alles ok bisher... du machst das gut

Schritt 2: JRT.exe konnte nicht heruntergeladen werden und es gehen wieder diese ....Fenster auf und immer noch im Sekundentakt diese Benutzerkontensteuerung.

......:-(

Anmerkung: Beende bitte deine Schutzsoftware. Wie genau gemeint? Im Sinne einer Deaktivierung irgendwo oder einfach "geschlossene Fenster"?
Es ist nichts geöffnet. Außer diese extrem nervige Benutzerkontensteuerung, welche im Sekundentakt aufgeht.

Was ich hier habe, zu Schritt 2: SH4 Execution Guard. Ausführung einer unbekannten Datei. Möchten Sie diese Datei ausführen?

Firma: NirSoft
Beschreibung NirCmd

Ist dass das? Zulassen ja, nein?:-/

Hi,

ich möchte dir ja wirklich gerne helfen. Lies bitte einmal in RUHE die Posts die du mir geschrieben hast und stell dir vor was ich da herauslesen kann. Es fällt mir wirklich schwer deinen Gedankensprüngen zu folgen ...

lass JRT erstmal weg und mache bitte mit den folgendne Schritten weiter

Schritt 1:
Downloade Dir bitte Malwarebytes Anti-Malware

• Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
• Starte Malwarebytes' Anti-Malware (MBAM).
• Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
• Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
• Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
• Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
• Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
• Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Schritt 2:

ESET Online Scanner

• Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
• Lade und starte Eset Online Scanner
• Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
• Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
• Klicke auf Starten.
• Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Klicke am Ende des Suchlaufs auf Fertig stellen.
• Schließe das Fenster von ESET.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.2 (02.02.2015:1)
OS: Windows 8 x64
Ran by Cynthia on 22.02.2015 at 22:20:21,97
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 22.02.2015 at 22:28:01,55
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

ich habe dir bereits weitere Schritte gepostet... bitte führe sie aus.

Teile mir bitte mit, ob sich das Verhalten deines Rechners bessert.

Schritt 1: Malwarebytes Anti-Malware
Malwarebytes | Free Anti-Malware & Internet Security Software

Scan Date: 22.02.2015
Scan Time: 22:36:58
Logfile: mbam.txt
Administrator: Yes

Version: 2.00.4.1028
Malware Database: v2015.02.22.06
Rootkit Database: v2015.02.22.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled

OS: Windows 8
CPU: x64
File System: NTFS
User: Cynthia

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 329576
Time Elapsed: 22 min, 30 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Schritt 2 bin dabei. Ja, ich habe den Eindruck, dass es sich bessert. Seiten zeigen aber immer noch "Chat-Fenster" und Malwarebytes blockiert eine vermeintlich infizierte Seite

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=f8458a4cd90a774f8001348de8682646
# engine=22596
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-02-23 12:25:02
# local_time=2015-02-23 01:25:02 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.2.9200 NT
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 45570672 58497511 0 0
# scanned=221285
# found=6
# cleaned=0
# scan_time=6550
sh=95DEDDFC2396FE6D650550CE226CD5ABBAFD3AF6 ft=0 fh=0000000000000000 vn="HTML/Iframe.B.Gen Virus" ac=I fn="C:\Users\Cynthia\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QMZ53J2K\displayFlash[1].js"
sh=12CE0A52F0939009145C6DEBEC624170365D41A8 ft=0 fh=0000000000000000 vn="HTML/Iframe.B.Gen Virus" ac=I fn="C:\Users\Cynthia\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QMZ53J2K\mobile[1].js"
sh=64661593A52D6046FE2B2E220A15E356EBFBB620 ft=0 fh=0000000000000000 vn="HTML/Iframe.B.Gen Virus" ac=I fn="C:\Users\Cynthia\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SG2ANUVV\analytics[1].js"
sh=64661593A52D6046FE2B2E220A15E356EBFBB620 ft=0 fh=0000000000000000 vn="HTML/Iframe.B.Gen Virus" ac=I fn="C:\Users\Cynthia\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SG2ANUVV\ga[1].js"
sh=64661593A52D6046FE2B2E220A15E356EBFBB620 ft=0 fh=0000000000000000 vn="HTML/Iframe.B.Gen Virus" ac=I fn="C:\Users\Cynthia\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\C67PFJ76\analytics[1].js"
sh=64661593A52D6046FE2B2E220A15E356EBFBB620 ft=0 fh=0000000000000000 vn="HTML/Iframe.B.Gen Virus" ac=I fn="C:\Users\Cynthia\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\TPX5MLR1\ga[1].js"

noch etwas: Spyhunter zeigt mir heute 36 Bedrohungen an. Sollte ich das rauskopieren irgendwie? Hab kein Aktion gewählt.

Wichtig ist dass du in CodeTagd postest...

Ja poste einmal die Spyhunter Funde

Hallo Heiko,

Danke, dass du noch da bist!:-) Ich habe diesen Hashtag im Editor nicht. Bin nicht sicher, ob ich die richtige "Version habe", da ich einige Apps gelöscht hatte

Spyhunter hat 36 Funde gelistet, leider kann ich sie nicht rauskopieren. Bzw. weiß nicht, wie ich das als Datei zum posten bekomme.
Vermutlich nicht hilfreich, aber:

adserver (5 Infektionen)
Adtech (1 Infektion)
Advert (2 Infektionen)
Burst Media (1 Infektion)
Casale Media ( 5 Infektionen)
Media (9 Infektionen)
Serving-sys (9 Infektionen)
Sex (1 Infektion)
Tradedoubler ( 3 Infektionen)

Ok, habe es jetzt kapiert, mit den Codes- Tut mir leid.

lass Spyhunter bitte die Funde löschen...

das geht leider nicht. Da Spyhunter zwar so nett ist und sucht, jedoch die Ergebnisse nur löscht, sofern man die Vollversion kauft. :-/

Gut...

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

C:\Users\Cynthia\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QMZ53J2K\mobile[1].js
C:\Users\Cynthia\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SG2ANUVV\analytics[1].js
C:\Users\Cynthia\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SG2ANUVV\ga[1].js
C:\Users\Cynthia\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\C67PFJ76\analytics[1].js
C:\Users\Cynthia\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\TPX5MLR1\ga[1].js
emptytemp:
         

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

• Starte nun FRST erneut und klicke den Entfernen Button.
• Das Tool erstellt eine Fixlog.txt.
• Poste mir deren Inhalt.

teile mir mit, ob sich das Verhalten deines REchners verbessert...

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 22-02-2015
Ran by Cynthia at 2015-02-23 18:40:35 Run:1
Running from C:\Users\Cynthia\Downloads
Loaded Profiles: Cynthia (Available profiles: Cynthia)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
C:\Users\Cynthia\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QMZ53J2K\mobile[1].js
C:\Users\Cynthia\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SG2ANUVV\analytics[1].js
C:\Users\Cynthia\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SG2ANUVV\ga[1].js
C:\Users\Cynthia\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\C67PFJ76\analytics[1].js
C:\Users\Cynthia\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\TPX5MLR1\ga[1].js
emptytemp:
*****************

C:\Users\Cynthia\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QMZ53J2K\mobile[1].js => Moved successfully.
C:\Users\Cynthia\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SG2ANUVV\analytics[1].js => Moved successfully.
C:\Users\Cynthia\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SG2ANUVV\ga[1].js => Moved successfully.
C:\Users\Cynthia\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\C67PFJ76\analytics[1].js => Moved successfully.
C:\Users\Cynthia\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\TPX5MLR1\ga[1].js => Moved successfully.
EmptyTemp: => Removed 441.4 MB temporary data.


The system needed a reboot.

==== End of Fixlog 18:40:54 ====

Also diese Fenster, welche aufgehen, scheinen im Moment weniger zu sein.

gut dann kommen wir ja voran.

Bitte in Cpodetags posten!

erstelle ein neues FRST Logfile und poste es hier. starte dazu frst und drücke scan

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-02-2015
Ran by Cynthia (administrator) on HANSMEISER on 23-02-2015 18:54:13
Running from C:\Users\Cynthia\Downloads
Loaded Profiles: Cynthia (Available profiles: Cynthia)
Platform: Windows 8 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 10 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Enigma Software Group USA, LLC.) C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe
(Windows (R) Win 7 DDK provider) C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\AdminService.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDService.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Launch Manager\LMSvc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\systemcore\mfefire.exe
(McAfee, Inc.) C:\Program Files\mcafee\msc\McAPExe.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\SiteAdvisor\mcsacore.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\AMCore\mcshield.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\CSP\1.3.336.0\McCSPServiceHost.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Enigma Software Group USA, LLC.) C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter4.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDTouch.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Launch Manager\LMEvent.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Launch Manager\LMTray.exe
(Atheros Communications) C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
() C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\Platform\McUICnt.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerTray.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\SiteAdvisor\saUI.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2890640 2013-04-22] (ELAN Microelectronics Corp.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13550152 2013-05-30] (Realtek Semiconductor)
HKLM\...\Run: [BCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [108144 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [mcpltui_exe] => C:\Program Files\Common Files\mcafee\Platform\McUICnt.exe [643064 2014-09-17] (McAfee, Inc.)
HKLM-x32\...\Run: [mcui_exe] => C:\Program Files\McAfee.com\Agent\mcagent.exe [533872 2014-10-06] (McAfee, Inc.)
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer\Run: [BtvStack] => C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe [133248 2013-05-31] ( (Atheros Communications))

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-1287913836-1958190919-2930970059-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://acer13.msn.com
HKU\S-1-5-21-1287913836-1958190919-2930970059-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer13.msn.com
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-1287913836-1958190919-2930970059-1001 -> {5CC05DBD-1A88-4E23-A2A8-D24690A9CCA3} URL = 
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: McAfee SiteAdvisor BHO -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: McAfee SiteAdvisor BHO -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
Toolbar: HKLM - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
Toolbar: HKLM-x32 - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
Handler-x32: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
Handler-x32: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\mcafee\msc\McSnIePl64.dll (McAfee, Inc.)
Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files (x86)\McAfee\msc\McSnIePl.dll (McAfee, Inc.)
Tcpip\Parameters: [DhcpNameServer] 195.238.181.164 8.8.8.8

FireFox:
========
FF ProfilePath: C:\Users\Cynthia\AppData\Roaming\Mozilla\Firefox\Profiles\6bau22e7.default
FF NetworkProxy: "type", 0
FF Plugin: @mcafee.com/MSC,version=10 -> c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.66 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @mcafee.com/MSC,version=10 -> c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL ()
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Extension: Adblock Plus - C:\Users\Cynthia\AppData\Roaming\Mozilla\Firefox\Profiles\6bau22e7.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-02-22]
FF HKLM-x32\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor
FF Extension: McAfee SiteAdvisor - C:\Program Files (x86)\McAfee\SiteAdvisor [2013-06-04]
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
FF Extension: McAfee Anti-Spam Thunderbird Extension - C:\Program Files\McAfee\MSK [2013-06-04]

Chrome: 
=======
CHR HKLM\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files (x86)\McAfee\SiteAdvisor\McChPlg.crx [2015-02-22]
CHR HKLM-x32\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files (x86)\McAfee\SiteAdvisor\McChPlg.crx [2015-02-22]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AtherosSvc; C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\adminservice.exe [310912 2013-05-31] (Windows (R) Win 7 DDK provider)
S3 DeviceFastLaneService; C:\Program Files\Acer\Acer Device Fast-lane\DeviceFastLaneSvc.exe [470056 2013-04-30] (Acer Incorporated)
R3 ePowerSvc; C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe [662088 2013-03-15] (Acer Incorporated)
R2 ETDService; C:\Program Files\Elantech\ETDService.exe [100752 2013-04-22] (ELAN Microelectronics Corp.)
R2 HomeNetSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [335064 2014-10-31] (McAfee, Inc.)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [732160 2012-12-10] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [803872 2012-12-10] (Intel(R) Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165336 2013-01-14] (Intel Corporation)
R2 LMSvc; C:\Program Files\Acer\Acer Launch Manager\LMSvc.exe [431656 2013-06-17] (Acer Incorporate)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)
R2 McAfee SiteAdvisor Service; C:\Program Files (x86)\McAfee\SiteAdvisor\McSACore.exe [155368 2015-02-12] (McAfee, Inc.)
R2 McAPExe; C:\Program Files\McAfee\MSC\McAPExe.exe [562200 2014-10-06] (McAfee, Inc.)
S3 McAWFwk; c:\Program Files\mcafee\msc\McAWFwk.exe [332080 2012-01-26] (McAfee, Inc.)
R2 mcbootdelaystartsvc; C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe [335064 2014-10-31] (McAfee, Inc.)
R2 mccspsvc; C:\Program Files\Common Files\McAfee\CSP\1.3.336.0\McCSPServiceHost.exe [422632 2014-11-21] (McAfee, Inc.)
R2 McMPFSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [335064 2014-10-31] (McAfee, Inc.)
R2 McNaiAnn; C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe [335064 2014-10-31] (McAfee, Inc.)
S3 McODS; C:\Program Files\mcafee\VirusScan\mcods.exe [601864 2014-12-03] (McAfee, Inc.)
S2 McOobeSv; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [200728 2012-05-11] (McAfee, Inc.)
R2 mcpltsvc; C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe [335064 2014-10-31] (McAfee, Inc.)
R2 McProxy; C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe [335064 2014-10-31] (McAfee, Inc.)
R2 mfecore; C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe [1050952 2014-11-06] (McAfee, Inc.)
R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [221832 2014-10-01] (McAfee, Inc.)
R2 mfevtp; C:\windows\system32\mfevtps.exe [189920 2014-10-01] (McAfee, Inc.)
R2 MSK80Service; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [335064 2014-10-31] (McAfee, Inc.)
S3 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [4230016 2013-01-28] (Symantec Corporation)
R2 SpyHunter 4 Service; C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe [1025920 2015-02-22] (Enigma Software Group USA, LLC.)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [14920 2013-04-21] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [77464 2013-05-30] (Qualcomm Atheros)
S3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)
S3 ccSet_NARA; C:\Windows\system32\drivers\NARAx64\0403000.00E\ccSetx64.sys [168608 2012-05-26] (Symantec Corporation)
R3 cfwids; C:\Windows\System32\drivers\cfwids.sys [72136 2014-10-01] (McAfee, Inc.)
R3 esgiguard; C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [15920 2015-02-22] (Enigma Software Group USA, LLC.)
S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2015-02-22] ()
S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [197704 2013-09-23] (McAfee, Inc.)
R3 LMDriver; C:\Windows\System32\drivers\LMDriver.sys [21360 2013-01-10] (Acer Incorporated)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [129752 2015-02-23] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2014-11-21] (Malwarebytes Corporation)
R3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [181584 2014-10-01] (McAfee, Inc.)
R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [313680 2014-10-01] (McAfee, Inc.)
S0 mfeelamk; C:\Windows\System32\drivers\mfeelamk.sys [70608 2014-10-01] (McAfee, Inc.)
R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [526360 2014-10-01] (McAfee, Inc.)
R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [786304 2014-10-01] (McAfee, Inc.)
R3 mfencbdc; C:\Windows\system32\DRIVERS\mfencbdc.sys [447440 2014-09-19] (McAfee, Inc.)
S3 mfencrk; C:\Windows\system32\DRIVERS\mfencrk.sys [96600 2014-09-19] (McAfee, Inc.)
R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [348560 2014-10-01] (McAfee, Inc.)
R3 RadioShim; C:\Windows\System32\drivers\RadioShim.sys [15704 2013-01-10] (Acer Incorporated)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-23 18:37 - 2015-02-23 18:40 - 00000561 _____ () C:\Users\Cynthia\Downloads\Neues Textdokument.txt
2015-02-23 18:34 - 2015-02-23 18:34 - 00000572 _____ () C:\Users\Cynthia\Desktop\fixlist.txt.txt
2015-02-23 13:06 - 2015-02-23 13:06 - 00000000 ____D () C:\Users\Default\AppData\Local\Microsoft Help
2015-02-23 13:06 - 2015-02-23 13:06 - 00000000 ____D () C:\Users\Default User\AppData\Local\Microsoft Help
2015-02-23 11:49 - 2015-02-23 11:53 - 00000000 ____D () C:\WINDOWS\system32\MRT
2015-02-23 11:49 - 2015-01-29 17:49 - 116773704 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2015-02-22 23:27 - 2015-02-22 23:27 - 02347384 _____ (ESET) C:\Users\Cynthia\Desktop\esetsmartinstaller_deu.exe
2015-02-22 23:14 - 2015-02-22 23:14 - 00001251 _____ () C:\Users\Cynthia\Desktop\mbam.txt
2015-02-22 23:11 - 2015-02-22 23:11 - 00000000 ____D () C:\Users\Cynthia\AppData\Local\clear.fi
2015-02-22 22:35 - 2015-02-23 18:43 - 00129752 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-02-22 22:34 - 2015-02-22 22:34 - 00001070 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-02-22 22:34 - 2015-02-22 22:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-02-22 22:34 - 2015-02-22 22:34 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-02-22 22:34 - 2015-02-22 22:34 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-02-22 22:34 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2015-02-22 22:34 - 2014-11-21 06:14 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2015-02-22 22:34 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2015-02-22 22:28 - 2015-02-22 22:28 - 00000614 _____ () C:\Users\Cynthia\Desktop\JRT.txt
2015-02-22 21:02 - 2015-02-22 21:10 - 00000000 ____D () C:\AdwCleaner
2015-02-22 21:00 - 2015-02-22 21:00 - 02126848 _____ () C:\Users\Cynthia\Desktop\AdwCleaner4.1.exe
2015-02-22 19:27 - 2015-02-22 19:27 - 00019264 _____ () C:\Users\Cynthia\Desktop\Addition.txt
2015-02-22 19:26 - 2015-02-23 18:54 - 00016235 _____ () C:\Users\Cynthia\Downloads\FRST.txt
2015-02-22 19:26 - 2015-02-22 19:27 - 00019264 _____ () C:\Users\Cynthia\Downloads\Addition.txt
2015-02-22 19:25 - 2015-02-23 18:54 - 00000000 ____D () C:\FRST
2015-02-22 18:02 - 2015-02-22 18:02 - 00001469 _____ () C:\Users\Cynthia\Desktop\FRST64 - Verknüpfung.lnk
2015-02-22 18:01 - 2015-02-22 18:02 - 02087424 _____ (Farbar) C:\Users\Cynthia\Downloads\FRST64.exe
2015-02-22 17:54 - 2015-02-22 18:15 - 00000476 _____ () C:\Users\Cynthia\Downloads\defogger_disable.log
2015-02-22 17:54 - 2015-02-22 17:54 - 00000000 _____ () C:\Users\Cynthia\defogger_reenable
2015-02-22 17:50 - 2015-02-22 17:50 - 00050477 _____ () C:\Users\Cynthia\Downloads\Defogger.exe
2015-02-22 17:50 - 2015-02-22 17:50 - 00001082 _____ () C:\Users\Cynthia\Desktop\Defogger - Verknüpfung.lnk
2015-02-22 14:45 - 2015-02-22 14:45 - 00003338 _____ () C:\WINDOWS\System32\Tasks\SpyHunter4Startup
2015-02-22 14:45 - 2015-02-22 14:45 - 00001091 _____ () C:\Users\Cynthia\Desktop\SpyHunter.lnk
2015-02-22 14:45 - 2015-02-22 14:45 - 00000000 ____D () C:\Users\Cynthia\AppData\Roaming\Enigma Software Group
2015-02-22 14:45 - 2015-02-22 14:45 - 00000000 _____ () C:\autoexec.bat
2015-02-22 14:44 - 2015-02-22 14:44 - 00000000 ____D () C:\sh4ldr
2015-02-22 14:40 - 2015-02-22 14:40 - 00022704 _____ () C:\WINDOWS\system32\Drivers\EsgScanner.sys
2015-02-22 14:40 - 2015-02-22 14:40 - 00000000 ____D () C:\Program Files\Enigma Software Group
2015-02-22 14:38 - 2015-02-22 14:39 - 03044736 _____ (Enigma Software Group USA, LLC.) C:\Users\Cynthia\Downloads\SpyHunter-Installer.exe
2015-02-22 14:08 - 2015-02-22 14:08 - 00000000 ____H () C:\WINDOWS\system32\Drivers\Msft_User_WpdFs_01_11_00.Wdf
2015-02-22 13:22 - 2015-02-22 13:22 - 00000000 ____D () C:\Users\Cynthia\Downloads\Eleganza Unterlagen Rohfassung
2015-02-22 13:22 - 2015-02-22 13:22 - 00000000 ____D () C:\Users\Cynthia\Downloads\Download Word Testversion und Fix it
2015-02-22 13:02 - 2014-05-20 03:33 - 00059416 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
2015-02-22 13:02 - 2014-05-20 00:45 - 00629248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll
2015-02-22 13:02 - 2014-05-20 00:45 - 00086528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll
2015-02-22 13:02 - 2014-05-20 00:24 - 03286528 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2015-02-22 13:02 - 2014-05-20 00:24 - 01623040 _____ (Microsoft Corporation) C:\WINDOWS\system32\wucltux.dll
2015-02-22 13:02 - 2014-05-20 00:24 - 00773632 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
2015-02-22 13:02 - 2014-05-20 00:24 - 00253440 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUSettingsProvider.dll
2015-02-22 13:02 - 2014-05-20 00:24 - 00176640 _____ (Microsoft Corporation) C:\WINDOWS\system32\storewuauth.dll
2015-02-22 13:02 - 2014-05-20 00:24 - 00100352 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll
2015-02-22 13:02 - 2014-05-14 23:43 - 00144384 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuwebv.dll
2015-02-22 13:02 - 2014-05-14 23:43 - 00040448 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapp.exe
2015-02-22 13:02 - 2014-05-14 23:42 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuwebv.dll
2015-02-22 13:02 - 2014-05-14 23:42 - 00035328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapp.exe
2015-02-22 13:02 - 2013-08-16 06:21 - 00049664 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups.dll
2015-02-22 13:02 - 2013-08-16 06:21 - 00049152 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups2.dll
2015-02-22 13:02 - 2013-08-15 23:43 - 00020992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wups.dll
2015-02-22 12:53 - 2015-02-22 12:53 - 00000000 ____D () C:\WINDOWS\System32\Tasks\OfficeSoftwareProtectionPlatform
2015-02-22 12:53 - 2015-02-22 12:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SharePoint
2015-02-22 12:53 - 2015-02-22 12:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
2015-02-22 12:52 - 2015-02-22 12:52 - 00000000 ____D () C:\Program Files\Common Files\DESIGNER
2015-02-22 12:51 - 2015-02-22 12:51 - 00000000 ____D () C:\WINDOWS\PCHEALTH
2015-02-22 12:51 - 2015-02-22 12:51 - 00000000 ____D () C:\Program Files\Microsoft Synchronization Services
2015-02-22 12:51 - 2015-02-22 12:51 - 00000000 ____D () C:\Program Files\Microsoft Sync Framework
2015-02-22 12:51 - 2015-02-22 12:51 - 00000000 ____D () C:\Program Files\Microsoft SQL Server Compact Edition
2015-02-22 12:50 - 2015-02-22 12:50 - 00000000 ____D () C:\Program Files\Microsoft Analysis Services
2015-02-22 12:50 - 2015-02-22 12:50 - 00000000 ____D () C:\Program Files (x86)\Microsoft Visual Studio 8
2015-02-22 12:50 - 2015-02-22 12:50 - 00000000 ____D () C:\Program Files (x86)\Microsoft Analysis Services
2015-02-22 12:49 - 2015-02-23 13:08 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-02-22 12:49 - 2015-02-22 12:51 - 00000000 ____D () C:\Program Files\Microsoft Office
2015-02-22 12:49 - 2015-02-22 12:49 - 00000000 __RHD () C:\MSOCache
2015-02-22 12:49 - 2015-02-22 12:49 - 00000000 ____D () C:\Users\Cynthia\AppData\Local\Microsoft Help
2015-02-22 11:55 - 2015-02-22 11:55 - 00000000 _____ () C:\Recovery.txt
2015-02-22 11:29 - 2013-09-23 13:49 - 00197704 _____ (McAfee, Inc.) C:\WINDOWS\system32\Drivers\HipShieldK.sys
2015-02-22 11:17 - 2015-02-22 11:25 - 00000004 _____ () C:\ScrubRetValFile.txt
2015-02-22 10:52 - 2015-02-22 10:52 - 00001127 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-02-22 10:52 - 2015-02-22 10:52 - 00001115 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-02-22 10:52 - 2015-02-22 10:52 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-02-22 10:52 - 2015-02-22 10:52 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-02-22 10:51 - 2015-02-22 10:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
2015-02-22 10:02 - 2015-02-22 10:03 - 00000000 ____D () C:\Users\Cynthia\AppData\Roaming\Mozilla
2015-02-22 10:02 - 2015-02-22 10:03 - 00000000 ____D () C:\Users\Cynthia\AppData\Local\Mozilla
2015-02-22 10:02 - 2015-02-22 10:02 - 00000000 ____D () C:\ProgramData\Mozilla
2015-02-22 09:33 - 2015-02-22 14:00 - 00003600 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1287913836-1958190919-2930970059-1001
2015-02-22 09:30 - 2015-02-22 09:30 - 00000000 ____D () C:\ProgramData\Pokki
2015-02-22 09:27 - 2015-02-22 09:27 - 00001446 _____ () C:\Users\Cynthia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-02-22 09:27 - 2015-02-22 09:27 - 00000000 ____D () C:\WINDOWS\System32\Tasks\WPD
2015-02-22 09:27 - 2015-02-22 09:27 - 00000000 ____D () C:\Users\Cynthia\AppData\Roaming\Macromedia
2015-02-22 09:27 - 2015-02-22 09:27 - 00000000 ____D () C:\Users\Cynthia\AppData\Roaming\Atheros
2015-02-22 09:27 - 2015-02-22 09:27 - 00000000 ____D () C:\Users\Cynthia\AppData\Roaming\Adobe
2015-02-22 09:27 - 2015-02-22 09:27 - 00000000 ____D () C:\ProgramData\OEM_YAHOO
2015-02-22 09:27 - 2015-02-22 09:27 - 00000000 ____D () C:\Program Files\Preload
2015-02-22 09:27 - 2015-02-22 09:27 - 00000000 ____D () C:\Program Files\Accessory Store
2015-02-22 09:26 - 2015-02-22 13:00 - 00000000 ____D () C:\Users\Cynthia\AppData\Local\Packages
2015-02-22 09:26 - 2015-02-22 09:26 - 00000020 ___SH () C:\Users\Cynthia\ntuser.ini
2015-02-22 09:26 - 2015-02-22 09:26 - 00000000 _SHDL () C:\Users\Cynthia\Vorlagen
2015-02-22 09:26 - 2015-02-22 09:26 - 00000000 _SHDL () C:\Users\Cynthia\Startmenü
2015-02-22 09:26 - 2015-02-22 09:26 - 00000000 _SHDL () C:\Users\Cynthia\Netzwerkumgebung
2015-02-22 09:26 - 2015-02-22 09:26 - 00000000 _SHDL () C:\Users\Cynthia\Lokale Einstellungen
2015-02-22 09:26 - 2015-02-22 09:26 - 00000000 _SHDL () C:\Users\Cynthia\Eigene Dateien
2015-02-22 09:26 - 2015-02-22 09:26 - 00000000 _SHDL () C:\Users\Cynthia\Druckumgebung
2015-02-22 09:26 - 2015-02-22 09:26 - 00000000 _SHDL () C:\Users\Cynthia\Documents\Eigene Musik
2015-02-22 09:26 - 2015-02-22 09:26 - 00000000 _SHDL () C:\Users\Cynthia\Documents\Eigene Bilder
2015-02-22 09:26 - 2015-02-22 09:26 - 00000000 _SHDL () C:\Users\Cynthia\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2015-02-22 09:26 - 2015-02-22 09:26 - 00000000 _SHDL () C:\Users\Cynthia\AppData\Local\Verlauf
2015-02-22 09:26 - 2015-02-22 09:26 - 00000000 _SHDL () C:\Users\Cynthia\AppData\Local\Anwendungsdaten
2015-02-22 09:26 - 2015-02-22 09:26 - 00000000 _SHDL () C:\Users\Cynthia\Anwendungsdaten
2015-02-22 09:26 - 2015-02-22 09:26 - 00000000 ____D () C:\Users\Cynthia\AppData\Local\VirtualStore
2015-02-22 09:25 - 2015-02-22 17:54 - 00000000 ____D () C:\Users\Cynthia
2015-02-22 09:25 - 2013-04-21 10:38 - 00000000 ___RD () C:\Users\Cynthia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2015-02-22 09:25 - 2012-07-26 09:13 - 00000000 ___RD () C:\Users\Cynthia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2015-02-22 09:25 - 2012-07-26 09:13 - 00000000 ___RD () C:\Users\Cynthia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2015-02-22 09:25 - 2012-07-26 09:13 - 00000000 ____D () C:\Users\Cynthia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2015-02-22 01:56 - 2015-02-22 01:56 - 00000000 _SHDL () C:\Users\Public\Documents\Eigene Musik
2015-02-22 01:56 - 2015-02-22 01:56 - 00000000 _SHDL () C:\Users\Public\Documents\Eigene Bilder
2015-02-22 01:56 - 2015-02-22 01:56 - 00000000 _SHDL () C:\Users\Default\Vorlagen
2015-02-22 01:56 - 2015-02-22 01:56 - 00000000 _SHDL () C:\Users\Default\Startmenü
2015-02-22 01:56 - 2015-02-22 01:56 - 00000000 _SHDL () C:\Users\Default\Netzwerkumgebung
2015-02-22 01:56 - 2015-02-22 01:56 - 00000000 _SHDL () C:\Users\Default\Lokale Einstellungen
2015-02-22 01:56 - 2015-02-22 01:56 - 00000000 _SHDL () C:\Users\Default\Eigene Dateien
2015-02-22 01:56 - 2015-02-22 01:56 - 00000000 _SHDL () C:\Users\Default\Druckumgebung
2015-02-22 01:56 - 2015-02-22 01:56 - 00000000 _SHDL () C:\Users\Default\Documents\Eigene Musik
2015-02-22 01:56 - 2015-02-22 01:56 - 00000000 _SHDL () C:\Users\Default\Documents\Eigene Bilder
2015-02-22 01:56 - 2015-02-22 01:56 - 00000000 _SHDL () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2015-02-22 01:56 - 2015-02-22 01:56 - 00000000 _SHDL () C:\Users\Default\AppData\Local\Verlauf
2015-02-22 01:56 - 2015-02-22 01:56 - 00000000 _SHDL () C:\Users\Default\AppData\Local\Anwendungsdaten
2015-02-22 01:56 - 2015-02-22 01:56 - 00000000 _SHDL () C:\Users\Default\Anwendungsdaten
2015-02-22 01:56 - 2015-02-22 01:56 - 00000000 _SHDL () C:\Users\Default User\Documents\Eigene Musik
2015-02-22 01:56 - 2015-02-22 01:56 - 00000000 _SHDL () C:\Users\Default User\Documents\Eigene Bilder
2015-02-22 01:56 - 2015-02-22 01:56 - 00000000 _SHDL () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2015-02-22 01:56 - 2015-02-22 01:56 - 00000000 _SHDL () C:\Users\Default User\AppData\Local\Verlauf
2015-02-22 01:56 - 2015-02-22 01:56 - 00000000 _SHDL () C:\Users\Default User\AppData\Local\Anwendungsdaten
2015-02-22 01:56 - 2015-02-22 01:56 - 00000000 _SHDL () C:\Programme
2015-02-22 01:56 - 2015-02-22 01:56 - 00000000 _SHDL () C:\ProgramData\Vorlagen
2015-02-22 01:56 - 2015-02-22 01:56 - 00000000 _SHDL () C:\ProgramData\Startmenü
2015-02-22 01:56 - 2015-02-22 01:56 - 00000000 _SHDL () C:\ProgramData\Microsoft\Windows\Start Menu\Programme
2015-02-22 01:56 - 2015-02-22 01:56 - 00000000 _SHDL () C:\ProgramData\Dokumente
2015-02-22 01:56 - 2015-02-22 01:56 - 00000000 _SHDL () C:\ProgramData\Anwendungsdaten
2015-02-22 01:56 - 2015-02-22 01:56 - 00000000 _SHDL () C:\Program Files\Gemeinsame Dateien
2015-02-22 01:56 - 2015-02-22 01:56 - 00000000 _SHDL () C:\Dokumente und Einstellungen

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-23 18:00 - 2012-07-26 09:12 - 00000000 ____D () C:\WINDOWS\system32\sru
2015-02-23 17:37 - 2013-09-13 05:12 - 01377511 _____ () C:\WINDOWS\WindowsUpdate.log
2015-02-23 14:07 - 2012-07-26 08:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
2015-02-23 13:06 - 2012-07-26 09:12 - 00000000 ____D () C:\Program Files\Common Files\System
2015-02-23 13:06 - 2012-07-26 06:26 - 00000199 _____ () C:\WINDOWS\win.ini
2015-02-23 11:49 - 2012-07-26 06:26 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM
2015-02-23 11:43 - 2012-07-26 09:12 - 00000000 ____D () C:\WINDOWS\rescache
2015-02-23 09:27 - 2013-09-13 14:54 - 00753134 _____ () C:\WINDOWS\system32\perfh007.dat
2015-02-23 09:27 - 2013-09-13 14:54 - 00155826 _____ () C:\WINDOWS\system32\perfc007.dat
2015-02-23 09:27 - 2012-07-26 08:28 - 01745416 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2015-02-23 09:24 - 2012-07-26 08:21 - 00026027 _____ () C:\WINDOWS\setupact.log
2015-02-23 09:20 - 2012-07-26 08:22 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2015-02-23 09:19 - 2013-06-04 04:59 - 00014694 _____ () C:\WINDOWS\PFRO.log
2015-02-22 18:51 - 2013-06-04 05:28 - 00000000 ____D () C:\Program Files (x86)\McAfee
2015-02-22 15:15 - 2012-07-26 09:12 - 00000000 ____D () C:\WINDOWS\AUInstallAgent
2015-02-22 14:28 - 2013-06-04 05:28 - 00000000 ____D () C:\ProgramData\McAfee
2015-02-22 12:58 - 2013-09-13 05:56 - 00421792 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2015-02-22 12:58 - 2012-07-26 06:26 - 00262144 ___SH () C:\WINDOWS\system32\config\BBI
2015-02-22 12:52 - 2012-07-26 09:12 - 00000000 ____D () C:\Program Files\Common Files\microsoft shared
2015-02-22 12:51 - 2013-06-04 05:10 - 00000000 ____D () C:\Program Files (x86)\MSBuild
2015-02-22 12:50 - 2012-07-26 08:52 - 00000000 ____D () C:\WINDOWS\ShellNew
2015-02-22 12:49 - 2013-09-13 06:08 - 00000000 ____D () C:\Program Files (x86)\Microsoft Office
2015-02-22 11:55 - 2012-07-26 09:13 - 00262144 _____ () C:\WINDOWS\system32\config\BCD-Template
2015-02-22 11:28 - 2013-06-04 05:28 - 00000000 ____D () C:\Program Files\Common Files\mcafee
2015-02-22 11:28 - 2012-07-26 09:12 - 00000000 ___HD () C:\WINDOWS\ELAMBKUP
2015-02-22 10:51 - 2013-06-04 05:30 - 00001848 _____ () C:\Users\Public\Desktop\McAfee Internet Security Suite.lnk
2015-02-22 09:51 - 2013-06-04 05:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acer
2015-02-22 09:51 - 2013-06-04 05:31 - 00000000 ____D () C:\ProgramData\Acer
2015-02-22 09:51 - 2013-06-04 05:31 - 00000000 ____D () C:\Program Files (x86)\Acer
2015-02-22 09:48 - 2012-07-26 09:12 - 00000000 ____D () C:\WINDOWS\system32\restore
2015-02-22 09:39 - 2013-06-04 05:26 - 00000000 ____D () C:\Program Files (x86)\WildTangent Games
2015-02-22 09:36 - 2013-06-04 05:26 - 00000000 ____D () C:\ProgramData\WildTangent
2015-02-22 09:28 - 2013-06-04 05:50 - 00000000 ___HD () C:\OEM
2015-02-22 09:27 - 2013-09-13 06:09 - 00003550 _____ () C:\WINDOWS\System32\Tasks\Norton Online Backup ARA
2015-02-22 09:27 - 2013-09-13 06:08 - 00000000 ____D () C:\ProgramData\Norton
2015-02-22 09:26 - 2012-07-26 09:12 - 00000000 ___RD () C:\WINDOWS\ImmersiveControlPanel
2015-02-22 09:26 - 2012-07-26 09:12 - 00000000 ____D () C:\WINDOWS\WinStore
2015-02-22 01:56 - 2012-07-26 09:12 - 00000000 ____D () C:\Program Files\Windows NT
2015-02-22 01:56 - 2012-07-26 06:37 - 00000000 __RHD () C:\Users\Default

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2013-06-04 04:59

==================== End Of Log ============================
         

--- --- ---


Entschuldige, war nicht vollständig kopiert. Dieser hier, ist vollständig.

das Logfile ist unvollständig