48E4C}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{FD8E81D0-F5FE-4CB1-9AEA-1E163D2BAB78}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\globalUpdate.OneClickCtrl.10
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\globalUpdate.OneClickProcessLauncherMachine
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\globalUpdate.OneClickProcessLauncherMachine.1.0
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\globalUpdate.Update3WebControl.4
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoCreateAsync
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoCreateAsync.1.0
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreClass
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreClass.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreMachineClass
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreMachineClass.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CredentialDialogMachine
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CredentialDialogMachine.1.0
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachine
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachine.1.0
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachineFallback
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachineFallback.1.0
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassSvc
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassSvc.1.0
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\globalUpdateUpdate.ProcessLauncher
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\globalUpdateUpdate.ProcessLauncher.1.0
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3COMClassService
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3COMClassService.1.0
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachine
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachine.1.0
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachineFallback
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachineFallback.1.0
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebSvc
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebSvc.1.0
Schlüssel Gefunden : HKLM\SOFTWARE\GlobalUpdate
Schlüssel Gefunden : HKLM\SOFTWARE\InstalledBrowserExtensions
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5645E0E7-FC12-43BF-A6E4-F9751942B298}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5E89ACE9-E16B-499A-87B4-0DBF742404C1}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{5645E0E7-FC12-43BF-A6E4-F9751942B298}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1F88FC5D-4D46-448A-AF59-7061FFC6ABBF}_is1
Schlüssel Gefunden : HKLM\SOFTWARE\MozillaPlugins\@staging.google.com/globalUpdate Update;version=10
Schlüssel Gefunden : HKLM\SOFTWARE\MozillaPlugins\@staging.google.com/globalUpdate Update;version=4
Schlüssel Gefunden : HKLM\SOFTWARE\Uniblue
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\InstalledBrowserExtensions
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}

***** [ Internetbrowser ] *****

-\\ Internet Explorer v11.0.9600.17416


-\\ Mozilla Firefox v36.0 (x86 de)

[y8szgoz2.default] - Zeile Gefunden : user_pref("browser.newtab.url", "chrome://unitedtb/content/newtab/newtab-page.xhtml");
[y8szgoz2.default] - Zeile Gefunden : user_pref("browser.search.defaultenginename", "webssearches");
[y8szgoz2.default] - Zeile Gefunden : user_pref("browser.search.selectedEngine", "webssearches");
[y8szgoz2.default] - Zeile Gefunden : user_pref("extensions.aLOLKP26107084HBHOP59134464com71803.71803.internaldb.Resources_meta.value", "%7B%22popup.html%22%3A%7B%22id%22%3A1028460%2C%22ver%22%3A1%2C%22status%22%3A1%2C%22name%22%3A%22popu[...]
[y8szgoz2.default] - Zeile Gefunden : user_pref("extensions.aLOLKP26107084HBHOP59134464com71803.71803.internaldb.Resources_resource_1028460.value", "%22%3C%21DOCTYPE%20html%3E%5Cr%5Cn%3Chtml%3E%5Cr%5Cn%3Chead%3E%5Cr%5Cn%3C%21--%20This%20m[...]
[y8szgoz2.default] - Zeile Gefunden : user_pref("extensions.aLOLKP26107084HBHOP59134464com71803.71803.internaldb.monetization_plugin_bundledUrls.value", "%7B%22dealply_s%22%3A%7B%22urls%22%3A%5B%22ssfiles.com%22%5D%7D%2C%22dealply_p%22%3A[...]
[y8szgoz2.default] - Zeile Gefunden : user_pref("extensions.aNAUPP49116685MVOEOKE10798312com69917.69917.internaldb.monetization_plugin_bundledUrls.value", "%7B%22dealply_s%22%3A%7B%22urls%22%3A%5B%22ssfiles.com%22%5D%7D%2C%22dealply_p%22%[...]
[y8szgoz2.default] - Zeile Gefunden : user_pref("extensions.ab6e4f54065ff48dd97db30cac9b45f807bf54a45a4669e51ccom67913.67913.internaldb.monetization_plugin_bundledUrls.value", "%7B%22dealply_s%22%3A%7B%22urls%22%3A%5B%22ssfiles.com%22%5D%[...]
[y8szgoz2.default] - Zeile Gefunden : user_pref("extensions.crossrider.bic", "14bc15f7ebc7fa69f110d5bac057970f");

-\\ Google Chrome v40.0.2214.111

*************************

AdwCleaner[R0].txt - [5894 Bytes] - [13/02/2015 23:57:48]
AdwCleaner[R1].txt - [2005 Bytes] - [14/02/2015 19:10:30]
AdwCleaner[R2].txt - [1680 Bytes] - [14/02/2015 20:30:38]
AdwCleaner[R3].txt - [1120 Bytes] - [14/02/2015 21:03:28]
AdwCleaner[R4].txt - [2393 Bytes] - [15/02/2015 09:54:56]
AdwCleaner[R5].txt - [1282 Bytes] - [15/02/2015 21:26:24]
AdwCleaner[R6].txt - [18808 Bytes] - [15/02/2015 21:53:52]
AdwCleaner[R7].txt - [3213 Bytes] - [17/02/2015 20:13:04]
AdwCleaner[R8].txt - [10671 Bytes] - [25/02/2015 20:32:22]
AdwCleaner[S0].txt - [5721 Bytes] - [14/02/2015 13:48:50]
AdwCleaner[S1].txt - [2084 Bytes] - [14/02/2015 20:27:25]
AdwCleaner[S2].txt - [1777 Bytes] - [14/02/2015 20:33:14]
AdwCleaner[S3].txt - [1344 Bytes] - [15/02/2015 21:29:13]
AdwCleaner[S4].txt - [18001 Bytes] - [15/02/2015 21:58:00]
AdwCleaner[S5].txt - [3310 Bytes] - [17/02/2015 20:51:56]

########## EOF - C:\AdwCleaner\AdwCleaner[R8].txt - [11086 Bytes] ##########

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.2 (02.02.2015:1)
OS: Windows 8.1 x64
Ran by Andi on 25.02.2015 at 20:48:16,37
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ FireFox

Successfully deleted: [Folder] C:\Users\Andi\AppData\Roaming\mozilla\firefox\profiles\y8szgoz2.default\extensions\toolbar@web.de
Successfully deleted the following from C:\Users\Andi\AppData\Roaming\mozilla\firefox\profiles\y8szgoz2.default\prefs.js

user_pref("b7ZpYoD", "Dzt4WGZMDe4TDyVLBSYPW6mGWfJ7gfsYDftIoiZ6Ae4UB6CKC7lIhS4IB7qZDyVLBS4OCMlMscIYhy0TDe8VBNnKg70LA7VVujJPhSZ8CMEKAe4UhfZohSYSCMPKm6bQljlEhyw5CyPHqfxsgjmEAMC9C
user_pref("browser.search.searchengine.desc", "this is my first firefox searchEngine");
user_pref("browser.search.searchengine.ptid", "tugs");
user_pref("browser.search.searchengine.uid", "HGSTXHTS725050A7E630_RC250ACB0D8S9J0D8S9JX");
user_pref("extensions.ab6e4f54065ff48dd97db30cac9b45f807bf54a45a4669e51ccom67913.67913.internaldb.monetization_plugin_bundledUrls.value", "%7B%22dealply_s%22%3A%7B%22urls%22%3
user_pref("xuZy0fS", "uyh8BMq9Ae0KucV2Dzt4W7VMuzDPBMmLDG4HheFMvMFLg7x9Ae0KvMZGhegKAe4UhfZohSYSCMPKm6bQljlEhyw5CyPHqfxsgjmEAMC9CkZhsSU+vjwPW6tVDzlGBTJ0XeqZDyqOuykPW689CNV2DMxGs



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 25.02.2015 at 20:51:13,45
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 18-02-2015 01
Ran by Andi (administrator) on DEISTER on 25-02-2015 20:37:29
Running from C:\Users\Andi\Desktop
Loaded Profiles: Andi (Available profiles: Andi)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
() C:\Program Files (x86)\PHotkey\PGFNEXSrv.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Dolby Laboratories Inc.) C:\Program Files\Dolby Digital Plus\ddp.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\ibtsiva.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Time Lapse Solutions) C:\ProgramData\rJDRDPLhi\lhOYKYn.exe
() C:\Program Files (x86)\PHotkey\PHotkey.exe
() C:\Program Files (x86)\PHotkey\MsgTranAgt.exe
() C:\Program Files (x86)\PHotkey\MsgTranAgt64.exe
() C:\Program Files (x86)\PHotkey\Atouch64.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
() C:\Program Files (x86)\PHotkey\GPMTray.exe
() C:\Program Files (x86)\PHotkey\KeyboardMonitorTool.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Intel Corporation) C:\Windows\System32\igfxTray.exe
() C:\Program Files (x86)\PHotkey\MsgTranAgt.exe
() C:\Program Files (x86)\PHotkey\MsgTranAgt64.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe
() C:\Program Files (x86)\PHotkey\Dolbyosd.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.3.9600.17477_none_fa2b7d3b9b36c7b4\TiWorker.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Farbar) C:\Users\Andi\Desktop\FRST64(1).exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [320360 2014-06-25] (Intel Corporation)
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [3278088 2014-07-01] (ELAN Microelectronics Corp.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13674712 2014-08-15] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1393520 2014-08-15] (Realtek Semiconductor)
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll",TrayApp
HKLM-x32\...\Run: [CLMLServer_For_P2G8] => C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111576 2013-08-05] (CyberLink)
HKLM-x32\...\Run: [CLVirtualDrive] => C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [490760 2013-11-26] (CyberLink Corp.)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [95192 2013-03-11] (CyberLink Corp.)
HKLM-x32\...\Run: [YouCam Service] => C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe [267224 2013-09-18] (CyberLink Corp.)
HKLM\...\Policies\Explorer: [ConfirmFileDelete] 1
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKLM\...\Policies\Explorer: [NoFolderOptions] 0
HKU\S-1-5-21-1040584371-3716677195-284654461-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7394584 2014-12-12] (Piriform Ltd)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
SearchScopes: HKLM -> {DC91FAFB-6CEA-49E5-BB74-9CEE75D09B77} URL = 
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: buyyandbirrowaSe -> {d251ad2b-1095-4530-9785-a87e719e24ac} -> C:\Program Files (x86)\buyyandbirrowaSe\covq6NwOrKB6UE.dll ()
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
StartMenuInternet: IEXPLORE.EXE - iexplore.exe

FireFox:
========
FF ProfilePath: C:\Users\Andi\AppData\Roaming\Mozilla\Firefox\Profiles\y8szgoz2.default
FF NewTab: chrome://unitedtb/content/newtab/newtab-page.xhtml
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_296.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_296.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Extension: MediaPlayersvideos  1.1 - C:\Users\Andi\AppData\Roaming\Mozilla\Firefox\Profiles\y8szgoz2.default\Extensions\b6e4f54065ff48dd97db30ca@c9b45f807bf54a45a4669e51c.com [2015-02-21]
FF Extension: Xmarks - C:\Users\Andi\AppData\Roaming\Mozilla\Firefox\Profiles\y8szgoz2.default\Extensions\foxmarks@kei.com [2015-01-14]
FF Extension: SuperPlusRadio v2.1V25.02 - C:\Users\Andi\AppData\Roaming\Mozilla\Firefox\Profiles\y8szgoz2.default\Extensions\LOLKP26107084@HBHOP59134464.com [2015-02-25]
FF Extension: Browsers+ Apps + - C:\Users\Andi\AppData\Roaming\Mozilla\Firefox\Profiles\y8szgoz2.default\Extensions\NAUPP49116685@MVOEOKE10798312.com [2015-02-21]
FF Extension: Search Enginer - C:\Users\Andi\AppData\Roaming\Mozilla\Firefox\Profiles\y8szgoz2.default\Extensions\searchengine@gmail.com [2015-02-15]
FF Extension: WEB.DE MailCheck - C:\Users\Andi\AppData\Roaming\Mozilla\Firefox\Profiles\y8szgoz2.default\Extensions\toolbar@web.de [2015-02-25]
FF Extension: youtubeunblockerunblockeryt - C:\Users\Andi\AppData\Roaming\Mozilla\Firefox\Profiles\y8szgoz2.default\Extensions\youtubeunblocker@unblocker.yt [2015-02-19]
FF Extension: buuYandbrowwSSE - C:\Users\Andi\AppData\Roaming\Mozilla\Firefox\Profiles\y8szgoz2.default\Extensions\yuR@D.net [2015-02-02]
FF Extension: c151d79ee61b4a90a8875a46d38fba99 - C:\Users\Andi\AppData\Roaming\Mozilla\Firefox\Profiles\y8szgoz2.default\Extensions\{c151d79e-e61b-4a90-a887-5a46d38fba99} [2015-02-19]
FF Extension: NoScript - C:\Users\Andi\AppData\Roaming\Mozilla\Firefox\Profiles\y8szgoz2.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2015-02-02]
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Users\Andi\AppData\Roaming\Mozilla\Firefox\Profiles\y8szgoz2.default\Extensions\{B64D9B05-48E1-4CEB-BF58-E0643994E900}.xpi [2015-02-25]
FF Extension: Adblock Plus - C:\Users\Andi\AppData\Roaming\Mozilla\Firefox\Profiles\y8szgoz2.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-01-13]
FF Extension: Positive Finds - C:\Users\Andi\AppData\Roaming\Mozilla\Firefox\Profiles\y8szgoz2.default\Extensions\{f47391f8-d25a-4213-814d-d386acf92dcf}.xpi [2015-02-12]
FF Extension: UITBAutoInstaller - C:\Program Files (x86)\Mozilla Firefox\distribution\bundles\{edd7fc99-d65c-4979-85c2-ddeed30c50c7} [2015-02-25]
FF HKLM-x32\...\Firefox\Extensions: [searchengine@gmail.com] - C:\Users\Andi\AppData\Roaming\Mozilla\Firefox\Profiles\y8szgoz2.default\extensions\searchengine@gmail.com

Chrome: 
=======
CHR HomePage: Default -> hxxp://www.istartsurf.com/?type=hppp&ts=1424032548&from=tugs&uid=HGSTXHTS725050A7E630_RC250ACB0D8S9J0D8S9JX
CHR StartupUrls: Default -> "hxxp://www.istartsurf.com/?type=hppp&ts=1424032548&from=tugs&uid=HGSTXHTS725050A7E630_RC250ACB0D8S9J0D8S9JX"
CHR DefaultSearchKeyword: Default -> istartsurf
CHR DefaultSuggestURL: Default -> 
CHR Profile: C:\Users\Andi\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\Andi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-02-15]
CHR Extension: (Google Docs) - C:\Users\Andi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-15]
CHR Extension: (Google Drive) - C:\Users\Andi\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-02-15]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Andi\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2015-02-15]
CHR Extension: (YouTube) - C:\Users\Andi\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-02-15]
CHR Extension: (Google Search) - C:\Users\Andi\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-02-15]
CHR Extension: (Google Sheets) - C:\Users\Andi\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-02-15]
CHR Extension: (gmimocjjppdelmhpcmpkhekmpoddgima) - C:\Users\Andi\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmimocjjppdelmhpcmpkhekmpoddgima [2015-02-20]
CHR Extension: (lafgkmgbfkfpbhepoolagpahghdhmaop) - C:\Users\Andi\AppData\Local\Google\Chrome\User Data\Default\Extensions\lafgkmgbfkfpbhepoolagpahghdhmaop [2015-02-19]
CHR Extension: (Google Wallet) - C:\Users\Andi\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-02-15]
CHR Extension: (paegkacdgdffjjiepbbdcgkfgnjcdonl) - C:\Users\Andi\AppData\Local\Google\Chrome\User Data\Default\Extensions\paegkacdgdffjjiepbbdcgkfgnjcdonl [2015-02-19]
CHR Extension: (Gmail) - C:\Users\Andi\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-02-15]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2449592 2014-11-12] (Microsoft Corporation)
R2 CyberLink PowerDVD 10 MS Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe [74712 2013-03-11] (CyberLink)
R2 CyberLink PowerDVD 10 MS Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe [316376 2013-03-11] (CyberLink)
S2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [16232 2014-06-25] (Intel Corporation)
R2 iBtSiva; C:\Program Files (x86)\Intel\Bluetooth\ibtsiva.exe [121304 2014-08-07] (Intel Corporation)
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [324568 2014-07-25] (Intel Corporation)
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [887256 2014-05-13] (Intel(R) Corporation)
S2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [131544 2014-06-24] (Intel Corporation)
S3 iumsvc; C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [174368 2014-04-09] ()
S2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [154584 2014-06-24] (Intel Corporation)
R2 lhOYKYn; C:\ProgramData\rJDRDPLhi\lhOYKYn.exe [2733544 2015-02-15] (Time Lapse Solutions)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [284912 2014-05-29] ()
R2 PGFNEXSrv; C:\Program Files (x86)\PHotkey\PGFNEXSrv.exe [136192 2014-03-04] () [File not signed]
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [389896 2013-03-06] ()
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3816176 2014-05-29] (Intel® Corporation)
S2 cae99edb; "C:\Windows\system32\rundll32.exe" "c:\Program Files (x86)\Super Optimizer\SupOptCrash.dll",ENT

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-03-18] (Microsoft Corporation)
R3 btmaux; C:\Windows\system32\DRIVERS\btmaux.sys [141624 2014-05-13] (Motorola Solutions, Inc.)
R3 btmhsf; C:\Windows\system32\DRIVERS\btmhsf.sys [1424184 2014-06-17] (Motorola Solutions, Inc.)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [91712 2013-03-05] (CyberLink)
S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2015-02-13] ()
R3 ETDSMBus; C:\Windows\system32\DRIVERS\ETDSMBus.sys [23816 2014-07-01] (ELAN Microelectronic Corp.)
R3 iaLPSS_GPIO; C:\Windows\System32\drivers\iaLPSS_GPIO.sys [35832 2014-06-10] (Intel Corporation)
R3 ibtusb; C:\Windows\system32\DRIVERS\ibtusb.sys [220104 2014-08-07] (Intel Corporation)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-02-20] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [125952 2014-06-24] (Intel Corporation)
R3 NETwNb64; C:\Windows\system32\DRIVERS\Netwbw02.sys [3446240 2014-06-18] (Intel Corporation)
S3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew02.sys [4649440 2013-06-18] (Intel Corporation)
R2 PEGAGFN; C:\Program Files (x86)\PHotkey\PEGAGFN.sys [14344 2009-09-11] (PEGATRON)
R3 PegaRadioSwitch; C:\Windows\System32\drivers\PegaRadioSwitch.sys [23552 2013-08-22] (Windows (R) Win 7 DDK provider)
S3 RtlWlanu; C:\Windows\system32\DRIVERS\rtwlanu.sys [2968280 2014-01-15] (Realtek Semiconductor Corporation                           )
R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-25 20:37 - 2015-02-25 20:37 - 00000000 ____D () C:\Users\Andi\AppData\Local\ZombieInvasion
2015-02-25 20:30 - 2015-02-25 20:30 - 00045420 _____ () C:\Users\Andi\Desktop\cc_20150225_202958.reg
2015-02-25 17:31 - 2015-02-25 20:31 - 00000004 _____ () C:\Windows\SysWOW64\029B560A371F4E00AB32838EBC01B9E7
2015-02-25 16:47 - 2015-02-25 16:47 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf
2015-02-25 16:33 - 2015-02-25 20:36 - 00000292 _____ () C:\Windows\Tasks\PC-Mechanic Subscription.job
2015-02-25 16:33 - 2015-02-25 16:33 - 00002560 _____ () C:\Windows\System32\Tasks\PC-Mechanic Subscription
2015-02-25 16:33 - 2015-02-25 16:33 - 00001261 _____ () C:\Users\Public\Desktop\DVDVideoSoft Free Studio.lnk
2015-02-25 16:33 - 2015-02-25 16:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
2015-02-25 16:31 - 2015-02-25 20:36 - 00001348 _____ () C:\Windows\Tasks\MPNIT.job
2015-02-25 16:31 - 2015-02-25 20:36 - 00001344 _____ () C:\Windows\Tasks\KKZ.job
2015-02-25 16:31 - 2015-02-25 16:32 - 00000000 ____D () C:\Program Files (x86)\SuperPlusRadio v2.1V25.02
2015-02-25 16:31 - 2015-02-25 16:31 - 01959376 _____ (RadioCanyonv2V25.02) C:\Users\Andi\AppData\Roaming\MPNIT.exe
2015-02-25 16:31 - 2015-02-25 16:31 - 01330128 _____ (RadioCanyonv2V25.02) C:\Users\Andi\AppData\Roaming\KKZ.exe
2015-02-25 16:31 - 2015-02-25 16:31 - 00004350 _____ () C:\Windows\System32\Tasks\MPNIT
2015-02-25 16:31 - 2015-02-25 16:31 - 00004348 _____ () C:\Windows\System32\Tasks\KKZ
2015-02-25 16:31 - 2015-02-25 16:31 - 00000000 ____D () C:\Program Files (x86)\1498dc0a-f4d9-4408-be95-19affbd6d965
2015-02-25 16:30 - 2015-02-25 16:33 - 00000000 ____D () C:\Program Files (x86)\DVDVideoSoft
2015-02-25 16:30 - 2015-02-25 16:30 - 00000000 ____D () C:\Program Files (x86)\WEB.DE MailCheck
2015-02-25 16:30 - 2015-02-25 16:30 - 00000000 ____D () C:\Program Files (x86)\Free Codec Pack
2015-02-25 16:27 - 2015-02-25 16:27 - 03313168 _____ (DVDVideoSoft Ltd. ) C:\Users\Andi\Downloads\FreeYouTube55ToMP3Converter(1).exe
2015-02-25 16:26 - 2015-02-25 16:33 - 00000000 ____D () C:\Users\Andi\AppData\Roaming\DVDVideoSoft
2015-02-25 16:25 - 2015-02-25 16:28 - 03312672 _____ (DVDVideoSoft Ltd. ) C:\Users\Andi\Downloads\FreeYouTube55ToMP3Converter.exe
2015-02-25 06:26 - 2015-02-25 16:30 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-02-20 22:16 - 2015-02-25 20:35 - 00000000 ____D () C:\Users\Andi\Desktop\Neuer Ordner
2015-02-20 22:11 - 2015-02-20 22:12 - 00027914 _____ () C:\Users\Andi\Desktop\Addition.txt
2015-02-20 22:10 - 2015-02-25 20:38 - 00018084 _____ () C:\Users\Andi\Desktop\FRST.txt
2015-02-20 22:09 - 2015-02-25 20:37 - 00000000 ____D () C:\FRST
2015-02-20 22:08 - 2015-02-20 22:08 - 02086912 _____ (Farbar) C:\Users\Andi\Desktop\FRST64(1).exe
2015-02-20 21:56 - 2015-02-20 21:56 - 00026027 _____ () C:\Users\Andi\Desktop\junkjnk.txt
2015-02-20 21:54 - 2015-02-20 21:54 - 00004065 _____ () C:\Users\Andi\Desktop\ghgj.txt
2015-02-20 21:54 - 2015-02-20 21:54 - 00000336 _____ () C:\Users\Andi\Desktop\jj.txt
2015-02-17 20:11 - 2015-02-17 20:11 - 00243664 _____ () C:\Users\Andi\Downloads\Firefox Setup Stub 35.0.1.exe
2015-02-17 14:03 - 2015-02-17 17:04 - 00001957 _____ () C:\Users\Public\Desktop\Google  Chrome.lnk
2015-02-15 21:48 - 2015-02-15 21:48 - 00001284 _____ () C:\Users\Andi\Desktop\Revo Uninstaller.lnk
2015-02-15 21:44 - 2015-02-15 21:48 - 00000000 ____D () C:\ProgramData\rJDRDPLhi
2015-02-15 21:43 - 2015-02-15 21:45 - 00000000 ____D () C:\Program Files (x86)\Cinemax Plus 1.9cV15.02
2015-02-15 21:43 - 2015-02-15 21:43 - 00000000 ____D () C:\Program Files (x86)\4bf237b8-803c-4cad-8ece-2db7514c4a71
2015-02-15 21:42 - 2015-02-15 21:42 - 00000000 ____D () C:\ProgramData\{8841397d-393c-30ac-8841-1397d393e5f4}
2015-02-15 21:36 - 2015-02-15 21:49 - 00000000 ___HD () C:\Users\Public\Temp
2015-02-15 21:35 - 2015-02-17 17:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-02-15 21:34 - 2015-02-15 21:58 - 00000000 ____D () C:\Program Files (x86)\PlusBrowSRAps2.5
2015-02-15 21:34 - 2015-02-15 21:35 - 00000000 ____D () C:\Program Files (x86)\MedPlayV3.1
2015-02-15 21:34 - 2015-02-15 21:34 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_webTinst_01009.Wdf
2015-02-15 21:33 - 2015-02-25 20:38 - 00000910 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-02-15 21:33 - 2015-02-25 20:36 - 00000906 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-02-15 21:33 - 2015-02-15 21:36 - 00000000 ____D () C:\Users\Andi\AppData\Local\Google
2015-02-15 21:33 - 2015-02-15 21:35 - 00000000 ____D () C:\Program Files (x86)\Google
2015-02-15 21:33 - 2015-02-15 21:33 - 00003882 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-02-15 21:33 - 2015-02-15 21:33 - 00003646 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-02-15 21:32 - 2015-02-15 21:32 - 00695760 _____ () C:\Users\Andi\Downloads\ChromeSetup.exe
2015-02-15 21:18 - 2015-02-15 21:18 - 00001520 _____ () C:\Users\Andi\Desktop\JRT.txt
2015-02-15 21:18 - 2015-02-15 21:18 - 00000000 ____D () C:\Program Files\McAfee
2015-02-15 21:10 - 2015-02-15 21:11 - 01388274 _____ (Thisisu) C:\Users\Andi\Downloads\JRT.exe
2015-02-15 21:05 - 2015-02-15 21:48 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2015-02-15 21:05 - 2015-02-15 21:05 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Andi\Desktop\revosetup95.exe
2015-02-15 20:52 - 2015-02-15 21:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
2015-02-15 16:50 - 2015-02-15 16:50 - 00022512 _____ () C:\Windows\system32\Drivers\SPPD.sys
2015-02-15 10:46 - 2015-02-15 10:46 - 02134528 _____ (Farbar) C:\Users\Andi\Downloads\FRST64.exe
2015-02-14 20:40 - 2015-02-14 20:40 - 00000000 ____D () C:\Users\Andi\AppData\Roaming\WinRAR
2015-02-14 20:40 - 2008-05-11 00:01 - 701775872 _____ () C:\Users\Andi\Desktop\lidl-winxp7in1.iso
2015-02-14 20:39 - 2015-02-15 21:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2015-02-14 20:39 - 2015-02-14 20:39 - 02059896 _____ () C:\Users\Andi\Downloads\winrar-x64-520d.exe
2015-02-14 20:39 - 2015-02-14 20:39 - 00000000 ____D () C:\Program Files\WinRAR
2015-02-13 23:57 - 2015-02-25 20:35 - 00000000 ____D () C:\AdwCleaner
2015-02-13 23:56 - 2015-02-13 23:57 - 02112512 _____ () C:\Users\Andi\Desktop\AdwCleaner_4.110.exe
2015-02-13 23:31 - 2015-02-13 23:31 - 00000000 ____D () C:\Users\Andi\Downloads\David Cross_ HITS_
2015-02-13 23:25 - 2015-02-13 23:25 - 00000000 _____ () C:\autoexec.bat
2015-02-13 23:24 - 2015-02-13 23:24 - 00003320 _____ () C:\Windows\System32\Tasks\SpyHunter4Startup
2015-02-13 23:24 - 2015-02-13 23:24 - 00000000 ____D () C:\sh4ldr
2015-02-13 23:23 - 2015-02-15 21:20 - 00000000 ____D () C:\Program Files\Enigma Software Group
2015-02-13 23:23 - 2015-02-13 23:23 - 00022704 _____ () C:\Windows\system32\Drivers\EsgScanner.sys
2015-02-13 23:22 - 2015-02-13 23:22 - 03044736 _____ (Enigma Software Group USA, LLC.) C:\Users\Andi\Downloads\SpyHunter-Installer.exe
2015-02-12 14:12 - 2015-01-23 05:41 - 06041600 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-02-12 14:12 - 2015-01-23 04:17 - 04300800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-02-12 00:15 - 2015-02-15 10:48 - 00000000 ____D () C:\Users\Andi\Downloads\backups
2015-02-12 00:14 - 2015-02-15 10:41 - 00012415 _____ () C:\Users\Andi\Downloads\hijackthis.log
2015-02-12 00:13 - 2015-02-12 00:13 - 00388608 _____ (Trend Micro Inc.) C:\Users\Andi\Downloads\HijackThis.exe
2015-02-12 00:07 - 2015-02-14 13:52 - 00000000 ____D () C:\Users\Andi\Downloads\Microsoft.Windows.XP.7in1.German.inkl.SP3-Lidl
2015-02-12 00:06 - 2015-02-12 00:06 - 00000000 ____D () C:\Users\Andi\Downloads\Sour Soul Bundle
2015-02-12 00:05 - 2015-02-12 00:05 - 00000899 _____ () C:\Users\Andi\Desktop\µTorrent.lnk
2015-02-12 00:05 - 2015-02-12 00:05 - 00000879 _____ () C:\Users\Andi\AppData\Roaming\Microsoft\Windows\Start Menu\µTorrent.lnk
2015-02-12 00:04 - 2015-02-15 10:46 - 00000000 ____D () C:\Users\Andi\AppData\Roaming\uTorrent
2015-02-12 00:04 - 2015-02-12 00:04 - 01740880 _____ (BitTorrent Inc.) C:\Users\Andi\Downloads\uTorrent.exe
2015-02-11 23:59 - 2015-02-11 23:59 - 00000000 ____D () C:\Users\Andi\AppData\Roaming\DesktopIconGoodgame
2015-02-11 23:27 - 2015-02-11 23:47 - 32358400 _____ () C:\Users\Andi\Downloads\XP.Home.Edition.OEM.SP3.GER-RHB.rar.part
2015-02-11 19:57 - 2015-02-11 19:57 - 00000000 ____D () C:\ProgramData\Canneverbe Limited
2015-02-11 19:56 - 2015-02-11 19:56 - 00001171 _____ () C:\Users\Public\Desktop\CDBurnerXP.lnk
2015-02-11 19:56 - 2015-02-11 19:56 - 00001121 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk
2015-02-11 19:56 - 2015-02-11 19:56 - 00000000 ____D () C:\Users\Andi\AppData\Roaming\Canneverbe Limited
2015-02-11 19:56 - 2015-02-11 19:56 - 00000000 ____D () C:\Program Files (x86)\CDBurnerXP
2015-02-11 19:55 - 2015-02-11 19:55 - 05409016 _____ (Canneverbe Limited ) C:\Users\Andi\Downloads\cdbxp_setup_4.5.4.5306_minimal(1).exe
2015-02-11 19:54 - 2015-02-11 19:55 - 05409016 _____ (Canneverbe Limited ) C:\Users\Andi\Downloads\cdbxp_setup_4.5.4.5306_minimal.exe
2015-02-11 19:43 - 2015-02-11 20:13 - 666894336 _____ () C:\Users\Andi\Downloads\xp_deutsch_32.iso
2015-02-11 01:05 - 2015-01-15 23:43 - 00563504 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-02-11 01:05 - 2015-01-15 23:43 - 00177984 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-02-11 01:05 - 2015-01-14 05:22 - 00445440 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-02-11 01:05 - 2015-01-14 04:53 - 00324096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2015-02-11 01:05 - 2015-01-10 10:10 - 07472960 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-02-11 01:05 - 2015-01-10 08:00 - 00430080 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-02-11 01:05 - 2015-01-10 07:38 - 00359424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-02-11 01:05 - 2014-12-19 09:57 - 00788680 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2015-02-11 01:05 - 2014-12-19 09:25 - 00602776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2015-02-11 01:05 - 2014-12-09 04:45 - 00393728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll
2015-02-11 01:05 - 2014-12-09 02:56 - 00538624 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll
2015-02-11 01:05 - 2014-12-09 00:12 - 00391526 _____ () C:\Windows\system32\ApnDatabase.xml
2015-02-11 01:05 - 2014-10-29 03:51 - 00154112 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-02-11 01:05 - 2014-10-29 03:50 - 00736768 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-02-11 01:05 - 2014-10-29 03:06 - 00736768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-02-11 01:05 - 2014-10-29 03:06 - 00154112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-02-11 01:05 - 2014-10-29 02:31 - 01441792 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-02-11 01:04 - 2015-02-04 00:38 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-02-11 01:04 - 2015-02-04 00:08 - 00761856 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-02-11 01:04 - 2015-02-04 00:08 - 00414208 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-02-11 01:04 - 2015-02-03 00:11 - 01098752 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-02-11 01:04 - 2015-02-03 00:11 - 00894464 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-02-11 01:04 - 2015-02-03 00:11 - 00609280 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-02-11 01:04 - 2015-01-19 19:42 - 01487976 _____ (Microsoft Corporation) C:\Windows\system32\sppobjs.dll
2015-02-11 01:04 - 2015-01-13 23:11 - 01762840 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-02-11 01:04 - 2015-01-13 23:04 - 01489072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2015-02-11 01:04 - 2015-01-12 04:09 - 25056256 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-02-11 01:04 - 2015-01-12 03:48 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-02-11 01:04 - 2015-01-12 03:48 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-02-11 01:04 - 2015-01-12 03:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-02-11 01:04 - 2015-01-12 03:34 - 00816128 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-02-11 01:04 - 2015-01-12 03:25 - 19740160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-02-11 01:04 - 2015-01-12 03:21 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-02-11 01:04 - 2015-01-12 03:08 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-02-11 01:04 - 2015-01-12 03:07 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-02-11 01:04 - 2015-01-12 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-02-11 01:04 - 2015-01-12 03:02 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-02-11 01:04 - 2015-01-12 02:58 - 01032704 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2015-02-11 01:04 - 2015-01-12 02:55 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-02-11 01:04 - 2015-01-12 02:51 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2015-02-11 01:04 - 2015-01-12 02:48 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-02-11 01:04 - 2015-01-12 02:48 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-02-11 01:04 - 2015-01-12 02:48 - 00374272 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-02-11 01:04 - 2015-01-12 02:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-02-11 01:04 - 2015-01-12 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-02-11 01:04 - 2015-01-12 02:43 - 14401024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-02-11 01:04 - 2015-01-12 02:34 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2015-02-11 01:04 - 2015-01-12 02:30 - 00880128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2015-02-11 01:04 - 2015-01-12 02:27 - 02865152 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll
2015-02-11 01:04 - 2015-01-12 02:27 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-02-11 01:04 - 2015-01-12 02:25 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2015-02-11 01:04 - 2015-01-12 02:23 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-02-11 01:04 - 2015-01-12 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-02-11 01:04 - 2015-01-12 02:23 - 00327168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-02-11 01:04 - 2015-01-12 02:14 - 12829184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-02-11 01:04 - 2015-01-12 02:14 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-02-11 01:04 - 2015-01-12 02:02 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-02-11 01:04 - 2015-01-12 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-02-11 01:04 - 2015-01-12 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-02-11 01:04 - 2015-01-12 01:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-02-11 01:04 - 2015-01-10 10:10 - 01733440 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-02-11 01:04 - 2015-01-10 09:28 - 01498360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-02-11 01:04 - 2015-01-10 09:22 - 04175872 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-02-11 01:04 - 2014-10-29 03:02 - 00285184 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-02-11 01:04 - 2014-10-29 03:02 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-02-11 01:04 - 2014-10-29 02:57 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-02-11 01:04 - 2014-10-29 02:15 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-02-11 01:04 - 2014-10-29 02:15 - 00005632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-02-11 01:04 - 2014-10-29 02:14 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-02-11 01:04 - 2014-10-29 02:13 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-02-11 01:04 - 2014-10-29 02:13 - 00008704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-02-06 12:04 - 2015-02-01 15:46 - 00030720 ____H () C:\Users\Andi\Desktop\~WRL0001.tmp
2015-02-03 14:50 - 2015-02-03 14:50 - 00000000 ____D () C:\ProgramData\coupcoup
2015-02-02 09:00 - 2015-02-25 16:31 - 00000000 ____D () C:\Program Files (x86)\buuYandbrowwSSE
2015-02-02 09:00 - 2015-02-15 21:43 - 00000000 ____D () C:\Program Files (x86)\buyyandbirrowaSe
2015-02-02 09:00 - 2015-02-02 21:34 - 00000000 ____D () C:\Program Files (x86)\Proofread Bot  Grammar and Style Checker
2015-02-02 09:00 - 2015-02-02 21:34 - 00000000 ____D () C:\Program Files (x86)\Free2youe
2015-02-01 16:42 - 2015-02-01 16:42 - 00000000 __SHD () C:\Users\Andi\AppData\Local\EmieBrowserModeList
2015-02-01 11:36 - 2015-02-01 11:36 - 00000000 ____D () C:\Users\Andi\Documents\Benutzerdefinierte Office-Vorlagen
2015-02-01 11:15 - 2015-02-21 01:01 - 00003092 _____ () C:\Windows\System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-1040584371-3716677195-284654461-1001
2015-02-01 11:15 - 2015-02-21 01:01 - 00000000 ___RD () C:\Users\Andi\OneDrive
2015-02-01 11:14 - 2015-02-01 11:14 - 00000000 ____D () C:\ProgramData\Microsoft OneDrive
2015-02-01 11:07 - 2015-02-01 11:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2015-02-01 11:06 - 2015-02-08 11:20 - 00000000 ____D () C:\Program Files\Microsoft Office 15
2015-02-01 11:05 - 2015-02-01 11:05 - 01064632 _____ (Microsoft Corporation) C:\Users\Andi\Downloads\Setup.X86.de-DE_O365HomePremRetail_475a790f-447c-40a6-b22a-bd08a3094428_TX_DB_.exe
2015-02-01 11:05 - 2015-02-01 11:05 - 00000000 ___HD () C:\ProgramData\CanonBJ
2015-02-01 11:05 - 2008-04-21 20:00 - 00279040 _____ (CANON INC.) C:\Windows\system32\CNMLM9C.DLL

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-25 20:38 - 2015-01-14 14:26 - 01581361 _____ () C:\Windows\WindowsUpdate.log
2015-02-25 20:37 - 2015-01-13 22:15 - 00000000 ____D () C:\Users\Andi\Documents\Youcam
2015-02-25 20:36 - 2015-01-16 14:01 - 00008325 _____ () C:\Windows\setupact.log
2015-02-25 20:36 - 2014-08-20 10:06 - 00000000 ____D () C:\Windows\System32\Tasks\Lenovo
2015-02-25 20:36 - 2013-08-22 15:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-02-25 20:35 - 2015-01-17 15:41 - 00087536 _____ () C:\Windows\PFRO.log
2015-02-25 20:35 - 2015-01-13 22:28 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-02-25 20:35 - 2014-08-20 05:56 - 00188404 _____ () C:\Windows\SysWOW64\Gms.log
2015-02-25 20:35 - 2013-08-22 14:25 - 00262144 ___SH () C:\Windows\system32\config\BBI
2015-02-25 20:28 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\sru
2015-02-25 16:39 - 2015-01-13 22:22 - 00003922 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{96030ECB-8FB8-445B-80F5-496E1C075584}
2015-02-25 16:38 - 2015-01-13 22:19 - 00003596 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1040584371-3716677195-284654461-1001
2015-02-25 14:08 - 2014-07-09 12:34 - 00766620 _____ () C:\Windows\system32\perfh007.dat
2015-02-25 14:08 - 2014-07-09 12:34 - 00159902 _____ () C:\Windows\system32\perfc007.dat
2015-02-25 14:08 - 2014-03-18 16:26 - 01780340 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-02-25 07:12 - 2013-08-22 16:20 - 00000000 ____D () C:\Windows\CbsTemp
2015-02-21 22:26 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\AppReadiness
2015-02-20 21:45 - 2015-01-23 20:58 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-02-17 20:13 - 2015-01-13 22:28 - 00001175 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-02-17 20:13 - 2015-01-13 22:28 - 00001163 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-02-17 20:09 - 2015-01-13 22:13 - 00002329 _____ () C:\Users\Andi\Desktop\ALDI Süd Blumen Service.lnk
2015-02-17 20:09 - 2015-01-13 22:13 - 00002281 _____ () C:\Users\Andi\Desktop\ALDI Süd Reisen.lnk
2015-02-17 20:09 - 2015-01-13 22:13 - 00002193 _____ () C:\Users\Andi\Desktop\ALDI Talk.lnk
2015-02-17 20:09 - 2015-01-13 22:13 - 00002153 _____ () C:\Users\Andi\Desktop\ALDI Süd Startseite.lnk
2015-02-17 17:04 - 2015-01-13 22:13 - 00002081 _____ () C:\Users\Default\Desktop\ALDI Süd Blumen Service.lnk
2015-02-17 17:04 - 2015-01-13 22:13 - 00002081 _____ () C:\Users\Default User\Desktop\ALDI Süd Blumen Service.lnk
2015-02-17 17:04 - 2015-01-13 22:13 - 00002057 _____ () C:\Users\Default\Desktop\ALDI Süd Reisen.lnk
2015-02-17 17:04 - 2015-01-13 22:13 - 00002057 _____ () C:\Users\Default User\Desktop\ALDI Süd Reisen.lnk
2015-02-17 17:04 - 2015-01-13 22:13 - 00002013 _____ () C:\Users\Default\Desktop\ALDI Talk.lnk
2015-02-17 17:04 - 2015-01-13 22:13 - 00002013 _____ () C:\Users\Default User\Desktop\ALDI Talk.lnk
2015-02-17 17:04 - 2015-01-13 22:13 - 00001993 _____ () C:\Users\Default\Desktop\ALDI Süd Startseite.lnk
2015-02-17 17:04 - 2015-01-13 22:13 - 00001993 _____ () C:\Users\Default User\Desktop\ALDI Süd Startseite.lnk
2015-02-17 17:04 - 2014-08-20 07:53 - 00001961 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Welcome.lnk
2015-02-17 17:04 - 2014-08-20 07:52 - 00001967 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MEDIONhome.lnk
2015-02-15 21:20 - 2014-04-25 09:12 - 00000000 ____D () C:\ProgramData\McAfee
2015-02-15 21:20 - 2013-08-22 15:44 - 00491720 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-02-15 21:16 - 2013-08-22 16:36 - 00000000 ___HD () C:\Windows\ELAMBKUP
2015-02-15 21:13 - 2014-07-09 12:36 - 00000000 ____D () C:\Program Files\CyberLink
2015-02-15 16:53 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\NDF
2015-02-14 18:51 - 2015-01-15 23:38 - 00000000 ____D () C:\Windows\system32\MRT
2015-02-14 14:12 - 2014-04-24 17:12 - 116773704 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-02-13 23:24 - 2015-01-13 22:13 - 00000000 ____D () C:\Users\Andi
2015-02-12 19:27 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\rescache
2015-02-12 00:24 - 2013-08-22 14:25 - 00262144 ___SH () C:\Windows\system32\config\ELAM
2015-02-12 00:20 - 2015-01-17 15:42 - 00000000 ___SD () C:\Windows\system32\CompatTel
2015-02-12 00:20 - 2015-01-17 15:42 - 00000000 ____D () C:\Windows\system32\appraiser
2015-02-12 00:13 - 2015-01-13 22:13 - 00000000 ____D () C:\Users\Andi\AppData\Local\VirtualStore
2015-02-03 20:31 - 2015-01-23 20:44 - 00714720 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-02-03 20:31 - 2015-01-23 20:44 - 00106976 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-02-02 16:14 - 2015-01-18 17:55 - 00000000 ____D () C:\Users\Andi\AppData\Local\Adobe

==================== Files in the root of some directories =======

2015-01-25 17:12 - 2015-01-25 17:12 - 0002086 _____ () C:\Users\Andi\AppData\Roaming\KKZ
2015-02-25 16:31 - 2015-02-25 16:31 - 1330128 _____ (RadioCanyonv2V25.02) C:\Users\Andi\AppData\Roaming\KKZ.exe
2015-01-25 17:12 - 2015-01-25 17:12 - 0001248 _____ () C:\Users\Andi\AppData\Roaming\MPNIT
2015-02-25 16:31 - 2015-02-25 16:31 - 1959376 _____ (RadioCanyonv2V25.02) C:\Users\Andi\AppData\Roaming\MPNIT.exe
2015-01-13 23:24 - 2015-01-14 13:24 - 0000064 _____ () C:\Users\Andi\AppData\Roaming\WB.CFG
2014-08-20 07:39 - 2014-08-20 07:39 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2014-07-09 12:41 - 2014-07-09 12:42 - 0000104 _____ () C:\ProgramData\{01FB4998-33C4-4431-85ED-079E3EEFE75D}.log
2014-07-09 12:42 - 2014-07-09 12:42 - 0000119 _____ () C:\ProgramData\{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}.log
2014-07-09 12:38 - 2014-07-09 12:39 - 0000106 _____ () C:\ProgramData\{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}.log
2014-07-09 12:41 - 2014-07-09 12:41 - 0000111 _____ () C:\ProgramData\{44510C84-AE2A-4079-A75B-D44E68D73B9A}.log
2014-07-09 12:40 - 2014-07-09 12:40 - 0000032 _____ () C:\ProgramData\{551F492A-01B0-4DC4-866F-875EC4EDC0A8}.log
2014-07-09 12:37 - 2014-07-09 12:37 - 0000107 _____ () C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log
2014-07-09 12:40 - 2014-07-09 12:41 - 0000108 _____ () C:\ProgramData\{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}.log
2014-07-09 12:37 - 2014-07-09 12:38 - 0000110 _____ () C:\ProgramData\{E3739848-5329-48E3-8D28-5BBD6E8BE384}.log
2014-07-09 12:39 - 2014-07-09 12:39 - 0000110 _____ () C:\ProgramData\{E3D04529-6EDB-11D8-A372-0050BAE317E1}.log

Some content of TEMP:
====================
C:\Users\Andi\AppData\Local\Temp\1C35A9D4-C736-5B1C-AD23-E3A07B57F7EF.dll
C:\Users\Andi\AppData\Local\Temp\1C35A9D4-C736-5B1C-AD23-E3A07B57F7EF.exe
C:\Users\Andi\AppData\Local\Temp\93B8ADA9-4755-E096-0175-EC1BBC79044E.exe
C:\Users\Andi\AppData\Local\Temp\AppLauncher.exe
C:\Users\Andi\AppData\Local\Temp\optprosetup.exe
C:\Users\Andi\AppData\Local\Temp\Quarantine.exe
C:\Users\Andi\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-02-18 16:02

==================== End Of Log ============================

--- --- ---

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 18-02-2015 01
Ran by Andi at 2015-02-25 20:39:09
Running from C:\Users\Andi\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

µTorrent (HKU\S-1-5-21-1040584371-3716677195-284654461-1001\...\uTorrent) (Version: 3.4.2.38656 - BitTorrent Inc.)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.296 - Adobe Systems Incorporated)
Ashampoo AppLauncher (Medion) v.1.0.0 (HKLM-x32\...\Ashampoo AppLauncher (Medion)_is1) (Version: 1.0.0 - Ashampoo GmbH & Co. KG)
CCleaner (HKLM\...\CCleaner) (Version: 5.01 - Piriform)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.4.5306 - CDBurnerXP)
CyberLink Home Cinema 10 (HKLM-x32\...\InstallShield_{8F14AA37-5193-4A14-BD5B-BDF9B361AEF7}) (Version: 10.0 - CyberLink Corp.)
CyberLink PowerDirector 11 (Version: 11.0.0.3714 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dolby Digital Plus Advanced Audio (HKLM\...\{B0BFC63F-EA07-419E-960B-3FB2ED5DD0B2}) (Version: 7.6.3.1 - Dolby Laboratories Inc)
ELAN Touchpad 11.10.26.3_X64_WHQL (HKLM\...\Elantech) (Version: 11.10.26.3 - ELAN Microelectronic Corp.)
Fotogalerie (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Free Studio version 6.5.0.219 (HKLM-x32\...\Free Studio_is1) (Version: 6.5.0.219 - DVDVideoSoft Ltd.)
Galerie de photos (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 40.0.2214.111 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Intel(R) Chipset Device Software (x32 Version: 10.0.17 - Intel(R) Corporation) Hidden
Intel(R) Management Engine Components (HKLM\...\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 10.0.25.1048 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3871 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 13.2.0.1016 - Intel Corporation)
Intel(R) Serial IO (HKLM\...\{9FD91C5C-44AE-4D9D-85BE-AE52816B0294}) (Version: 1.1.226.0 - Intel Corporation)
Intel(R) Update Manager (HKLM-x32\...\{84A2B59B-6A7B-4C01-8592-15C9BFE6AC36}) (Version: 2.4.3 - Intel Corporation)
Intel(R) Wireless Bluetooth(R)(patch version 17.1.1431.1) (HKLM\...\{302600C1-6BDF-4FD1-1407-148929CC1385}) (Version: 17.1.1407.0480 - Intel Corporation)
Intel® PROSet/Wireless Software (HKLM-x32\...\{85b9d34f-7397-4e39-8600-07942ef6ca04}) (Version: 17.0.5 - Intel Corporation)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
MedPlayV3.1 (HKLM-x32\...\MedPlayV3.1) (Version: 1.36.01.22 - PlayersMComp)
Microsoft Office 365 - de-de (HKLM\...\O365HomePremRetail - de-de) (Version: 15.0.4675.1003 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-1040584371-3716677195-284654461-1001\...\OneDriveSetup.exe) (Version: 17.3.4713.0209 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 36.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 36.0 (x86 de)) (Version: 36.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 35.0.1 - Mozilla)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4675.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4675.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4675.1003 - Microsoft Corporation) Hidden
PHotkey (HKLM-x32\...\{E50C224A-BBF2-428D-9DCF-DBF9DF85C40E}) (Version: 1.00.0105 - Pegatron Corporation)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9600.39054 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.19.726.2013 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7318 - Realtek Semiconductor Corp.)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
SuperPlusRadio v2.1V25.02 (HKLM-x32\...\SuperPlusRadio v2.1V25.02) (Version: 1.36.01.22 - RadioCanyonv2V25.02) <==== ATTENTION
WEB.DE MailCheck für Mozilla Firefox (HKLM-x32\...\1&1 Mail & Media GmbH Toolbar FF) (Version: 3.0.1.1739 - 1&1 Mail & Media GmbH)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
WinRAR 5.20 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.20.0 - win.rar GmbH)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-1040584371-3716677195-284654461-1001_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Andi\AppData\Local\Microsoft\OneDrive\17.3.4713.0209\amd64\FileSyncApi64.dll (Microsoft Corporation)

==================== Restore Points  =========================

29-01-2015 02:47:19 Windows Update
08-02-2015 13:21:16 Geplanter Prüfpunkt
12-02-2015 19:13:37 Windows Update
15-02-2015 21:06:44 Revo Uninstaller's restore point - CHIP Best Deal
25-02-2015 16:32:31 Uniblue PC Mechanic installation

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 14:25 - 2013-08-22 14:25 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {2890B47C-2D64-4E3F-8FE5-6805C59B21A2} - System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-1040584371-3716677195-284654461-1001 => %localappdata%\Microsoft\OneDrive\OneDrive.exe
Task: {3CFA2605-3644-4A52-A8B4-0D82A76417A0} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473 => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [2014-04-09] ()
Task: {4E205356-4008-4EFE-8857-DDEFF3202725} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473-Logon => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [2014-04-09] ()
Task: {5C9944EA-E447-4204-918D-27A756562761} - System32\Tasks\SpyHunter4Startup => C:\Program Files\Enigma Software Group\SpyHunter\Spyhunter4.exe
Task: {652E6E3A-2BC8-417D-9C8A-4F50D409188E} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2015-02-14] (Microsoft Corporation)
Task: {6DE1B0F0-4A78-4BAD-8E35-0291BF5300D3} - \avaxvyyvyf No Task File <==== ATTENTION
Task: {6E5449D3-7E1E-4C56-9183-D81B2330AD80} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-02-15] (Google Inc.)
Task: {949B7E89-3B24-47FD-95B1-FB45CFA03C82} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-12-12] (Piriform Ltd)
Task: {961C6AB4-CFBF-4FFF-BB96-DD8B6E3FD9FD} - System32\Tasks\MPNIT => C:\Users\Andi\AppData\Roaming\MPNIT.exe [2015-02-25] (RadioCanyonv2V25.02) <==== ATTENTION
Task: {A1ADADA1-DF9A-41CE-BE00-1D1438BFCA33} - System32\Tasks\PC-Mechanic Subscription => C:\Program Files (x86)\Uniblue\PC-Mechanic\pc-mechanic.exe
Task: {A5C88AD9-278C-4961-BB27-B6F43AC2DD36} - System32\Tasks\KKZ => C:\Users\Andi\AppData\Roaming\KKZ.exe [2015-02-25] (RadioCanyonv2V25.02) <==== ATTENTION
Task: {AFF5A446-7B90-45EA-AB31-1CB6A9B0969E} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2014-11-04] (Microsoft Corporation)
Task: {C46EBA3E-4D7C-4A8D-8617-1026E718B277} - System32\Tasks\DolbySelectorTask => C:\Program Files\Dolby Digital Plus\ddp.exe [2014-04-07] (Dolby Laboratories Inc.)
Task: {D96A0A33-467A-463B-852F-EE1D38E67226} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2015-02-01] (Microsoft Corporation)
Task: {F23CFA49-C485-4565-B000-F85A7E5797C4} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-02-15] (Google Inc.)
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\KKZ.job => C:\Users\Andi\AppData\Roaming\KKZ.exe <==== ATTENTION
Task: C:\Windows\Tasks\MPNIT.job => C:\Users\Andi\AppData\Roaming\MPNIT.exe <==== ATTENTION
Task: C:\Windows\Tasks\PC-Mechanic Subscription.job => C:\Program Files (x86)\Uniblue\PC-Mechanic\pc-mechanic.exe

==================== Loaded Modules (whitelisted) ==============

2014-08-20 10:05 - 2014-03-04 16:58 - 00136192 _____ () C:\Program Files (x86)\PHotkey\PGFNEXSrv.exe
2014-04-07 16:13 - 2014-04-07 16:13 - 00052096 _____ () C:\Program Files\Dolby Digital Plus\Dolby.DDP.Controls_Desktop.dll
2015-02-01 11:06 - 2014-05-20 08:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2014-07-09 12:40 - 2013-03-06 14:42 - 00389896 _____ () C:\Program Files\CyberLink\Shared files\RichVideo64.exe
2014-08-20 10:05 - 2014-07-11 17:15 - 02222592 _____ () C:\Program Files (x86)\PHotkey\PHotkey.exe
2014-08-20 10:05 - 2010-01-12 17:36 - 00117256 _____ () C:\Program Files (x86)\PHotkey\MsgTranAgt.exe
2014-08-20 10:05 - 2010-01-12 17:36 - 00121864 _____ () C:\Program Files (x86)\PHotkey\MsgTranAgt64.exe
2014-08-20 10:05 - 2010-12-17 14:04 - 00449032 _____ () C:\Program Files (x86)\PHotkey\ATouch64.exe
2014-08-20 10:05 - 2014-02-21 17:19 - 08857088 _____ () C:\Program Files (x86)\PHotkey\GPMTray.exe
2014-08-20 10:05 - 2014-07-08 14:39 - 03006464 _____ () C:\Program Files (x86)\PHotkey\KeyboardMonitorTool.exe
2014-08-20 10:05 - 2014-03-18 21:54 - 05644800 _____ () C:\Program Files (x86)\PHotkey\Dolbyosd.exe
2014-12-12 23:24 - 2014-12-12 23:24 - 00047104 _____ () C:\Program Files\CCleaner\lang\lang-1031.dll
2014-08-20 10:05 - 2009-12-18 15:36 - 00973432 _____ () C:\Program Files (x86)\PHotkey\acAuth.dll
2014-08-20 10:05 - 2013-09-17 23:23 - 00108032 _____ () C:\Program Files (x86)\PHotkey\PGFNEX.dll
2014-07-09 12:39 - 2013-08-05 08:49 - 00627672 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMediaLibrary.dll
2013-08-05 15:48 - 2013-08-05 15:48 - 00016856 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvcPS.dll
2014-06-24 16:08 - 2014-06-24 16:08 - 01241560 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""

==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1040584371-3716677195-284654461-1001\Control Panel\Desktop\\Wallpaper -> C:\Windows\web\wallpaper\MEDION\wallpaper.jpg
DNS Servers: 192.168.178.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

HKLM\...\StartupApproved\Run: => "mcpltui_exe"
HKU\S-1-5-21-1040584371-3716677195-284654461-1001\...\StartupApproved\Run: => "Super Optimizer"

==================== Accounts: =============================

Administrator (S-1-5-21-1040584371-3716677195-284654461-500 - Administrator - Disabled)
Andi (S-1-5-21-1040584371-3716677195-284654461-1001 - Administrator - Enabled) => C:\Users\Andi
Gast (S-1-5-21-1040584371-3716677195-284654461-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1040584371-3716677195-284654461-1003 - Limited - Enabled)

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (02/25/2015 05:54:24 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Deister)
Description: Bei der Aktivierung der App „FileManager_cw5n1h2txyewy!Microsoft.Windows.PhotoManager“ ist folgender Fehler aufgetreten: -2147023170. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (02/25/2015 05:54:23 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: PhotosApp.exe, Version: 6.3.9600.17122, Zeitstempel: 0x537192fe
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.3.9600.17630, Zeitstempel: 0x54b0e17a
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000094aa0
ID des fehlerhaften Prozesses: 0x154c
Startzeit der fehlerhaften Anwendung: 0xPhotosApp.exe0
Pfad der fehlerhaften Anwendung: PhotosApp.exe1
Pfad des fehlerhaften Moduls: PhotosApp.exe2
Berichtskennung: PhotosApp.exe3
Vollständiger Name des fehlerhaften Pakets: PhotosApp.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: PhotosApp.exe5

Error: (02/25/2015 05:30:42 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Deister)
Description: Bei der Aktivierung der App „FileManager_cw5n1h2txyewy!Microsoft.Windows.PhotoManager“ ist folgender Fehler aufgetreten: -2147023170. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (02/25/2015 05:30:41 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: PhotosApp.exe, Version: 6.3.9600.17122, Zeitstempel: 0x537192fe
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.3.9600.17630, Zeitstempel: 0x54b0e17a
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000094aa0
ID des fehlerhaften Prozesses: 0x1a88
Startzeit der fehlerhaften Anwendung: 0xPhotosApp.exe0
Pfad der fehlerhaften Anwendung: PhotosApp.exe1
Pfad des fehlerhaften Moduls: PhotosApp.exe2
Berichtskennung: PhotosApp.exe3
Vollständiger Name des fehlerhaften Pakets: PhotosApp.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: PhotosApp.exe5

Error: (02/25/2015 05:24:29 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Deister)
Description: Bei der Aktivierung der App „FileManager_cw5n1h2txyewy!Microsoft.Windows.PhotoManager“ ist folgender Fehler aufgetreten: -2147023170. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (02/25/2015 05:24:28 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: PhotosApp.exe, Version: 6.3.9600.17122, Zeitstempel: 0x537192fe
Name des fehlerhaften Moduls: twinapi.appcore.dll, Version: 6.3.9600.17195, Zeitstempel: 0x53894a69
Ausnahmecode: 0xc000027b
Fehleroffset: 0x00000000000547ac
ID des fehlerhaften Prozesses: 0x1820
Startzeit der fehlerhaften Anwendung: 0xPhotosApp.exe0
Pfad der fehlerhaften Anwendung: PhotosApp.exe1
Pfad des fehlerhaften Moduls: PhotosApp.exe2
Berichtskennung: PhotosApp.exe3
Vollständiger Name des fehlerhaften Pakets: PhotosApp.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: PhotosApp.exe5

Error: (02/25/2015 05:24:24 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Deister)
Description: Bei der Aktivierung der App „FileManager_cw5n1h2txyewy!Microsoft.Windows.PhotoManager“ ist folgender Fehler aufgetreten: -2147023170. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (02/25/2015 05:24:22 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: PhotosApp.exe, Version: 6.3.9600.17122, Zeitstempel: 0x537192fe
Name des fehlerhaften Moduls: twinapi.appcore.dll, Version: 6.3.9600.17195, Zeitstempel: 0x53894a69
Ausnahmecode: 0xc000027b
Fehleroffset: 0x00000000000547ac
ID des fehlerhaften Prozesses: 0x12f4
Startzeit der fehlerhaften Anwendung: 0xPhotosApp.exe0
Pfad der fehlerhaften Anwendung: PhotosApp.exe1
Pfad des fehlerhaften Moduls: PhotosApp.exe2
Berichtskennung: PhotosApp.exe3
Vollständiger Name des fehlerhaften Pakets: PhotosApp.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: PhotosApp.exe5

Error: (02/25/2015 05:23:33 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Deister)
Description: Bei der Aktivierung der App „FileManager_cw5n1h2txyewy!Microsoft.Windows.PhotoManager“ ist folgender Fehler aufgetreten: -2147023170. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (02/25/2015 05:23:32 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: PhotosApp.exe, Version: 6.3.9600.17122, Zeitstempel: 0x537192fe
Name des fehlerhaften Moduls: twinapi.appcore.dll, Version: 6.3.9600.17195, Zeitstempel: 0x53894a69
Ausnahmecode: 0xc000027b
Fehleroffset: 0x00000000000547ac
ID des fehlerhaften Prozesses: 0x1574
Startzeit der fehlerhaften Anwendung: 0xPhotosApp.exe0
Pfad der fehlerhaften Anwendung: PhotosApp.exe1
Pfad des fehlerhaften Moduls: PhotosApp.exe2
Berichtskennung: PhotosApp.exe3
Vollständiger Name des fehlerhaften Pakets: PhotosApp.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: PhotosApp.exe5


System errors:
=============
Error: (02/25/2015 08:36:49 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Super Optimizer erreicht.

Error: (02/25/2015 08:35:35 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT-AUTORITÄT)
Description: Das WLAN-Erweiterungsmodul wurde unerwartet beendet.

Modulpfad: C:\Windows\System32\IWMSSvc.dll

Error: (02/25/2015 08:35:35 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT-AUTORITÄT)
Description: Das WLAN-Erweiterungsmodul wurde unerwartet beendet.

Modulpfad: C:\Windows\System32\IWMSSvc.dll

Error: (02/25/2015 08:35:30 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT-AUTORITÄT)
Description: Das WLAN-Erweiterungsmodul wurde unerwartet beendet.

Modulpfad: C:\Windows\System32\IWMSSvc.dll

Error: (02/25/2015 08:35:22 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (02/25/2015 08:35:22 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Media Player-Netzwerkfreigabedienst" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (02/25/2015 08:35:22 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Intel® Centrino® Wireless Bluetooth® + High Speed Service" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (02/25/2015 08:35:22 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Intel(R) Rapid Storage Technology" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (02/25/2015 08:35:22 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "lhOYKYn" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (02/25/2015 08:35:22 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Intel(R) PROSet/Wireless Zero Configuration Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.


Microsoft Office Sessions:
=========================
Error: (02/25/2015 05:54:24 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Deister)
Description: FileManager_cw5n1h2txyewy!Microsoft.Windows.PhotoManager-2147023170

Error: (02/25/2015 05:54:23 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: PhotosApp.exe6.3.9600.17122537192fentdll.dll6.3.9600.1763054b0e17ac00000050000000000094aa0154c01d0511bb4d09e30C:\Windows\FileManager\PhotosApp.exeC:\Windows\SYSTEM32\ntdll.dllf2a7d349-bd0e-11e4-829b-303a64c67d6fFileManager_6.3.9600.16384_neutral_neutral_cw5n1h2txyewyMicrosoft.Windows.PhotoManager

Error: (02/25/2015 05:30:42 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Deister)
Description: FileManager_cw5n1h2txyewy!Microsoft.Windows.PhotoManager-2147023170

Error: (02/25/2015 05:30:41 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: PhotosApp.exe6.3.9600.17122537192fentdll.dll6.3.9600.1763054b0e17ac00000050000000000094aa01a8801d05117db6a1109C:\Windows\FileManager\PhotosApp.exeC:\Windows\SYSTEM32\ntdll.dlla2fd0a8b-bd0b-11e4-829b-303a64c67d6fFileManager_6.3.9600.16384_neutral_neutral_cw5n1h2txyewyMicrosoft.Windows.PhotoManager

Error: (02/25/2015 05:24:29 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Deister)
Description: FileManager_cw5n1h2txyewy!Microsoft.Windows.PhotoManager-2147023170

Error: (02/25/2015 05:24:28 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: PhotosApp.exe6.3.9600.17122537192fetwinapi.appcore.dll6.3.9600.1719553894a69c000027b00000000000547ac182001d05117865e76ceC:\Windows\FileManager\PhotosApp.exeC:\Windows\System32\twinapi.appcore.dllc4642d05-bd0a-11e4-829b-303a64c67d6fFileManager_6.3.9600.16384_neutral_neutral_cw5n1h2txyewyMicrosoft.Windows.PhotoManager

Error: (02/25/2015 05:24:24 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Deister)
Description: FileManager_cw5n1h2txyewy!Microsoft.Windows.PhotoManager-2147023170

Error: (02/25/2015 05:24:22 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: PhotosApp.exe6.3.9600.17122537192fetwinapi.appcore.dll6.3.9600.1719553894a69c000027b00000000000547ac12f401d051178347e68fC:\Windows\FileManager\PhotosApp.exeC:\Windows\System32\twinapi.appcore.dllc14a24c6-bd0a-11e4-829b-303a64c67d6fFileManager_6.3.9600.16384_neutral_neutral_cw5n1h2txyewyMicrosoft.Windows.PhotoManager

Error: (02/25/2015 05:23:33 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Deister)
Description: FileManager_cw5n1h2txyewy!Microsoft.Windows.PhotoManager-2147023170

Error: (02/25/2015 05:23:32 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: PhotosApp.exe6.3.9600.17122537192fetwinapi.appcore.dll6.3.9600.1719553894a69c000027b00000000000547ac157401d05117651e156fC:\Windows\FileManager\PhotosApp.exeC:\Windows\System32\twinapi.appcore.dlla32554ef-bd0a-11e4-829b-303a64c67d6fFileManager_6.3.9600.16384_neutral_neutral_cw5n1h2txyewyMicrosoft.Windows.PhotoManager


==================== Memory info =========================== 

Processor: Intel(R) Pentium(R) 3558U @ 1.70GHz
Percentage of memory in use: 33%
Total physical RAM: 4013 MB
Available physical RAM: 2662.47 MB
Total Pagefile: 5037 MB
Available Pagefile: 3647.69 MB
Total Virtual: 131072 MB
Available Virtual: 131071.84 MB

==================== Drives ================================

Drive c: (Boot) (Fixed) (Total:404.05 GB) (Free:364.54 GB) NTFS
Drive d: (Recover) (Fixed) (Total:60 GB) (Free:45.13 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: 488DA0F9)

Partition: GPT Partition Type.

==================== End Of Log ============================

cosinus · 26.02.2015, 10:31

Die Funde mit dem adwCleaner auch löschen lassen...

Kampffisch · 26.02.2015, 19:46

Zitat:

Zitat von cosinus

Die Funde mit dem adwCleaner auch löschen lassen...

Habe ich gemacht, problemm immer noch vorhanden?

Vorallem wenn ich NoScript deaktiviere werde ich von popups überflutet.

cosinus · 26.02.2015, 21:29

Im Log steht aber immer nur "gefunden" - hättest du mit adwCleaner gelöscht, stünde da auch "gelöscht"

Kampffisch · 27.02.2015, 21:57

Zitat:

Zitat von cosinus

Im Log steht aber immer nur "gefunden" - hättest du mit adwCleaner gelöscht, stünde da auch "gelöscht"

Ja ich habe die Log sofort nach dem Suchlauf gepostet und habe es danach gelöscht!

cosinus · 27.02.2015, 21:59

Poste doch einfach das richtige Log

Kampffisch · 27.02.2015, 22:12

AdwCleaner Logfile:

Code:

ATTFilter

# AdwCleaner v4.111 - Bericht erstellt 27/02/2015 um 22:01:07
# Aktualisiert 18/02/2015 von Xplode
# Datenbank : 2015-02-18.3 [Server]
# Betriebssystem : Windows 8.1  (x64)
# Benutzername : Andi - DEISTER
# Gestarted von : C:\Users\Andi\Desktop\adwcleaner_4.111.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\coupcoup
Ordner Gelöscht : C:\Program Files (x86)\Free2youe
Ordner Gelöscht : C:\Users\Andi\AppData\Local\ZombieInvasion
Ordner Gelöscht : C:\Users\Andi\AppData\Roaming\Mozilla\Firefox\Profiles\y8szgoz2.default\Extensions\searchengine@gmail.com
Datei Gelöscht : C:\Users\Andi\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\PC-Mechanic.lnk

***** [ Geplante Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [searchengine@gmail.com]
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{9C81D00A-3DAA-48AB-90C7-8252119ABB93}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{1DA17428-323D-48FF-857C-98CFEE48BFD5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WajIntEnhance
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Vosteran.com

***** [ Internetbrowser ] *****

-\\ Internet Explorer v11.0.9600.17416


-\\ Mozilla Firefox v36.0 (x86 de)

[y8szgoz2.default\prefs.js] - Zeile Gelöscht : user_pref("browser.newtab.url", "chrome://unitedtb/content/newtab/newtab-page.xhtml");
[y8szgoz2.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.ab6e4f54065ff48dd97db30cac9b45f807bf54a45a4669e51ccom67913.67913.internaldb.monetization_plugin_bundledUrls.value", "%7B%22dealply_s%22%3A%7B%22urls%22%3A%5B%22ssfiles.com%22%5D%[...]

-\\ Google Chrome v40.0.2214.111


*************************

AdwCleaner[R0].txt - [5894 Bytes] - [13/02/2015 23:57:48]
AdwCleaner[R1].txt - [2005 Bytes] - [14/02/2015 19:10:30]
AdwCleaner[R2].txt - [1680 Bytes] - [14/02/2015 20:30:38]
AdwCleaner[R3].txt - [1120 Bytes] - [14/02/2015 21:03:28]
AdwCleaner[R4].txt - [2393 Bytes] - [15/02/2015 09:54:56]
AdwCleaner[R5].txt - [1282 Bytes] - [15/02/2015 21:26:24]
AdwCleaner[R6].txt - [18808 Bytes] - [15/02/2015 21:53:52]
AdwCleaner[R7].txt - [3213 Bytes] - [17/02/2015 20:13:04]
AdwCleaner[R8].txt - [11186 Bytes] - [25/02/2015 20:32:22]
AdwCleaner[R9].txt - [2952 Bytes] - [27/02/2015 21:59:32]
AdwCleaner[S0].txt - [5721 Bytes] - [14/02/2015 13:48:50]
AdwCleaner[S1].txt - [2084 Bytes] - [14/02/2015 20:27:25]
AdwCleaner[S2].txt - [1777 Bytes] - [14/02/2015 20:33:14]
AdwCleaner[S3].txt - [1344 Bytes] - [15/02/2015 21:29:13]
AdwCleaner[S4].txt - [18001 Bytes] - [15/02/2015 21:58:00]
AdwCleaner[S5].txt - [3310 Bytes] - [17/02/2015 20:51:56]
AdwCleaner[S6].txt - [11213 Bytes] - [25/02/2015 20:35:14]
AdwCleaner[S7].txt - [2892 Bytes] - [27/02/2015 22:01:07]

########## EOF - C:\AdwCleaner\AdwCleaner[S7].txt - [2951  Bytes] ##########

--- --- ---

Und hier der von 25.2 .

Code:

ATTFilter

# AdwCleaner v4.110 - Bericht erstellt 25/02/2015 um 20:35:14
# Aktualisiert 05/02/2015 von Xplode
# Datenbank : 2015-02-05.2 [Lokal]
# Betriebssystem : Windows 8.1  (x64)
# Benutzername : Andi - DEISTER
# Gestarted von : C:\Users\Andi\Desktop\AdwCleaner_4.110.exe
# Option : Löschen

***** [ Dienste ] *****

[#] Dienst Gelöscht : globalUpdate
[#] Dienst Gelöscht : globalUpdatem

***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Uniblue
Ordner Gelöscht : C:\Program Files (x86)\globalUpdate
Ordner Gelöscht : C:\Program Files (x86)\Uniblue
Ordner Gelöscht : C:\Users\Andi\AppData\Local\globalUpdate
Ordner Gelöscht : C:\Users\Andi\AppData\Local\ZombieInvasion
Ordner Gelöscht : C:\Users\Andi\AppData\Roaming\Uniblue
Ordner Gelöscht : C:\Users\Andi\AppData\Roaming\RHEng
Ordner Gelöscht : C:\Users\Andi\AppData\Roaming\Mozilla\Firefox\Profiles\y8szgoz2.default\Extensions\thefoxonlybetter@quicksaver
Datei Gelöscht : C:\Users\Public\Desktop\PC Mechanic.lnk
Datei Gelöscht : C:\Users\Andi\AppData\Roaming\Mozilla\Firefox\Profiles\y8szgoz2.default\searchplugins\webssearches.xml

***** [ Geplante Tasks ] *****

Task Gelöscht : globalUpdateUpdateTaskMachineCore
Task Gelöscht : globalUpdateUpdateTaskMachineUA
Task Gelöscht : PC-Mechanic Startup
Task Gelöscht : PC-Mechanic Maintenance
Task Gelöscht : 9466407f-23e0-4aaf-8a1d-106c65917ab5-1-6
Task Gelöscht : 9466407f-23e0-4aaf-8a1d-106c65917ab5-1-7
Task Gelöscht : 9466407f-23e0-4aaf-8a1d-106c65917ab5-10_user
Task Gelöscht : 9466407f-23e0-4aaf-8a1d-106c65917ab5-4
Task Gelöscht : 9466407f-23e0-4aaf-8a1d-106c65917ab5-5
Task Gelöscht : 9466407f-23e0-4aaf-8a1d-106c65917ab5-5_user
Task Gelöscht : 9466407f-23e0-4aaf-8a1d-106c65917ab5-6
Task Gelöscht : 9466407f-23e0-4aaf-8a1d-106c65917ab5-7

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdate.OneClickCtrl.10
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdate.OneClickProcessLauncherMachine
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdate.OneClickProcessLauncherMachine.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdate.Update3WebControl.4
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoCreateAsync
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoCreateAsync.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreClass
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreClass.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreMachineClass
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreMachineClass.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CredentialDialogMachine
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CredentialDialogMachine.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachine
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachine.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachineFallback
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachineFallback.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassSvc
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassSvc.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.ProcessLauncher
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.ProcessLauncher.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3COMClassService
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3COMClassService.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachine
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachine.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachineFallback
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachineFallback.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebSvc
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebSvc.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@staging.google.com/globalUpdate Update;version=10
Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@staging.google.com/globalUpdate Update;version=4
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{3278F5CF-48F3-4253-A6BB-004CE84AF492}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{577975B8-C40E-43E6-B0DE-4C6B44088B52}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{02A96331-0CA6-40E2-A87D-C224601985EB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3278F5CF-48F3-4253-A6BB-004CE84AF492}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3B5702BA-7F4C-4D1A-B026-1E9A01D43978}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{5645E0E7-FC12-43BF-A6E4-F9751942B298}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{577975B8-C40E-43E6-B0DE-4C6B44088B52}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{5E89ACE9-E16B-499A-87B4-0DBF742404C1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{69F256DF-BA98-45E9-86EA-FC3CFECF9D30}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{6E87FC94-9866-49B9-8E93-5736D6DE3DD7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{7E49F793-B3CD-4BF7-8419-B34B8BD30E61}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{834469E3-CA2B-4F21-A5CA-4F6F4DBCDE87}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{8529FAA3-5BFD-43C1-AB35-B53C4B96C6E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{ADBC39BE-3D20-4333-8D99-E91EB1B62474}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CFC47BB5-5FB5-4AD0-8427-6AA04334A3FC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E06CA7F5-BA34-4FF6-8D24-B1BDC594D91F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E0ADB535-D7B5-4D8B-B15D-578BDD20D76A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F6421EE5-A5BE-4D31-81D5-C16B7BF48E4C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FD8E81D0-F5FE-4CB1-9AEA-1E163D2BAB78}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{5645E0E7-FC12-43BF-A6E4-F9751942B298}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5645E0E7-FC12-43BF-A6E4-F9751942B298}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5E89ACE9-E16B-499A-87B4-0DBF742404C1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\GlobalUpdate
Schlüssel Gelöscht : HKCU\Software\InstalledBrowserExtensions
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Crossrider
Schlüssel Gelöscht : HKLM\SOFTWARE\GlobalUpdate
Schlüssel Gelöscht : HKLM\SOFTWARE\InstalledBrowserExtensions
Schlüssel Gelöscht : HKLM\SOFTWARE\Uniblue
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1F88FC5D-4D46-448A-AF59-7061FFC6ABBF}_is1
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\InstalledBrowserExtensions

***** [ Internetbrowser ] *****

-\\ Internet Explorer v11.0.9600.17416


-\\ Mozilla Firefox v36.0 (x86 de)

[y8szgoz2.default\prefs.js] - Zeile Gelöscht : user_pref("browser.newtab.url", "chrome://unitedtb/content/newtab/newtab-page.xhtml");
[y8szgoz2.default\prefs.js] - Zeile Gelöscht : user_pref("browser.search.defaultenginename", "webssearches");
[y8szgoz2.default\prefs.js] - Zeile Gelöscht : user_pref("browser.search.selectedEngine", "webssearches");
[y8szgoz2.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.aLOLKP26107084HBHOP59134464com71803.71803.internaldb.Resources_meta.value", "%7B%22popup.html%22%3A%7B%22id%22%3A1028460%2C%22ver%22%3A1%2C%22status%22%3A1%2C%22name%22%3A%22popu[...]
[y8szgoz2.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.aLOLKP26107084HBHOP59134464com71803.71803.internaldb.Resources_resource_1028460.value", "%22%3C%21DOCTYPE%20html%3E%5Cr%5Cn%3Chtml%3E%5Cr%5Cn%3Chead%3E%5Cr%5Cn%3C%21--%20This%20m[...]
[y8szgoz2.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.aLOLKP26107084HBHOP59134464com71803.71803.internaldb.monetization_plugin_bundledUrls.value", "%7B%22dealply_s%22%3A%7B%22urls%22%3A%5B%22ssfiles.com%22%5D%7D%2C%22dealply_p%22%3A[...]
[y8szgoz2.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.aNAUPP49116685MVOEOKE10798312com69917.69917.internaldb.monetization_plugin_bundledUrls.value", "%7B%22dealply_s%22%3A%7B%22urls%22%3A%5B%22ssfiles.com%22%5D%7D%2C%22dealply_p%22%[...]
[y8szgoz2.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.ab6e4f54065ff48dd97db30cac9b45f807bf54a45a4669e51ccom67913.67913.internaldb.monetization_plugin_bundledUrls.value", "%7B%22dealply_s%22%3A%7B%22urls%22%3A%5B%22ssfiles.com%22%5D%[...]
[y8szgoz2.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossrider.bic", "14bc15f7ebc7fa69f110d5bac057970f");

-\\ Google Chrome v40.0.2214.111


*************************

AdwCleaner[R0].txt - [5894 Bytes] - [13/02/2015 23:57:48]
AdwCleaner[R1].txt - [2005 Bytes] - [14/02/2015 19:10:30]
AdwCleaner[R2].txt - [1680 Bytes] - [14/02/2015 20:30:38]
AdwCleaner[R3].txt - [1120 Bytes] - [14/02/2015 21:03:28]
AdwCleaner[R4].txt - [2393 Bytes] - [15/02/2015 09:54:56]
AdwCleaner[R5].txt - [1282 Bytes] - [15/02/2015 21:26:24]
AdwCleaner[R6].txt - [18808 Bytes] - [15/02/2015 21:53:52]
AdwCleaner[R7].txt - [3213 Bytes] - [17/02/2015 20:13:04]
AdwCleaner[R8].txt - [11186 Bytes] - [25/02/2015 20:32:22]
AdwCleaner[S0].txt - [5721 Bytes] - [14/02/2015 13:48:50]
AdwCleaner[S1].txt - [2084 Bytes] - [14/02/2015 20:27:25]
AdwCleaner[S2].txt - [1777 Bytes] - [14/02/2015 20:33:14]
AdwCleaner[S3].txt - [1344 Bytes] - [15/02/2015 21:29:13]
AdwCleaner[S4].txt - [18001 Bytes] - [15/02/2015 21:58:00]
AdwCleaner[S5].txt - [3310 Bytes] - [17/02/2015 20:51:56]
AdwCleaner[S6].txt - [11060 Bytes] - [25/02/2015 20:35:14]

########## EOF - C:\AdwCleaner\AdwCleaner[S6].txt - [11120  Bytes] ##########

cosinus · 27.02.2015, 22:13

Zitat:

Bericht erstellt 27/02/2015 um 22:01:07

Heute erstellt und schon wieder oder immer noch Müll drauf?

Kampffisch · 27.02.2015, 22:16

Zitat:

Zitat von cosinus

Heute erstellt und schon wieder oder immer noch Müll drauf?

Ja mir kommt es so vor als ob dieser nie weg war ^^, weiter unten ist der vom 25.2

cosinus · 27.02.2015, 22:22

Also 3x ist Bremer Recht...

Starte mal Windows neu, und daaaan:

Adware/Junkware/Toolbars entfernen

Alte Versionen von adwCleaner und falls vorhanden JRT vorher löschen, danach neu runterladen auf den Desktop!
Virenscanner jetzt vor dem Einsatz dieser Tools bitte komplett deaktivieren!

1. Schritt: adwCleaner

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

2. Schritt: JRT - Junkware Removal Tool

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

3. Schritt: Frisches Log mit FRST

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Kampffisch · 27.02.2015, 22:53

Code:

ATTFilter

# AdwCleaner v4.111 - Bericht erstellt 27/02/2015 um 22:36:39
# Aktualisiert 18/02/2015 von Xplode
# Datenbank : 2015-02-18.3 [Server]
# Betriebssystem : Windows 8.1  (x64)
# Benutzername : Andi - DEISTER
# Gestarted von : C:\Users\Andi\Desktop\adwcleaner_4.111.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\Users\Andi\AppData\Local\ZombieInvasion

***** [ Geplante Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****


***** [ Internetbrowser ] *****

-\\ Internet Explorer v11.0.9600.17416


-\\ Mozilla Firefox v36.0 (x86 de)

[y8szgoz2.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.ab6e4f54065ff48dd97db30cac9b45f807bf54a45a4669e51ccom67913.67913.internaldb.monetization_plugin_bundledUrls.value", "%7B%22dealply_s%22%3A%7B%22urls%22%3A%5B%22ssfiles.com%22%5D%[...]

-\\ Google Chrome v40.0.2214.111


*************************

AdwCleaner[R0].txt - [5894 Bytes] - [13/02/2015 23:57:48]
AdwCleaner[R10].txt - [2175 Bytes] - [27/02/2015 22:03:56]
AdwCleaner[R11].txt - [2235 Bytes] - [27/02/2015 22:34:59]
AdwCleaner[R1].txt - [2005 Bytes] - [14/02/2015 19:10:30]
AdwCleaner[R2].txt - [1680 Bytes] - [14/02/2015 20:30:38]
AdwCleaner[R3].txt - [1120 Bytes] - [14/02/2015 21:03:28]
AdwCleaner[R4].txt - [2393 Bytes] - [15/02/2015 09:54:56]
AdwCleaner[R5].txt - [1282 Bytes] - [15/02/2015 21:26:24]
AdwCleaner[R6].txt - [18808 Bytes] - [15/02/2015 21:53:52]
AdwCleaner[R7].txt - [3213 Bytes] - [17/02/2015 20:13:04]
AdwCleaner[R8].txt - [11186 Bytes] - [25/02/2015 20:32:22]
AdwCleaner[R9].txt - [2952 Bytes] - [27/02/2015 21:59:32]
AdwCleaner[S0].txt - [5721 Bytes] - [14/02/2015 13:48:50]
AdwCleaner[S1].txt - [2084 Bytes] - [14/02/2015 20:27:25]
AdwCleaner[S2].txt - [1777 Bytes] - [14/02/2015 20:33:14]
AdwCleaner[S3].txt - [1344 Bytes] - [15/02/2015 21:29:13]
AdwCleaner[S4].txt - [18001 Bytes] - [15/02/2015 21:58:00]
AdwCleaner[S5].txt - [3310 Bytes] - [17/02/2015 20:51:56]
AdwCleaner[S6].txt - [11213 Bytes] - [25/02/2015 20:35:14]
AdwCleaner[S7].txt - [3031 Bytes] - [27/02/2015 22:01:07]
AdwCleaner[S8].txt - [2165 Bytes] - [27/02/2015 22:36:39]

########## EOF - C:\AdwCleaner\AdwCleaner[S8].txt - [2224  Bytes] ##########

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.2 (02.02.2015:1)
OS: Windows 8.1 x64
Ran by Andi on 27.02.2015 at 22:38:49,74
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 27.02.2015 at 22:41:44,87
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 25-02-2015 01
Ran by Andi (administrator) on DEISTER on 27-02-2015 22:42:14
Running from C:\Users\Andi\Desktop
Loaded Profiles: Andi (Available profiles: Andi)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
() C:\Program Files (x86)\PHotkey\PGFNEXSrv.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Dolby Laboratories Inc.) C:\Program Files\Dolby Digital Plus\ddp.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\ibtsiva.exe
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Time Lapse Solutions) C:\ProgramData\rJDRDPLhi\lhOYKYn.exe
() C:\Program Files (x86)\PHotkey\PHotkey.exe
() C:\Program Files (x86)\PHotkey\MsgTranAgt.exe
() C:\Program Files (x86)\PHotkey\MsgTranAgt64.exe
() C:\Program Files (x86)\PHotkey\Atouch64.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Intel Corporation) C:\Windows\System32\igfxTray.exe
() C:\Program Files (x86)\PHotkey\GPMTray.exe
() C:\Program Files (x86)\PHotkey\KeyboardMonitorTool.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
() C:\Program Files (x86)\PHotkey\MsgTranAgt.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
() C:\Program Files (x86)\PHotkey\MsgTranAgt64.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
() C:\Program Files (x86)\PHotkey\Dolbyosd.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [320360 2014-06-25] (Intel Corporation)
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [3278088 2014-07-01] (ELAN Microelectronics Corp.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13674712 2014-08-15] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1393520 2014-08-15] (Realtek Semiconductor)
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll",TrayApp
HKLM-x32\...\Run: [CLMLServer_For_P2G8] => C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111576 2013-08-05] (CyberLink)
HKLM-x32\...\Run: [CLVirtualDrive] => C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [490760 2013-11-26] (CyberLink Corp.)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [95192 2013-03-11] (CyberLink Corp.)
HKLM-x32\...\Run: [YouCam Service] => C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe [267224 2013-09-18] (CyberLink Corp.)
HKLM\...\Policies\Explorer: [ConfirmFileDelete] 1
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKLM\...\Policies\Explorer: [NoFolderOptions] 0
HKU\S-1-5-21-1040584371-3716677195-284654461-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7394584 2014-12-12] (Piriform Ltd)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
SearchScopes: HKLM -> {DC91FAFB-6CEA-49E5-BB74-9CEE75D09B77} URL = 
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: buyyandbirrowaSe -> {d251ad2b-1095-4530-9785-a87e719e24ac} -> C:\Program Files (x86)\buyyandbirrowaSe\covq6NwOrKB6UE.dll ()
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
StartMenuInternet: IEXPLORE.EXE - iexplore.exe

FireFox:
========
FF ProfilePath: C:\Users\Andi\AppData\Roaming\Mozilla\Firefox\Profiles\y8szgoz2.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_296.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_296.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Extension: MediaPlayersvideos  1.1 - C:\Users\Andi\AppData\Roaming\Mozilla\Firefox\Profiles\y8szgoz2.default\Extensions\b6e4f54065ff48dd97db30ca@c9b45f807bf54a45a4669e51c.com [2015-02-21]
FF Extension: Xmarks - C:\Users\Andi\AppData\Roaming\Mozilla\Firefox\Profiles\y8szgoz2.default\Extensions\foxmarks@kei.com [2015-01-14]
FF Extension: SuperPlusRadio v2.1V25.02 - C:\Users\Andi\AppData\Roaming\Mozilla\Firefox\Profiles\y8szgoz2.default\Extensions\LOLKP26107084@HBHOP59134464.com [2015-02-25]
FF Extension: Browsers+ Apps + - C:\Users\Andi\AppData\Roaming\Mozilla\Firefox\Profiles\y8szgoz2.default\Extensions\NAUPP49116685@MVOEOKE10798312.com [2015-02-21]
FF Extension: youtubeunblockerunblockeryt - C:\Users\Andi\AppData\Roaming\Mozilla\Firefox\Profiles\y8szgoz2.default\Extensions\youtubeunblocker@unblocker.yt [2015-02-19]
FF Extension: buuYandbrowwSSE - C:\Users\Andi\AppData\Roaming\Mozilla\Firefox\Profiles\y8szgoz2.default\Extensions\yuR@D.net [2015-02-02]
FF Extension: c151d79ee61b4a90a8875a46d38fba99 - C:\Users\Andi\AppData\Roaming\Mozilla\Firefox\Profiles\y8szgoz2.default\Extensions\{c151d79e-e61b-4a90-a887-5a46d38fba99} [2015-02-19]
FF Extension: NoScript - C:\Users\Andi\AppData\Roaming\Mozilla\Firefox\Profiles\y8szgoz2.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2015-02-02]
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Users\Andi\AppData\Roaming\Mozilla\Firefox\Profiles\y8szgoz2.default\Extensions\{B64D9B05-48E1-4CEB-BF58-E0643994E900}.xpi [2015-02-25]
FF Extension: Adblock Plus - C:\Users\Andi\AppData\Roaming\Mozilla\Firefox\Profiles\y8szgoz2.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-01-13]
FF Extension: Positive Finds - C:\Users\Andi\AppData\Roaming\Mozilla\Firefox\Profiles\y8szgoz2.default\Extensions\{f47391f8-d25a-4213-814d-d386acf92dcf}.xpi [2015-02-12]
FF Extension: UITBAutoInstaller - C:\Program Files (x86)\Mozilla Firefox\distribution\bundles\{edd7fc99-d65c-4979-85c2-ddeed30c50c7} [2015-02-25]

Chrome: 
=======
CHR HomePage: Default -> hxxp://www.istartsurf.com/?type=hppp&ts=1424032548&from=tugs&uid=HGSTXHTS725050A7E630_RC250ACB0D8S9J0D8S9JX
CHR StartupUrls: Default -> "hxxp://www.istartsurf.com/?type=hppp&ts=1424032548&from=tugs&uid=HGSTXHTS725050A7E630_RC250ACB0D8S9J0D8S9JX"
CHR DefaultSearchKeyword: Default -> istartsurf
CHR DefaultSuggestURL: Default -> 
CHR Profile: C:\Users\Andi\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\Andi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-02-15]
CHR Extension: (Google Docs) - C:\Users\Andi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-15]
CHR Extension: (Google Drive) - C:\Users\Andi\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-02-15]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Andi\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2015-02-15]
CHR Extension: (YouTube) - C:\Users\Andi\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-02-15]
CHR Extension: (Google Search) - C:\Users\Andi\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-02-15]
CHR Extension: (Google Sheets) - C:\Users\Andi\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-02-15]
CHR Extension: (gmimocjjppdelmhpcmpkhekmpoddgima) - C:\Users\Andi\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmimocjjppdelmhpcmpkhekmpoddgima [2015-02-20]
CHR Extension: (lafgkmgbfkfpbhepoolagpahghdhmaop) - C:\Users\Andi\AppData\Local\Google\Chrome\User Data\Default\Extensions\lafgkmgbfkfpbhepoolagpahghdhmaop [2015-02-19]
CHR Extension: (Google Wallet) - C:\Users\Andi\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-02-15]
CHR Extension: (paegkacdgdffjjiepbbdcgkfgnjcdonl) - C:\Users\Andi\AppData\Local\Google\Chrome\User Data\Default\Extensions\paegkacdgdffjjiepbbdcgkfgnjcdonl [2015-02-19]
CHR Extension: (Gmail) - C:\Users\Andi\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-02-15]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2711736 2015-01-13] (Microsoft Corporation)
R2 CyberLink PowerDVD 10 MS Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe [74712 2013-03-11] (CyberLink)
R2 CyberLink PowerDVD 10 MS Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe [316376 2013-03-11] (CyberLink)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [16232 2014-06-25] (Intel Corporation)
R2 iBtSiva; C:\Program Files (x86)\Intel\Bluetooth\ibtsiva.exe [121304 2014-08-07] (Intel Corporation)
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [324568 2014-07-25] (Intel Corporation)
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [887256 2014-05-13] (Intel(R) Corporation)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [131544 2014-06-24] (Intel Corporation)
S3 iumsvc; C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [174368 2014-04-09] ()
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [154584 2014-06-24] (Intel Corporation)
R2 lhOYKYn; C:\ProgramData\rJDRDPLhi\lhOYKYn.exe [2733544 2015-02-15] (Time Lapse Solutions)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [284912 2014-05-29] ()
R2 PGFNEXSrv; C:\Program Files (x86)\PHotkey\PGFNEXSrv.exe [136192 2014-03-04] () [File not signed]
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [389896 2013-03-06] ()
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3816176 2014-05-29] (Intel® Corporation)
S2 cae99edb; "C:\Windows\system32\rundll32.exe" "c:\Program Files (x86)\Super Optimizer\SupOptCrash.dll",ENT

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-03-18] (Microsoft Corporation)
R3 btmaux; C:\Windows\system32\DRIVERS\btmaux.sys [141624 2014-05-13] (Motorola Solutions, Inc.)
R3 btmhsf; C:\Windows\system32\DRIVERS\btmhsf.sys [1424184 2014-06-17] (Motorola Solutions, Inc.)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [91712 2013-03-05] (CyberLink)
S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2015-02-13] ()
R3 ETDSMBus; C:\Windows\system32\DRIVERS\ETDSMBus.sys [23816 2014-07-01] (ELAN Microelectronic Corp.)
R3 iaLPSS_GPIO; C:\Windows\System32\drivers\iaLPSS_GPIO.sys [35832 2014-06-10] (Intel Corporation)
R3 ibtusb; C:\Windows\system32\DRIVERS\ibtusb.sys [220104 2014-08-07] (Intel Corporation)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-02-20] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [125952 2014-06-24] (Intel Corporation)
R3 NETwNb64; C:\Windows\system32\DRIVERS\Netwbw02.sys [3446240 2014-06-18] (Intel Corporation)
S3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew02.sys [4649440 2013-06-18] (Intel Corporation)
R2 PEGAGFN; C:\Program Files (x86)\PHotkey\PEGAGFN.sys [14344 2009-09-11] (PEGATRON)
R3 PegaRadioSwitch; C:\Windows\System32\drivers\PegaRadioSwitch.sys [23552 2013-08-22] (Windows (R) Win 7 DDK provider)
S3 RtlWlanu; C:\Windows\system32\DRIVERS\rtwlanu.sys [2968280 2014-01-15] (Realtek Semiconductor Corporation                           )
R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-27 22:42 - 2015-02-27 22:42 - 02087936 _____ (Farbar) C:\Users\Andi\Desktop\FRST64.exe
2015-02-27 22:42 - 2015-02-27 22:42 - 00000000 ____D () C:\Users\Andi\Desktop\FRST-OlderVersion
2015-02-27 22:41 - 2015-02-27 22:41 - 00000613 _____ () C:\Users\Andi\Desktop\JRT.txt
2015-02-27 21:58 - 2015-02-27 21:58 - 02126848 _____ () C:\Users\Andi\Desktop\adwcleaner_4.111.exe
2015-02-25 20:47 - 2015-02-25 20:47 - 01388274 _____ (Thisisu) C:\Users\Andi\Downloads\JRT(1).exe
2015-02-25 20:30 - 2015-02-25 20:30 - 00045420 _____ () C:\Users\Andi\Desktop\cc_20150225_202958.reg
2015-02-25 17:31 - 2015-02-25 20:31 - 00000004 _____ () C:\Windows\SysWOW64\029B560A371F4E00AB32838EBC01B9E7
2015-02-25 16:47 - 2015-02-25 16:47 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf
2015-02-25 16:33 - 2015-02-27 22:37 - 00000292 _____ () C:\Windows\Tasks\PC-Mechanic Subscription.job
2015-02-25 16:33 - 2015-02-25 16:33 - 00002560 _____ () C:\Windows\System32\Tasks\PC-Mechanic Subscription
2015-02-25 16:33 - 2015-02-25 16:33 - 00001261 _____ () C:\Users\Public\Desktop\DVDVideoSoft Free Studio.lnk
2015-02-25 16:33 - 2015-02-25 16:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
2015-02-25 16:31 - 2015-02-27 22:37 - 00001348 _____ () C:\Windows\Tasks\MPNIT.job
2015-02-25 16:31 - 2015-02-27 22:37 - 00001344 _____ () C:\Windows\Tasks\KKZ.job
2015-02-25 16:31 - 2015-02-25 16:32 - 00000000 ____D () C:\Program Files (x86)\SuperPlusRadio v2.1V25.02
2015-02-25 16:31 - 2015-02-25 16:31 - 01959376 _____ (RadioCanyonv2V25.02) C:\Users\Andi\AppData\Roaming\MPNIT.exe
2015-02-25 16:31 - 2015-02-25 16:31 - 01330128 _____ (RadioCanyonv2V25.02) C:\Users\Andi\AppData\Roaming\KKZ.exe
2015-02-25 16:31 - 2015-02-25 16:31 - 00004350 _____ () C:\Windows\System32\Tasks\MPNIT
2015-02-25 16:31 - 2015-02-25 16:31 - 00004348 _____ () C:\Windows\System32\Tasks\KKZ
2015-02-25 16:31 - 2015-02-25 16:31 - 00000000 ____D () C:\Program Files (x86)\1498dc0a-f4d9-4408-be95-19affbd6d965
2015-02-25 16:30 - 2015-02-25 16:33 - 00000000 ____D () C:\Program Files (x86)\DVDVideoSoft
2015-02-25 16:30 - 2015-02-25 16:30 - 00000000 ____D () C:\Program Files (x86)\WEB.DE MailCheck
2015-02-25 16:30 - 2015-02-25 16:30 - 00000000 ____D () C:\Program Files (x86)\Free Codec Pack
2015-02-25 16:27 - 2015-02-25 16:27 - 03313168 _____ (DVDVideoSoft Ltd. ) C:\Users\Andi\Downloads\FreeYouTube55ToMP3Converter(1).exe
2015-02-25 16:26 - 2015-02-25 16:33 - 00000000 ____D () C:\Users\Andi\AppData\Roaming\DVDVideoSoft
2015-02-25 16:25 - 2015-02-25 16:28 - 03312672 _____ (DVDVideoSoft Ltd. ) C:\Users\Andi\Downloads\FreeYouTube55ToMP3Converter.exe
2015-02-25 07:12 - 2014-12-13 22:28 - 00513488 _____ () C:\Windows\SysWOW64\locale.nls
2015-02-25 07:12 - 2014-12-13 22:28 - 00513488 _____ () C:\Windows\system32\locale.nls
2015-02-25 07:12 - 2014-10-29 02:27 - 01200128 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Globalization.dll
2015-02-25 07:12 - 2014-10-29 02:27 - 00323072 _____ (Microsoft Corporation) C:\Windows\system32\GlobCollationHost.dll
2015-02-25 07:12 - 2014-10-29 02:04 - 00868352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Globalization.dll
2015-02-25 07:12 - 2014-10-29 02:04 - 00200704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\GlobCollationHost.dll
2015-02-25 06:26 - 2015-02-25 16:30 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-02-20 22:16 - 2015-02-27 22:41 - 00000000 ____D () C:\Users\Andi\Desktop\Neuer Ordner
2015-02-20 22:11 - 2015-02-25 20:39 - 00026122 _____ () C:\Users\Andi\Desktop\Addition.txt
2015-02-20 22:10 - 2015-02-27 22:42 - 00017792 _____ () C:\Users\Andi\Desktop\FRST.txt
2015-02-20 22:09 - 2015-02-27 22:42 - 00000000 ____D () C:\FRST
2015-02-20 21:56 - 2015-02-20 21:56 - 00026027 _____ () C:\Users\Andi\Desktop\junkjnk.txt
2015-02-20 21:54 - 2015-02-20 21:54 - 00004065 _____ () C:\Users\Andi\Desktop\ghgj.txt
2015-02-20 21:54 - 2015-02-20 21:54 - 00000336 _____ () C:\Users\Andi\Desktop\jj.txt
2015-02-17 20:11 - 2015-02-17 20:11 - 00243664 _____ () C:\Users\Andi\Downloads\Firefox Setup Stub 35.0.1.exe
2015-02-17 14:03 - 2015-02-17 17:04 - 00001957 _____ () C:\Users\Public\Desktop\Google  Chrome.lnk
2015-02-15 21:48 - 2015-02-15 21:48 - 00001284 _____ () C:\Users\Andi\Desktop\Revo Uninstaller.lnk
2015-02-15 21:44 - 2015-02-15 21:48 - 00000000 ____D () C:\ProgramData\rJDRDPLhi
2015-02-15 21:43 - 2015-02-15 21:45 - 00000000 ____D () C:\Program Files (x86)\Cinemax Plus 1.9cV15.02
2015-02-15 21:43 - 2015-02-15 21:43 - 00000000 ____D () C:\Program Files (x86)\4bf237b8-803c-4cad-8ece-2db7514c4a71
2015-02-15 21:42 - 2015-02-15 21:42 - 00000000 ____D () C:\ProgramData\{8841397d-393c-30ac-8841-1397d393e5f4}
2015-02-15 21:36 - 2015-02-15 21:49 - 00000000 ___HD () C:\Users\Public\Temp
2015-02-15 21:35 - 2015-02-17 17:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-02-15 21:34 - 2015-02-15 21:58 - 00000000 ____D () C:\Program Files (x86)\PlusBrowSRAps2.5
2015-02-15 21:34 - 2015-02-15 21:35 - 00000000 ____D () C:\Program Files (x86)\MedPlayV3.1
2015-02-15 21:34 - 2015-02-15 21:34 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_webTinst_01009.Wdf
2015-02-15 21:33 - 2015-02-27 22:38 - 00000910 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-02-15 21:33 - 2015-02-27 22:37 - 00000906 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-02-15 21:33 - 2015-02-15 21:36 - 00000000 ____D () C:\Users\Andi\AppData\Local\Google
2015-02-15 21:33 - 2015-02-15 21:35 - 00000000 ____D () C:\Program Files (x86)\Google
2015-02-15 21:33 - 2015-02-15 21:33 - 00003882 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-02-15 21:33 - 2015-02-15 21:33 - 00003646 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-02-15 21:32 - 2015-02-15 21:32 - 00695760 _____ () C:\Users\Andi\Downloads\ChromeSetup.exe
2015-02-15 21:18 - 2015-02-15 21:18 - 00000000 ____D () C:\Program Files\McAfee
2015-02-15 21:10 - 2015-02-15 21:11 - 01388274 _____ (Thisisu) C:\Users\Andi\Desktop\JRT.exe
2015-02-15 21:05 - 2015-02-15 21:48 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2015-02-15 21:05 - 2015-02-15 21:05 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Andi\Desktop\revosetup95.exe
2015-02-15 20:52 - 2015-02-15 21:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
2015-02-15 16:50 - 2015-02-15 16:50 - 00022512 _____ () C:\Windows\system32\Drivers\SPPD.sys
2015-02-15 10:46 - 2015-02-15 10:46 - 02134528 _____ (Farbar) C:\Users\Andi\Downloads\FRST64.exe
2015-02-14 20:40 - 2015-02-14 20:40 - 00000000 ____D () C:\Users\Andi\AppData\Roaming\WinRAR
2015-02-14 20:40 - 2008-05-11 00:01 - 701775872 _____ () C:\Users\Andi\Desktop\lidl-winxp7in1.iso
2015-02-14 20:39 - 2015-02-15 21:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2015-02-14 20:39 - 2015-02-14 20:39 - 02059896 _____ () C:\Users\Andi\Downloads\winrar-x64-520d.exe
2015-02-14 20:39 - 2015-02-14 20:39 - 00000000 ____D () C:\Program Files\WinRAR
2015-02-13 23:57 - 2015-02-27 22:36 - 00000000 ____D () C:\AdwCleaner
2015-02-13 23:31 - 2015-02-13 23:31 - 00000000 ____D () C:\Users\Andi\Downloads\David Cross_ HITS_
2015-02-13 23:25 - 2015-02-13 23:25 - 00000000 _____ () C:\autoexec.bat
2015-02-13 23:24 - 2015-02-13 23:24 - 00003320 _____ () C:\Windows\System32\Tasks\SpyHunter4Startup
2015-02-13 23:24 - 2015-02-13 23:24 - 00000000 ____D () C:\sh4ldr
2015-02-13 23:23 - 2015-02-15 21:20 - 00000000 ____D () C:\Program Files\Enigma Software Group
2015-02-13 23:23 - 2015-02-13 23:23 - 00022704 _____ () C:\Windows\system32\Drivers\EsgScanner.sys
2015-02-13 23:22 - 2015-02-13 23:22 - 03044736 _____ (Enigma Software Group USA, LLC.) C:\Users\Andi\Downloads\SpyHunter-Installer.exe
2015-02-12 14:12 - 2015-01-23 05:41 - 06041600 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-02-12 14:12 - 2015-01-23 04:17 - 04300800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-02-12 00:15 - 2015-02-15 10:48 - 00000000 ____D () C:\Users\Andi\Downloads\backups
2015-02-12 00:14 - 2015-02-15 10:41 - 00012415 _____ () C:\Users\Andi\Downloads\hijackthis.log
2015-02-12 00:13 - 2015-02-12 00:13 - 00388608 _____ (Trend Micro Inc.) C:\Users\Andi\Downloads\HijackThis.exe
2015-02-12 00:07 - 2015-02-14 13:52 - 00000000 ____D () C:\Users\Andi\Downloads\Microsoft.Windows.XP.7in1.German.inkl.SP3-Lidl
2015-02-12 00:06 - 2015-02-12 00:06 - 00000000 ____D () C:\Users\Andi\Downloads\Sour Soul Bundle
2015-02-12 00:05 - 2015-02-12 00:05 - 00000899 _____ () C:\Users\Andi\Desktop\µTorrent.lnk
2015-02-12 00:05 - 2015-02-12 00:05 - 00000879 _____ () C:\Users\Andi\AppData\Roaming\Microsoft\Windows\Start Menu\µTorrent.lnk
2015-02-12 00:04 - 2015-02-15 10:46 - 00000000 ____D () C:\Users\Andi\AppData\Roaming\uTorrent
2015-02-12 00:04 - 2015-02-12 00:04 - 01740880 _____ (BitTorrent Inc.) C:\Users\Andi\Downloads\uTorrent.exe
2015-02-11 23:59 - 2015-02-11 23:59 - 00000000 ____D () C:\Users\Andi\AppData\Roaming\DesktopIconGoodgame
2015-02-11 23:27 - 2015-02-11 23:47 - 32358400 _____ () C:\Users\Andi\Downloads\XP.Home.Edition.OEM.SP3.GER-RHB.rar.part
2015-02-11 19:57 - 2015-02-11 19:57 - 00000000 ____D () C:\ProgramData\Canneverbe Limited
2015-02-11 19:56 - 2015-02-11 19:56 - 00001171 _____ () C:\Users\Public\Desktop\CDBurnerXP.lnk
2015-02-11 19:56 - 2015-02-11 19:56 - 00001121 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk
2015-02-11 19:56 - 2015-02-11 19:56 - 00000000 ____D () C:\Users\Andi\AppData\Roaming\Canneverbe Limited
2015-02-11 19:56 - 2015-02-11 19:56 - 00000000 ____D () C:\Program Files (x86)\CDBurnerXP
2015-02-11 19:55 - 2015-02-11 19:55 - 05409016 _____ (Canneverbe Limited ) C:\Users\Andi\Downloads\cdbxp_setup_4.5.4.5306_minimal(1).exe
2015-02-11 19:54 - 2015-02-11 19:55 - 05409016 _____ (Canneverbe Limited ) C:\Users\Andi\Downloads\cdbxp_setup_4.5.4.5306_minimal.exe
2015-02-11 19:43 - 2015-02-11 20:13 - 666894336 _____ () C:\Users\Andi\Downloads\xp_deutsch_32.iso
2015-02-11 01:05 - 2015-01-15 23:43 - 00563504 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-02-11 01:05 - 2015-01-15 23:43 - 00177984 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-02-11 01:05 - 2015-01-14 05:22 - 00445440 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-02-11 01:05 - 2015-01-14 04:53 - 00324096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2015-02-11 01:05 - 2015-01-10 10:10 - 07472960 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-02-11 01:05 - 2015-01-10 08:00 - 00430080 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-02-11 01:05 - 2015-01-10 07:38 - 00359424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-02-11 01:05 - 2014-12-19 09:57 - 00788680 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2015-02-11 01:05 - 2014-12-19 09:25 - 00602776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2015-02-11 01:05 - 2014-12-09 04:45 - 00393728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll
2015-02-11 01:05 - 2014-12-09 02:56 - 00538624 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll
2015-02-11 01:05 - 2014-12-09 00:12 - 00391526 _____ () C:\Windows\system32\ApnDatabase.xml
2015-02-11 01:05 - 2014-10-29 03:51 - 00154112 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-02-11 01:05 - 2014-10-29 03:50 - 00736768 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-02-11 01:05 - 2014-10-29 03:06 - 00736768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-02-11 01:05 - 2014-10-29 03:06 - 00154112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-02-11 01:05 - 2014-10-29 02:31 - 01441792 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-02-11 01:04 - 2015-02-04 00:38 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-02-11 01:04 - 2015-02-04 00:08 - 00761856 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-02-11 01:04 - 2015-02-04 00:08 - 00414208 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-02-11 01:04 - 2015-02-03 00:11 - 01098752 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-02-11 01:04 - 2015-02-03 00:11 - 00894464 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-02-11 01:04 - 2015-02-03 00:11 - 00609280 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-02-11 01:04 - 2015-01-19 19:42 - 01487976 _____ (Microsoft Corporation) C:\Windows\system32\sppobjs.dll
2015-02-11 01:04 - 2015-01-13 23:11 - 01762840 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-02-11 01:04 - 2015-01-13 23:04 - 01489072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2015-02-11 01:04 - 2015-01-12 04:09 - 25056256 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-02-11 01:04 - 2015-01-12 03:48 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-02-11 01:04 - 2015-01-12 03:48 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-02-11 01:04 - 2015-01-12 03:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-02-11 01:04 - 2015-01-12 03:34 - 00816128 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-02-11 01:04 - 2015-01-12 03:25 - 19740160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-02-11 01:04 - 2015-01-12 03:21 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-02-11 01:04 - 2015-01-12 03:08 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-02-11 01:04 - 2015-01-12 03:07 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-02-11 01:04 - 2015-01-12 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-02-11 01:04 - 2015-01-12 03:02 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-02-11 01:04 - 2015-01-12 02:58 - 01032704 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2015-02-11 01:04 - 2015-01-12 02:55 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-02-11 01:04 - 2015-01-12 02:51 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2015-02-11 01:04 - 2015-01-12 02:48 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-02-11 01:04 - 2015-01-12 02:48 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-02-11 01:04 - 2015-01-12 02:48 - 00374272 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-02-11 01:04 - 2015-01-12 02:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-02-11 01:04 - 2015-01-12 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-02-11 01:04 - 2015-01-12 02:43 - 14401024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-02-11 01:04 - 2015-01-12 02:34 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2015-02-11 01:04 - 2015-01-12 02:30 - 00880128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2015-02-11 01:04 - 2015-01-12 02:27 - 02865152 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll
2015-02-11 01:04 - 2015-01-12 02:27 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-02-11 01:04 - 2015-01-12 02:25 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2015-02-11 01:04 - 2015-01-12 02:23 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-02-11 01:04 - 2015-01-12 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-02-11 01:04 - 2015-01-12 02:23 - 00327168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-02-11 01:04 - 2015-01-12 02:14 - 12829184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-02-11 01:04 - 2015-01-12 02:14 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-02-11 01:04 - 2015-01-12 02:02 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-02-11 01:04 - 2015-01-12 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-02-11 01:04 - 2015-01-12 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-02-11 01:04 - 2015-01-12 01:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-02-11 01:04 - 2015-01-10 10:10 - 01733440 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-02-11 01:04 - 2015-01-10 09:28 - 01498360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-02-11 01:04 - 2015-01-10 09:22 - 04175872 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-02-11 01:04 - 2014-10-29 03:02 - 00285184 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-02-11 01:04 - 2014-10-29 03:02 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-02-11 01:04 - 2014-10-29 02:57 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-02-11 01:04 - 2014-10-29 02:15 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-02-11 01:04 - 2014-10-29 02:15 - 00005632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-02-11 01:04 - 2014-10-29 02:14 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-02-11 01:04 - 2014-10-29 02:13 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-02-11 01:04 - 2014-10-29 02:13 - 00008704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-02-06 12:04 - 2015-02-01 15:46 - 00030720 ____H () C:\Users\Andi\Desktop\~WRL0001.tmp
2015-02-02 09:00 - 2015-02-25 16:31 - 00000000 ____D () C:\Program Files (x86)\buuYandbrowwSSE
2015-02-02 09:00 - 2015-02-15 21:43 - 00000000 ____D () C:\Program Files (x86)\buyyandbirrowaSe
2015-02-02 09:00 - 2015-02-02 21:34 - 00000000 ____D () C:\Program Files (x86)\Proofread Bot  Grammar and Style Checker
2015-02-01 16:42 - 2015-02-01 16:42 - 00000000 __SHD () C:\Users\Andi\AppData\Local\EmieBrowserModeList
2015-02-01 11:36 - 2015-02-01 11:36 - 00000000 ____D () C:\Users\Andi\Documents\Benutzerdefinierte Office-Vorlagen
2015-02-01 11:15 - 2015-02-21 01:01 - 00003092 _____ () C:\Windows\System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-1040584371-3716677195-284654461-1001
2015-02-01 11:15 - 2015-02-21 01:01 - 00000000 ___RD () C:\Users\Andi\OneDrive
2015-02-01 11:14 - 2015-02-01 11:14 - 00000000 ____D () C:\ProgramData\Microsoft OneDrive
2015-02-01 11:07 - 2015-02-01 11:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2015-02-01 11:06 - 2015-02-25 20:58 - 00000000 ____D () C:\Program Files\Microsoft Office 15
2015-02-01 11:05 - 2015-02-01 11:05 - 01064632 _____ (Microsoft Corporation) C:\Users\Andi\Downloads\Setup.X86.de-DE_O365HomePremRetail_475a790f-447c-40a6-b22a-bd08a3094428_TX_DB_.exe
2015-02-01 11:05 - 2015-02-01 11:05 - 00000000 ___HD () C:\ProgramData\CanonBJ
2015-02-01 11:05 - 2008-04-21 20:00 - 00279040 _____ (CANON INC.) C:\Windows\system32\CNMLM9C.DLL

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-27 22:39 - 2014-08-20 05:56 - 00006468 _____ () C:\Windows\SysWOW64\Gms.log
2015-02-27 22:38 - 2015-01-14 14:26 - 01100671 _____ () C:\Windows\WindowsUpdate.log
2015-02-27 22:38 - 2015-01-13 22:15 - 00000000 ____D () C:\Users\Andi\Documents\Youcam
2015-02-27 22:37 - 2015-01-16 14:01 - 00008673 _____ () C:\Windows\setupact.log
2015-02-27 22:37 - 2014-08-20 10:06 - 00000000 ____D () C:\Windows\System32\Tasks\Lenovo
2015-02-27 22:37 - 2013-08-22 15:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-02-27 22:36 - 2013-08-22 14:25 - 00262144 ___SH () C:\Windows\system32\config\BBI
2015-02-27 22:14 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\sru
2015-02-27 22:08 - 2015-01-13 22:19 - 00003596 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1040584371-3716677195-284654461-1001
2015-02-27 22:02 - 2015-01-17 15:41 - 00087942 _____ () C:\Windows\PFRO.log
2015-02-27 18:30 - 2015-01-13 22:22 - 00003922 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{96030ECB-8FB8-445B-80F5-496E1C075584}
2015-02-27 17:23 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\AppReadiness
2015-02-27 17:15 - 2014-07-09 12:34 - 00766620 _____ () C:\Windows\system32\perfh007.dat
2015-02-27 17:15 - 2014-07-09 12:34 - 00159902 _____ () C:\Windows\system32\perfc007.dat
2015-02-27 17:15 - 2014-03-18 16:26 - 01780340 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-02-27 07:31 - 2013-08-22 16:20 - 00000000 ____D () C:\Windows\CbsTemp
2015-02-25 20:35 - 2015-01-13 22:28 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-02-20 21:45 - 2015-01-23 20:58 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-02-17 20:13 - 2015-01-13 22:28 - 00001175 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-02-17 20:13 - 2015-01-13 22:28 - 00001163 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-02-17 20:09 - 2015-01-13 22:13 - 00002329 _____ () C:\Users\Andi\Desktop\ALDI Süd Blumen Service.lnk
2015-02-17 20:09 - 2015-01-13 22:13 - 00002281 _____ () C:\Users\Andi\Desktop\ALDI Süd Reisen.lnk
2015-02-17 20:09 - 2015-01-13 22:13 - 00002193 _____ () C:\Users\Andi\Desktop\ALDI Talk.lnk
2015-02-17 20:09 - 2015-01-13 22:13 - 00002153 _____ () C:\Users\Andi\Desktop\ALDI Süd Startseite.lnk
2015-02-17 17:04 - 2015-01-13 22:13 - 00002081 _____ () C:\Users\Default\Desktop\ALDI Süd Blumen Service.lnk
2015-02-17 17:04 - 2015-01-13 22:13 - 00002081 _____ () C:\Users\Default User\Desktop\ALDI Süd Blumen Service.lnk
2015-02-17 17:04 - 2015-01-13 22:13 - 00002057 _____ () C:\Users\Default\Desktop\ALDI Süd Reisen.lnk
2015-02-17 17:04 - 2015-01-13 22:13 - 00002057 _____ () C:\Users\Default User\Desktop\ALDI Süd Reisen.lnk
2015-02-17 17:04 - 2015-01-13 22:13 - 00002013 _____ () C:\Users\Default\Desktop\ALDI Talk.lnk
2015-02-17 17:04 - 2015-01-13 22:13 - 00002013 _____ () C:\Users\Default User\Desktop\ALDI Talk.lnk
2015-02-17 17:04 - 2015-01-13 22:13 - 00001993 _____ () C:\Users\Default\Desktop\ALDI Süd Startseite.lnk
2015-02-17 17:04 - 2015-01-13 22:13 - 00001993 _____ () C:\Users\Default User\Desktop\ALDI Süd Startseite.lnk
2015-02-17 17:04 - 2014-08-20 07:53 - 00001961 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Welcome.lnk
2015-02-17 17:04 - 2014-08-20 07:52 - 00001967 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MEDIONhome.lnk
2015-02-15 21:20 - 2014-04-25 09:12 - 00000000 ____D () C:\ProgramData\McAfee
2015-02-15 21:20 - 2013-08-22 15:44 - 00491720 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-02-15 21:16 - 2013-08-22 16:36 - 00000000 ___HD () C:\Windows\ELAMBKUP
2015-02-15 21:13 - 2014-07-09 12:36 - 00000000 ____D () C:\Program Files\CyberLink
2015-02-15 16:53 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\NDF
2015-02-14 18:51 - 2015-01-15 23:38 - 00000000 ____D () C:\Windows\system32\MRT
2015-02-14 14:12 - 2014-04-24 17:12 - 116773704 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-02-13 23:24 - 2015-01-13 22:13 - 00000000 ____D () C:\Users\Andi
2015-02-12 19:27 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\rescache
2015-02-12 00:24 - 2013-08-22 14:25 - 00262144 ___SH () C:\Windows\system32\config\ELAM
2015-02-12 00:20 - 2015-01-17 15:42 - 00000000 ___SD () C:\Windows\system32\CompatTel
2015-02-12 00:20 - 2015-01-17 15:42 - 00000000 ____D () C:\Windows\system32\appraiser
2015-02-12 00:13 - 2015-01-13 22:13 - 00000000 ____D () C:\Users\Andi\AppData\Local\VirtualStore
2015-02-03 20:31 - 2015-01-23 20:44 - 00714720 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-02-03 20:31 - 2015-01-23 20:44 - 00106976 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-02-02 16:14 - 2015-01-18 17:55 - 00000000 ____D () C:\Users\Andi\AppData\Local\Adobe

==================== Files in the root of some directories =======

2015-01-25 17:12 - 2015-01-25 17:12 - 0002086 _____ () C:\Users\Andi\AppData\Roaming\KKZ
2015-02-25 16:31 - 2015-02-25 16:31 - 1330128 _____ (RadioCanyonv2V25.02) C:\Users\Andi\AppData\Roaming\KKZ.exe
2015-01-25 17:12 - 2015-01-25 17:12 - 0001248 _____ () C:\Users\Andi\AppData\Roaming\MPNIT
2015-02-25 16:31 - 2015-02-25 16:31 - 1959376 _____ (RadioCanyonv2V25.02) C:\Users\Andi\AppData\Roaming\MPNIT.exe
2015-01-13 23:24 - 2015-01-14 13:24 - 0000064 _____ () C:\Users\Andi\AppData\Roaming\WB.CFG
2014-08-20 07:39 - 2014-08-20 07:39 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2014-07-09 12:41 - 2014-07-09 12:42 - 0000104 _____ () C:\ProgramData\{01FB4998-33C4-4431-85ED-079E3EEFE75D}.log
2014-07-09 12:42 - 2014-07-09 12:42 - 0000119 _____ () C:\ProgramData\{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}.log
2014-07-09 12:38 - 2014-07-09 12:39 - 0000106 _____ () C:\ProgramData\{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}.log
2014-07-09 12:41 - 2014-07-09 12:41 - 0000111 _____ () C:\ProgramData\{44510C84-AE2A-4079-A75B-D44E68D73B9A}.log
2014-07-09 12:40 - 2014-07-09 12:40 - 0000032 _____ () C:\ProgramData\{551F492A-01B0-4DC4-866F-875EC4EDC0A8}.log
2014-07-09 12:37 - 2014-07-09 12:37 - 0000107 _____ () C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log
2014-07-09 12:40 - 2014-07-09 12:41 - 0000108 _____ () C:\ProgramData\{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}.log
2014-07-09 12:37 - 2014-07-09 12:38 - 0000110 _____ () C:\ProgramData\{E3739848-5329-48E3-8D28-5BBD6E8BE384}.log
2014-07-09 12:39 - 2014-07-09 12:39 - 0000110 _____ () C:\ProgramData\{E3D04529-6EDB-11D8-A372-0050BAE317E1}.log

Some content of TEMP:
====================
C:\Users\Andi\AppData\Local\Temp\1C35A9D4-C736-5B1C-AD23-E3A07B57F7EF.dll
C:\Users\Andi\AppData\Local\Temp\1C35A9D4-C736-5B1C-AD23-E3A07B57F7EF.exe
C:\Users\Andi\AppData\Local\Temp\93B8ADA9-4755-E096-0175-EC1BBC79044E.exe
C:\Users\Andi\AppData\Local\Temp\AppLauncher.exe
C:\Users\Andi\AppData\Local\Temp\optprosetup.exe
C:\Users\Andi\AppData\Local\Temp\Quarantine.exe
C:\Users\Andi\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-02-18 16:02

==================== End Of Log ============================

--- --- ---

--- --- ---

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 25-02-2015 01
Ran by Andi at 2015-02-27 22:43:32
Running from C:\Users\Andi\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

µTorrent (HKU\S-1-5-21-1040584371-3716677195-284654461-1001\...\uTorrent) (Version: 3.4.2.38656 - BitTorrent Inc.)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.296 - Adobe Systems Incorporated)
Ashampoo AppLauncher (Medion) v.1.0.0 (HKLM-x32\...\Ashampoo AppLauncher (Medion)_is1) (Version: 1.0.0 - Ashampoo GmbH & Co. KG)
CCleaner (HKLM\...\CCleaner) (Version: 5.01 - Piriform)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.4.5306 - CDBurnerXP)
CyberLink Home Cinema 10 (HKLM-x32\...\InstallShield_{8F14AA37-5193-4A14-BD5B-BDF9B361AEF7}) (Version: 10.0 - CyberLink Corp.)
CyberLink PowerDirector 11 (Version: 11.0.0.3714 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dolby Digital Plus Advanced Audio (HKLM\...\{B0BFC63F-EA07-419E-960B-3FB2ED5DD0B2}) (Version: 7.6.3.1 - Dolby Laboratories Inc)
ELAN Touchpad 11.10.26.3_X64_WHQL (HKLM\...\Elantech) (Version: 11.10.26.3 - ELAN Microelectronic Corp.)
Fotogalerie (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Free Studio version 6.5.0.219 (HKLM-x32\...\Free Studio_is1) (Version: 6.5.0.219 - DVDVideoSoft Ltd.)
Galerie de photos (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 40.0.2214.111 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Intel(R) Chipset Device Software (x32 Version: 10.0.17 - Intel(R) Corporation) Hidden
Intel(R) Management Engine Components (HKLM\...\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 10.0.25.1048 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3871 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 13.2.0.1016 - Intel Corporation)
Intel(R) Serial IO (HKLM\...\{9FD91C5C-44AE-4D9D-85BE-AE52816B0294}) (Version: 1.1.226.0 - Intel Corporation)
Intel(R) Update Manager (HKLM-x32\...\{84A2B59B-6A7B-4C01-8592-15C9BFE6AC36}) (Version: 2.4.3 - Intel Corporation)
Intel(R) Wireless Bluetooth(R)(patch version 17.1.1431.1) (HKLM\...\{302600C1-6BDF-4FD1-1407-148929CC1385}) (Version: 17.1.1407.0480 - Intel Corporation)
Intel® PROSet/Wireless Software (HKLM-x32\...\{85b9d34f-7397-4e39-8600-07942ef6ca04}) (Version: 17.0.5 - Intel Corporation)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
MedPlayV3.1 (HKLM-x32\...\MedPlayV3.1) (Version: 1.36.01.22 - PlayersMComp)
Microsoft Office 365 - de-de (HKLM\...\O365HomePremRetail - de-de) (Version: 15.0.4693.1002 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-1040584371-3716677195-284654461-1001\...\OneDriveSetup.exe) (Version: 17.3.4713.0209 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 36.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 36.0 (x86 de)) (Version: 36.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 35.0.1 - Mozilla)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4693.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4693.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4693.1002 - Microsoft Corporation) Hidden
PHotkey (HKLM-x32\...\{E50C224A-BBF2-428D-9DCF-DBF9DF85C40E}) (Version: 1.00.0105 - Pegatron Corporation)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9600.39054 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.19.726.2013 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7318 - Realtek Semiconductor Corp.)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
SuperPlusRadio v2.1V25.02 (HKLM-x32\...\SuperPlusRadio v2.1V25.02) (Version: 1.36.01.22 - RadioCanyonv2V25.02) <==== ATTENTION
WEB.DE MailCheck für Mozilla Firefox (HKLM-x32\...\1&1 Mail & Media GmbH Toolbar FF) (Version: 3.0.1.1739 - 1&1 Mail & Media GmbH)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
WinRAR 5.20 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.20.0 - win.rar GmbH)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-1040584371-3716677195-284654461-1001_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Andi\AppData\Local\Microsoft\OneDrive\17.3.4713.0209\amd64\FileSyncApi64.dll (Microsoft Corporation)

==================== Restore Points  =========================

29-01-2015 02:47:19 Windows Update
08-02-2015 13:21:16 Geplanter Prüfpunkt
12-02-2015 19:13:37 Windows Update
15-02-2015 21:06:44 Revo Uninstaller's restore point - CHIP Best Deal
25-02-2015 16:32:31 Uniblue PC Mechanic installation

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 14:25 - 2013-08-22 14:25 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {18B4BEBC-7A90-40F2-ADE3-2EA130AFEA4F} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2015-02-14] (Microsoft Corporation)
Task: {2890B47C-2D64-4E3F-8FE5-6805C59B21A2} - System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-1040584371-3716677195-284654461-1001 => %localappdata%\Microsoft\OneDrive\OneDrive.exe
Task: {3CFA2605-3644-4A52-A8B4-0D82A76417A0} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473 => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [2014-04-09] ()
Task: {4E205356-4008-4EFE-8857-DDEFF3202725} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473-Logon => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [2014-04-09] ()
Task: {5BEA9C50-49DB-4831-9D67-69CCE402B4B0} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2014-12-30] (Microsoft Corporation)
Task: {5C9944EA-E447-4204-918D-27A756562761} - System32\Tasks\SpyHunter4Startup => C:\Program Files\Enigma Software Group\SpyHunter\Spyhunter4.exe
Task: {6DE1B0F0-4A78-4BAD-8E35-0291BF5300D3} - \avaxvyyvyf No Task File <==== ATTENTION
Task: {6E5449D3-7E1E-4C56-9183-D81B2330AD80} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-02-15] (Google Inc.)
Task: {8C040AA4-246A-461E-B684-E80AB5F42366} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2014-12-30] (Microsoft Corporation)
Task: {949B7E89-3B24-47FD-95B1-FB45CFA03C82} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-12-12] (Piriform Ltd)
Task: {961C6AB4-CFBF-4FFF-BB96-DD8B6E3FD9FD} - System32\Tasks\MPNIT => C:\Users\Andi\AppData\Roaming\MPNIT.exe [2015-02-25] (RadioCanyonv2V25.02) <==== ATTENTION
Task: {A1ADADA1-DF9A-41CE-BE00-1D1438BFCA33} - System32\Tasks\PC-Mechanic Subscription => C:\Program Files (x86)\Uniblue\PC-Mechanic\pc-mechanic.exe
Task: {A5C88AD9-278C-4961-BB27-B6F43AC2DD36} - System32\Tasks\KKZ => C:\Users\Andi\AppData\Roaming\KKZ.exe [2015-02-25] (RadioCanyonv2V25.02) <==== ATTENTION
Task: {C46EBA3E-4D7C-4A8D-8617-1026E718B277} - System32\Tasks\DolbySelectorTask => C:\Program Files\Dolby Digital Plus\ddp.exe [2014-04-07] (Dolby Laboratories Inc.)
Task: {D96A0A33-467A-463B-852F-EE1D38E67226} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2015-01-14] (Microsoft Corporation)
Task: {F23CFA49-C485-4565-B000-F85A7E5797C4} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-02-15] (Google Inc.)
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\KKZ.job => C:\Users\Andi\AppData\Roaming\KKZ.exe <==== ATTENTION
Task: C:\Windows\Tasks\MPNIT.job => C:\Users\Andi\AppData\Roaming\MPNIT.exe <==== ATTENTION
Task: C:\Windows\Tasks\PC-Mechanic Subscription.job => C:\Program Files (x86)\Uniblue\PC-Mechanic\pc-mechanic.exe

==================== Loaded Modules (whitelisted) ==============

2014-08-20 10:05 - 2014-03-04 16:58 - 00136192 _____ () C:\Program Files (x86)\PHotkey\PGFNEXSrv.exe
2014-04-07 16:13 - 2014-04-07 16:13 - 00052096 _____ () C:\Program Files\Dolby Digital Plus\Dolby.DDP.Controls_Desktop.dll
2015-02-01 11:06 - 2014-05-20 08:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2014-07-09 12:40 - 2013-03-06 14:42 - 00389896 _____ () C:\Program Files\CyberLink\Shared files\RichVideo64.exe
2014-08-20 10:05 - 2014-07-11 17:15 - 02222592 _____ () C:\Program Files (x86)\PHotkey\PHotkey.exe
2014-08-20 10:05 - 2010-01-12 17:36 - 00117256 _____ () C:\Program Files (x86)\PHotkey\MsgTranAgt.exe
2014-08-20 10:05 - 2010-01-12 17:36 - 00121864 _____ () C:\Program Files (x86)\PHotkey\MsgTranAgt64.exe
2014-08-20 10:05 - 2010-12-17 14:04 - 00449032 _____ () C:\Program Files (x86)\PHotkey\ATouch64.exe
2014-08-20 10:05 - 2014-02-21 17:19 - 08857088 _____ () C:\Program Files (x86)\PHotkey\GPMTray.exe
2014-08-20 10:05 - 2014-07-08 14:39 - 03006464 _____ () C:\Program Files (x86)\PHotkey\KeyboardMonitorTool.exe
2014-08-20 10:05 - 2014-03-18 21:54 - 05644800 _____ () C:\Program Files (x86)\PHotkey\Dolbyosd.exe
2014-12-12 23:24 - 2014-12-12 23:24 - 00047104 _____ () C:\Program Files\CCleaner\lang\lang-1031.dll
2014-08-20 10:05 - 2009-12-18 15:36 - 00973432 _____ () C:\Program Files (x86)\PHotkey\acAuth.dll
2014-08-20 10:05 - 2013-09-17 23:23 - 00108032 _____ () C:\Program Files (x86)\PHotkey\PGFNEX.dll
2014-07-09 12:39 - 2013-08-05 08:49 - 00627672 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMediaLibrary.dll
2013-08-05 15:48 - 2013-08-05 15:48 - 00016856 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvcPS.dll
2014-06-24 16:08 - 2014-06-24 16:08 - 01241560 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
2014-04-09 11:29 - 2014-04-09 11:29 - 00174368 _____ () C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe
2014-04-09 11:30 - 2014-04-09 11:30 - 00041248 _____ () C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\win32api.pyd
2014-04-09 11:29 - 2014-04-09 11:29 - 00059680 _____ () C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\pywintypes27.dll
2014-04-09 11:29 - 2014-04-09 11:29 - 00119072 _____ () C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\pythoncom27.dll
2014-04-09 11:29 - 2014-04-09 11:29 - 00562464 _____ () C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\urlmon.dll
2014-04-09 11:29 - 2014-04-09 11:29 - 00401184 _____ () C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iertutil.dll
2014-04-09 11:29 - 2014-04-09 11:29 - 00412448 _____ () C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\WININET.dll
2014-04-09 11:30 - 2014-04-09 11:30 - 00020256 _____ () C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\_multiprocessing.pyd
2014-04-09 11:30 - 2014-04-09 11:30 - 00025376 _____ () C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\win32service.pyd
2014-04-09 11:30 - 2014-04-09 11:30 - 00022816 _____ () C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\servicemanager.pyd
2014-04-09 11:30 - 2014-04-09 11:30 - 00018208 _____ () C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\win32event.pyd
2014-04-09 11:30 - 2014-04-09 11:30 - 00027424 _____ () C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\_socket.pyd
2014-04-09 11:30 - 2014-04-09 11:30 - 00277280 _____ () C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\_ssl.pyd
2014-04-09 11:30 - 2014-04-09 11:30 - 00113952 _____ () C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\_hashlib.pyd
2014-04-09 11:30 - 2014-04-09 11:30 - 00016672 _____ () C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\select.pyd
2014-04-09 11:30 - 2014-04-09 11:30 - 00040736 _____ () C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\_ctypes.pyd
2014-04-09 11:30 - 2014-04-09 11:30 - 00023328 _____ () C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\win32process.pyd
2014-04-09 11:30 - 2014-04-09 11:30 - 00020256 _____ () C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\win32ts.pyd
2014-04-09 11:30 - 2014-04-09 11:30 - 00018720 _____ () C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\win32profile.pyd
2014-04-09 11:30 - 2014-04-09 11:30 - 00042784 _____ () C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\win32security.pyd
2014-04-09 11:30 - 2014-04-09 11:30 - 00336160 _____ () C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\_bsddb.pyd
2014-04-09 11:30 - 2014-04-09 11:30 - 00023328 _____ () C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\win32evtlog.pyd
2014-04-09 11:30 - 2014-04-09 11:30 - 00024864 _____ () C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\win32inet.pyd
2014-04-09 11:29 - 2014-04-09 11:29 - 00021280 _____ () C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\EnvironmentID.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""

==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1040584371-3716677195-284654461-1001\Control Panel\Desktop\\Wallpaper -> C:\Windows\web\wallpaper\MEDION\wallpaper.jpg
DNS Servers: 192.168.178.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

HKLM\...\StartupApproved\Run: => "mcpltui_exe"
HKU\S-1-5-21-1040584371-3716677195-284654461-1001\...\StartupApproved\Run: => "Super Optimizer"

==================== Accounts: =============================

Administrator (S-1-5-21-1040584371-3716677195-284654461-500 - Administrator - Disabled)
Andi (S-1-5-21-1040584371-3716677195-284654461-1001 - Administrator - Enabled) => C:\Users\Andi
Gast (S-1-5-21-1040584371-3716677195-284654461-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1040584371-3716677195-284654461-1003 - Limited - Enabled)

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============
Error: (02/27/2015 10:43:38 PM) (Source: DCOM) (EventID: 10010) (User: Deister)
Description: {9AA46009-3CE0-458A-A354-715610A075E6}

Error: (02/27/2015 10:43:08 PM) (Source: DCOM) (EventID: 10010) (User: Deister)
Description: {9AA46009-3CE0-458A-A354-715610A075E6}


Microsoft Office Sessions:
=========================

==================== Memory info =========================== 

Processor: Intel(R) Pentium(R) 3558U @ 1.70GHz
Percentage of memory in use: 34%
Total physical RAM: 4013 MB
Available physical RAM: 2624.37 MB
Total Pagefile: 5037 MB
Available Pagefile: 3639.8 MB
Total Virtual: 131072 MB
Available Virtual: 131071.84 MB

==================== Drives ================================

Drive c: (Boot) (Fixed) (Total:404.05 GB) (Free:363.6 GB) NTFS
Drive d: (Recover) (Fixed) (Total:60 GB) (Free:45.13 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: 488DA0F9)

Partition: GPT Partition Type.

==================== End Of Log ============================

26.02.2015, 10:31	#6
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Ständig öffnen sich werbeseiten und Popups! Die Funde mit dem adwCleaner auch löschen lassen... __________________ --> Ständig öffnen sich werbeseiten und Popups!

26.02.2015, 21:29	#8
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Ständig öffnen sich werbeseiten und Popups! Im Log steht aber immer nur "gefunden" - hättest du mit adwCleaner gelöscht, stünde da auch "gelöscht" __________________ Logfiles bitte immer in CODE-Tags posten

27.02.2015, 21:59	#10
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Ständig öffnen sich werbeseiten und Popups! Poste doch einfach das richtige Log __________________ Logfiles bitte immer in CODE-Tags posten

Ständig öffnen sich werbeseiten und Popups!

Plagegeister aller Art und deren Bekämpfung: Ständig öffnen sich werbeseiten und Popups!