Malwarebytes findet mehrere Tage nacheinander immer um die 200 Bedrohungen und einiges laeuft auf meinem Laptop schief

Mareike1984 · 06.03.2015, 16:25

Liebes Trojaner-Board-Team,

ich habe seit laengerer Zeit vor drei Tagen endlich mal wieder Malwarebytes ueber mein System drueber laufen lassen, da ich mir GIMP runterladen wollte und mein System seither irgendwie spinnt. So haben sich einige Programme heruntergeladen, die ich gar nicht haben wollte und dieses kann ich auch nicht entfernen. Und staendig poppt etwas auf, wenn ich im Internet bin. Drei Tage nacheinander hat Malwarebytes nun immer wieder um die 200 Bedrohungen entdeckt und ich hoffe, ihr koennt mir dabei helfen.

Ich dachte eigentlich, dass mir Sophos Protection ja eigentlich helfen muesste. Aber irgendwie scheine ich einiges auf meinem Rechner zu haben, das meinem Computer schadet.

Viele Gruesse und danke euch
Mareike

schrauber · 06.03.2015, 16:48

hi,

Logfile von MBAM?

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Mareike1984 · 06.03.2015, 17:00

Was meinst du denn mit Logfile von MBAM?

Hier die FRST files.

VG
Mareike

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 04-03-2015 01
Ran by Mika at 2015-03-06 16:56:21
Running from C:\Users\Mika\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Sophos Anti-Virus (Enabled - Up to date) {6BABF8F7-3EB6-BD1D-9167-8C5ECA060A29}
AS: Sophos Anti-Virus (Enabled - Up to date) {D0CA1913-188C-B293-ABD7-B72CB1814094}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 4.65 (HKLM-x32\...\7-Zip) (Version:  - )
Acrobat X Suite (HKLM-x32\...\{3F41BA46-09C3-4500-96D7-DC4390AD0124}) (Version: 1.0 - Adobe Systems Incorporated)
Adobe Acrobat XI Pro (HKLM-x32\...\{AC76BA86-1033-FFFF-7760-000000000006}) (Version: 11.0.10 - Adobe Systems)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 1.5.3.9130 - Adobe Systems Inc.)
Adobe Captivate Quiz Results Analyzer (HKLM-x32\...\QuizResultsAnalyzer.E7BED6E5DDA59983786DD72EBFA46B1598278E07.1) (Version: 1.0 - Adobe Systems Incorporated)
Adobe Captivate Reviewer (HKLM-x32\...\AdobeCaptivateReviewer2.E7BED6E5DDA59983786DD72EBFA46B1598278E07.1) (Version: 2.0 - Adobe Systems Incorporated)
Adobe Community Help (HKLM-x32\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 3.0.0.400 - Adobe Systems Incorporated)
Adobe Media Player (HKLM-x32\...\com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 1.8 - Adobe Systems Incorporated)
Amazon 1Button App (HKLM-x32\...\{0A7D6F3C-F2AB-48ED-BE23-99791BFF87D6}) (Version: 1.0.0.4 - Amazon)
Apple Application Support (32-bit) (HKLM-x32\...\{447CDCE5-F555-429B-BFA6-642C3C6D684F}) (Version: 3.1.2 - Apple Inc.)
Apple Application Support (64-bit) (HKLM\...\{0DF7096B-715A-4233-8633-C7A16ED6D616}) (Version: 3.1.2 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{C4123106-B685-48E6-B9BD-E4F911841EB4}) (Version: 8.1.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
CyberLink Media Suite Essentials (HKLM-x32\...\InstallShield_{8F14AA37-5193-4A14-BD5B-BDF9B361AEF7}) (Version: 10.0 - CyberLink Corp.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dell Backup and Recovery (HKLM-x32\...\{0ED7EE95-6A97-47AA-AD73-152C08A15B04}) (Version: 1.7.5.63 - Dell Inc.)
Dell Custom Help (Version: 16.05.1000.0264 - Intel Corporation) Hidden
Dell Digital Delivery (HKLM-x32\...\{BC8233D8-59BA-4D40-92B9-4FDE7452AA8B}) (Version: 3.0.3999.0 - Dell Products, LP)
Dell SupportAssist (HKLM\...\PC-Doctor for Windows) (Version: 1.0.6584.52 - Dell)
Dell Touchpad (HKLM\...\SynTPDeinstKey) (Version: 17.0.8.0 - Synaptics Incorporated)
Dell Update (HKLM-x32\...\{7E07B3E7-9A66-41F3-A91D-EC2CCE14E5B9}) (Version: 1.1.1072.0 - Dell Inc.)
Epson Connect Guide (HKLM-x32\...\Epson Connect Guide) (Version:  - )
Epson Event Manager (HKLM-x32\...\{8F01524C-0676-4CC1-B4AE-64753C723391}) (Version: 3.01.0005 - Seiko Epson Corporation)
Epson FAX Utility (HKLM-x32\...\{0CBE6C93-CB2E-4378-91EE-12BE6D4E2E4A}) (Version: 1.30.00 - SEIKO EPSON CORPORATION)
Epson Network Guide WF-2540 Series (HKLM-x32\...\WF-2540 Series Netg) (Version:  - )
Epson PC-FAX Driver (HKLM-x32\...\EPSON PC-FAX Driver 2) (Version:  - )
EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version:  - Seiko Epson Corporation)
Epson User's Guide WF-2540 Series (HKLM-x32\...\WF-2540 Series Useg) (Version:  - )
EPSON WF-2540 Series Printer Uninstall (HKLM\...\EPSON WF-2540 Series) (Version:  - SEIKO EPSON Corporation)
EpsonNet Print (HKLM-x32\...\{3E31400D-274E-4647-916C-2CACC3741799}) (Version: 2.6.0 - SEIKO EPSON CORPORATION)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 40.0.2214.115 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.14.1724 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3412 - Intel Corporation)
Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology(patch version 3.0.1327.1) (HKLM\...\{302600C1-6BDF-4FD1-1307-148929CC1385}) (Version: 3.1.1307.0362 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.8.0.1016 - Intel Corporation)
Intel® PROSet/Wireless Software (HKLM-x32\...\{f782ff3b-2729-43d2-973c-8de9d966ab4f}) (Version: 16.5.1 - Intel Corporation)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.38 - Irfan Skiljan)
iTunes (HKLM\...\{D227565A-0033-40AD-89BA-653A205CDC11}) (Version: 12.1.1.4 - Apple Inc.)
Java 8 Update 31 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418031F0}) (Version: 8.0.310 - Oracle Corporation)
Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)
K-Lite Mega Codec Pack 10.4.0 (HKLM-x32\...\KLiteCodecPack_is1) (Version: 10.4.0 - )
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft Office Korrekturhilfen 2013 - Deutsch (HKLM\...\{90150000-001F-0407-1000-0000000FF1CE}) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUS) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SkyDrive (HKU\S-1-5-21-1401536446-3937075962-3797694313-1001\...\SkyDriveSetup.exe) (Version: 16.4.6013.0910 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
MWSnap 3 (HKLM-x32\...\MWSnap 3) (Version: 3.0.0.74 - Mirek Wojtowicz)
NICI U.S./Worldwide 2.77.1.0 (x64) (HKLM\...\{123B3157-26AF-43F5-AD46-AB200AC56292}) (Version: 2.77.1.0 - Novell, Inc.)
Novell Client for Windows (HKLM\...\Novell Client for Windows) (Version: 2 SP3 - Novell, Inc.)
OCS Inventory NG Agent 2.0.4.0 (HKLM-x32\...\OCS Inventory NG Agent) (Version: 2.0.4.0 - OCS Inventory NG Team)
OpenVPN 2.2.2 (HKLM-x32\...\OpenVPN) (Version: 2.2.2 - )
Outils de vérification linguistique 2013 de Microsoft Office*- Français (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
ownCloud (HKLM-x32\...\ownCloud) (Version: 1.5.4.2686 - ownCloud)
PDF Settings CS5 (x32 Version: 10.0 - Adobe Systems Incorporated) Hidden
Quickset64 (HKLM\...\{87CF757E-C1F1-4D22-865C-00C6950B5258}) (Version: 11.1.14 - Dell Inc.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7023 - Realtek Semiconductor Corp.)
RUBICon (HKLM-x32\...\{438134D3-0BD4-4C52-8575-5B2B63AD01C2}) (Version: 2.0.25 - RUB)
SCR3xxx Smart Card Reader (HKLM-x32\...\{6DA99C69-0799-467E-9496-F37E1E452A4A}) (Version: 8.40 - SCM Microsystems)
Secunia PSI (3.0.0.10004) (HKLM-x32\...\Secunia PSI) (Version: 3.0.0.10004 - Secunia)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{D82063A8-7C8C-4C3B-A9BB-95138CA55D26}) (Version:  - Microsoft)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (Version:  - Microsoft) Hidden
Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)
Sophos Anti-Virus (HKLM-x32\...\{D929B3B5-56C6-46CC-B3A3-A1A784CBB8E4}) (Version: 10.3.12 - Sophos Limited)
Sophos AutoUpdate (HKLM-x32\...\{7CD26A0C-9B59-4E84-B5EE-B386B2F7AA16}) (Version: 4.1.0.273 - Sophos Limited)
Sophos Remote Management System (HKLM-x32\...\{FED1005D-CBC8-45D5-A288-FFC7BB304121}) (Version: 3.4.1 - Sophos Limited)
Subtitle Edit 3.4.5 (HKLM-x32\...\SubtitleEdit_is1) (Version: 3.4.5.0 - Nikse)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3505.0912 - Microsoft Corporation)
WinPatrol (HKLM\...\{6A206A04-6BC1-411B-AA04-4E52EDEEADF2}) (Version: 33.1.2015.0 - WinPatrol)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-1401536446-3937075962-3797694313-1001_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Mika\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1401536446-3937075962-3797694313-1001_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Mika\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1401536446-3937075962-3797694313-1001_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Mika\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1401536446-3937075962-3797694313-1001_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Mika\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\FileSyncApi64.dll (Microsoft Corporation)

==================== Restore Points  =========================

05-03-2015 15:05:29 End of disinfection

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 14:25 - 2013-08-22 14:25 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {1B2BF8DD-A5F3-443E-9784-DD89D84A32C1} - System32\Tasks\CLVDLauncher => C:\Program Files (x86)\CyberLink\Power2Go8\CLVDLauncher.exe [2013-03-22] (CyberLink Corp.)
Task: {23414E0B-9EFA-43EC-B96E-5A7C9BC83FC4} - System32\Tasks\GenericSettingsHandler\Windows-Credentials\RetrySyncTask_for_S-1-5-21-1401536446-3937075962-3797694313-1001
Task: {2D4CE93F-7BB8-41E9-8B07-28586282C63E} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)
Task: {31966912-1B65-48A9-A4DF-1A4AB373C30A} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2015-02-17] (Microsoft Corporation)
Task: {5DC5B020-B715-4915-AD75-B95E50E6BFE2} - System32\Tasks\Synaptics TouchPad Enhancements => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2013-08-02] (Synaptics Incorporated)
Task: {5F3365BC-2E42-45CC-AF4A-790015D2535B} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)
Task: {7A941184-7D06-4463-AC2A-5E4483274381} - System32\Tasks\CLMLSvc_P2G8 => C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [2013-03-05] (CyberLink)
Task: {83A64583-6182-4A34-9F72-957E23A89344} - System32\Tasks\SystemToolsDailyTest => uaclauncher.exe
Task: {8AF919E1-E009-43D6-92A8-611FBB098DA4} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\Dell\SupportAssist\uaclauncher.exe [2015-02-03] (PC-Doctor, Inc.)
Task: {9A7B14F0-BA2E-4D7E-86A7-5FF8B9FB3B79} - System32\Tasks\PCDEventLauncherTask => C:\Program Files\Dell\SupportAssist\sessionchecker.exe [2015-02-03] (PC-Doctor, Inc.)
Task: {AF485B05-42E2-46AA-AD96-1B4BDDB0A0EC} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-04-06] (Google Inc.)
Task: {C6912531-DD93-4A5D-9600-B4E13DE69723} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-04-06] (Google Inc.)
Task: {E07226ED-0A42-4AB6-AC98-21D57F433519} - System32\Tasks\AdobeAAMUpdater-1.0-MicrosoftAccount-mareikefoerst@gmail.com => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2014-02-27] (Adobe Systems Incorporated)
Task: {E5709F65-3EF0-43F7-AC00-A8935E29604B} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {F4B36036-046B-4271-9996-1A1EC1FAB3DA} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2014-01-23] (Microsoft Corporation)
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) ==============

2013-08-27 11:59 - 2013-01-15 23:17 - 01004088 _____ () C:\Windows\system32\ncnetprovider.dll
2013-08-27 11:59 - 2013-01-15 23:17 - 00109112 _____ () C:\Windows\system32\NCLangID.dll
2013-08-27 11:59 - 2013-01-15 23:17 - 00174648 _____ () C:\Windows\system32\MAPBASE.dll
2013-08-27 11:59 - 2013-01-15 23:17 - 00272440 _____ () C:\Windows\system32\NWSHLXNT.dll
2013-08-27 11:59 - 2013-01-16 11:02 - 00015872 _____ () C:\Windows\system32\nls\ENGLISH\NCLangIDR.DLL
2013-08-27 11:59 - 2013-01-16 11:06 - 00086016 _____ () C:\Windows\system32\nls\ENGLISH\MAPBASER.DLL
2013-08-27 11:59 - 2013-01-16 11:07 - 00101376 _____ () C:\Windows\system32\nls\ENGLISH\NWSHLXNTR.DLL
2013-08-27 11:59 - 2013-01-16 11:08 - 00488448 _____ () C:\Windows\system32\nls\ENGLISH\ncnetproviderR.DLL
2013-08-27 11:59 - 2013-01-15 23:17 - 00048696 _____ () C:\Windows\system32\ncv1_0.DLL
2013-08-27 11:59 - 2013-01-16 11:02 - 00015872 _____ () C:\Windows\SYSTEM32\nls\ENGLISH\NCLangIDR.DLL
2013-08-27 11:59 - 2013-01-15 23:17 - 00152120 _____ () C:\Program Files\Novell\Client\XTier\Common\libslp.dll
2015-01-20 22:35 - 2015-01-20 22:35 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-01-20 22:35 - 2015-01-20 22:35 - 01346344 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2015-01-21 15:01 - 2015-01-21 15:01 - 08898728 _____ () C:\Program Files\Microsoft Office\Office15\1033\GrooveIntlResource.dll
2013-08-27 11:59 - 2013-01-15 23:17 - 00039992 _____ () C:\Program Files\Novell\Client\nwtray.exe
2013-08-27 11:59 - 2013-01-15 23:17 - 01004088 _____ () C:\Windows\SYSTEM32\NCNetProvider.DLL
2013-08-27 11:59 - 2013-01-15 23:17 - 00109112 _____ () C:\Windows\SYSTEM32\NCLangID.dll
2013-08-27 11:59 - 2013-01-15 23:17 - 00174648 _____ () C:\Windows\SYSTEM32\MAPBASE.dll
2013-08-27 11:59 - 2013-01-15 23:17 - 00272440 _____ () C:\Windows\SYSTEM32\NWSHLXNT.dll
2013-08-27 11:59 - 2013-01-16 11:06 - 00086016 _____ () C:\Windows\SYSTEM32\nls\ENGLISH\MAPBASER.DLL
2013-08-27 11:59 - 2013-01-16 11:07 - 00101376 _____ () C:\Windows\SYSTEM32\nls\ENGLISH\NWSHLXNTR.DLL
2013-08-27 11:59 - 2013-01-16 11:08 - 00488448 _____ () C:\Windows\SYSTEM32\nls\ENGLISH\NCNetProviderR.DLL
2014-09-18 19:37 - 2014-07-03 03:55 - 00487144 _____ () C:\Program Files (x86)\Dell Backup and Recovery\Components\Shell\DBRCrawler.exe
2011-12-15 18:29 - 2011-12-15 18:29 - 00104712 _____ () C:\Program Files (x86)\OpenVPN\bin\openvpn-gui-1.0.3.exe
2011-12-15 18:29 - 2011-12-15 18:29 - 00510464 _____ () C:\Program Files (x86)\OpenVPN\bin\openvpn.exe
2014-04-24 09:24 - 2014-04-24 09:24 - 01055808 _____ () C:\Program Files (x86)\Sophos\Remote Management System\ACE.dll
2014-04-24 09:24 - 2014-04-24 09:24 - 01539136 _____ () C:\Program Files (x86)\Sophos\Remote Management System\TAO.dll
2014-04-24 09:24 - 2014-04-24 09:24 - 00183360 _____ () C:\Program Files (x86)\Sophos\Remote Management System\TAO_DynamicAny.dll
2014-04-24 09:24 - 2014-04-24 09:24 - 00760896 _____ () C:\Program Files (x86)\Sophos\Remote Management System\LIBEAY32.dll
2014-04-24 09:24 - 2014-04-24 09:24 - 00076864 _____ () C:\Program Files (x86)\Sophos\Remote Management System\ACE_SSL.dll
2014-04-24 09:24 - 2014-04-24 09:24 - 00146496 _____ () C:\Program Files (x86)\Sophos\Remote Management System\SSLEAY32.dll
2014-04-24 09:24 - 2014-04-24 09:24 - 00535616 _____ () C:\Program Files (x86)\Sophos\Remote Management System\TAO_PortableServer.dll
2014-04-24 09:24 - 2014-04-24 09:24 - 00244800 _____ () C:\Program Files (x86)\Sophos\Remote Management System\TAO_SSLIOP.DLL
2014-04-24 09:24 - 2014-04-24 09:24 - 00740416 _____ () C:\Program Files (x86)\Sophos\Remote Management System\TAO_Security.dll
2014-04-24 09:24 - 2014-04-24 09:24 - 00039488 _____ () C:\Program Files (x86)\Sophos\Remote Management System\TAO_Valuetype.dll
2014-04-24 09:24 - 2014-04-24 09:24 - 00244800 _____ () C:\Program Files (x86)\Sophos\Remote Management System\TAO_SSLIOP.dll
2011-09-29 17:19 - 2011-09-29 17:19 - 00067584 _____ () C:\Program Files (x86)\OCS Inventory Agent\zlib1.dll
2014-01-05 03:06 - 2013-03-05 04:40 - 00626240 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMediaLibrary.dll
2013-03-05 20:41 - 2013-03-05 20:41 - 00015424 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvcPS.dll
2012-09-23 19:43 - 2012-09-23 19:43 - 00010240 _____ () C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\locale\de_de\acrotray.deu
2014-11-24 11:39 - 2014-11-24 11:39 - 00155528 _____ () C:\Program Files (x86)\Dell Digital Delivery\ServiceTagPlusPlus.dll
2014-01-05 02:59 - 2013-09-04 01:53 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
2014-09-18 19:37 - 2014-07-30 23:37 - 01906464 _____ () C:\Program Files (x86)\Dell Backup and Recovery\Components\Restore\STRestoreAPI.dll
2014-01-05 03:14 - 2012-11-26 08:19 - 01153384 _____ () C:\Program Files (x86)\Dell Backup and Recovery\Components\Restore\libxml2.dll
2014-09-18 19:37 - 2012-11-26 05:19 - 00117608 _____ () C:\Program Files (x86)\Dell Backup and Recovery\Components\Restore\zlib1.dll
2015-03-05 18:47 - 2015-03-05 18:47 - 04214272 _____ () c:\Program Files (x86)\Supporter\Supporter.dll
2015-02-20 21:00 - 2015-02-17 23:44 - 01117512 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.115\libglesv2.dll
2015-02-20 21:00 - 2015-02-17 23:44 - 00211272 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.115\libegl.dll
2015-02-20 21:00 - 2015-02-17 23:44 - 09171272 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.115\pdf.dll
2011-12-15 18:29 - 2011-12-15 18:29 - 00090112 _____ () C:\Program Files (x86)\OpenVPN\bin\lzo2.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\Users\Mika\SkyDrive:ms-properties
AlternateDataStreams: C:\Users\Mika\SkyDrive.old:ms-properties
AlternateDataStreams: C:\Users\Mika\Downloads\noname (1).eml:OECustomProperty
AlternateDataStreams: C:\Users\Mika\Downloads\noname (2).eml:OECustomProperty
AlternateDataStreams: C:\Users\Mika\Downloads\noname.eml:OECustomProperty

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SAVService => ""="service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SAVService => ""="service"

==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1401536446-3937075962-3797694313-1001\Control Panel\Desktop\\Wallpaper -> C:\Windows\web\wallpaper\dell\BlueLava_1112000xx_inspiron_wallpaper58095_16x9_72dpi_RGB.jpg
DNS Servers: 134.99.24.129 - 192.168.2.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

HKLM\...\StartupApproved\Run: => "iTunesHelper"

==================== Accounts: =============================

Administrator (S-1-5-21-1401536446-3937075962-3797694313-500 - Administrator - Enabled) => C:\Users\Administrator
Guest (S-1-5-21-1401536446-3937075962-3797694313-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1401536446-3937075962-3797694313-1003 - Limited - Enabled)
Mika (S-1-5-21-1401536446-3937075962-3797694313-1001 - Administrator - Enabled) => C:\Users\Mika
SophosSAUEWBFBM-MBL0 (S-1-5-21-1401536446-3937075962-3797694313-1004 - Limited - Enabled)

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (03/06/2015 04:21:18 PM) (Source: DellUpdate) (EventID: 0) (User: )
Description: Failed in handling the PowerEvent. The error that occurred was: System.NullReferenceException: Object reference not set to an instance of an object.
   at DellUpdate.WindowsService.Controller.ResetWcfConnections()
   at DellUpdate.WindowsService.UpdateService.OnPowerEvent(PowerBroadcastStatus powerStatus)
   at System.ServiceProcess.ServiceBase.DeferredPowerEvent(Int32 eventType, IntPtr eventData).

Error: (03/06/2015 01:17:53 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: chrome.exe, version: 40.0.2214.115, time stamp: 0x54e3aecf
Faulting module name: ntdll.dll, version: 6.3.9600.17630, time stamp: 0x54b0d74f
Exception code: 0xc0000142
Fault offset: 0x0009e0b2
Faulting process id: 0xe04
Faulting application start time: 0xchrome.exe0
Faulting application path: chrome.exe1
Faulting module path: chrome.exe2
Report Id: chrome.exe3
Faulting package full name: chrome.exe4
Faulting package-relative application ID: chrome.exe5

Error: (03/06/2015 01:06:46 PM) (Source: DellUpdate) (EventID: 0) (User: )
Description: Failed in handling the PowerEvent. The error that occurred was: System.NullReferenceException: Object reference not set to an instance of an object.
   at DellUpdate.WindowsService.Controller.ResetWcfConnections()
   at DellUpdate.WindowsService.UpdateService.OnPowerEvent(PowerBroadcastStatus powerStatus)
   at System.ServiceProcess.ServiceBase.DeferredPowerEvent(Int32 eventType, IntPtr eventData).

Error: (03/06/2015 00:47:07 PM) (Source: DellUpdate) (EventID: 0) (User: )
Description: Failed in handling the PowerEvent. The error that occurred was: System.NullReferenceException: Object reference not set to an instance of an object.
   at DellUpdate.WindowsService.Controller.ResetWcfConnections()
   at DellUpdate.WindowsService.UpdateService.OnPowerEvent(PowerBroadcastStatus powerStatus)
   at System.ServiceProcess.ServiceBase.DeferredPowerEvent(Int32 eventType, IntPtr eventData).

Error: (03/06/2015 00:22:54 PM) (Source: DellUpdate) (EventID: 0) (User: )
Description: Failed in handling the PowerEvent. The error that occurred was: System.NullReferenceException: Object reference not set to an instance of an object.
   at DellUpdate.WindowsService.Controller.ResetWcfConnections()
   at DellUpdate.WindowsService.UpdateService.OnPowerEvent(PowerBroadcastStatus powerStatus)
   at System.ServiceProcess.ServiceBase.DeferredPowerEvent(Int32 eventType, IntPtr eventData).

Error: (03/06/2015 09:59:16 AM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005

Error: (03/06/2015 09:59:14 AM) (Source: DellUpdate) (EventID: 0) (User: )
Description: Failed in handling the PowerEvent. The error that occurred was: System.NullReferenceException: Object reference not set to an instance of an object.
   at DellUpdate.WindowsService.Controller.ResetWcfConnections()
   at DellUpdate.WindowsService.UpdateService.OnPowerEvent(PowerBroadcastStatus powerStatus)
   at System.ServiceProcess.ServiceBase.DeferredPowerEvent(Int32 eventType, IntPtr eventData).

Error: (03/06/2015 09:02:22 AM) (Source: DellUpdate) (EventID: 0) (User: )
Description: Failed in handling the PowerEvent. The error that occurred was: System.NullReferenceException: Object reference not set to an instance of an object.
   at DellUpdate.WindowsService.Controller.ResetWcfConnections()
   at DellUpdate.WindowsService.UpdateService.OnPowerEvent(PowerBroadcastStatus powerStatus)
   at System.ServiceProcess.ServiceBase.DeferredPowerEvent(Int32 eventType, IntPtr eventData).

Error: (03/06/2015 02:17:38 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 9594

Error: (03/06/2015 02:17:38 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 9594


System errors:
=============
Error: (03/05/2015 06:03:49 PM) (Source: Service Control Manager) (EventID: 7003) (User: )
Description: The McAfee AP Service service depends on the following service: mfevtp. This service might not be installed.

Error: (03/05/2015 04:15:10 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: The Interactive Services Detection service terminated with the following error: 
%%1

Error: (03/05/2015 03:25:42 PM) (Source: Service Control Manager) (EventID: 7032) (User: )
Description: The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Sophos Anti-Virus service, but this action failed with the following error: 
%%1056

Error: (03/05/2015 03:25:41 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Sophos Anti-Virus service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 500 milliseconds: Restart the service.

Error: (03/05/2015 03:25:41 PM) (Source: SAVOnAccess) (EventID: 37) (User: )
Description: Driver threads still active when driver is being shutdown.

Error: (03/05/2015 03:08:20 PM) (Source: Service Control Manager) (EventID: 7003) (User: )
Description: The McAfee AP Service service depends on the following service: mfevtp. This service might not be installed.

Error: (03/05/2015 01:22:56 PM) (Source: Service Control Manager) (EventID: 7003) (User: )
Description: The McAfee AP Service service depends on the following service: mfevtp. This service might not be installed.

Error: (03/05/2015 01:21:52 PM) (Source: DCOM) (EventID: 10010) (User: EWBFBM-MBL15)
Description: {9BA05972-F6A8-11CF-A442-00A0C90A8F39}

Error: (03/03/2015 09:18:12 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: The Interactive Services Detection service terminated with the following error: 
%%1

Error: (03/03/2015 05:27:03 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: application-specificLocalActivation{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC)UnavailableUnavailable


Microsoft Office Sessions:
=========================
Error: (03/06/2015 04:21:18 PM) (Source: DellUpdate) (EventID: 0) (User: )
Description: Failed in handling the PowerEvent. The error that occurred was: System.NullReferenceException: Object reference not set to an instance of an object.
   at DellUpdate.WindowsService.Controller.ResetWcfConnections()
   at DellUpdate.WindowsService.UpdateService.OnPowerEvent(PowerBroadcastStatus powerStatus)
   at System.ServiceProcess.ServiceBase.DeferredPowerEvent(Int32 eventType, IntPtr eventData).

Error: (03/06/2015 01:17:53 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: chrome.exe40.0.2214.11554e3aecfntdll.dll6.3.9600.1763054b0d74fc00001420009e0b2e0401d058079163886aC:\Program Files (x86)\Google\Chrome\Application\chrome.exeC:\Windows\SYSTEM32\ntdll.dllcfe1fd93-c3fa-11e4-82d6-fcf8ae3cd0dd

Error: (03/06/2015 01:06:46 PM) (Source: DellUpdate) (EventID: 0) (User: )
Description: Failed in handling the PowerEvent. The error that occurred was: System.NullReferenceException: Object reference not set to an instance of an object.
   at DellUpdate.WindowsService.Controller.ResetWcfConnections()
   at DellUpdate.WindowsService.UpdateService.OnPowerEvent(PowerBroadcastStatus powerStatus)
   at System.ServiceProcess.ServiceBase.DeferredPowerEvent(Int32 eventType, IntPtr eventData).

Error: (03/06/2015 00:47:07 PM) (Source: DellUpdate) (EventID: 0) (User: )
Description: Failed in handling the PowerEvent. The error that occurred was: System.NullReferenceException: Object reference not set to an instance of an object.
   at DellUpdate.WindowsService.Controller.ResetWcfConnections()
   at DellUpdate.WindowsService.UpdateService.OnPowerEvent(PowerBroadcastStatus powerStatus)
   at System.ServiceProcess.ServiceBase.DeferredPowerEvent(Int32 eventType, IntPtr eventData).

Error: (03/06/2015 00:22:54 PM) (Source: DellUpdate) (EventID: 0) (User: )
Description: Failed in handling the PowerEvent. The error that occurred was: System.NullReferenceException: Object reference not set to an instance of an object.
   at DellUpdate.WindowsService.Controller.ResetWcfConnections()
   at DellUpdate.WindowsService.UpdateService.OnPowerEvent(PowerBroadcastStatus powerStatus)
   at System.ServiceProcess.ServiceBase.DeferredPowerEvent(Int32 eventType, IntPtr eventData).

Error: (03/06/2015 09:59:16 AM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005

Error: (03/06/2015 09:59:14 AM) (Source: DellUpdate) (EventID: 0) (User: )
Description: Failed in handling the PowerEvent. The error that occurred was: System.NullReferenceException: Object reference not set to an instance of an object.
   at DellUpdate.WindowsService.Controller.ResetWcfConnections()
   at DellUpdate.WindowsService.UpdateService.OnPowerEvent(PowerBroadcastStatus powerStatus)
   at System.ServiceProcess.ServiceBase.DeferredPowerEvent(Int32 eventType, IntPtr eventData).

Error: (03/06/2015 09:02:22 AM) (Source: DellUpdate) (EventID: 0) (User: )
Description: Failed in handling the PowerEvent. The error that occurred was: System.NullReferenceException: Object reference not set to an instance of an object.
   at DellUpdate.WindowsService.Controller.ResetWcfConnections()
   at DellUpdate.WindowsService.UpdateService.OnPowerEvent(PowerBroadcastStatus powerStatus)
   at System.ServiceProcess.ServiceBase.DeferredPowerEvent(Int32 eventType, IntPtr eventData).

Error: (03/06/2015 02:17:38 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 9594

Error: (03/06/2015 02:17:38 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 9594


CodeIntegrity Errors:
===================================
  Date: 2014-04-23 11:45:25.762
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2014-04-23 11:45:25.558
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2014-04-23 11:45:25.246
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i5-4200U CPU @ 1.60GHz
Percentage of memory in use: 34%
Total physical RAM: 8096.64 MB
Available physical RAM: 5310.8 MB
Total Pagefile: 16288.64 MB
Available Pagefile: 13229.5 MB
Total Virtual: 131072 MB
Available Virtual: 131071.8 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:922.82 GB) (Free:849.88 GB) NTFS
Drive e: (ESP) (Fixed) (Total:0.48 GB) (Free:0.46 GB) FAT32
Drive x: (WINRETOOLS) (Fixed) (Total:0.48 GB) (Free:0.2 GB) NTFS
Drive y: (PBR Image) (Fixed) (Total:7.56 GB) (Free:0.74 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: 3FA227C9)

Partition: GPT Partition Type.

==================== End Of Log ============================

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-03-2015 01
Ran by Mika (administrator) on EWBFBM-MBL15 on 06-03-2015 16:53:58
Running from C:\Users\Mika\Downloads
Loaded Profiles: Mika (Available profiles: Mika & Administrator)
Platform: Windows 8.1 (X64) OS Language: English (United States)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Novell, Inc.) C:\Program Files\Novell\Client\XTier\Services\xtsvcmgr.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\ibtrksrv.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psia.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Remote Management System\ManagementAgentNT.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Remote Management System\RouterNT.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_filter.exe
(Sophos Limited) C:\Program Files (x86)\Common Files\Sophos\Web Intelligence\swi_fc.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe
(Uwe Sieber - www.uwe-sieber.de) C:\Program Files (x86)\USBDLM\USBDLM.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Seiko Epson Corporation) C:\Windows\System32\escsvc64.exe
(OCS Inventory NG) C:\Program Files (x86)\OCS Inventory Agent\OcsService.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Uwe Sieber - www.uwe-sieber.de) C:\Program Files (x86)\USBDLM\USBDLM_usr.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Dell Inc.) C:\Program Files\Dell\QuickSet\quickset.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
() C:\Program Files\Novell\Client\nwtray.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Ruiware LLC) C:\Program Files (x86)\WinPatrol\WinPatrol\WinPatrol.exe
(OCS Inventory NG) C:\Program Files (x86)\OCS Inventory Agent\OcsSystray.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psi_tray.exe
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\acrotray.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\AutoUpdate\ALMon.exe
(Dell Products, LP.) C:\Program Files (x86)\Dell Digital Delivery\DeliveryService.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXRCV.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe
(Dell Inc.) C:\Program Files (x86)\Dell Update\DellUpService.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
(SoftThinks SAS) C:\Program Files (x86)\Dell Backup and Recovery\SftService.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(SoftThinks - Dell) C:\Program Files (x86)\Dell Backup and Recovery\Components\DBRUpdate\DBRUpd.exe
(SoftThinks - Dell) C:\Program Files (x86)\Dell Backup and Recovery\Toaster.exe
(Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
() C:\Program Files (x86)\Dell Backup and Recovery\Components\Shell\DBRCrawler.exe
(SysTool PasSame LIMITED) C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe
(XTab system) C:\Program Files (x86)\XTab\ProtectService.exe
(SearchProtect) C:\Program Files (x86)\XTab\CmdShell.exe
(XTab system) C:\Program Files (x86)\XTab\HPNotify.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
() C:\Program Files (x86)\OpenVPN\bin\openvpn-gui-1.0.3.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
() C:\Program Files (x86)\OpenVPN\bin\openvpn.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7202520 2013-08-20] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1321688 2013-08-07] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_PushButton] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1321688 2013-08-07] (Realtek Semiconductor)
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [287592 2013-08-07] (Intel Corporation)
HKLM\...\Run: [QuickSet] => c:\Program Files\Dell\QuickSet\QuickSet.exe [3760432 2013-08-02] (Dell Inc.)
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll",TrayApp
HKLM\...\Run: [NWTRAY] => C:\Program Files\Novell\Client\nwtray.exe [39992 2013-01-15] ()
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [558496 2014-02-27] (Adobe Systems Incorporated)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [169768 2015-02-13] (Apple Inc.)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS5ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe [406992 2010-02-22] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Acrobat Assistant 8.0] => C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Acrotray.exe [3498728 2014-12-03] (Adobe Systems Inc.)
HKLM-x32\...\Run: [Sophos AutoUpdate Monitor] => C:\Program Files (x86)\Sophos\AutoUpdate\almon.exe [1593640 2015-03-03] (Sophos Limited)
HKLM-x32\...\Run: [FUFAXRCV] => C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXRCV.exe [502912 2012-04-03] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [FUFAXSTM] => C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXSTM.exe [863360 2012-04-03] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [EEventManager] => C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [1058912 2012-04-02] (SEIKO EPSON CORPORATION)
HKLM-x32\...\RunOnce: [ Malwarebytes Anti-Malware  (cleanup)] => C:\ProgramData\Malwarebytes\ Malwarebytes Anti-Malware \mbamdor.exe [54072 2014-11-21] (Malwarebytes Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\ScCertProp: wlnotify.dll [X]
HKU\S-1-5-21-1401536446-3937075962-3797694313-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [30878816 2014-12-11] (Skype Technologies S.A.)
HKU\S-1-5-21-1401536446-3937075962-3797694313-1001\...\Run: [WinPatrol] => C:\Program Files (x86)\WinPatrol\WinPatrol\winpatrol.exe [1160536 2015-02-23] (Ruiware LLC)
HKU\S-1-5-18\...\Run: [EPLTarget\P0000000000000000] => C:\Windows\system32\spool\DRIVERS\x64\3\E_YATIHSA.EXE /EPT "EPLTarget\P0000000000000000" /M "WorkForce 845"
HKU\S-1-5-18\...\Run: [EPLTarget\P0000000000000001] => C:\Windows\system32\spool\DRIVERS\x64\3\E_YATIIUE.EXE [283232 2012-02-28] (SEIKO EPSON CORPORATION)
AppInit_DLLs-x32: C:\PROGRA~2\Sophos\SOPHOS~1\SOPHOS~1.DLL => C:\Program Files (x86)\Sophos\Sophos Anti-Virus\sophos_detoured.dll [275352 2015-01-13] (Sophos Limited)
Lsa: [Authentication Packages] msv1_0 ncv1_0
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\OCS Inventory NG Systray.lnk
ShortcutTarget: OCS Inventory NG Systray.lnk -> C:\Program Files (x86)\OCS Inventory Agent\OcsSystray.exe (OCS Inventory NG)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Secunia)
Startup: C:\Users\Mika\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Download.lnk
ShortcutTarget: Download.lnk -> C:\ProgramData\{d6560dff-0f39-a46a-d656-60dff0f337fc}\Download.exe (No File)
ShellIconOverlayIdentifiers: [DBARFileBackuped] -> {831cebdd-6baf-4432-be76-9e0989c14aef} => C:\Windows\system32\mscoree.dll (Microsoft Corporation)
ShellIconOverlayIdentifiers: [DBARFileNotBackuped] -> {275e4fd7-21ef-45cf-a836-832e5d2cc1b3} => C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-1401536446-3937075962-3797694313-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:62005;https=127.0.0.1:62005
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = ?type=hppp
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = ?type=hppp
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = web/?type=dspp&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = ?type=hppp
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = ?type=hppp
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = web/?type=dspp&q={searchTerms}
HKU\S-1-5-21-1401536446-3937075962-3797694313-1001\Software\Microsoft\Internet Explorer\Main,Start Page = ?type=hppp
SearchScopes: HKU\S-1-5-21-1401536446-3937075962-3797694313-1001 -> DefaultScope {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cvs&utm_campaign=install_ie&utm_content=ds&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421&ts=1425577466&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1401536446-3937075962-3797694313-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cvs&utm_campaign=install_ie&utm_content=ds&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421&ts=1425577466&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1401536446-3937075962-3797694313-1001 -> {12E797B7-A75C-4051-B4D9-8F48480ECCE7} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cvs&utm_campaign=install_ie&utm_content=ds&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421&ts=1425577466&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1401536446-3937075962-3797694313-1001 -> {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cvs&utm_campaign=install_ie&utm_content=ds&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421&ts=1425577466&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1401536446-3937075962-3797694313-1001 -> {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cvs&utm_campaign=install_ie&utm_content=ds&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421&ts=1425577466&type=default&q={searchTerms}
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_31\bin\ssv.dll (Oracle Corporation)
BHO: Adobe Acrobat Create PDF Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_31\bin\jp2ssv.dll (Oracle Corporation)
BHO: Adobe Acrobat Create PDF from Selection -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll (Oracle Corporation)
BHO-x32: Adobe Acrobat Create PDF Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Adobe Acrobat Create PDF from Selection -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKU\S-1-5-21-1401536446-3937075962-3797694313-1001 -> Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll (Adobe Systems Incorporated)
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
StartMenuInternet: IEXPLORE.EXE - iexplore.exe

FireFox:
========
FF ProfilePath: C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default
FF NetworkProxy: "type", 5
FF Plugin: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files\Java\jre1.8.0_31\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Acrobat -> C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
FF user.js: detected! => C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\user.js
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn [2014-04-24]
FF Extension: No Name - C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com [Not Found]
FF Extension: No Name - C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\fftoolbar2014@etech.com [Not Found]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [Not Found]

Chrome: 
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR HomePage: Default -> 
CHR StartupUrls: Default -> "hxxp://www.mystartsearch.com/?type=hp&ts=1425557118&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421", "hxxp://www.mystartsearch.com/?type=hppp&ts=1425557178&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421", "hxxp://www.mystartsearch.com/?type=hp&ts=1425577412&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421", "hxxp://www.mystartsearch.com/?type=hppp&ts=1425577428&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421", "?type=hppp"
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}
CHR Profile: C:\Users\Mika\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Mika\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-04-06]
CHR Extension: (Google Drive) - C:\Users\Mika\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-04-06]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Mika\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2015-01-19]
CHR Extension: (YouTube) - C:\Users\Mika\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-04-06]
CHR Extension: (Google Search) - C:\Users\Mika\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-04-06]
CHR Extension: (Adobe Acrobat - Create PDF) - C:\Users\Mika\AppData\Local\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj [2014-04-24]
CHR Extension: (Hola Better Internet) - C:\Users\Mika\AppData\Local\Google\Chrome\User Data\Default\Extensions\gkojfkhlekighikafcpjkiklfbnlmeio [2014-08-16]
CHR Extension: (Cars 2 World Grand Prix Races) - C:\Users\Mika\AppData\Local\Google\Chrome\User Data\Default\Extensions\kfkpnakihjiclpakoaggnpaphjjjjelo [2015-03-05]
CHR Extension: (Google Wallet) - C:\Users\Mika\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-04-06]
CHR Extension: (Gmail) - C:\Users\Mika\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-04-06]
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCChromeExtn\WCChromeExtn.crx [2014-12-03]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-01-19] (Apple Inc.)
R2 DellUpdate; C:\Program Files (x86)\Dell Update\DellUpService.exe [150224 2014-09-09] (Dell Inc.)
R2 EpsonScanSvc; C:\Windows\system32\EscSvc64.exe [135824 2011-12-12] (Seiko Epson Corporation)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15720 2013-08-07] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; c:\Program Files\Intel\iCLS Client\HeciServer.exe [733696 2013-05-12] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; c:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-12] (Intel(R) Corporation)
R2 Intel(R) Wireless Bluetooth(R) 4.0 Radio Management; C:\Program Files (x86)\Intel\Bluetooth\ibtrksrv.exe [155448 2013-08-01] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-04] (Intel Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [284912 2013-08-23] ()
R2 OCS Inventory Service; C:\Program Files (x86)\OCS Inventory Agent\OcsService.exe [35840 2012-01-27] (OCS Inventory NG) [File not signed]
S3 OpenVPNService; C:\Program Files (x86)\OpenVPN\bin\openvpnserv.exe [14848 2011-12-15] () [File not signed]
R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [253776 2013-07-30] (CyberLink)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [246488 2013-06-19] (Realtek Semiconductor)
R2 SAVAdminService; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe [288552 2014-05-20] (Sophos Limited)
R2 SAVService; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe [208168 2014-10-17] (Sophos Limited)
R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1363160 2014-11-28] (Secunia)
R2 SftService; C:\Program Files (x86)\Dell Backup and Recovery\sftservice.exe [1924328 2014-09-18] (SoftThinks SAS)
R2 Sophos Agent; C:\Program Files (x86)\Sophos\Remote Management System\ManagementAgentNT.exe [289856 2014-04-24] (Sophos Limited)
R2 Sophos AutoUpdate Service; C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe [340776 2015-03-03] (Sophos Limited)
R2 Sophos Message Router; C:\Program Files (x86)\Sophos\Remote Management System\RouterNT.exe [818240 2014-04-24] (Sophos Limited)
R2 Sophos Web Control Service; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe [341800 2014-10-17] (Sophos Limited)
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
R2 swi_filter; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_filter.exe [300840 2015-01-13] (Sophos Limited)
R2 swi_service; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe [3274536 2015-01-13] (Sophos Limited)
R2 USBDLM; C:\Program Files (x86)\USBDLM\USBDLM.exe [337888 2012-01-15] (Uwe Sieber - www.uwe-sieber.de) [File not signed]
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)
R2 XTSvcMgr; C:\Program Files\Novell\Client\XTier\Services\XTSvcMgr.exe [20536 2013-01-15] (Novell, Inc.)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3667696 2013-08-23] (Intel® Corporation)
S2 McAPExe; "C:\Program Files\McAfee\MSC\McAPExe.exe" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 BthLEEnum; C:\Windows\System32\drivers\BthLEEnum.sys [226304 2013-12-04] (Microsoft Corporation)
R3 btmaux; C:\Windows\system32\DRIVERS\btmaux.sys [132920 2013-04-24] (Motorola Solutions, Inc.)
R3 btmhsf; C:\Windows\system32\DRIVERS\btmhsf.sys [1385784 2013-06-27] (Motorola Solutions, Inc.)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [91712 2013-03-05] (CyberLink)
R3 DellRbtn; C:\Windows\System32\drivers\DellRbtn.sys [10752 2013-01-25] (OSR Open Systems Resources, Inc.)
U0 fvtg; C:\Windows\System32\drivers\hnovwgtv.sys [79064 2015-03-06] (Malwarebytes Corporation)
R3 ibtusb; C:\Windows\system32\DRIVERS\ibtusb.sys [114632 2013-07-01] (Intel Corporation)
R3 MEIx64; C:\Windows\System32\drivers\TeeDriverx64.sys [99288 2013-12-19] (Intel Corporation)
R0 NCFilter; C:\Windows\System32\DRIVERS\NCFilter.sys [112696 2013-01-15] ()
R2 NCFSD; C:\Program Files\Novell\Client\XTier\Drivers\ncfsd.sys [115256 2013-01-15] ()
R2 NCIOCTL; C:\Program Files\Novell\Client\XTier\Drivers\ncioctl.sys [90680 2013-01-15] ()
R0 NCRecognizer; C:\Windows\System32\DRIVERS\NCRecognizer.sys [120376 2013-01-15] ()
R0 NCUncFilter; C:\Windows\System32\DRIVERS\NCUncFilter.sys [26680 2013-01-15] ()
R3 NETwNb64; C:\Windows\system32\DRIVERS\NETwbw02.sys [3589600 2013-09-25] (Intel Corporation)
R1 NICM; C:\Program Files\Novell\Client\XTier\Drivers\nicm.sys [31800 2013-01-15] (Novell, Inc.)
S3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2014-11-28] (Secunia)
S3 S3XXx64; C:\Windows\system32\DRIVERS\S3XXx64.sys [73856 2015-02-17] (Identiv)
R1 SAVOnAccess; C:\Windows\System32\DRIVERS\savonaccess.sys [161024 2014-10-17] (Sophos Limited)
S3 sdcfilter; C:\Windows\system32\DRIVERS\sdcfilter.sys [38144 2014-05-20] (Sophos Limited)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [34544 2013-08-02] (Synaptics Incorporated)
S4 SophosBootDriver; C:\Windows\system32\DRIVERS\SophosBootDriver.sys [27904 2014-05-20] (Sophos Limited)
R1 swi_callout; C:\Windows\system32\DRIVERS\swi_callout.sys [32512 2015-03-03] (Sophos Limited)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)
U3 nccache; C:\Program Files\Novell\Client\XTier\Drivers\nccache.sys [55864 2013-01-15] (Novell, Inc.)
U3 nciom; C:\Program Files\Novell\Client\XTier\Drivers\nciom.sys [80952 2013-01-15] (Novell, Inc.)
U3 ncp; C:\Program Files\Novell\Client\XTier\Drivers\ncp.sys [79416 2013-01-15] (Novell, Inc.)
U3 ncpfsp; C:\Program Files\Novell\Client\XTier\Drivers\ncpfsp.sys [101944 2013-01-15] (Novell, Inc.)
U3 ncpl; C:\Program Files\Novell\Client\XTier\Drivers\ncpl.sys [49720 2013-01-15] (Novell, Inc.)
U3 ndm; C:\Program Files\Novell\Client\XTier\Drivers\ndm.sys [20024 2013-01-15] (Novell, Inc.)
U3 ndmndap; C:\Program Files\Novell\Client\XTier\Drivers\ndmndap.sys [84024 2013-01-15] (Novell, Inc.)
U3 niam; C:\Program Files\Novell\Client\XTier\Drivers\niam.sys [39480 2013-01-15] (Novell, Inc.)
U3 nipctl; C:\Program Files\Novell\Client\XTier\Drivers\nipctl.sys [56376 2013-01-15] (Novell, Inc.)
U3 nscm; C:\Program Files\Novell\Client\XTier\Drivers\nscm.sys [37944 2013-01-15] (Novell, Inc.)
U3 nsns; C:\Program Files\Novell\Client\XTier\Drivers\nsns.sys [25656 2013-01-15] (Novell, Inc.)
U3 nsvccost; C:\Program Files\Novell\Client\XTier\Drivers\nsvccost.sys [36408 2013-01-15] (Novell, Inc.)
U3 xtxplat; C:\Program Files\Novell\Client\XTier\Drivers\xtxplat.sys [59960 2013-01-15] (Novell, Inc.)
S3 PCDSRVC{3B54B31B-D06B6431-06020200}_0; \??\c:\program files\dell\supportassist\pcdsrvc_x64.pkms [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-06 16:53 - 2015-03-06 16:55 - 00032263 _____ () C:\Users\Mika\Downloads\FRST.txt
2015-03-06 16:53 - 2015-03-06 16:54 - 00000000 ____D () C:\FRST
2015-03-06 16:53 - 2015-03-06 16:53 - 02092544 _____ (Farbar) C:\Users\Mika\Downloads\FRST64.exe
2015-03-06 13:58 - 2015-03-06 13:58 - 00079064 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\hnovwgtv.sys
2015-03-06 09:05 - 2015-03-06 09:05 - 01728218 _____ () C:\Users\Mika\Downloads\openvpn-install (1).exe
2015-03-05 18:47 - 2015-03-06 13:57 - 00000000 ____D () C:\Program Files (x86)\Cars 2 World Grand Prix Races
2015-03-05 18:47 - 2015-03-05 18:47 - 00000000 ____D () C:\Program Files (x86)\Supporter
2015-03-05 18:46 - 2015-03-06 13:57 - 00000000 ____D () C:\Program Files (x86)\PPricoeLeSs
2015-03-05 18:46 - 2015-03-05 18:46 - 00000000 ____D () C:\ProgramData\8075021230841169077
2015-03-05 18:45 - 2015-03-05 18:45 - 00000000 ____D () C:\ProgramData\phkdkiknppjjglfkjnfjndjcgledaebg
2015-03-05 18:44 - 2015-03-06 13:58 - 00000000 ____D () C:\Program Files (x86)\XTab
2015-03-05 18:44 - 2015-03-06 13:57 - 00000000 ____D () C:\ProgramData\{d6560dff-0f39-a46a-d656-60dff0f337fc}
2015-03-05 18:43 - 2015-03-06 13:58 - 00000000 ____D () C:\ProgramData\WindowsMangerProtect
2015-03-05 18:15 - 2015-03-05 18:16 - 28687167 _____ () C:\Users\Mika\Downloads\Pressekonferenz Studie Bildung%2C Migration%2C Milieu am 04 12 13 in Berlin youtube original.mp4
2015-03-05 18:14 - 2015-03-05 18:15 - 08004264 _____ () C:\Users\Mika\Downloads\Studie Bildung Milieu und Migration Interview mit Hassan El Moussaoui.mp4
2015-03-05 18:14 - 2015-03-05 18:15 - 07664850 _____ () C:\Users\Mika\Downloads\Studie -Bildung%2C Milieu und Migration- - Interview mit Elvida Sabanovic.mp4
2015-03-05 18:14 - 2015-03-05 18:15 - 06494192 _____ () C:\Users\Mika\Downloads\Studie -Bildung%2C Milieu und Migration- - Interview mit Nazan Wagner.mp4
2015-03-05 18:14 - 2015-03-05 18:14 - 08821007 _____ () C:\Users\Mika\Downloads\Studie -Bildung%2C Milieu und Migration- - Interview mit Sakire Efe.mp4
2015-03-05 16:15 - 2015-03-03 21:15 - 00032512 _____ (Sophos Limited) C:\Windows\system32\Drivers\swi_callout.sys
2015-03-05 15:46 - 2015-03-05 17:46 - 00000000 ____D () C:\Users\Mika\AppData\Roaming\WinPatrol
2015-03-05 15:46 - 2015-03-05 15:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinPatrol
2015-03-05 15:46 - 2015-03-05 15:46 - 00000000 ____D () C:\ProgramData\InstallMate
2015-03-05 15:46 - 2015-03-05 15:46 - 00000000 ____D () C:\Program Files (x86)\WinPatrol
2015-03-05 15:35 - 2015-03-05 15:35 - 01081688 _____ (WinPatrol) C:\Users\Mika\Downloads\wpsetup.exe
2015-03-05 15:34 - 2015-03-06 13:15 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-03-05 15:34 - 2015-03-05 15:34 - 00001120 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-03-05 15:34 - 2015-03-05 15:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-03-05 15:34 - 2015-03-05 15:34 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-03-05 15:34 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-03-05 15:34 - 2014-11-21 06:14 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-03-05 15:34 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-03-05 15:33 - 2015-03-05 15:33 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Mika\Downloads\mbam-setup-2.0.4.1028.exe
2015-03-05 15:25 - 2015-03-05 15:25 - 00448512 _____ (OldTimer Tools) C:\Users\Mika\Downloads\TFC.exe
2015-03-05 15:23 - 2015-03-05 15:23 - 00001091 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Secunia PSI.lnk
2015-03-05 15:23 - 2015-03-05 15:23 - 00000000 ____D () C:\Users\Mika\AppData\Local\Secunia PSI
2015-03-05 15:23 - 2015-03-05 15:23 - 00000000 ____D () C:\Program Files (x86)\Secunia
2015-03-05 15:22 - 2015-03-05 15:23 - 05490752 _____ (Secunia) C:\Users\Mika\Downloads\PSISetup10004.exe
2015-03-05 15:04 - 2015-03-05 15:06 - 00001479 _____ () C:\DelFix.txt
2015-03-05 13:20 - 2015-03-05 13:20 - 00003130 _____ () C:\Windows\System32\Tasks\{EF9F9432-56D5-4276-9BC8-1E4A4270E62B}
2015-03-05 13:13 - 2015-03-05 13:13 - 00000000 ____D () C:\Users\Mika\AppData\Roaming\dlg
2015-03-05 13:12 - 2015-03-05 13:12 - 00000000 __SHD () C:\Users\Mika\AppData\Local\EmieBrowserModeList
2015-03-05 13:10 - 2015-03-05 13:10 - 00000000 ____D () C:\Users\Mika\AppData\Roaming\QuickScan
2015-03-05 13:06 - 2015-03-05 17:46 - 00000000 ____D () C:\Users\Mika\AppData\Roaming\InetStat
2015-03-05 13:04 - 2015-03-05 13:04 - 00572432 _____ () C:\Users\Mika\Downloads\gimp-Download.exe
2015-03-05 12:37 - 2015-03-05 13:01 - 00000000 ____D () C:\Users\Mika\Desktop\STA Fotos
2015-03-05 12:35 - 2015-03-05 12:35 - 06593997 _____ () C:\Users\Mika\Downloads\Fotos Milieus Abschlussbericht.7z
2015-03-01 21:42 - 2015-03-01 21:42 - 11157403 _____ () C:\Users\Mika\Downloads\attachments (17).zip
2015-03-01 19:24 - 2015-03-01 19:24 - 06594884 _____ () C:\Users\Mika\Downloads\attachments (16).zip
2015-03-01 10:19 - 2015-03-01 10:19 - 00281848 _____ () C:\Windows\Minidump\030115-28812-01.dmp
2015-02-28 15:37 - 2014-12-13 22:28 - 00513488 _____ () C:\Windows\SysWOW64\locale.nls
2015-02-28 15:37 - 2014-12-13 22:28 - 00513488 _____ () C:\Windows\system32\locale.nls
2015-02-28 15:37 - 2014-10-29 02:27 - 01200128 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Globalization.dll
2015-02-28 15:37 - 2014-10-29 02:27 - 00323072 _____ (Microsoft Corporation) C:\Windows\system32\GlobCollationHost.dll
2015-02-28 15:37 - 2014-10-29 02:04 - 00868352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Globalization.dll
2015-02-28 15:37 - 2014-10-29 02:04 - 00200704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\GlobCollationHost.dll
2015-02-24 17:16 - 2015-02-24 17:16 - 00052893 _____ () C:\Users\Mika\Downloads\Präsentation NEU (3).pptx
2015-02-24 17:01 - 2015-02-24 17:01 - 00052893 _____ () C:\Users\Mika\Downloads\Präsentation NEU (2).pptx
2015-02-24 17:00 - 2015-02-24 17:00 - 00052893 _____ () C:\Users\Mika\Downloads\Präsentation NEU (1).pptx
2015-02-24 16:58 - 2015-02-24 16:58 - 00052893 _____ () C:\Users\Mika\Downloads\Präsentation NEU.pptx
2015-02-24 15:45 - 2015-02-24 15:45 - 03541590 _____ () C:\Users\Mika\Downloads\Zweite Lieferung milieus-gewichtet.xlsx
2015-02-24 15:42 - 2015-02-24 15:42 - 00076472 _____ () C:\Users\Mika\Downloads\Präsentation1.pptx
2015-02-23 13:27 - 2015-02-23 13:27 - 01644971 _____ () C:\Users\Mika\Desktop\Fotosammlung Dereköy verkleinert.zip
2015-02-23 13:22 - 2015-02-23 13:22 - 00001020 _____ () C:\Users\Mika\Desktop\IrfanView.lnk
2015-02-23 13:20 - 2015-02-23 13:20 - 02197648 _____ (Irfan Skiljan) C:\Users\Mika\Downloads\iview438g_setup (1).exe
2015-02-23 13:12 - 2015-02-23 13:18 - 00000000 ____D () C:\Users\Mika\Desktop\Fotosammlung Dereköy verkleinert
2015-02-22 21:58 - 2015-02-22 21:58 - 00000000 ____D () C:\Program Files (x86)\MSECache
2015-02-22 21:57 - 2015-02-22 21:58 - 19998504 _____ (Microsoft Corporation) C:\Users\Mika\Downloads\proofingtools_de-de-x64.exe
2015-02-22 16:52 - 2015-02-22 16:52 - 00000000 ____D () C:\Users\Mika\AppData\Roaming\IrfanView
2015-02-22 16:52 - 2015-02-22 16:52 - 00000000 ____D () C:\Program Files (x86)\IrfanView
2015-02-22 16:51 - 2015-02-22 16:51 - 02197648 _____ (Irfan Skiljan) C:\Users\Mika\Downloads\iview438g_setup (3).exe
2015-02-22 16:51 - 2015-02-22 16:51 - 02197648 _____ (Irfan Skiljan) C:\Users\Mika\Downloads\iview438g_setup (2).exe
2015-02-22 16:47 - 2015-02-22 16:47 - 02197648 _____ (Irfan Skiljan) C:\Users\Mika\Downloads\iview438g_setup.exe
2015-02-22 12:19 - 2015-02-22 12:19 - 01728218 _____ () C:\Users\Mika\Downloads\openvpn-install.exe
2015-02-21 22:26 - 2015-02-21 22:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2015-02-21 22:26 - 2015-02-21 22:26 - 00000000 ____D () C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7
2015-02-21 22:26 - 2015-02-21 22:26 - 00000000 ____D () C:\Program Files\iTunes
2015-02-21 22:26 - 2015-02-21 22:26 - 00000000 ____D () C:\Program Files\iPod
2015-02-21 22:26 - 2015-02-21 22:26 - 00000000 ____D () C:\Program Files (x86)\iTunes
2015-02-20 17:07 - 2015-02-20 17:07 - 00000000 _____ () C:\Users\Mika\Downloads\f.txt
2015-02-20 15:16 - 2015-02-20 15:17 - 00000000 ____D () C:\Users\Mika\Documents\Outlook Files
2015-02-20 15:16 - 2015-02-20 15:16 - 00394049 _____ () C:\Users\Mika\Downloads\noname (1).eml
2015-02-20 15:16 - 2015-02-20 15:16 - 00010158 _____ () C:\Users\Mika\Downloads\noname (2).eml
2015-02-20 15:15 - 2015-02-20 15:15 - 00006023 _____ () C:\Users\Mika\Downloads\noname.eml
2015-02-18 17:32 - 2015-01-23 05:41 - 06041600 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-02-18 17:32 - 2015-01-23 04:17 - 04300800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-02-17 13:40 - 2015-02-17 13:40 - 00073856 _____ (Identiv) C:\Windows\system32\Drivers\S3XXx64.sys
2015-02-16 19:52 - 2015-02-20 15:16 - 00000000 ____D () C:\Users\Mika\AppData\Roaming\Apple Computer
2015-02-16 19:52 - 2015-02-16 19:52 - 00000000 ____D () C:\Users\Mika\AppData\Local\Apple Computer
2015-02-16 19:51 - 2012-10-03 16:14 - 00033240 _____ (GEAR Software Inc.) C:\Windows\system32\Drivers\GEARAspiWDM.sys
2015-02-16 19:50 - 2015-02-16 19:50 - 00000000 ____D () C:\ProgramData\Apple Computer
2015-02-16 19:49 - 2015-02-16 19:49 - 00002535 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
2015-02-16 19:49 - 2015-02-16 19:49 - 00000000 ____D () C:\Windows\System32\Tasks\Apple
2015-02-16 19:49 - 2015-02-16 19:49 - 00000000 ____D () C:\Users\Mika\AppData\Local\Apple
2015-02-16 19:49 - 2015-02-16 19:49 - 00000000 ____D () C:\Program Files\Bonjour
2015-02-16 19:49 - 2015-02-16 19:49 - 00000000 ____D () C:\Program Files (x86)\Bonjour
2015-02-16 19:49 - 2015-02-16 19:49 - 00000000 ____D () C:\Program Files (x86)\Apple Software Update
2015-02-16 19:48 - 2015-02-21 22:26 - 00000000 ____D () C:\Program Files\Common Files\Apple
2015-02-16 19:48 - 2015-02-16 19:49 - 00000000 ____D () C:\ProgramData\Apple
2015-02-16 19:45 - 2015-02-16 19:46 - 152439600 _____ (Apple Inc.) C:\Users\Mika\Downloads\itunes6464setup.exe
2015-02-15 23:08 - 2015-02-15 23:08 - 31398083 _____ () C:\Users\Mika\Downloads\Client Document Package.zip
2015-02-15 22:20 - 2015-02-15 22:20 - 00004034 _____ () C:\Windows\System32\Tasks\PCDoctorBackgroundMonitorTask
2015-02-15 22:20 - 2015-02-15 22:20 - 00003484 _____ () C:\Windows\System32\Tasks\PCDEventLauncherTask
2015-02-15 22:20 - 2015-02-15 22:20 - 00003224 _____ () C:\Windows\System32\Tasks\SystemToolsDailyTest
2015-02-15 22:20 - 2015-02-15 22:20 - 00000000 ____D () C:\ProgramData\PC-Doctor for Windows
2015-02-15 22:20 - 2015-02-15 22:20 - 00000000 ____D () C:\Program Files\Dell Support Center
2015-02-13 19:31 - 2015-02-04 00:38 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-02-13 19:31 - 2015-02-04 00:08 - 00761856 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-02-13 19:31 - 2015-02-04 00:08 - 00414208 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-02-13 19:31 - 2015-02-03 00:11 - 01098752 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-02-13 19:31 - 2015-02-03 00:11 - 00894464 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-02-13 19:31 - 2015-02-03 00:11 - 00609280 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-02-13 19:31 - 2015-01-19 19:42 - 01487976 _____ (Microsoft Corporation) C:\Windows\system32\sppobjs.dll
2015-02-13 19:31 - 2014-12-19 09:57 - 00788680 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2015-02-13 19:31 - 2014-12-19 09:25 - 00602776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2015-02-13 19:31 - 2014-12-09 00:12 - 00391526 _____ () C:\Windows\system32\ApnDatabase.xml
2015-02-10 22:19 - 2015-01-15 23:43 - 00563504 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-02-10 22:19 - 2015-01-15 23:43 - 00177984 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-02-10 22:19 - 2015-01-14 05:22 - 00445440 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-02-10 22:19 - 2015-01-14 04:53 - 00324096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2015-02-10 22:19 - 2015-01-13 23:11 - 01762840 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-02-10 22:19 - 2015-01-13 23:04 - 01489072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2015-02-10 22:19 - 2015-01-12 04:09 - 25056256 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-02-10 22:19 - 2015-01-10 10:10 - 07472960 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-02-10 22:19 - 2015-01-10 10:10 - 01733440 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-02-10 22:19 - 2015-01-10 09:28 - 01498360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-02-10 22:19 - 2015-01-10 08:00 - 00430080 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-02-10 22:19 - 2015-01-10 07:38 - 00359424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-02-10 22:19 - 2014-12-09 04:45 - 00393728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll
2015-02-10 22:19 - 2014-12-09 02:56 - 00538624 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll
2015-02-10 22:19 - 2014-10-29 03:51 - 00154112 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-02-10 22:19 - 2014-10-29 03:50 - 00736768 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-02-10 22:19 - 2014-10-29 03:06 - 00736768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-02-10 22:19 - 2014-10-29 03:06 - 00154112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-02-10 22:19 - 2014-10-29 03:02 - 00285184 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-02-10 22:19 - 2014-10-29 03:02 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-02-10 22:19 - 2014-10-29 02:57 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-02-10 22:19 - 2014-10-29 02:31 - 01441792 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-02-10 22:19 - 2014-10-29 02:15 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-02-10 22:19 - 2014-10-29 02:15 - 00005632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-02-10 22:19 - 2014-10-29 02:14 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-02-10 22:19 - 2014-10-29 02:13 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-02-10 22:19 - 2014-10-29 02:13 - 00008704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-02-10 22:18 - 2015-01-12 03:48 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-02-10 22:18 - 2015-01-12 03:48 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-02-10 22:18 - 2015-01-12 03:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-02-10 22:18 - 2015-01-12 03:34 - 00816128 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-02-10 22:18 - 2015-01-12 03:25 - 19740160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-02-10 22:18 - 2015-01-12 03:21 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-02-10 22:18 - 2015-01-12 03:08 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-02-10 22:18 - 2015-01-12 03:07 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-02-10 22:18 - 2015-01-12 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-02-10 22:18 - 2015-01-12 03:02 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-02-10 22:18 - 2015-01-12 02:58 - 01032704 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2015-02-10 22:18 - 2015-01-12 02:55 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-02-10 22:18 - 2015-01-12 02:51 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2015-02-10 22:18 - 2015-01-12 02:48 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-02-10 22:18 - 2015-01-12 02:48 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-02-10 22:18 - 2015-01-12 02:48 - 00374272 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-02-10 22:18 - 2015-01-12 02:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-02-10 22:18 - 2015-01-12 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-02-10 22:18 - 2015-01-12 02:43 - 14401024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-02-10 22:18 - 2015-01-12 02:34 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2015-02-10 22:18 - 2015-01-12 02:30 - 00880128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2015-02-10 22:18 - 2015-01-12 02:27 - 02865152 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll
2015-02-10 22:18 - 2015-01-12 02:27 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-02-10 22:18 - 2015-01-12 02:25 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2015-02-10 22:18 - 2015-01-12 02:23 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-02-10 22:18 - 2015-01-12 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-02-10 22:18 - 2015-01-12 02:23 - 00327168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-02-10 22:18 - 2015-01-12 02:14 - 12829184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-02-10 22:18 - 2015-01-12 02:14 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-02-10 22:18 - 2015-01-12 02:02 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-02-10 22:18 - 2015-01-12 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-02-10 22:18 - 2015-01-12 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-02-10 22:18 - 2015-01-12 01:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-02-10 22:18 - 2015-01-10 09:22 - 04175872 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-02-05 07:11 - 2015-02-05 07:11 - 00808667 _____ () C:\Users\Mika\Downloads\mkoiiinicole.zip

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-06 16:44 - 2014-01-05 03:01 - 02083101 _____ () C:\Windows\WindowsUpdate.log
2015-03-06 16:21 - 2014-10-07 20:14 - 00000000 ____D () C:\Users\Mika\AppData\Roaming\Skype
2015-03-06 16:21 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\sru
2015-03-06 13:58 - 2014-04-06 16:22 - 00000930 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-03-06 13:58 - 2014-04-06 16:22 - 00000926 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-03-05 19:02 - 2014-04-04 06:40 - 00003600 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1401536446-3937075962-3797694313-1001
2015-03-05 18:55 - 2014-08-22 21:44 - 00001380 _____ () C:\Users\Mika\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk
2015-03-05 18:55 - 2014-04-04 06:34 - 00001448 _____ () C:\Users\Mika\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-03-05 18:54 - 2014-04-24 08:46 - 00002337 _____ () C:\Users\Administrator\Desktop\Google Chrome.lnk
2015-03-05 18:44 - 2014-04-13 22:48 - 02023424 ___SH () C:\Users\Mika\Desktop\Thumbs.db
2015-03-05 18:39 - 2014-04-04 06:34 - 00000000 ____D () C:\Users\Mika\AppData\Local\Packages
2015-03-05 18:25 - 2014-04-29 21:48 - 01916928 ___SH () C:\Users\Mika\Downloads\Thumbs.db
2015-03-05 18:12 - 2014-01-05 03:13 - 00000000 ____D () C:\Program Files (x86)\Dell Backup and Recovery
2015-03-05 18:06 - 2014-04-04 06:54 - 00000000 ___DO () C:\Users\Mika\SkyDrive
2015-03-05 18:03 - 2014-01-05 02:40 - 00193342 _____ () C:\Windows\PFRO.log
2015-03-05 18:03 - 2013-08-22 15:46 - 00032728 _____ () C:\Windows\setupact.log
2015-03-05 18:03 - 2013-08-22 15:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-03-05 18:03 - 2013-08-22 14:25 - 00524288 ___SH () C:\Windows\system32\config\BBI
2015-03-05 15:19 - 2014-09-05 08:19 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2015-03-05 15:13 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\AppReadiness
2015-03-05 15:07 - 2014-04-24 09:06 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-03-05 11:50 - 2014-04-23 10:49 - 00000000 ____D () C:\Users\Mika\AppData\Local\Adobe
2015-03-05 11:43 - 2014-08-03 22:40 - 00000000 ____D () C:\Users\Mika\Desktop\Meine Hochzeit
2015-03-05 11:22 - 2015-01-26 16:29 - 00000000 ____D () C:\Users\Mika\AppData\Roaming\vlc
2015-03-05 11:12 - 2014-11-02 21:06 - 00000000 ____D () C:\Users\Mika\AppData\Local\Windows Live
2015-03-05 11:04 - 2014-06-11 09:43 - 00000000 ____D () C:\Users\Mika\MediathekView
2015-03-05 11:03 - 2014-08-16 10:24 - 00000000 ____D () C:\Users\Mika\Downloads\MediathekView_7
2015-03-05 11:03 - 2014-06-11 09:38 - 00000000 ____D () C:\Users\Mika\.mediathek3
2015-03-05 11:03 - 2014-06-11 09:37 - 00000000 ____D () C:\Users\Mika\Downloads\MediathekView_6
2015-03-01 23:39 - 2014-04-04 06:31 - 00000000 ____D () C:\Users\Mika
2015-03-01 10:19 - 2014-04-24 10:57 - 00000000 ____D () C:\Windows\Minidump
2015-03-01 10:19 - 2014-04-24 10:56 - 558134323 _____ () C:\Windows\MEMORY.DMP
2015-03-01 00:30 - 2013-08-22 16:20 - 00000000 ____D () C:\Windows\CbsTemp
2015-02-18 17:17 - 2013-08-22 15:44 - 05051904 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-02-18 17:15 - 2014-04-07 21:39 - 00000000 ____D () C:\Windows\system32\MRT
2015-02-18 17:12 - 2014-12-25 20:30 - 00000000 ____D () C:\Windows\system32\appraiser
2015-02-18 17:12 - 2014-08-07 21:58 - 00000000 ___SD () C:\Windows\system32\CompatTel
2015-02-17 22:48 - 2014-04-07 21:39 - 116773704 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-02-17 22:47 - 2014-04-24 09:48 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2015-02-17 22:47 - 2014-04-24 09:43 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-02-17 22:10 - 2014-01-05 03:01 - 00000000 ____D () C:\ProgramData\Package Cache
2015-02-17 21:53 - 2013-08-22 14:25 - 00000199 _____ () C:\Windows\win.ini
2015-02-15 22:20 - 2014-01-05 03:09 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dell
2015-02-15 22:19 - 2014-01-05 03:09 - 00000000 ____D () C:\ProgramData\PCDr
2015-02-15 22:19 - 2014-01-05 03:00 - 00000000 ____D () C:\Program Files\Dell
2015-02-08 18:45 - 2014-01-05 02:55 - 00865408 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-02-07 13:53 - 2014-04-06 16:22 - 00003902 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-02-07 13:53 - 2014-04-06 16:22 - 00003666 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-02-05 13:10 - 2014-10-28 19:43 - 00000000 ____D () C:\Users\Mika\Desktop\Mueko III

==================== Files in the root of some directories =======

2014-01-05 02:42 - 2014-01-05 02:42 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2014-04-23 10:39 - 2014-04-23 10:40 - 0000315 _____ () C:\ProgramData\NCIDebug.log
2014-01-05 03:08 - 2014-01-05 03:08 - 0000121 _____ () C:\ProgramData\{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}.log
2014-01-05 03:05 - 2014-01-05 03:06 - 0000106 _____ () C:\ProgramData\{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}.log
2014-01-05 03:06 - 2014-01-05 03:07 - 0000111 _____ () C:\ProgramData\{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}.log
2014-01-05 03:07 - 2014-01-05 03:08 - 0000108 _____ () C:\ProgramData\{B46BEA36-0B71-4A4E-AE41-87241643FA0A}.log
2014-01-05 03:05 - 2014-01-05 03:05 - 0000107 _____ () C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-01-26 11:39

==================== End Of Log ============================

--- --- ---

schrauber · 07.03.2015, 12:50

Das Log von MBAM?

Mareike1984 · 07.03.2015, 18:36

Hi Schrauber,

leider habe ich keine Logfiles von den letzten Tagen erstellt. Jetzt gerade habe ich nochmals ein logfile ueber Malewarebytes erstellt. Es wurden jedoch nur 2 Bedrohungen gefunden. Das aendert sich aber bestimmt wieder im Laufe des Tages, da ich die anderen ja immer in Quarantaene gepackt habe.

Wenn ich eine Internetseite oeffne, dann werden direkt immer 5 mysearchengine Websites angezeigt und auf allen moeglichen Seiten habe ich so komische Popups und staendig oeffnen sich andere Fenster. Eieiei....

Danke fuer die weitere Behandlung meines Problems

MAreike

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 3/7/2015
Suchlauf-Zeit: 5:07:11 PM
Logdatei: Logfile MBAM.txt
Administrator: Ja

Version: 2.00.4.1028
Malware Datenbank: v2015.03.07.03
Rootkit Datenbank: v2015.02.25.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 8.1
CPU: x64
Dateisystem: NTFS
Benutzer: Mika

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 398824
Verstrichene Zeit: 28 Min, 57 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(Keine schädliche Elemente erkannt)

Module: 0
(Keine schädliche Elemente erkannt)

Registrierungsschlüssel: 0
(Keine schädliche Elemente erkannt)

Registrierungswerte: 0
(Keine schädliche Elemente erkannt)

Registrierungsdaten: 0
(Keine schädliche Elemente erkannt)

Ordner: 0
(Keine schädliche Elemente erkannt)

Dateien: 2
PUP.Optional.MyStartSearch.A, C:\Users\Mika\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.mystartsearch.com_0.localstorage, Löschen bei Neustart, [0ea192b00684ae886cc27f2ffa09a15f], 
PUP.Optional.MyStartSearch.A, C:\Users\Mika\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.mystartsearch.com_0.localstorage-journal, Löschen bei Neustart, [bcf3d270cac083b3e04ec3eb1ce72cd4], 

Physische Sektoren: 0
(Keine schädliche Elemente erkannt)


(end)

Oh ich habe es doch noch gefunden. Hier das Logfile vom 5.3.2015

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 3/5/2015
Suchlauf-Zeit: 3:37:11 PM
Logdatei: Logfile MBAM 5.3.2015.txt
Administrator: Ja

Version: 2.00.4.1028
Malware Datenbank: v2015.03.05.02
Rootkit Datenbank: v2015.02.25.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 8.1
CPU: x64
Dateisystem: NTFS
Benutzer: Mika

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 397140
Verstrichene Zeit: 34 Min, 52 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 2
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\ProtectService.exe, 2728, Löschen bei Neustart, [ce1884bd8505270f903347c6ab571ee2]
PUP.Optional.WindowsMangerProtect.A, C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe, 1956, Löschen bei Neustart, [ba2ca899107a8aac3925109fa45feb15]

Module: 2
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\msvcp110.dll, Löschen bei Neustart, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\msvcr110.dll, Löschen bei Neustart, [52940c352268a492e7c21893ca39a25e], 

Registrierungsschlüssel: 15
PUP.Optional.XTab.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\IHProtect Service, In Quarantäne, [ce1884bd8505270f903347c6ab571ee2], 
PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}, In Quarantäne, [c81e3b069febb482c321ba627b881fe1], 
PUP.Optional.SupTab.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}, In Quarantäne, [c81e3b069febb482c321ba627b881fe1], 
PUP.Optional.SupTab.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{917CAAE9-DD47-4025-936E-1414F07DF5B8}, In Quarantäne, [c81e3b069febb482c321ba627b881fe1], 
PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{917CAAE9-DD47-4025-936E-1414F07DF5B8}, In Quarantäne, [c81e3b069febb482c321ba627b881fe1], 
PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}, In Quarantäne, [c81e3b069febb482c321ba627b881fe1], 
PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}, In Quarantäne, [c81e3b069febb482c321ba627b881fe1], 
PUP.Optional.Qone8, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, In Quarantäne, [668090b1bdcd70c673fdf21fb253eb15], 
PUP.Optional.IHProtect.A, HKLM\SOFTWARE\WOW6432NODE\IHProtect, In Quarantäne, [9e48221ffd8ddb5befb90d9e23e07f81], 
PUP.Optional.MyStartSearch.A, HKLM\SOFTWARE\WOW6432NODE\mystartsearchSoftware, In Quarantäne, [9254db66e9a12e08bcc0e4cf14efa858], 
PUP.Optional.Qone8, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, In Quarantäne, [bc2a43fe9af07abc4e2244cd70955ea2], 
PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\SUPTAB, In Quarantäne, [6c7ab190f89265d1c3a501c0b3501ee2], 
PUP.Optional.WindowsMangerProtect.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\WindowsMangerProtect, In Quarantäne, [ba2ca899107a8aac3925109fa45feb15], 
PUP.Optional.WindowsMangerProtect.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\EVENTLOG\APPLICATION\WindowsMangerProtect, In Quarantäne, [6b7ba79a8901fe386a39971fb2517789], 
PUP.Optional.Qone8, HKU\S-1-5-21-1401536446-3937075962-3797694313-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, In Quarantäne, [e501d76a8109bd79105fdb366a9b5fa1], 

Registrierungswerte: 4
PUP.Optional.SearchEngine.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS|searchengine@gmail.com, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\searchengine@gmail.com, In Quarantäne, [7274b28ffa90b08661e284aed431639d]
PUP.Optional.IStart.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS|istart_ffnt@gmail.com, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com, In Quarantäne, [fee8d86961295fd7030d821e33d0cd33]
PUP.Optional.FFToolbar.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS|fftoolbar2014@etech.com, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\fftoolbar2014@etech.com, In Quarantäne, [eff73011187288aecc78b5f6c73ce31d]
PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\SUPTAB|ptid, cvs, In Quarantäne, [6c7ab190f89265d1c3a501c0b3501ee2]

Registrierungsdaten: 16
PUP.Optional.MyStartSearch.A, HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND, C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.mystartsearch.com/?type=sc&ts=1425557118&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421, Gut: (iexplore.exe), Schlecht: (C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.mystartsearch.com/?type=sc&ts=1425557118&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421),Ersetzt,[3da99fa29bef2412e7c722ad32d3857b]
PUP.Optional.MyStartSearch.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, hxxp://www.mystartsearch.com/web/?type=ds&ts=1425557118&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://www.mystartsearch.com/web/?type=ds&ts=1425557118&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421&q={searchTerms}),Ersetzt,[0ed891b0d5b596a0c756ad225baab54b]
PUP.Optional.MyStartSearch.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, hxxp://www.mystartsearch.com/?type=hppp&ts=1425557178&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421, Gut: (www.google.com), Schlecht: (hxxp://www.mystartsearch.com/?type=hppp&ts=1425557178&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421),Ersetzt,[e7ffb091b2d82c0a5fbea02f6f96c937]
PUP.Optional.MyStartSearch.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://www.mystartsearch.com/?type=hppp&ts=1425557178&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421, Gut: (www.google.com), Schlecht: (hxxp://www.mystartsearch.com/?type=hppp&ts=1425557178&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421),Ersetzt,[db0be958d9b1e94d5bc2d8f7e421e61a]
PUP.Optional.MyStartSearch.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, hxxp://www.mystartsearch.com/web/?type=ds&ts=1425557118&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://www.mystartsearch.com/web/?type=ds&ts=1425557118&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421&q={searchTerms}),Ersetzt,[19cde061c6c440f6b16cba1529dc33cd]
PUP.Optional.Qone8, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Gut: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Schlecht: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),Ersetzt,[3bab360b335710267433ffdc09fcda26]
PUP.Optional.MyStartSearch.A, HKLM\SOFTWARE\WOW6432NODE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND, C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.mystartsearch.com/?type=sc&ts=1425557118&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421, Gut: (iexplore.exe), Schlecht: (C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.mystartsearch.com/?type=sc&ts=1425557118&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421),Ersetzt,[5b8b8fb28802290d3e70636cb64fe11f]
PUP.Optional.MyStartSearch.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, hxxp://www.mystartsearch.com/web/?type=ds&ts=1425557118&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://www.mystartsearch.com/web/?type=ds&ts=1425557118&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421&q={searchTerms}),Ersetzt,[c323f24f6327c96db6676a65976edf21]
PUP.Optional.MyStartSearch.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, hxxp://www.mystartsearch.com/?type=hppp&ts=1425557178&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421, Gut: (www.google.com), Schlecht: (hxxp://www.mystartsearch.com/?type=hppp&ts=1425557178&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421),Ersetzt,[fcea55ec3d4d979f56c748878283946c]
PUP.Optional.MyStartSearch.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://www.mystartsearch.com/?type=hppp&ts=1425557178&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421, Gut: (www.google.com), Schlecht: (hxxp://www.mystartsearch.com/?type=hppp&ts=1425557178&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421),Ersetzt,[9d49162b94f68da97f9e488764a1b14f]
PUP.Optional.MyStartSearch.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, hxxp://www.mystartsearch.com/web/?type=ds&ts=1425557118&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://www.mystartsearch.com/web/?type=ds&ts=1425557118&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421&q={searchTerms}),Ersetzt,[a541053ccac02016ff1ecf004eb7f40c]
PUP.Optional.Qone8, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Gut: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Schlecht: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),Ersetzt,[f7ef0a37503aa78ffea9c714ea1be31d]
PUP.Optional.MyStartSearch.A, HKU\S-1-5-21-1401536446-3937075962-3797694313-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, hxxp://www.mystartsearch.com/web/?type=ds&ts=1425557118&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://www.mystartsearch.com/web/?type=ds&ts=1425557118&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421&q={searchTerms}),Ersetzt,[bf2790b1bcce8aac7f9f824d03024eb2]
PUP.Optional.MyStartSearch.A, HKU\S-1-5-21-1401536446-3937075962-3797694313-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://www.mystartsearch.com/?type=hppp&ts=1425557178&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421, Gut: (www.google.com), Schlecht: (hxxp://www.mystartsearch.com/?type=hppp&ts=1425557178&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421),Ersetzt,[a0461a271d6d290d52cc0ac559ac8878]
PUP.Optional.MyStartSearch.A, HKU\S-1-5-21-1401536446-3937075962-3797694313-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, hxxp://www.mystartsearch.com/?type=hppp&ts=1425557178&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421, Gut: (www.google.com), Schlecht: (hxxp://www.mystartsearch.com/?type=hppp&ts=1425557178&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421),Ersetzt,[9254ee53d2b8e84e8e90b916d62fe719]
PUP.Optional.MyStartSearch.A, HKU\S-1-5-21-1401536446-3937075962-3797694313-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, hxxp://www.mystartsearch.com/web/?type=ds&ts=1425557118&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://www.mystartsearch.com/web/?type=ds&ts=1425557118&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421&q={searchTerms}),Ersetzt,[f9edbb86107a8babf22ce7e8cd383cc4]

Ordner: 72
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab, Löschen bei Neustart, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\image, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\img, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\js, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\en-US, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\es-419, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\es-ES, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\fr-BE, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\fr-CA, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\fr-CH, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\fr-FR, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\fr-LU, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\it-CH, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\it-IT, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\pl, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\pt, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\pt-BR, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\ru, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\ru-MO, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\tr-TR, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\vi-VI, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\zh-CN, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\zh-TW, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.WPM.A, C:\ProgramData\WindowsMangerProtect, Löschen bei Neustart, [a34387ba72188babf02c3746a3601ce4], 
PUP.Optional.WPM.A, C:\ProgramData\WindowsMangerProtect\update, In Quarantäne, [a34387ba72188babf02c3746a3601ce4], 
PUP.Optional.IHProtectUpDate.A, C:\ProgramData\IHProtectUpDate, In Quarantäne, [fcea073a9eec4aec951eb1e861a2be42], 
PUP.Optional.IHProtectUpDate.A, C:\ProgramData\IHProtectUpDate\update, In Quarantäne, [fcea073a9eec4aec951eb1e861a2be42], 
PUP.Optional.FFToolbar.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\fftoolbar2014@etech.com, In Quarantäne, [fcea6bd6cbbf60d627ba4257ea1912ee], 
PUP.Optional.FFToolbar.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\fftoolbar2014@etech.com\chrome, In Quarantäne, [fcea6bd6cbbf60d627ba4257ea1912ee], 
PUP.Optional.FFToolbar.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\fftoolbar2014@etech.com\chrome\content, In Quarantäne, [fcea6bd6cbbf60d627ba4257ea1912ee], 
PUP.Optional.FFToolbar.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\fftoolbar2014@etech.com\chrome\skin, In Quarantäne, [fcea6bd6cbbf60d627ba4257ea1912ee], 
PUP.Optional.Wajam.A, C:\Program Files (x86)\WNEnhance, In Quarantäne, [eff7033ea9e150e68b1d7429f50e8f71], 
PUP.Optional.SearchEngine.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\searchengine@gmail.com, In Quarantäne, [7373b091ed9d9f971c02504ea55e6898], 
PUP.Optional.SearchEngine.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\searchengine@gmail.com\chrome, In Quarantäne, [7373b091ed9d9f971c02504ea55e6898], 
PUP.Optional.SearchEngine.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\searchengine@gmail.com\chrome\content, In Quarantäne, [7373b091ed9d9f971c02504ea55e6898], 
PUP.Optional.SearchEngine.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\searchengine@gmail.com\chrome\skin, In Quarantäne, [7373b091ed9d9f971c02504ea55e6898], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\content, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\content\include, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\content\include\tools, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\content\js, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\content\js\lib, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\content\js\module, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\content\js\pack, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\en, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\en-US, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\es, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\es-419, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\fr, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\fr-BE, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\fr-CA, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\fr-CH, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\fr-LU, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\it, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\it-CH, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\pl, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\pt-BR, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\ru, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\ru-MO, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\tr, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\vi, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\zh-CN, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\zh-TW, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\skin, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\defaults, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\defaults\preferences, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\modules, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 

Dateien: 146
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\ProtectService.exe, Löschen bei Neustart, [ce1884bd8505270f903347c6ab571ee2], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\XTab\SupTab.dll, In Quarantäne, [c81e3b069febb482c321ba627b881fe1], 
PUP.Optional.BrowserWatch, C:\Program Files (x86)\XTab\BrowerWatchCH.dll, In Quarantäne, [aa3c94ad553574c232c8ef7ed42c32ce], 
PUP.Optional.BrowserWatch, C:\Program Files (x86)\XTab\BrowerWatchFF.dll, In Quarantäne, [db0b7cc5acdebc7afcfecf9e49b743bd], 
PUP.Optional.ELEX, C:\Program Files (x86)\XTab\HPNotify.exe, In Quarantäne, [1ccad66b94f6f93de38f34faec16a45c], 
PUP.Optional.MyStartSearch.A, C:\Users\Mika\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.mystartsearch.com_0.localstorage, In Quarantäne, [ab3b44fd692124129b79cbe0f40ff10f], 
PUP.Optional.MyStartSearch.A, C:\Users\Mika\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.mystartsearch.com_0.localstorage-journal, In Quarantäne, [8066360b276338fee92be9c23fc4728e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\uninstall.exe, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\BrowserAction.dll, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\CmdShell.exe, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\conf, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\ffsearch_toolbar!1.0.0.1025.xpi, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\IeWatchDog.dll, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\install.data, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\msvcp110.dll, Löschen bei Neustart, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\msvcr110.dll, Löschen bei Neustart, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\searchProvider.xml, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\about.png, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\about_bk.png, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\btn.png, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\btn_apply.png, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\close.png, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\conf.xml, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\conf_back.png, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\input_bk.png, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\logo.png, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\main.xml, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\radio_1.png, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\radio_2.png, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\rigth_arrow.png, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\settings.png, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\data.html, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\indexIE.html, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\indexIE8.html, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\main.css, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\ver.txt, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\img\google_trends.png, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\img\icon128.png, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\img\icon16.png, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\img\icon48.png, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\img\loading.gif, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\img\logo32.ico, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\js\common.js, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\js\ga.js, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\js\jquery-1.11.0.min.js, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\js\jquery.autocomplete.js, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\js\js.js, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\js\library.js, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\js\xagainit-ie8.js, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\js\xagainit2.0.js, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\en-US\messages.json, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\es-419\messages.json, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\es-ES\messages.json, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\fr-BE\messages.json, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\fr-CA\messages.json, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\fr-CH\messages.json, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\fr-FR\messages.json, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\fr-LU\messages.json, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\it-CH\messages.json, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\it-IT\messages.json, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\pl\messages.json, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\pt\messages.json, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\pt-BR\messages.json, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\ru\messages.json, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\ru-MO\messages.json, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\tr-TR\messages.json, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\vi-VI\messages.json, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\zh-CN\messages.json, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\zh-TW\messages.json, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.InetStat.A, C:\Users\Mika\AppData\Roaming\InetStat\inetstat.exe, In Quarantäne, [ce1873ce8bff2a0cb208c5f0649f22de], 
PUP.Optional.WindowsMangerProtect.A, C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe, Löschen bei Neustart, [ba2ca899107a8aac3925109fa45feb15], 
PUP.Optional.WPM.A, C:\ProgramData\WindowsMangerProtect\update\conf, In Quarantäne, [a34387ba72188babf02c3746a3601ce4], 
PUP.Optional.IHProtectUpDate.A, C:\ProgramData\IHProtectUpDate\update\conf, In Quarantäne, [fcea073a9eec4aec951eb1e861a2be42], 
PUP.Optional.FFToolbar.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\fftoolbar2014@etech.com\chrome.manifest, In Quarantäne, [fcea6bd6cbbf60d627ba4257ea1912ee], 
PUP.Optional.FFToolbar.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\fftoolbar2014@etech.com\install.rdf, In Quarantäne, [fcea6bd6cbbf60d627ba4257ea1912ee], 
PUP.Optional.FFToolbar.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\fftoolbar2014@etech.com\chrome\content\toolbar.js, In Quarantäne, [fcea6bd6cbbf60d627ba4257ea1912ee], 
PUP.Optional.FFToolbar.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\fftoolbar2014@etech.com\chrome\content\toolbar.xul, In Quarantäne, [fcea6bd6cbbf60d627ba4257ea1912ee], 
PUP.Optional.FFToolbar.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\fftoolbar2014@etech.com\chrome\skin\icon.png, In Quarantäne, [fcea6bd6cbbf60d627ba4257ea1912ee], 
PUP.Optional.SearchEngine.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\searchengine@gmail.com\chrome.manifest, In Quarantäne, [7373b091ed9d9f971c02504ea55e6898], 
PUP.Optional.SearchEngine.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\searchengine@gmail.com\install.rdf, In Quarantäne, [7373b091ed9d9f971c02504ea55e6898], 
PUP.Optional.SearchEngine.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\searchengine@gmail.com\chrome\content\toolbar.js, In Quarantäne, [7373b091ed9d9f971c02504ea55e6898], 
PUP.Optional.SearchEngine.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\searchengine@gmail.com\chrome\content\toolbar.xul, In Quarantäne, [7373b091ed9d9f971c02504ea55e6898], 
PUP.Optional.SearchEngine.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\searchengine@gmail.com\chrome\skin\icon.png, In Quarantäne, [7373b091ed9d9f971c02504ea55e6898], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome.manifest, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\install.rdf, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\content\index.html, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\content\quick_start.js, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\content\quick_start.xul, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\content\include\speed_dial.js, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\content\include\tools\about_blank_hook.js, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\content\include\tools\misc.js, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\content\include\tools\popup_image_helper.js, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\content\include\tools\urlrequestor.js, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\content\js\js.js, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\content\js\lib\doT.min.js, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\content\js\lib\jquery-2.1.0.min.js, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\content\js\lib\jquery.autocomplete.js, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\content\js\module\hotSearch.js, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\content\js\module\mostgrid.js, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\content\js\module\search.js, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\content\js\module\stat.js, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\content\js\pack\common.js, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\content\js\pack\ga.js, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\content\js\pack\xagainit.js, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\en\locale.properties, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\en-US\locale.properties, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\es\locale.properties, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\es-419\locale.properties, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\fr\locale.properties, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\fr-BE\locale.properties, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\fr-CA\locale.properties, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\fr-CH\locale.properties, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\fr-LU\locale.properties, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\it\locale.properties, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\it-CH\locale.properties, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\pl\locale.properties, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\pt-BR\locale.properties, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\ru\locale.properties, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\ru-MO\locale.properties, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\tr\locale.properties, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\vi\locale.properties, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\zh-CN\locale.properties, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\zh-TW\locale.properties, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\skin\default_logo.png, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\skin\googlelogo.png, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\skin\google_trends.png, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\skin\icon.png, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\skin\loading.gif, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\skin\logo.png, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\skin\newtab.ico, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\skin\simple.css, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\skin\style.css, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\defaults\preferences\fvd.js, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\defaults\preferences\preferences.js, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\modules\addonmanager.js, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\modules\aes.js, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\modules\config.js, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\modules\dialogs.js, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\modules\last_tab.js, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\modules\misc.js, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\modules\properties.js, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\modules\remoterequest.js, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\modules\restoreprefs.js, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\modules\settings.js, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.MyStartSearch.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\prefs.js, Gut: (), Schlecht: (user_pref("browser.newtab.url", "hxxp://www.mystartsearch.com/newtab/?type=nt&ts=1425557118&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421");), Ersetzt,[39ad55ec622856e0ad0472a3d5316997]
PUP.Optional.MyStartSearch.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\prefs.js, Gut: (), Schlecht: (user_pref("browser.startup.homepage", "hxxp://www.mystartsearch.com/?type=hppp&ts=1425557178&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421");), Ersetzt,[a046122f305a57dfdcd694811de94db3]

Physische Sektoren: 0
(Keine schädliche Elemente erkannt)


(end)

Oh ich habe es doch noch gefunden. Hier das Logfile vom 5.3.2015

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 3/5/2015
Suchlauf-Zeit: 3:37:11 PM
Logdatei: Logfile MBAM 5.3.2015.txt
Administrator: Ja

Version: 2.00.4.1028
Malware Datenbank: v2015.03.05.02
Rootkit Datenbank: v2015.02.25.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 8.1
CPU: x64
Dateisystem: NTFS
Benutzer: Mika

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 397140
Verstrichene Zeit: 34 Min, 52 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 2
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\ProtectService.exe, 2728, Löschen bei Neustart, [ce1884bd8505270f903347c6ab571ee2]
PUP.Optional.WindowsMangerProtect.A, C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe, 1956, Löschen bei Neustart, [ba2ca899107a8aac3925109fa45feb15]

Module: 2
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\msvcp110.dll, Löschen bei Neustart, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\msvcr110.dll, Löschen bei Neustart, [52940c352268a492e7c21893ca39a25e], 

Registrierungsschlüssel: 15
PUP.Optional.XTab.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\IHProtect Service, In Quarantäne, [ce1884bd8505270f903347c6ab571ee2], 
PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}, In Quarantäne, [c81e3b069febb482c321ba627b881fe1], 
PUP.Optional.SupTab.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}, In Quarantäne, [c81e3b069febb482c321ba627b881fe1], 
PUP.Optional.SupTab.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{917CAAE9-DD47-4025-936E-1414F07DF5B8}, In Quarantäne, [c81e3b069febb482c321ba627b881fe1], 
PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{917CAAE9-DD47-4025-936E-1414F07DF5B8}, In Quarantäne, [c81e3b069febb482c321ba627b881fe1], 
PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}, In Quarantäne, [c81e3b069febb482c321ba627b881fe1], 
PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}, In Quarantäne, [c81e3b069febb482c321ba627b881fe1], 
PUP.Optional.Qone8, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, In Quarantäne, [668090b1bdcd70c673fdf21fb253eb15], 
PUP.Optional.IHProtect.A, HKLM\SOFTWARE\WOW6432NODE\IHProtect, In Quarantäne, [9e48221ffd8ddb5befb90d9e23e07f81], 
PUP.Optional.MyStartSearch.A, HKLM\SOFTWARE\WOW6432NODE\mystartsearchSoftware, In Quarantäne, [9254db66e9a12e08bcc0e4cf14efa858], 
PUP.Optional.Qone8, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, In Quarantäne, [bc2a43fe9af07abc4e2244cd70955ea2], 
PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\SUPTAB, In Quarantäne, [6c7ab190f89265d1c3a501c0b3501ee2], 
PUP.Optional.WindowsMangerProtect.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\WindowsMangerProtect, In Quarantäne, [ba2ca899107a8aac3925109fa45feb15], 
PUP.Optional.WindowsMangerProtect.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\EVENTLOG\APPLICATION\WindowsMangerProtect, In Quarantäne, [6b7ba79a8901fe386a39971fb2517789], 
PUP.Optional.Qone8, HKU\S-1-5-21-1401536446-3937075962-3797694313-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, In Quarantäne, [e501d76a8109bd79105fdb366a9b5fa1], 

Registrierungswerte: 4
PUP.Optional.SearchEngine.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS|searchengine@gmail.com, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\searchengine@gmail.com, In Quarantäne, [7274b28ffa90b08661e284aed431639d]
PUP.Optional.IStart.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS|istart_ffnt@gmail.com, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com, In Quarantäne, [fee8d86961295fd7030d821e33d0cd33]
PUP.Optional.FFToolbar.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS|fftoolbar2014@etech.com, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\fftoolbar2014@etech.com, In Quarantäne, [eff73011187288aecc78b5f6c73ce31d]
PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\SUPTAB|ptid, cvs, In Quarantäne, [6c7ab190f89265d1c3a501c0b3501ee2]

Registrierungsdaten: 16
PUP.Optional.MyStartSearch.A, HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND, C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.mystartsearch.com/?type=sc&ts=1425557118&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421, Gut: (iexplore.exe), Schlecht: (C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.mystartsearch.com/?type=sc&ts=1425557118&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421),Ersetzt,[3da99fa29bef2412e7c722ad32d3857b]
PUP.Optional.MyStartSearch.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, hxxp://www.mystartsearch.com/web/?type=ds&ts=1425557118&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://www.mystartsearch.com/web/?type=ds&ts=1425557118&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421&q={searchTerms}),Ersetzt,[0ed891b0d5b596a0c756ad225baab54b]
PUP.Optional.MyStartSearch.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, hxxp://www.mystartsearch.com/?type=hppp&ts=1425557178&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421, Gut: (www.google.com), Schlecht: (hxxp://www.mystartsearch.com/?type=hppp&ts=1425557178&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421),Ersetzt,[e7ffb091b2d82c0a5fbea02f6f96c937]
PUP.Optional.MyStartSearch.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://www.mystartsearch.com/?type=hppp&ts=1425557178&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421, Gut: (www.google.com), Schlecht: (hxxp://www.mystartsearch.com/?type=hppp&ts=1425557178&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421),Ersetzt,[db0be958d9b1e94d5bc2d8f7e421e61a]
PUP.Optional.MyStartSearch.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, hxxp://www.mystartsearch.com/web/?type=ds&ts=1425557118&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://www.mystartsearch.com/web/?type=ds&ts=1425557118&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421&q={searchTerms}),Ersetzt,[19cde061c6c440f6b16cba1529dc33cd]
PUP.Optional.Qone8, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Gut: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Schlecht: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),Ersetzt,[3bab360b335710267433ffdc09fcda26]
PUP.Optional.MyStartSearch.A, HKLM\SOFTWARE\WOW6432NODE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND, C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.mystartsearch.com/?type=sc&ts=1425557118&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421, Gut: (iexplore.exe), Schlecht: (C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.mystartsearch.com/?type=sc&ts=1425557118&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421),Ersetzt,[5b8b8fb28802290d3e70636cb64fe11f]
PUP.Optional.MyStartSearch.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, hxxp://www.mystartsearch.com/web/?type=ds&ts=1425557118&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://www.mystartsearch.com/web/?type=ds&ts=1425557118&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421&q={searchTerms}),Ersetzt,[c323f24f6327c96db6676a65976edf21]
PUP.Optional.MyStartSearch.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, hxxp://www.mystartsearch.com/?type=hppp&ts=1425557178&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421, Gut: (www.google.com), Schlecht: (hxxp://www.mystartsearch.com/?type=hppp&ts=1425557178&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421),Ersetzt,[fcea55ec3d4d979f56c748878283946c]
PUP.Optional.MyStartSearch.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://www.mystartsearch.com/?type=hppp&ts=1425557178&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421, Gut: (www.google.com), Schlecht: (hxxp://www.mystartsearch.com/?type=hppp&ts=1425557178&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421),Ersetzt,[9d49162b94f68da97f9e488764a1b14f]
PUP.Optional.MyStartSearch.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, hxxp://www.mystartsearch.com/web/?type=ds&ts=1425557118&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://www.mystartsearch.com/web/?type=ds&ts=1425557118&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421&q={searchTerms}),Ersetzt,[a541053ccac02016ff1ecf004eb7f40c]
PUP.Optional.Qone8, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Gut: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Schlecht: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),Ersetzt,[f7ef0a37503aa78ffea9c714ea1be31d]
PUP.Optional.MyStartSearch.A, HKU\S-1-5-21-1401536446-3937075962-3797694313-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, hxxp://www.mystartsearch.com/web/?type=ds&ts=1425557118&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://www.mystartsearch.com/web/?type=ds&ts=1425557118&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421&q={searchTerms}),Ersetzt,[bf2790b1bcce8aac7f9f824d03024eb2]
PUP.Optional.MyStartSearch.A, HKU\S-1-5-21-1401536446-3937075962-3797694313-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://www.mystartsearch.com/?type=hppp&ts=1425557178&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421, Gut: (www.google.com), Schlecht: (hxxp://www.mystartsearch.com/?type=hppp&ts=1425557178&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421),Ersetzt,[a0461a271d6d290d52cc0ac559ac8878]
PUP.Optional.MyStartSearch.A, HKU\S-1-5-21-1401536446-3937075962-3797694313-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, hxxp://www.mystartsearch.com/?type=hppp&ts=1425557178&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421, Gut: (www.google.com), Schlecht: (hxxp://www.mystartsearch.com/?type=hppp&ts=1425557178&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421),Ersetzt,[9254ee53d2b8e84e8e90b916d62fe719]
PUP.Optional.MyStartSearch.A, HKU\S-1-5-21-1401536446-3937075962-3797694313-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, hxxp://www.mystartsearch.com/web/?type=ds&ts=1425557118&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://www.mystartsearch.com/web/?type=ds&ts=1425557118&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421&q={searchTerms}),Ersetzt,[f9edbb86107a8babf22ce7e8cd383cc4]

Ordner: 72
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab, Löschen bei Neustart, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\image, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\img, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\js, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\en-US, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\es-419, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\es-ES, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\fr-BE, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\fr-CA, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\fr-CH, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\fr-FR, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\fr-LU, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\it-CH, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\it-IT, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\pl, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\pt, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\pt-BR, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\ru, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\ru-MO, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\tr-TR, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\vi-VI, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\zh-CN, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\zh-TW, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.WPM.A, C:\ProgramData\WindowsMangerProtect, Löschen bei Neustart, [a34387ba72188babf02c3746a3601ce4], 
PUP.Optional.WPM.A, C:\ProgramData\WindowsMangerProtect\update, In Quarantäne, [a34387ba72188babf02c3746a3601ce4], 
PUP.Optional.IHProtectUpDate.A, C:\ProgramData\IHProtectUpDate, In Quarantäne, [fcea073a9eec4aec951eb1e861a2be42], 
PUP.Optional.IHProtectUpDate.A, C:\ProgramData\IHProtectUpDate\update, In Quarantäne, [fcea073a9eec4aec951eb1e861a2be42], 
PUP.Optional.FFToolbar.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\fftoolbar2014@etech.com, In Quarantäne, [fcea6bd6cbbf60d627ba4257ea1912ee], 
PUP.Optional.FFToolbar.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\fftoolbar2014@etech.com\chrome, In Quarantäne, [fcea6bd6cbbf60d627ba4257ea1912ee], 
PUP.Optional.FFToolbar.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\fftoolbar2014@etech.com\chrome\content, In Quarantäne, [fcea6bd6cbbf60d627ba4257ea1912ee], 
PUP.Optional.FFToolbar.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\fftoolbar2014@etech.com\chrome\skin, In Quarantäne, [fcea6bd6cbbf60d627ba4257ea1912ee], 
PUP.Optional.Wajam.A, C:\Program Files (x86)\WNEnhance, In Quarantäne, [eff7033ea9e150e68b1d7429f50e8f71], 
PUP.Optional.SearchEngine.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\searchengine@gmail.com, In Quarantäne, [7373b091ed9d9f971c02504ea55e6898], 
PUP.Optional.SearchEngine.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\searchengine@gmail.com\chrome, In Quarantäne, [7373b091ed9d9f971c02504ea55e6898], 
PUP.Optional.SearchEngine.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\searchengine@gmail.com\chrome\content, In Quarantäne, [7373b091ed9d9f971c02504ea55e6898], 
PUP.Optional.SearchEngine.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\searchengine@gmail.com\chrome\skin, In Quarantäne, [7373b091ed9d9f971c02504ea55e6898], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\content, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\content\include, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\content\include\tools, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\content\js, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\content\js\lib, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\content\js\module, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\content\js\pack, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\en, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\en-US, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\es, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\es-419, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\fr, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\fr-BE, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\fr-CA, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\fr-CH, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\fr-LU, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\it, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\it-CH, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\pl, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\pt-BR, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\ru, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\ru-MO, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\tr, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\vi, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\zh-CN, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\zh-TW, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\skin, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\defaults, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\defaults\preferences, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\modules, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 

Dateien: 146
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\ProtectService.exe, Löschen bei Neustart, [ce1884bd8505270f903347c6ab571ee2], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\XTab\SupTab.dll, In Quarantäne, [c81e3b069febb482c321ba627b881fe1], 
PUP.Optional.BrowserWatch, C:\Program Files (x86)\XTab\BrowerWatchCH.dll, In Quarantäne, [aa3c94ad553574c232c8ef7ed42c32ce], 
PUP.Optional.BrowserWatch, C:\Program Files (x86)\XTab\BrowerWatchFF.dll, In Quarantäne, [db0b7cc5acdebc7afcfecf9e49b743bd], 
PUP.Optional.ELEX, C:\Program Files (x86)\XTab\HPNotify.exe, In Quarantäne, [1ccad66b94f6f93de38f34faec16a45c], 
PUP.Optional.MyStartSearch.A, C:\Users\Mika\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.mystartsearch.com_0.localstorage, In Quarantäne, [ab3b44fd692124129b79cbe0f40ff10f], 
PUP.Optional.MyStartSearch.A, C:\Users\Mika\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.mystartsearch.com_0.localstorage-journal, In Quarantäne, [8066360b276338fee92be9c23fc4728e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\uninstall.exe, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\BrowserAction.dll, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\CmdShell.exe, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\conf, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\ffsearch_toolbar!1.0.0.1025.xpi, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\IeWatchDog.dll, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\install.data, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\msvcp110.dll, Löschen bei Neustart, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\msvcr110.dll, Löschen bei Neustart, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\searchProvider.xml, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\about.png, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\about_bk.png, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\btn.png, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\btn_apply.png, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\close.png, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\conf.xml, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\conf_back.png, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\input_bk.png, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\logo.png, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\main.xml, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\radio_1.png, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\radio_2.png, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\rigth_arrow.png, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\settings.png, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\data.html, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\indexIE.html, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\indexIE8.html, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\main.css, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\ver.txt, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\img\google_trends.png, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\img\icon128.png, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\img\icon16.png, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\img\icon48.png, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\img\loading.gif, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\img\logo32.ico, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\js\common.js, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\js\ga.js, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\js\jquery-1.11.0.min.js, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\js\jquery.autocomplete.js, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\js\js.js, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\js\library.js, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\js\xagainit-ie8.js, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\js\xagainit2.0.js, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\en-US\messages.json, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\es-419\messages.json, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\es-ES\messages.json, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\fr-BE\messages.json, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\fr-CA\messages.json, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\fr-CH\messages.json, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\fr-FR\messages.json, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\fr-LU\messages.json, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\it-CH\messages.json, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\it-IT\messages.json, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\pl\messages.json, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\pt\messages.json, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\pt-BR\messages.json, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\ru\messages.json, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\ru-MO\messages.json, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\tr-TR\messages.json, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\vi-VI\messages.json, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\zh-CN\messages.json, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\zh-TW\messages.json, In Quarantäne, [52940c352268a492e7c21893ca39a25e], 
PUP.Optional.InetStat.A, C:\Users\Mika\AppData\Roaming\InetStat\inetstat.exe, In Quarantäne, [ce1873ce8bff2a0cb208c5f0649f22de], 
PUP.Optional.WindowsMangerProtect.A, C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe, Löschen bei Neustart, [ba2ca899107a8aac3925109fa45feb15], 
PUP.Optional.WPM.A, C:\ProgramData\WindowsMangerProtect\update\conf, In Quarantäne, [a34387ba72188babf02c3746a3601ce4], 
PUP.Optional.IHProtectUpDate.A, C:\ProgramData\IHProtectUpDate\update\conf, In Quarantäne, [fcea073a9eec4aec951eb1e861a2be42], 
PUP.Optional.FFToolbar.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\fftoolbar2014@etech.com\chrome.manifest, In Quarantäne, [fcea6bd6cbbf60d627ba4257ea1912ee], 
PUP.Optional.FFToolbar.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\fftoolbar2014@etech.com\install.rdf, In Quarantäne, [fcea6bd6cbbf60d627ba4257ea1912ee], 
PUP.Optional.FFToolbar.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\fftoolbar2014@etech.com\chrome\content\toolbar.js, In Quarantäne, [fcea6bd6cbbf60d627ba4257ea1912ee], 
PUP.Optional.FFToolbar.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\fftoolbar2014@etech.com\chrome\content\toolbar.xul, In Quarantäne, [fcea6bd6cbbf60d627ba4257ea1912ee], 
PUP.Optional.FFToolbar.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\fftoolbar2014@etech.com\chrome\skin\icon.png, In Quarantäne, [fcea6bd6cbbf60d627ba4257ea1912ee], 
PUP.Optional.SearchEngine.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\searchengine@gmail.com\chrome.manifest, In Quarantäne, [7373b091ed9d9f971c02504ea55e6898], 
PUP.Optional.SearchEngine.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\searchengine@gmail.com\install.rdf, In Quarantäne, [7373b091ed9d9f971c02504ea55e6898], 
PUP.Optional.SearchEngine.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\searchengine@gmail.com\chrome\content\toolbar.js, In Quarantäne, [7373b091ed9d9f971c02504ea55e6898], 
PUP.Optional.SearchEngine.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\searchengine@gmail.com\chrome\content\toolbar.xul, In Quarantäne, [7373b091ed9d9f971c02504ea55e6898], 
PUP.Optional.SearchEngine.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\searchengine@gmail.com\chrome\skin\icon.png, In Quarantäne, [7373b091ed9d9f971c02504ea55e6898], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome.manifest, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\install.rdf, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\content\index.html, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\content\quick_start.js, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\content\quick_start.xul, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\content\include\speed_dial.js, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\content\include\tools\about_blank_hook.js, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\content\include\tools\misc.js, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\content\include\tools\popup_image_helper.js, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\content\include\tools\urlrequestor.js, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\content\js\js.js, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\content\js\lib\doT.min.js, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\content\js\lib\jquery-2.1.0.min.js, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\content\js\lib\jquery.autocomplete.js, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\content\js\module\hotSearch.js, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\content\js\module\mostgrid.js, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\content\js\module\search.js, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\content\js\module\stat.js, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\content\js\pack\common.js, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\content\js\pack\ga.js, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\content\js\pack\xagainit.js, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\en\locale.properties, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\en-US\locale.properties, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\es\locale.properties, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\es-419\locale.properties, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\fr\locale.properties, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\fr-BE\locale.properties, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\fr-CA\locale.properties, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\fr-CH\locale.properties, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\fr-LU\locale.properties, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\it\locale.properties, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\it-CH\locale.properties, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\pl\locale.properties, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\pt-BR\locale.properties, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\ru\locale.properties, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\ru-MO\locale.properties, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\tr\locale.properties, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\vi\locale.properties, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\zh-CN\locale.properties, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\locale\zh-TW\locale.properties, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\skin\default_logo.png, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\skin\googlelogo.png, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\skin\google_trends.png, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\skin\icon.png, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\skin\loading.gif, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\skin\logo.png, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\skin\newtab.ico, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\skin\simple.css, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\chrome\skin\style.css, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\defaults\preferences\fvd.js, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\defaults\preferences\preferences.js, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\modules\addonmanager.js, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\modules\aes.js, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\modules\config.js, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\modules\dialogs.js, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\modules\last_tab.js, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\modules\misc.js, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\modules\properties.js, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\modules\remoterequest.js, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\modules\restoreprefs.js, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.IStart.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com\modules\settings.js, In Quarantäne, [63836dd498f23cfa9a04b4eb1ce744bc], 
PUP.Optional.MyStartSearch.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\prefs.js, Gut: (), Schlecht: (user_pref("browser.newtab.url", "hxxp://www.mystartsearch.com/newtab/?type=nt&ts=1425557118&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421");), Ersetzt,[39ad55ec622856e0ad0472a3d5316997]
PUP.Optional.MyStartSearch.A, C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\prefs.js, Gut: (), Schlecht: (user_pref("browser.startup.homepage", "hxxp://www.mystartsearch.com/?type=hppp&ts=1425557178&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421");), Ersetzt,[a046122f305a57dfdcd694811de94db3]

Physische Sektoren: 0
(Keine schädliche Elemente erkannt)


(end)

schrauber · 08.03.2015, 09:58

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

Mareike1984 · 08.03.2015, 18:40

Hier nun die Logdatei vom AdwCleaner:

Code:

ATTFilter

# AdwCleaner v4.111 - Logfile created 08/03/2015 at 18:36:39
# Updated 18/02/2015 by Xplode
# Database : 2015-03-05.1 [Server]
# Operating system : Windows 8.1  (x64)
# Username : Mika - EWBFBM-MBL15
# Running from : C:\Users\Mika\Downloads\AdwCleaner_4.111.exe
# Option : Cleaning

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\8075021230841169077
Folder Deleted : C:\Program Files (x86)\PPricoeLeSs
Folder Deleted : C:\Users\Mika\AppData\Roaming\InetStat
Folder Deleted : C:\ProgramData\phkdkiknppjjglfkjnfjndjcgledaebg
File Deleted : C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\xv768coj.default\user.js
File Deleted : C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\user.js
File Deleted : C:\Users\Mika\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_services.hearstmags.com_0.localstorage-journal
File Deleted : C:\Users\Mika\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_services.hearstmags.com_0.localstorage
File Deleted : C:\Users\Mika\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_static.audienceinsights.net_0.localstorage
File Deleted : C:\Users\Mika\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_static.audienceinsights.net_0.localstorage-journal
File Deleted : C:\Users\Mika\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_static.olark.com_0.localstorage-journal
File Deleted : C:\Users\Mika\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_searches.vi-view.com_0.localstorage-journal
File Deleted : C:\Users\Mika\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_searches.vi-view.com_0.localstorage
File Deleted : C:\Users\Mika\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_static.olark.com_0.localstorage
File Deleted : C:\Users\Mika\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.metrolyrics.com_0.localstorage
File Deleted : C:\Users\Mika\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.metrolyrics.com_0.localstorage-journal

***** [ Scheduled tasks ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKCU\Software\Mozilla\Extends
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{12E797B7-A75C-4051-B4D9-8F48480ECCE7}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}
Key Deleted : HKCU\Software\InetStat
Key Deleted : HKCU\Software\OCS
Key Deleted : HKCU\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}
Key Deleted : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Key Deleted : HKLM\SOFTWARE\SupDp
Key Deleted : HKLM\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}
Key Deleted : HKLM\SOFTWARE\{12A61307-94CD-4F8E-94BC-918E511FAA81}
Data Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - *.local

***** [ Web browsers ] *****

-\\ Internet Explorer v11.0.9600.17416


-\\ Mozilla Firefox v

[xv768coj.default\prefs.js] - Line Deleted : user_pref("browser.search.selectedEngine", "Web Search");
[sbwnjcax.default\prefs.js] - Line Deleted : user_pref("browser.search.searchengine.alias", "mystartsearch");
[sbwnjcax.default\prefs.js] - Line Deleted : user_pref("browser.search.searchengine.iconURL", "hxxp://www.mystartsearch.com/web/favicon.ico");
[sbwnjcax.default\prefs.js] - Line Deleted : user_pref("browser.search.searchengine.name", "mystartsearch");
[sbwnjcax.default\prefs.js] - Line Deleted : user_pref("browser.search.searchengine.url", "hxxp://www.mystartsearch.com/web/?type=dspp&ts=1425557178&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421&q={searchTerms}");
[sbwnjcax.default\prefs.js] - Line Deleted : user_pref("extensions.enabledAddons", "fftoolbar2014%40etech.com:1.0.0.1025,istart_ffnt%40gmail.com:5.3.4,searchengine%40gmail.com:1.0.0.1027,%7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:35.0");

-\\ Google Chrome v40.0.2214.115

[C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\preferences] - Deleted [Extension] : phkdkiknppjjglfkjnfjndjcgledaebg
[C:\Users\Mika\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://www.softonic.de/s/{searchTerms}
[C:\Users\Mika\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://www.mystartsearch.com/web/?type=dspp&ts=1425577428&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421&q={searchTerms}
[C:\Users\Mika\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://www.mystartsearch.com/web/?type=dspp&ts=1425577428&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421&q={searchTerms}

*************************

AdwCleaner[R0].txt - [5602 bytes] - [08/03/2015 18:31:55]
AdwCleaner[S0].txt - [5130 bytes] - [08/03/2015 18:36:39]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [5189  bytes] ##########

schrauber · 08.03.2015, 19:40

und weiter

Mareike1984 · 08.03.2015, 20:44

Kommt ja schon

... Kann ich meinen Virusscan dann wieder einschalten, nachdem ich das Junkware Removal Tool ausgefuehrt habe?

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.3 (03.01.2015:1)
OS: Windows 8.1 x64
Ran by Mika on Sun 03/08/2015 at 20:33:33.33
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\pcdr"
Successfully deleted: [Folder] "C:\Users\Mika\AppData\Roaming\pcdr"



~~~ Chrome

Successfully deleted: [Folder] C:\Users\Mika\appdata\local\Google\Chrome\User Data\Default\Extensions\gkojfkhlekighikafcpjkiklfbnlmeio



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Sun 03/08/2015 at 20:39:31.39
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Und ein neues FRST Log

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 08-03-2015 03
Ran by Mika (administrator) on EWBFBM-MBL15 on 08-03-2015 20:42:55
Running from C:\Users\Mika\Downloads
Loaded Profiles: Mika (Available profiles: Mika & Administrator)
Platform: Windows 8.1 (X64) OS Language: English (United States)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Novell, Inc.) C:\Program Files\Novell\Client\XTier\Services\xtsvcmgr.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\ibtrksrv.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psia.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Remote Management System\ManagementAgentNT.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Remote Management System\RouterNT.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_filter.exe
(Sophos Limited) C:\Program Files (x86)\Common Files\Sophos\Web Intelligence\swi_fc.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe
(Uwe Sieber - www.uwe-sieber.de) C:\Program Files (x86)\USBDLM\USBDLM.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Uwe Sieber - www.uwe-sieber.de) C:\Program Files (x86)\USBDLM\USBDLM_usr.exe
(Seiko Epson Corporation) C:\Windows\System32\escsvc64.exe
(OCS Inventory NG) C:\Program Files (x86)\OCS Inventory Agent\OcsService.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Dell Inc.) C:\Program Files\Dell\QuickSet\quickset.exe
() C:\Program Files\Novell\Client\nwtray.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Ruiware LLC) C:\Program Files (x86)\WinPatrol\WinPatrol\WinPatrol.exe
(OCS Inventory NG) C:\Program Files (x86)\OCS Inventory Agent\OcsSystray.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psi_tray.exe
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\acrotray.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\AutoUpdate\ALMon.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXRCV.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXSTM.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Dell Products, LP.) C:\Program Files (x86)\Dell Digital Delivery\DeliveryService.exe
(Dell Inc.) C:\Program Files (x86)\Dell Update\DellUpService.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
(SoftThinks SAS) C:\Program Files (x86)\Dell Backup and Recovery\SftService.exe
(SoftThinks - Dell) C:\Program Files (x86)\Dell Backup and Recovery\Components\DBRUpdate\DBRUpd.exe
(SoftThinks - Dell) C:\Program Files (x86)\Dell Backup and Recovery\Toaster.exe
(Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
() C:\Program Files (x86)\Dell Backup and Recovery\Components\Shell\DBRCrawler.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Farbar) C:\Users\Mika\Downloads\FRST64 (2).exe
(Sophos Limited) C:\ProgramData\Sophos\AutoUpdate\Cache\sophos_autoupdate1.dir\ALUpdate.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7202520 2013-08-20] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1321688 2013-08-07] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_PushButton] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1321688 2013-08-07] (Realtek Semiconductor)
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [287592 2013-08-07] (Intel Corporation)
HKLM\...\Run: [QuickSet] => c:\Program Files\Dell\QuickSet\QuickSet.exe [3760432 2013-08-02] (Dell Inc.)
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll",TrayApp
HKLM\...\Run: [NWTRAY] => C:\Program Files\Novell\Client\nwtray.exe [39992 2013-01-15] ()
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [558496 2014-02-27] (Adobe Systems Incorporated)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [169768 2015-02-13] (Apple Inc.)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS5ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe [406992 2010-02-22] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Acrobat Assistant 8.0] => C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Acrotray.exe [3498728 2014-12-03] (Adobe Systems Inc.)
HKLM-x32\...\Run: [Sophos AutoUpdate Monitor] => C:\Program Files (x86)\Sophos\AutoUpdate\almon.exe [1593640 2015-03-03] (Sophos Limited)
HKLM-x32\...\Run: [FUFAXRCV] => C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXRCV.exe [502912 2012-04-03] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [FUFAXSTM] => C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXSTM.exe [863360 2012-04-03] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [EEventManager] => C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [1058912 2012-04-02] (SEIKO EPSON CORPORATION)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\ScCertProp: wlnotify.dll [X]
HKU\S-1-5-21-1401536446-3937075962-3797694313-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [30878816 2014-12-11] (Skype Technologies S.A.)
HKU\S-1-5-21-1401536446-3937075962-3797694313-1001\...\Run: [WinPatrol] => C:\Program Files (x86)\WinPatrol\WinPatrol\winpatrol.exe [1160536 2015-02-23] (Ruiware LLC)
HKU\S-1-5-18\...\Run: [EPLTarget\P0000000000000000] => C:\Windows\system32\spool\DRIVERS\x64\3\E_YATIHSA.EXE /EPT "EPLTarget\P0000000000000000" /M "WorkForce 845"
HKU\S-1-5-18\...\Run: [EPLTarget\P0000000000000001] => C:\Windows\system32\spool\DRIVERS\x64\3\E_YATIIUE.EXE [283232 2012-02-28] (SEIKO EPSON CORPORATION)
AppInit_DLLs-x32: C:\PROGRA~2\Sophos\SOPHOS~1\SOPHOS~1.DLL => C:\Program Files (x86)\Sophos\Sophos Anti-Virus\sophos_detoured.dll [275352 2015-01-13] (Sophos Limited)
Lsa: [Authentication Packages] msv1_0 ncv1_0
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\OCS Inventory NG Systray.lnk
ShortcutTarget: OCS Inventory NG Systray.lnk -> C:\Program Files (x86)\OCS Inventory Agent\OcsSystray.exe (OCS Inventory NG)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Secunia)
Startup: C:\Users\Mika\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Download.lnk
ShortcutTarget: Download.lnk -> C:\ProgramData\{d6560dff-0f39-a46a-d656-60dff0f337fc}\Download.exe (No File)
ShellIconOverlayIdentifiers: [DBARFileBackuped] -> {831cebdd-6baf-4432-be76-9e0989c14aef} => C:\Windows\system32\mscoree.dll (Microsoft Corporation)
ShellIconOverlayIdentifiers: [DBARFileNotBackuped] -> {275e4fd7-21ef-45cf-a836-832e5d2cc1b3} => C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-1401536446-3937075962-3797694313-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:62005;https=127.0.0.1:62005
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKU\S-1-5-21-1401536446-3937075962-3797694313-1001\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/?gws_rd=ssl
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2015-01-21] (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_31\bin\ssv.dll [2015-01-26] (Oracle Corporation)
BHO: Adobe Acrobat Create PDF Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll [2014-05-08] (Adobe Systems Incorporated)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2015-01-21] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-01-26] (Oracle Corporation)
BHO: Adobe Acrobat Create PDF from Selection -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll [2014-05-08] (Adobe Systems Incorporated)
BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2014-10-22] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-01-26] (Oracle Corporation)
BHO-x32: Adobe Acrobat Create PDF Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll [2013-12-21] (Adobe Systems Incorporated)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2015-01-21] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-01-26] (Oracle Corporation)
BHO-x32: Adobe Acrobat Create PDF from Selection -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll [2013-12-21] (Adobe Systems Incorporated)
Toolbar: HKLM - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll [2014-05-08] (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll [2013-12-21] (Adobe Systems Incorporated)
Toolbar: HKU\S-1-5-21-1401536446-3937075962-3797694313-1001 -> Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll [2014-05-08] (Adobe Systems Incorporated)
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2014-03-12] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
StartMenuInternet: IEXPLORE.EXE - iexplore.exe

FireFox:
========
FF ProfilePath: C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default
FF NetworkProxy: "type", 5
FF Plugin: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-01-26] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-01-26] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll [2014-04-28] (Adobe Systems)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-09-04] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-09-04] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-01-26] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-01-26] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2014-03-03] (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office15\NPSPWRAP.DLL [2014-01-22] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-09-13] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-07] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-07] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin-x32: Adobe Acrobat -> C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Air\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll [2014-04-28] (Adobe Systems)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2014-03-03] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn [2014-04-24]
FF Extension: No Name - C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com [Not Found]
FF Extension: No Name - C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\fftoolbar2014@etech.com [Not Found]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [Not Found]

Chrome: 
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR HomePage: Default -> 
CHR StartupUrls: Default -> "hxxp://www.mystartsearch.com/?type=hp&ts=1425557118&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421", "hxxp://www.mystartsearch.com/?type=hppp&ts=1425557178&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421", "hxxp://www.mystartsearch.com/?type=hp&ts=1425577412&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421", "hxxp://www.mystartsearch.com/?type=hppp&ts=1425577428&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421", "?type=hppp"
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}
CHR Profile: C:\Users\Mika\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Mika\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-04-06]
CHR Extension: (Google Drive) - C:\Users\Mika\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-04-06]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Mika\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2015-01-19]
CHR Extension: (YouTube) - C:\Users\Mika\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-04-06]
CHR Extension: (Google Search) - C:\Users\Mika\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-04-06]
CHR Extension: (Adobe Acrobat - Create PDF) - C:\Users\Mika\AppData\Local\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj [2014-04-24]
CHR Extension: (Google Wallet) - C:\Users\Mika\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-04-06]
CHR Extension: (Gmail) - C:\Users\Mika\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-04-06]
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCChromeExtn\WCChromeExtn.crx [2014-12-03]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-01-19] (Apple Inc.)
R2 DellUpdate; C:\Program Files (x86)\Dell Update\DellUpService.exe [150224 2014-09-09] (Dell Inc.)
R2 EpsonScanSvc; C:\Windows\system32\EscSvc64.exe [135824 2011-12-12] (Seiko Epson Corporation)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15720 2013-08-07] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; c:\Program Files\Intel\iCLS Client\HeciServer.exe [733696 2013-05-12] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; c:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-12] (Intel(R) Corporation)
R2 Intel(R) Wireless Bluetooth(R) 4.0 Radio Management; C:\Program Files (x86)\Intel\Bluetooth\ibtrksrv.exe [155448 2013-08-01] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-04] (Intel Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [284912 2013-08-23] ()
R2 OCS Inventory Service; C:\Program Files (x86)\OCS Inventory Agent\OcsService.exe [35840 2012-01-27] (OCS Inventory NG) [File not signed]
S3 OpenVPNService; C:\Program Files (x86)\OpenVPN\bin\openvpnserv.exe [14848 2011-12-15] () [File not signed]
R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [253776 2013-07-30] (CyberLink)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [246488 2013-06-19] (Realtek Semiconductor)
R2 SAVAdminService; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe [288552 2014-05-20] (Sophos Limited)
R2 SAVService; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe [208168 2014-10-17] (Sophos Limited)
R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1363160 2014-11-28] (Secunia)
R2 SftService; C:\Program Files (x86)\Dell Backup and Recovery\sftservice.exe [1924328 2014-09-18] (SoftThinks SAS)
R2 Sophos Agent; C:\Program Files (x86)\Sophos\Remote Management System\ManagementAgentNT.exe [289856 2014-04-24] (Sophos Limited)
R2 Sophos AutoUpdate Service; C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe [340776 2015-03-03] (Sophos Limited)
R2 Sophos Message Router; C:\Program Files (x86)\Sophos\Remote Management System\RouterNT.exe [818240 2014-04-24] (Sophos Limited)
R2 Sophos Web Control Service; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe [341800 2014-10-17] (Sophos Limited)
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
R2 swi_filter; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_filter.exe [300840 2015-01-13] (Sophos Limited)
R2 swi_service; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe [3274536 2015-01-13] (Sophos Limited)
R2 USBDLM; C:\Program Files (x86)\USBDLM\USBDLM.exe [337888 2012-01-15] (Uwe Sieber - www.uwe-sieber.de) [File not signed]
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)
R2 XTSvcMgr; C:\Program Files\Novell\Client\XTier\Services\XTSvcMgr.exe [20536 2013-01-15] (Novell, Inc.)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3667696 2013-08-23] (Intel® Corporation)
S2 McAPExe; "C:\Program Files\McAfee\MSC\McAPExe.exe" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 BthLEEnum; C:\Windows\System32\drivers\BthLEEnum.sys [226304 2013-12-04] (Microsoft Corporation)
R3 btmaux; C:\Windows\system32\DRIVERS\btmaux.sys [132920 2013-04-24] (Motorola Solutions, Inc.)
R3 btmhsf; C:\Windows\system32\DRIVERS\btmhsf.sys [1385784 2013-06-27] (Motorola Solutions, Inc.)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [91712 2013-03-05] (CyberLink)
R3 DellRbtn; C:\Windows\System32\drivers\DellRbtn.sys [10752 2013-01-25] (OSR Open Systems Resources, Inc.)
R3 ibtusb; C:\Windows\system32\DRIVERS\ibtusb.sys [114632 2013-07-01] (Intel Corporation)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-03-07] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\System32\drivers\TeeDriverx64.sys [99288 2013-12-19] (Intel Corporation)
R0 NCFilter; C:\Windows\System32\DRIVERS\NCFilter.sys [112696 2013-01-15] ()
R2 NCFSD; C:\Program Files\Novell\Client\XTier\Drivers\ncfsd.sys [115256 2013-01-15] ()
R2 NCIOCTL; C:\Program Files\Novell\Client\XTier\Drivers\ncioctl.sys [90680 2013-01-15] ()
R0 NCRecognizer; C:\Windows\System32\DRIVERS\NCRecognizer.sys [120376 2013-01-15] ()
R0 NCUncFilter; C:\Windows\System32\DRIVERS\NCUncFilter.sys [26680 2013-01-15] ()
R3 NETwNb64; C:\Windows\system32\DRIVERS\NETwbw02.sys [3589600 2013-09-25] (Intel Corporation)
R1 NICM; C:\Program Files\Novell\Client\XTier\Drivers\nicm.sys [31800 2013-01-15] (Novell, Inc.)
S3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2014-11-28] (Secunia)
S3 S3XXx64; C:\Windows\system32\DRIVERS\S3XXx64.sys [73856 2015-02-17] (Identiv)
R1 SAVOnAccess; C:\Windows\System32\DRIVERS\savonaccess.sys [161024 2014-10-17] (Sophos Limited)
S3 sdcfilter; C:\Windows\system32\DRIVERS\sdcfilter.sys [38144 2014-05-20] (Sophos Limited)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [34544 2013-08-02] (Synaptics Incorporated)
S4 SophosBootDriver; C:\Windows\system32\DRIVERS\SophosBootDriver.sys [27904 2014-05-20] (Sophos Limited)
R1 swi_callout; C:\Windows\system32\DRIVERS\swi_callout.sys [32512 2015-03-03] (Sophos Limited)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)
U3 nccache; C:\Program Files\Novell\Client\XTier\Drivers\nccache.sys [55864 2013-01-15] (Novell, Inc.)
U3 nciom; C:\Program Files\Novell\Client\XTier\Drivers\nciom.sys [80952 2013-01-15] (Novell, Inc.)
U3 ncp; C:\Program Files\Novell\Client\XTier\Drivers\ncp.sys [79416 2013-01-15] (Novell, Inc.)
U3 ncpfsp; C:\Program Files\Novell\Client\XTier\Drivers\ncpfsp.sys [101944 2013-01-15] (Novell, Inc.)
U3 ncpl; C:\Program Files\Novell\Client\XTier\Drivers\ncpl.sys [49720 2013-01-15] (Novell, Inc.)
U3 ndm; C:\Program Files\Novell\Client\XTier\Drivers\ndm.sys [20024 2013-01-15] (Novell, Inc.)
U3 ndmndap; C:\Program Files\Novell\Client\XTier\Drivers\ndmndap.sys [84024 2013-01-15] (Novell, Inc.)
U3 niam; C:\Program Files\Novell\Client\XTier\Drivers\niam.sys [39480 2013-01-15] (Novell, Inc.)
U3 nipctl; C:\Program Files\Novell\Client\XTier\Drivers\nipctl.sys [56376 2013-01-15] (Novell, Inc.)
U3 nscm; C:\Program Files\Novell\Client\XTier\Drivers\nscm.sys [37944 2013-01-15] (Novell, Inc.)
U3 nsns; C:\Program Files\Novell\Client\XTier\Drivers\nsns.sys [25656 2013-01-15] (Novell, Inc.)
U3 nsvccost; C:\Program Files\Novell\Client\XTier\Drivers\nsvccost.sys [36408 2013-01-15] (Novell, Inc.)
U3 xtxplat; C:\Program Files\Novell\Client\XTier\Drivers\xtxplat.sys [59960 2013-01-15] (Novell, Inc.)
R3 PCDSRVC{3B54B31B-D06B6431-06020200}_0; \??\c:\program files\dell\supportassist\pcdsrvc_x64.pkms [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-08 20:42 - 2015-03-08 20:42 - 02095104 _____ (Farbar) C:\Users\Mika\Downloads\FRST64 (2).exe
2015-03-08 20:41 - 2015-03-08 20:42 - 02095104 _____ (Farbar) C:\Users\Mika\Downloads\FRST64 (1).exe
2015-03-08 20:39 - 2015-03-08 20:39 - 00000902 _____ () C:\Users\Mika\Desktop\JRT.txt
2015-03-08 20:32 - 2015-03-08 20:33 - 01388333 _____ (Thisisu) C:\Users\Mika\Downloads\JRT.exe
2015-03-08 18:31 - 2015-03-08 18:36 - 00000000 ____D () C:\AdwCleaner
2015-03-08 18:30 - 2015-03-08 18:30 - 02126848 _____ () C:\Users\Mika\Downloads\AdwCleaner_4.111.exe
2015-03-06 16:56 - 2015-03-06 16:59 - 00035117 _____ () C:\Users\Mika\Downloads\Addition.txt
2015-03-06 16:53 - 2015-03-08 20:42 - 00030120 _____ () C:\Users\Mika\Downloads\FRST.txt
2015-03-06 16:53 - 2015-03-08 20:42 - 00000000 ____D () C:\FRST
2015-03-06 16:53 - 2015-03-06 16:53 - 02092544 _____ (Farbar) C:\Users\Mika\Downloads\FRST64.exe
2015-03-06 09:05 - 2015-03-06 09:05 - 01728218 _____ () C:\Users\Mika\Downloads\openvpn-install (1).exe
2015-03-05 18:47 - 2015-03-06 13:57 - 00000000 ____D () C:\Program Files (x86)\Cars 2 World Grand Prix Races
2015-03-05 18:44 - 2015-03-06 13:57 - 00000000 ____D () C:\ProgramData\{d6560dff-0f39-a46a-d656-60dff0f337fc}
2015-03-05 18:15 - 2015-03-05 18:16 - 28687167 _____ () C:\Users\Mika\Downloads\Pressekonferenz Studie Bildung%2C Migration%2C Milieu am 04 12 13 in Berlin youtube original.mp4
2015-03-05 18:14 - 2015-03-05 18:15 - 08004264 _____ () C:\Users\Mika\Downloads\Studie Bildung Milieu und Migration Interview mit Hassan El Moussaoui.mp4
2015-03-05 18:14 - 2015-03-05 18:15 - 07664850 _____ () C:\Users\Mika\Downloads\Studie -Bildung%2C Milieu und Migration- - Interview mit Elvida Sabanovic.mp4
2015-03-05 18:14 - 2015-03-05 18:15 - 06494192 _____ () C:\Users\Mika\Downloads\Studie -Bildung%2C Milieu und Migration- - Interview mit Nazan Wagner.mp4
2015-03-05 18:14 - 2015-03-05 18:14 - 08821007 _____ () C:\Users\Mika\Downloads\Studie -Bildung%2C Milieu und Migration- - Interview mit Sakire Efe.mp4
2015-03-05 16:15 - 2015-03-03 21:15 - 00032512 _____ (Sophos Limited) C:\Windows\system32\Drivers\swi_callout.sys
2015-03-05 15:46 - 2015-03-05 17:46 - 00000000 ____D () C:\Users\Mika\AppData\Roaming\WinPatrol
2015-03-05 15:46 - 2015-03-05 15:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinPatrol
2015-03-05 15:46 - 2015-03-05 15:46 - 00000000 ____D () C:\ProgramData\InstallMate
2015-03-05 15:46 - 2015-03-05 15:46 - 00000000 ____D () C:\Program Files (x86)\WinPatrol
2015-03-05 15:35 - 2015-03-05 15:35 - 01081688 _____ (WinPatrol) C:\Users\Mika\Downloads\wpsetup.exe
2015-03-05 15:34 - 2015-03-07 18:26 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-03-05 15:34 - 2015-03-05 15:34 - 00001120 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-03-05 15:34 - 2015-03-05 15:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-03-05 15:34 - 2015-03-05 15:34 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-03-05 15:34 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-03-05 15:34 - 2014-11-21 06:14 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-03-05 15:34 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-03-05 15:33 - 2015-03-05 15:33 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Mika\Downloads\mbam-setup-2.0.4.1028.exe
2015-03-05 15:25 - 2015-03-05 15:25 - 00448512 _____ (OldTimer Tools) C:\Users\Mika\Downloads\TFC.exe
2015-03-05 15:23 - 2015-03-05 15:23 - 00001091 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Secunia PSI.lnk
2015-03-05 15:23 - 2015-03-05 15:23 - 00000000 ____D () C:\Users\Mika\AppData\Local\Secunia PSI
2015-03-05 15:23 - 2015-03-05 15:23 - 00000000 ____D () C:\Program Files (x86)\Secunia
2015-03-05 15:22 - 2015-03-05 15:23 - 05490752 _____ (Secunia) C:\Users\Mika\Downloads\PSISetup10004.exe
2015-03-05 15:04 - 2015-03-05 15:06 - 00001479 _____ () C:\DelFix.txt
2015-03-05 13:20 - 2015-03-05 13:20 - 00003130 _____ () C:\Windows\System32\Tasks\{EF9F9432-56D5-4276-9BC8-1E4A4270E62B}
2015-03-05 13:13 - 2015-03-05 13:13 - 00000000 ____D () C:\Users\Mika\AppData\Roaming\dlg
2015-03-05 13:12 - 2015-03-05 13:12 - 00000000 __SHD () C:\Users\Mika\AppData\Local\EmieBrowserModeList
2015-03-05 13:10 - 2015-03-05 13:10 - 00000000 ____D () C:\Users\Mika\AppData\Roaming\QuickScan
2015-03-05 13:04 - 2015-03-05 13:04 - 00572432 _____ () C:\Users\Mika\Downloads\gimp-Download.exe
2015-03-05 12:37 - 2015-03-05 13:01 - 00000000 ____D () C:\Users\Mika\Desktop\STA Fotos
2015-03-05 12:35 - 2015-03-05 12:35 - 06593997 _____ () C:\Users\Mika\Downloads\Fotos Milieus Abschlussbericht.7z
2015-03-01 21:42 - 2015-03-01 21:42 - 11157403 _____ () C:\Users\Mika\Downloads\attachments (17).zip
2015-03-01 19:24 - 2015-03-01 19:24 - 06594884 _____ () C:\Users\Mika\Downloads\attachments (16).zip
2015-03-01 10:19 - 2015-03-01 10:19 - 00281848 _____ () C:\Windows\Minidump\030115-28812-01.dmp
2015-02-28 15:37 - 2014-12-13 22:28 - 00513488 _____ () C:\Windows\SysWOW64\locale.nls
2015-02-28 15:37 - 2014-12-13 22:28 - 00513488 _____ () C:\Windows\system32\locale.nls
2015-02-28 15:37 - 2014-10-29 02:27 - 01200128 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Globalization.dll
2015-02-28 15:37 - 2014-10-29 02:27 - 00323072 _____ (Microsoft Corporation) C:\Windows\system32\GlobCollationHost.dll
2015-02-28 15:37 - 2014-10-29 02:04 - 00868352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Globalization.dll
2015-02-28 15:37 - 2014-10-29 02:04 - 00200704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\GlobCollationHost.dll
2015-02-24 17:16 - 2015-02-24 17:16 - 00052893 _____ () C:\Users\Mika\Downloads\Präsentation NEU (3).pptx
2015-02-24 17:01 - 2015-02-24 17:01 - 00052893 _____ () C:\Users\Mika\Downloads\Präsentation NEU (2).pptx
2015-02-24 17:00 - 2015-02-24 17:00 - 00052893 _____ () C:\Users\Mika\Downloads\Präsentation NEU (1).pptx
2015-02-24 16:58 - 2015-02-24 16:58 - 00052893 _____ () C:\Users\Mika\Downloads\Präsentation NEU.pptx
2015-02-24 15:45 - 2015-02-24 15:45 - 03541590 _____ () C:\Users\Mika\Downloads\Zweite Lieferung milieus-gewichtet.xlsx
2015-02-24 15:42 - 2015-02-24 15:42 - 00076472 _____ () C:\Users\Mika\Downloads\Präsentation1.pptx
2015-02-23 13:27 - 2015-02-23 13:27 - 01644971 _____ () C:\Users\Mika\Desktop\Fotosammlung Dereköy verkleinert.zip
2015-02-23 13:22 - 2015-02-23 13:22 - 00001020 _____ () C:\Users\Mika\Desktop\IrfanView.lnk
2015-02-23 13:20 - 2015-02-23 13:20 - 02197648 _____ (Irfan Skiljan) C:\Users\Mika\Downloads\iview438g_setup (1).exe
2015-02-23 13:12 - 2015-02-23 13:18 - 00000000 ____D () C:\Users\Mika\Desktop\Fotosammlung Dereköy verkleinert
2015-02-22 21:58 - 2015-02-22 21:58 - 00000000 ____D () C:\Program Files (x86)\MSECache
2015-02-22 21:57 - 2015-02-22 21:58 - 19998504 _____ (Microsoft Corporation) C:\Users\Mika\Downloads\proofingtools_de-de-x64.exe
2015-02-22 16:52 - 2015-02-22 16:52 - 00000000 ____D () C:\Users\Mika\AppData\Roaming\IrfanView
2015-02-22 16:52 - 2015-02-22 16:52 - 00000000 ____D () C:\Program Files (x86)\IrfanView
2015-02-22 16:51 - 2015-02-22 16:51 - 02197648 _____ (Irfan Skiljan) C:\Users\Mika\Downloads\iview438g_setup (3).exe
2015-02-22 16:51 - 2015-02-22 16:51 - 02197648 _____ (Irfan Skiljan) C:\Users\Mika\Downloads\iview438g_setup (2).exe
2015-02-22 16:47 - 2015-02-22 16:47 - 02197648 _____ (Irfan Skiljan) C:\Users\Mika\Downloads\iview438g_setup.exe
2015-02-22 12:19 - 2015-02-22 12:19 - 01728218 _____ () C:\Users\Mika\Downloads\openvpn-install.exe
2015-02-21 22:26 - 2015-02-21 22:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2015-02-21 22:26 - 2015-02-21 22:26 - 00000000 ____D () C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7
2015-02-21 22:26 - 2015-02-21 22:26 - 00000000 ____D () C:\Program Files\iTunes
2015-02-21 22:26 - 2015-02-21 22:26 - 00000000 ____D () C:\Program Files\iPod
2015-02-21 22:26 - 2015-02-21 22:26 - 00000000 ____D () C:\Program Files (x86)\iTunes
2015-02-20 17:07 - 2015-02-20 17:07 - 00000000 _____ () C:\Users\Mika\Downloads\f.txt
2015-02-20 15:16 - 2015-02-20 15:17 - 00000000 ____D () C:\Users\Mika\Documents\Outlook Files
2015-02-20 15:16 - 2015-02-20 15:16 - 00394049 _____ () C:\Users\Mika\Downloads\noname (1).eml
2015-02-20 15:16 - 2015-02-20 15:16 - 00010158 _____ () C:\Users\Mika\Downloads\noname (2).eml
2015-02-20 15:15 - 2015-02-20 15:15 - 00006023 _____ () C:\Users\Mika\Downloads\noname.eml
2015-02-18 17:32 - 2015-01-23 05:41 - 06041600 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-02-18 17:32 - 2015-01-23 04:17 - 04300800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-02-17 13:40 - 2015-02-17 13:40 - 00073856 _____ (Identiv) C:\Windows\system32\Drivers\S3XXx64.sys
2015-02-16 19:52 - 2015-02-20 15:16 - 00000000 ____D () C:\Users\Mika\AppData\Roaming\Apple Computer
2015-02-16 19:52 - 2015-02-16 19:52 - 00000000 ____D () C:\Users\Mika\AppData\Local\Apple Computer
2015-02-16 19:51 - 2012-10-03 16:14 - 00033240 _____ (GEAR Software Inc.) C:\Windows\system32\Drivers\GEARAspiWDM.sys
2015-02-16 19:50 - 2015-02-16 19:50 - 00000000 ____D () C:\ProgramData\Apple Computer
2015-02-16 19:49 - 2015-02-16 19:49 - 00002535 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
2015-02-16 19:49 - 2015-02-16 19:49 - 00000000 ____D () C:\Windows\System32\Tasks\Apple
2015-02-16 19:49 - 2015-02-16 19:49 - 00000000 ____D () C:\Users\Mika\AppData\Local\Apple
2015-02-16 19:49 - 2015-02-16 19:49 - 00000000 ____D () C:\Program Files\Bonjour
2015-02-16 19:49 - 2015-02-16 19:49 - 00000000 ____D () C:\Program Files (x86)\Bonjour
2015-02-16 19:49 - 2015-02-16 19:49 - 00000000 ____D () C:\Program Files (x86)\Apple Software Update
2015-02-16 19:48 - 2015-02-21 22:26 - 00000000 ____D () C:\Program Files\Common Files\Apple
2015-02-16 19:48 - 2015-02-16 19:49 - 00000000 ____D () C:\ProgramData\Apple
2015-02-16 19:45 - 2015-02-16 19:46 - 152439600 _____ (Apple Inc.) C:\Users\Mika\Downloads\itunes6464setup.exe
2015-02-15 23:08 - 2015-02-15 23:08 - 31398083 _____ () C:\Users\Mika\Downloads\Client Document Package.zip
2015-02-15 22:20 - 2015-02-15 22:20 - 00004034 _____ () C:\Windows\System32\Tasks\PCDoctorBackgroundMonitorTask
2015-02-15 22:20 - 2015-02-15 22:20 - 00003484 _____ () C:\Windows\System32\Tasks\PCDEventLauncherTask
2015-02-15 22:20 - 2015-02-15 22:20 - 00003224 _____ () C:\Windows\System32\Tasks\SystemToolsDailyTest
2015-02-15 22:20 - 2015-02-15 22:20 - 00000000 ____D () C:\ProgramData\PC-Doctor for Windows
2015-02-15 22:20 - 2015-02-15 22:20 - 00000000 ____D () C:\Program Files\Dell Support Center
2015-02-13 19:31 - 2015-02-04 00:38 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-02-13 19:31 - 2015-02-04 00:08 - 00761856 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-02-13 19:31 - 2015-02-04 00:08 - 00414208 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-02-13 19:31 - 2015-02-03 00:11 - 01098752 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-02-13 19:31 - 2015-02-03 00:11 - 00894464 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-02-13 19:31 - 2015-02-03 00:11 - 00609280 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-02-13 19:31 - 2015-01-19 19:42 - 01487976 _____ (Microsoft Corporation) C:\Windows\system32\sppobjs.dll
2015-02-13 19:31 - 2014-12-19 09:57 - 00788680 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2015-02-13 19:31 - 2014-12-19 09:25 - 00602776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2015-02-13 19:31 - 2014-12-09 00:12 - 00391526 _____ () C:\Windows\system32\ApnDatabase.xml
2015-02-10 22:19 - 2015-01-15 23:43 - 00563504 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-02-10 22:19 - 2015-01-15 23:43 - 00177984 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-02-10 22:19 - 2015-01-14 05:22 - 00445440 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-02-10 22:19 - 2015-01-14 04:53 - 00324096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2015-02-10 22:19 - 2015-01-13 23:11 - 01762840 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-02-10 22:19 - 2015-01-13 23:04 - 01489072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2015-02-10 22:19 - 2015-01-12 04:09 - 25056256 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-02-10 22:19 - 2015-01-10 10:10 - 07472960 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-02-10 22:19 - 2015-01-10 10:10 - 01733440 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-02-10 22:19 - 2015-01-10 09:28 - 01498360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-02-10 22:19 - 2015-01-10 08:00 - 00430080 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-02-10 22:19 - 2015-01-10 07:38 - 00359424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-02-10 22:19 - 2014-12-09 04:45 - 00393728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll
2015-02-10 22:19 - 2014-12-09 02:56 - 00538624 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll
2015-02-10 22:19 - 2014-10-29 03:51 - 00154112 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-02-10 22:19 - 2014-10-29 03:50 - 00736768 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-02-10 22:19 - 2014-10-29 03:06 - 00736768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-02-10 22:19 - 2014-10-29 03:06 - 00154112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-02-10 22:19 - 2014-10-29 03:02 - 00285184 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-02-10 22:19 - 2014-10-29 03:02 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-02-10 22:19 - 2014-10-29 02:57 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-02-10 22:19 - 2014-10-29 02:31 - 01441792 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-02-10 22:19 - 2014-10-29 02:15 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-02-10 22:19 - 2014-10-29 02:15 - 00005632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-02-10 22:19 - 2014-10-29 02:14 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-02-10 22:19 - 2014-10-29 02:13 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-02-10 22:19 - 2014-10-29 02:13 - 00008704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-02-10 22:18 - 2015-01-12 03:48 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-02-10 22:18 - 2015-01-12 03:48 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-02-10 22:18 - 2015-01-12 03:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-02-10 22:18 - 2015-01-12 03:34 - 00816128 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-02-10 22:18 - 2015-01-12 03:25 - 19740160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-02-10 22:18 - 2015-01-12 03:21 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-02-10 22:18 - 2015-01-12 03:08 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-02-10 22:18 - 2015-01-12 03:07 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-02-10 22:18 - 2015-01-12 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-02-10 22:18 - 2015-01-12 03:02 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-02-10 22:18 - 2015-01-12 02:58 - 01032704 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2015-02-10 22:18 - 2015-01-12 02:55 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-02-10 22:18 - 2015-01-12 02:51 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2015-02-10 22:18 - 2015-01-12 02:48 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-02-10 22:18 - 2015-01-12 02:48 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-02-10 22:18 - 2015-01-12 02:48 - 00374272 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-02-10 22:18 - 2015-01-12 02:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-02-10 22:18 - 2015-01-12 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-02-10 22:18 - 2015-01-12 02:43 - 14401024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-02-10 22:18 - 2015-01-12 02:34 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2015-02-10 22:18 - 2015-01-12 02:30 - 00880128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2015-02-10 22:18 - 2015-01-12 02:27 - 02865152 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll
2015-02-10 22:18 - 2015-01-12 02:27 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-02-10 22:18 - 2015-01-12 02:25 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2015-02-10 22:18 - 2015-01-12 02:23 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-02-10 22:18 - 2015-01-12 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-02-10 22:18 - 2015-01-12 02:23 - 00327168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-02-10 22:18 - 2015-01-12 02:14 - 12829184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-02-10 22:18 - 2015-01-12 02:14 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-02-10 22:18 - 2015-01-12 02:02 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-02-10 22:18 - 2015-01-12 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-02-10 22:18 - 2015-01-12 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-02-10 22:18 - 2015-01-12 01:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-02-10 22:18 - 2015-01-10 09:22 - 04175872 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-08 20:38 - 2014-10-07 20:14 - 00000000 ____D () C:\Users\Mika\AppData\Roaming\Skype
2015-03-08 20:13 - 2014-01-05 03:01 - 01507050 _____ () C:\Windows\WindowsUpdate.log
2015-03-08 20:00 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\sru
2015-03-08 19:58 - 2014-04-06 16:22 - 00000930 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-03-08 19:00 - 2014-04-23 10:49 - 00000000 ____D () C:\Users\Mika\AppData\Local\Adobe
2015-03-08 18:46 - 2014-01-05 03:13 - 00000000 ____D () C:\Program Files (x86)\Dell Backup and Recovery
2015-03-08 18:39 - 2014-04-04 06:54 - 00000000 ___DO () C:\Users\Mika\SkyDrive
2015-03-08 18:37 - 2014-04-06 16:22 - 00000926 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-03-08 18:37 - 2013-08-22 15:46 - 00033192 _____ () C:\Windows\setupact.log
2015-03-08 18:37 - 2013-08-22 15:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-03-08 18:37 - 2013-08-22 14:25 - 00524288 ___SH () C:\Windows\system32\config\BBI
2015-03-08 18:36 - 2014-04-04 06:31 - 00000000 ____D () C:\Users\Mika
2015-03-08 18:18 - 2014-04-13 22:48 - 02032128 ___SH () C:\Users\Mika\Desktop\Thumbs.db
2015-03-08 17:59 - 2014-01-05 02:40 - 00224528 _____ () C:\Windows\PFRO.log
2015-03-07 17:36 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\Performance
2015-03-07 16:53 - 2014-04-04 06:40 - 00003600 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1401536446-3937075962-3797694313-1001
2015-03-06 17:56 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\NDF
2015-03-05 18:55 - 2014-08-22 21:44 - 00001380 _____ () C:\Users\Mika\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk
2015-03-05 18:55 - 2014-04-04 06:34 - 00001448 _____ () C:\Users\Mika\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-03-05 18:54 - 2014-04-24 08:46 - 00002337 _____ () C:\Users\Administrator\Desktop\Google Chrome.lnk
2015-03-05 18:39 - 2014-04-04 06:34 - 00000000 ____D () C:\Users\Mika\AppData\Local\Packages
2015-03-05 18:25 - 2014-04-29 21:48 - 01916928 ___SH () C:\Users\Mika\Downloads\Thumbs.db
2015-03-05 15:19 - 2014-09-05 08:19 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2015-03-05 15:13 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\AppReadiness
2015-03-05 15:07 - 2014-04-24 09:06 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-03-05 11:43 - 2014-08-03 22:40 - 00000000 ____D () C:\Users\Mika\Desktop\Meine Hochzeit
2015-03-05 11:22 - 2015-01-26 16:29 - 00000000 ____D () C:\Users\Mika\AppData\Roaming\vlc
2015-03-05 11:12 - 2014-11-02 21:06 - 00000000 ____D () C:\Users\Mika\AppData\Local\Windows Live
2015-03-05 11:04 - 2014-06-11 09:43 - 00000000 ____D () C:\Users\Mika\MediathekView
2015-03-05 11:03 - 2014-08-16 10:24 - 00000000 ____D () C:\Users\Mika\Downloads\MediathekView_7
2015-03-05 11:03 - 2014-06-11 09:38 - 00000000 ____D () C:\Users\Mika\.mediathek3
2015-03-05 11:03 - 2014-06-11 09:37 - 00000000 ____D () C:\Users\Mika\Downloads\MediathekView_6
2015-03-01 10:19 - 2014-04-24 10:57 - 00000000 ____D () C:\Windows\Minidump
2015-03-01 10:19 - 2014-04-24 10:56 - 558134323 _____ () C:\Windows\MEMORY.DMP
2015-03-01 00:30 - 2013-08-22 16:20 - 00000000 ____D () C:\Windows\CbsTemp
2015-02-18 17:17 - 2013-08-22 15:44 - 05051904 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-02-18 17:15 - 2014-04-07 21:39 - 00000000 ____D () C:\Windows\system32\MRT
2015-02-18 17:12 - 2014-12-25 20:30 - 00000000 ____D () C:\Windows\system32\appraiser
2015-02-18 17:12 - 2014-08-07 21:58 - 00000000 ___SD () C:\Windows\system32\CompatTel
2015-02-17 22:48 - 2014-04-07 21:39 - 116773704 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-02-17 22:47 - 2014-04-24 09:48 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2015-02-17 22:47 - 2014-04-24 09:43 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-02-17 22:10 - 2014-01-05 03:01 - 00000000 ____D () C:\ProgramData\Package Cache
2015-02-17 21:53 - 2013-08-22 14:25 - 00000199 _____ () C:\Windows\win.ini
2015-02-15 22:20 - 2014-01-05 03:09 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dell
2015-02-15 22:19 - 2014-01-05 03:00 - 00000000 ____D () C:\Program Files\Dell
2015-02-08 18:45 - 2014-01-05 02:55 - 00865408 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-02-07 13:53 - 2014-04-06 16:22 - 00003902 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-02-07 13:53 - 2014-04-06 16:22 - 00003666 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

==================== Files in the root of some directories =======

2014-01-05 02:42 - 2014-01-05 02:42 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2014-04-23 10:39 - 2014-04-23 10:40 - 0000315 _____ () C:\ProgramData\NCIDebug.log
2014-01-05 03:08 - 2014-01-05 03:08 - 0000121 _____ () C:\ProgramData\{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}.log
2014-01-05 03:05 - 2014-01-05 03:06 - 0000106 _____ () C:\ProgramData\{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}.log
2014-01-05 03:06 - 2014-01-05 03:07 - 0000111 _____ () C:\ProgramData\{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}.log
2014-01-05 03:07 - 2014-01-05 03:08 - 0000108 _____ () C:\ProgramData\{B46BEA36-0B71-4A4E-AE41-87241643FA0A}.log
2014-01-05 03:05 - 2014-01-05 03:05 - 0000107 _____ () C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log

Some content of TEMP:
====================
C:\Users\Mika\AppData\Local\Temp\Quarantine.exe
C:\Users\Mika\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-01-26 11:39

==================== End Of Log ============================

--- --- ---

--- --- ---

schrauber · 09.03.2015, 12:58

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

Mareike1984 · 11.03.2015, 00:10

Hier nun das Log von ESET

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=f253b8abffd62d4d9ad5913cf3d2e996
# engine=22845
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-03-10 10:20:53
# local_time=2015-03-10 11:20:53 (+0100, W. Europe Standard Time)
# country="United States"
# lang=1031
# osver=6.2.9200 NT 
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 10154254 28382276 0 0
# compatibility_mode_1='Sophos Anti-Virus'
# compatibility_mode=8450 16777213 100 99 92570 27698159 0 0
# scanned=238729
# found=5
# cleaned=0
# scan_time=9251
sh=AFAA605C0F5036B777B1A5269540A7804227BC73 ft=1 fh=3eb70ea2845d5af2 vn="Win32/Patched.NFY Trojaner" ac=I fn="C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.111\chrome.dll"
sh=59E8DEBDF59BB3B5882420264B3BD3B06BF04971 ft=1 fh=c71c00110e2f7687 vn="Variante von Win32/Adware.MultiPlug.DX Anwendung" ac=I fn="C:\Users\Mika\AppData\Local\Temp\D2F0\temp\TyHelpTFUO.xyz"
sh=187DE988D8D4EB1A8414F2526F37A3C17BFC7ED1 ft=1 fh=759708fd4136758c vn="Variante von Win32/DownloadGuide.D evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Mika\Downloads\gimp-Download.exe"
sh=5C85BA3EFBC1A1E4204CD0C5133C16EABDBD8CD5 ft=1 fh=0dcf06ec45a7da45 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Mika\Downloads\MediathekView - CHIP-Installer.exe"
sh=A663ACD7E3423C570AEB0E36BF043FC9CD03833A ft=1 fh=7646ad5fb6631e75 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Mika\Downloads\Subtitle Edit - CHIP-Installer.exe"

Hier nun das Logfile von Security Check

Code:

ATTFilter

 Results of screen317's Security Check version 0.99.97  
   x64 (UAC is enabled)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:`````````````` 
 Windows Firewall Enabled!  
 Windows Firewall Disabled!  
Windows Defender    
Sophos Anti-Virus   
 WMI entry may not exist for antivirus; attempting automatic update. 
`````````Anti-malware/Other Utilities Check:````````` 
 Secunia PSI (3.0.0.10004)   
 Java 8 Update 31  
 Java version 32-bit out of Date! 
  Java 64-bit 8 Update 31  
 Google Chrome (40.0.2214.111) 
 Google Chrome (40.0.2214.115) 
````````Process Check: objlist.exe by Laurent````````  
 WinPatrol winpatrol.exe 
 Sophos Sophos Anti-Virus SavService.exe  
 Sophos Sophos Anti-Virus SAVAdminService.exe  
 Sophos Sophos Anti-Virus Web Control swc_service.exe 
 Sophos Sophos Anti-Virus Web Intelligence swi_filter.exe 
 Sophos Sophos Anti-Virus Web Intelligence swi_service.exe 
 WinPatrol WinPatrol WinPatrol.exe  
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  % 
````````````````````End of Log``````````````````````

Und hier ein neues FRST Log
FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 09-03-2015 01
Ran by Mika (administrator) on EWBFBM-MBL15 on 10-03-2015 23:30:44
Running from C:\Users\Mika\Downloads
Loaded Profiles: Mika (Available profiles: Mika & Administrator)
Platform: Windows 8.1 (X64) OS Language: English (United States)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Novell, Inc.) C:\Program Files\Novell\Client\XTier\Services\xtsvcmgr.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\ibtrksrv.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psia.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Remote Management System\ManagementAgentNT.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Remote Management System\RouterNT.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_filter.exe
(Sophos Limited) C:\Program Files (x86)\Common Files\Sophos\Web Intelligence\swi_fc.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe
(Uwe Sieber - www.uwe-sieber.de) C:\Program Files (x86)\USBDLM\USBDLM.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Seiko Epson Corporation) C:\Windows\System32\escsvc64.exe
(OCS Inventory NG) C:\Program Files (x86)\OCS Inventory Agent\OcsService.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Dell Products, LP.) C:\Program Files (x86)\Dell Digital Delivery\DeliveryService.exe
(Dell Inc.) C:\Program Files (x86)\Dell Update\DellUpService.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
(SoftThinks SAS) C:\Program Files (x86)\Dell Backup and Recovery\SftService.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Uwe Sieber - www.uwe-sieber.de) C:\Program Files (x86)\USBDLM\USBDLM_usr.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Dell Inc.) C:\Program Files\Dell\QuickSet\quickset.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
() C:\Program Files\Novell\Client\nwtray.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Ruiware LLC) C:\Program Files (x86)\WinPatrol\WinPatrol\WinPatrol.exe
(OCS Inventory NG) C:\Program Files (x86)\OCS Inventory Agent\OcsSystray.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psi_tray.exe
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\acrotray.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\AutoUpdate\ALMon.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXRCV.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXSTM.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(SoftThinks - Dell) C:\Program Files (x86)\Dell Backup and Recovery\Components\DBRUpdate\DBRUpd.exe
(SoftThinks - Dell) C:\Program Files (x86)\Dell Backup and Recovery\Toaster.exe
(Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
() C:\Program Files (x86)\Dell Backup and Recovery\Components\Shell\DBRCrawler.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Farbar) C:\Users\Mika\Downloads\FRST64 (3).exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7202520 2013-08-20] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1321688 2013-08-07] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_PushButton] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1321688 2013-08-07] (Realtek Semiconductor)
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [287592 2013-08-07] (Intel Corporation)
HKLM\...\Run: [QuickSet] => c:\Program Files\Dell\QuickSet\QuickSet.exe [3760432 2013-08-02] (Dell Inc.)
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll",TrayApp
HKLM\...\Run: [NWTRAY] => C:\Program Files\Novell\Client\nwtray.exe [39992 2013-01-15] ()
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [558496 2014-02-27] (Adobe Systems Incorporated)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [169768 2015-02-13] (Apple Inc.)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS5ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe [406992 2010-02-22] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Acrobat Assistant 8.0] => C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Acrotray.exe [3498728 2014-12-03] (Adobe Systems Inc.)
HKLM-x32\...\Run: [Sophos AutoUpdate Monitor] => C:\Program Files (x86)\Sophos\AutoUpdate\almon.exe [1593640 2015-03-03] (Sophos Limited)
HKLM-x32\...\Run: [FUFAXRCV] => C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXRCV.exe [502912 2012-04-03] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [FUFAXSTM] => C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXSTM.exe [863360 2012-04-03] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [EEventManager] => C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [1058912 2012-04-02] (SEIKO EPSON CORPORATION)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\ScCertProp: wlnotify.dll [X]
HKU\S-1-5-21-1401536446-3937075962-3797694313-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [30878816 2014-12-11] (Skype Technologies S.A.)
HKU\S-1-5-21-1401536446-3937075962-3797694313-1001\...\Run: [WinPatrol] => C:\Program Files (x86)\WinPatrol\WinPatrol\winpatrol.exe [1160536 2015-02-23] (Ruiware LLC)
HKU\S-1-5-18\...\Run: [EPLTarget\P0000000000000000] => C:\Windows\system32\spool\DRIVERS\x64\3\E_YATIHSA.EXE /EPT "EPLTarget\P0000000000000000" /M "WorkForce 845"
HKU\S-1-5-18\...\Run: [EPLTarget\P0000000000000001] => C:\Windows\system32\spool\DRIVERS\x64\3\E_YATIIUE.EXE [283232 2012-02-28] (SEIKO EPSON CORPORATION)
AppInit_DLLs-x32: C:\PROGRA~2\Sophos\SOPHOS~1\SOPHOS~1.DLL => C:\Program Files (x86)\Sophos\Sophos Anti-Virus\sophos_detoured.dll [275352 2015-01-13] (Sophos Limited)
Lsa: [Authentication Packages] msv1_0 ncv1_0
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\OCS Inventory NG Systray.lnk
ShortcutTarget: OCS Inventory NG Systray.lnk -> C:\Program Files (x86)\OCS Inventory Agent\OcsSystray.exe (OCS Inventory NG)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Secunia)
Startup: C:\Users\Mika\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Download.lnk
ShortcutTarget: Download.lnk -> C:\ProgramData\{d6560dff-0f39-a46a-d656-60dff0f337fc}\Download.exe (No File)
ShellIconOverlayIdentifiers: [DBARFileBackuped] -> {831cebdd-6baf-4432-be76-9e0989c14aef} => C:\Windows\system32\mscoree.dll (Microsoft Corporation)
ShellIconOverlayIdentifiers: [DBARFileNotBackuped] -> {275e4fd7-21ef-45cf-a836-832e5d2cc1b3} => C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-1401536446-3937075962-3797694313-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:62005;https=127.0.0.1:62005
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKU\S-1-5-21-1401536446-3937075962-3797694313-1001\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/?gws_rd=ssl
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2015-01-21] (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_31\bin\ssv.dll [2015-01-26] (Oracle Corporation)
BHO: Adobe Acrobat Create PDF Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll [2014-05-08] (Adobe Systems Incorporated)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2015-01-21] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-01-26] (Oracle Corporation)
BHO: Adobe Acrobat Create PDF from Selection -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll [2014-05-08] (Adobe Systems Incorporated)
BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2014-10-22] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-01-26] (Oracle Corporation)
BHO-x32: Adobe Acrobat Create PDF Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll [2013-12-21] (Adobe Systems Incorporated)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2015-01-21] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-01-26] (Oracle Corporation)
BHO-x32: Adobe Acrobat Create PDF from Selection -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll [2013-12-21] (Adobe Systems Incorporated)
Toolbar: HKLM - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll [2014-05-08] (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll [2013-12-21] (Adobe Systems Incorporated)
Toolbar: HKU\S-1-5-21-1401536446-3937075962-3797694313-1001 -> Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll [2014-05-08] (Adobe Systems Incorporated)
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2014-03-12] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
StartMenuInternet: IEXPLORE.EXE - iexplore.exe

FireFox:
========
FF ProfilePath: C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default
FF NetworkProxy: "type", 5
FF Plugin: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-01-26] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-01-26] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll [2014-04-28] (Adobe Systems)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-09-04] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-09-04] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-01-26] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-01-26] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2014-03-03] (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office15\NPSPWRAP.DLL [2014-01-22] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-09-13] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-07] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-07] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin-x32: Adobe Acrobat -> C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Air\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll [2014-04-28] (Adobe Systems)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2014-03-03] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn [2014-04-24]
FF Extension: No Name - C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com [Not Found]
FF Extension: No Name - C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\fftoolbar2014@etech.com [Not Found]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [Not Found]

Chrome: 
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR HomePage: Default -> 
CHR StartupUrls: Default -> "hxxp://www.mystartsearch.com/?type=hp&ts=1425557118&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421", "hxxp://www.mystartsearch.com/?type=hppp&ts=1425557178&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421", "hxxp://www.mystartsearch.com/?type=hp&ts=1425577412&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421", "hxxp://www.mystartsearch.com/?type=hppp&ts=1425577428&from=cvs&uid=WDCXWD10JPVX-75JC3T0_WXF1AA360421AA360421", "?type=hppp"
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}
CHR Profile: C:\Users\Mika\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Mika\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-04-06]
CHR Extension: (Google Drive) - C:\Users\Mika\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-04-06]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Mika\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2015-01-19]
CHR Extension: (YouTube) - C:\Users\Mika\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-04-06]
CHR Extension: (Google Search) - C:\Users\Mika\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-04-06]
CHR Extension: (Adobe Acrobat - Create PDF) - C:\Users\Mika\AppData\Local\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj [2014-04-24]
CHR Extension: (Google Wallet) - C:\Users\Mika\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-04-06]
CHR Extension: (Gmail) - C:\Users\Mika\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-04-06]
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCChromeExtn\WCChromeExtn.crx [2014-12-03]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-01-19] (Apple Inc.)
R2 DellUpdate; C:\Program Files (x86)\Dell Update\DellUpService.exe [150224 2014-09-09] (Dell Inc.)
R2 EpsonScanSvc; C:\Windows\system32\EscSvc64.exe [135824 2011-12-12] (Seiko Epson Corporation)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15720 2013-08-07] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; c:\Program Files\Intel\iCLS Client\HeciServer.exe [733696 2013-05-12] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; c:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-12] (Intel(R) Corporation)
R2 Intel(R) Wireless Bluetooth(R) 4.0 Radio Management; C:\Program Files (x86)\Intel\Bluetooth\ibtrksrv.exe [155448 2013-08-01] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-04] (Intel Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [284912 2013-08-23] ()
R2 OCS Inventory Service; C:\Program Files (x86)\OCS Inventory Agent\OcsService.exe [35840 2012-01-27] (OCS Inventory NG) [File not signed]
S3 OpenVPNService; C:\Program Files (x86)\OpenVPN\bin\openvpnserv.exe [14848 2011-12-15] () [File not signed]
R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [253776 2013-07-30] (CyberLink)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [246488 2013-06-19] (Realtek Semiconductor)
R2 SAVAdminService; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe [288552 2014-05-20] (Sophos Limited)
R2 SAVService; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe [208168 2014-10-17] (Sophos Limited)
R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1363160 2014-11-28] (Secunia)
R2 SftService; C:\Program Files (x86)\Dell Backup and Recovery\sftservice.exe [1924328 2014-09-18] (SoftThinks SAS)
R2 Sophos Agent; C:\Program Files (x86)\Sophos\Remote Management System\ManagementAgentNT.exe [289856 2014-04-24] (Sophos Limited)
R2 Sophos AutoUpdate Service; C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe [340776 2015-03-03] (Sophos Limited)
R2 Sophos Message Router; C:\Program Files (x86)\Sophos\Remote Management System\RouterNT.exe [818240 2014-04-24] (Sophos Limited)
R2 Sophos Web Control Service; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe [341800 2014-10-17] (Sophos Limited)
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
R2 swi_filter; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_filter.exe [300840 2015-01-13] (Sophos Limited)
R2 swi_service; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe [3274536 2015-01-13] (Sophos Limited)
R2 USBDLM; C:\Program Files (x86)\USBDLM\USBDLM.exe [337888 2012-01-15] (Uwe Sieber - www.uwe-sieber.de) [File not signed]
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)
R2 XTSvcMgr; C:\Program Files\Novell\Client\XTier\Services\XTSvcMgr.exe [20536 2013-01-15] (Novell, Inc.)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3667696 2013-08-23] (Intel® Corporation)
S2 McAPExe; "C:\Program Files\McAfee\MSC\McAPExe.exe" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 BthLEEnum; C:\Windows\System32\drivers\BthLEEnum.sys [226304 2013-12-04] (Microsoft Corporation)
R3 btmaux; C:\Windows\system32\DRIVERS\btmaux.sys [132920 2013-04-24] (Motorola Solutions, Inc.)
R3 btmhsf; C:\Windows\system32\DRIVERS\btmhsf.sys [1385784 2013-06-27] (Motorola Solutions, Inc.)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [91712 2013-03-05] (CyberLink)
R3 DellRbtn; C:\Windows\System32\drivers\DellRbtn.sys [10752 2013-01-25] (OSR Open Systems Resources, Inc.)
R3 ibtusb; C:\Windows\system32\DRIVERS\ibtusb.sys [114632 2013-07-01] (Intel Corporation)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-03-07] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\System32\drivers\TeeDriverx64.sys [99288 2013-12-19] (Intel Corporation)
R0 NCFilter; C:\Windows\System32\DRIVERS\NCFilter.sys [112696 2013-01-15] ()
R2 NCFSD; C:\Program Files\Novell\Client\XTier\Drivers\ncfsd.sys [115256 2013-01-15] ()
R2 NCIOCTL; C:\Program Files\Novell\Client\XTier\Drivers\ncioctl.sys [90680 2013-01-15] ()
R0 NCRecognizer; C:\Windows\System32\DRIVERS\NCRecognizer.sys [120376 2013-01-15] ()
R0 NCUncFilter; C:\Windows\System32\DRIVERS\NCUncFilter.sys [26680 2013-01-15] ()
R3 NETwNb64; C:\Windows\system32\DRIVERS\NETwbw02.sys [3589600 2013-09-25] (Intel Corporation)
R1 NICM; C:\Program Files\Novell\Client\XTier\Drivers\nicm.sys [31800 2013-01-15] (Novell, Inc.)
S3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2014-11-28] (Secunia)
S3 S3XXx64; C:\Windows\system32\DRIVERS\S3XXx64.sys [73856 2015-02-17] (Identiv)
R1 SAVOnAccess; C:\Windows\System32\DRIVERS\savonaccess.sys [161024 2014-10-17] (Sophos Limited)
S3 sdcfilter; C:\Windows\system32\DRIVERS\sdcfilter.sys [38144 2014-05-20] (Sophos Limited)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [34544 2013-08-02] (Synaptics Incorporated)
S4 SophosBootDriver; C:\Windows\system32\DRIVERS\SophosBootDriver.sys [27904 2014-05-20] (Sophos Limited)
R1 swi_callout; C:\Windows\system32\DRIVERS\swi_callout.sys [32512 2015-03-03] (Sophos Limited)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)
U3 nccache; C:\Program Files\Novell\Client\XTier\Drivers\nccache.sys [55864 2013-01-15] (Novell, Inc.)
U3 nciom; C:\Program Files\Novell\Client\XTier\Drivers\nciom.sys [80952 2013-01-15] (Novell, Inc.)
U3 ncp; C:\Program Files\Novell\Client\XTier\Drivers\ncp.sys [79416 2013-01-15] (Novell, Inc.)
U3 ncpfsp; C:\Program Files\Novell\Client\XTier\Drivers\ncpfsp.sys [101944 2013-01-15] (Novell, Inc.)
U3 ncpl; C:\Program Files\Novell\Client\XTier\Drivers\ncpl.sys [49720 2013-01-15] (Novell, Inc.)
U3 ndm; C:\Program Files\Novell\Client\XTier\Drivers\ndm.sys [20024 2013-01-15] (Novell, Inc.)
U3 ndmndap; C:\Program Files\Novell\Client\XTier\Drivers\ndmndap.sys [84024 2013-01-15] (Novell, Inc.)
U3 niam; C:\Program Files\Novell\Client\XTier\Drivers\niam.sys [39480 2013-01-15] (Novell, Inc.)
U3 nipctl; C:\Program Files\Novell\Client\XTier\Drivers\nipctl.sys [56376 2013-01-15] (Novell, Inc.)
U3 nscm; C:\Program Files\Novell\Client\XTier\Drivers\nscm.sys [37944 2013-01-15] (Novell, Inc.)
U3 nsns; C:\Program Files\Novell\Client\XTier\Drivers\nsns.sys [25656 2013-01-15] (Novell, Inc.)
U3 nsvccost; C:\Program Files\Novell\Client\XTier\Drivers\nsvccost.sys [36408 2013-01-15] (Novell, Inc.)
U3 xtxplat; C:\Program Files\Novell\Client\XTier\Drivers\xtxplat.sys [59960 2013-01-15] (Novell, Inc.)
R3 PCDSRVC{3B54B31B-D06B6431-06020200}_0; \??\c:\program files\dell\supportassist\pcdsrvc_x64.pkms [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-10 23:30 - 2015-03-10 23:30 - 02095104 _____ (Farbar) C:\Users\Mika\Downloads\FRST64 (3).exe
2015-03-10 23:28 - 2015-03-10 23:28 - 00852604 _____ () C:\Users\Mika\Downloads\SecurityCheck.exe
2015-03-10 20:42 - 2015-03-10 20:43 - 02347384 _____ (ESET) C:\Users\Mika\Downloads\esetsmartinstaller_deu.exe
2015-03-08 20:46 - 2015-03-08 20:46 - 00000000 ____D () C:\Users\Mika\Documents\My Received Files
2015-03-08 20:42 - 2015-03-08 20:42 - 02095104 _____ (Farbar) C:\Users\Mika\Downloads\FRST64 (2).exe
2015-03-08 20:41 - 2015-03-08 20:42 - 02095104 _____ (Farbar) C:\Users\Mika\Downloads\FRST64 (1).exe
2015-03-08 20:39 - 2015-03-08 20:39 - 00000902 _____ () C:\Users\Mika\Desktop\JRT.txt
2015-03-08 20:32 - 2015-03-08 20:33 - 01388333 _____ (Thisisu) C:\Users\Mika\Downloads\JRT.exe
2015-03-08 18:31 - 2015-03-08 18:36 - 00000000 ____D () C:\AdwCleaner
2015-03-08 18:30 - 2015-03-08 18:30 - 02126848 _____ () C:\Users\Mika\Downloads\AdwCleaner_4.111.exe
2015-03-06 16:56 - 2015-03-06 16:59 - 00035117 _____ () C:\Users\Mika\Downloads\Addition.txt
2015-03-06 16:53 - 2015-03-10 23:30 - 00030060 _____ () C:\Users\Mika\Downloads\FRST.txt
2015-03-06 16:53 - 2015-03-10 23:30 - 00000000 ____D () C:\FRST
2015-03-06 16:53 - 2015-03-06 16:53 - 02092544 _____ (Farbar) C:\Users\Mika\Downloads\FRST64.exe
2015-03-06 09:05 - 2015-03-06 09:05 - 01728218 _____ () C:\Users\Mika\Downloads\openvpn-install (1).exe
2015-03-05 18:47 - 2015-03-06 13:57 - 00000000 ____D () C:\Program Files (x86)\Cars 2 World Grand Prix Races
2015-03-05 18:44 - 2015-03-06 13:57 - 00000000 ____D () C:\ProgramData\{d6560dff-0f39-a46a-d656-60dff0f337fc}
2015-03-05 18:15 - 2015-03-05 18:16 - 28687167 _____ () C:\Users\Mika\Downloads\Pressekonferenz Studie Bildung%2C Migration%2C Milieu am 04 12 13 in Berlin youtube original.mp4
2015-03-05 18:14 - 2015-03-05 18:15 - 08004264 _____ () C:\Users\Mika\Downloads\Studie Bildung Milieu und Migration Interview mit Hassan El Moussaoui.mp4
2015-03-05 18:14 - 2015-03-05 18:15 - 07664850 _____ () C:\Users\Mika\Downloads\Studie -Bildung%2C Milieu und Migration- - Interview mit Elvida Sabanovic.mp4
2015-03-05 18:14 - 2015-03-05 18:15 - 06494192 _____ () C:\Users\Mika\Downloads\Studie -Bildung%2C Milieu und Migration- - Interview mit Nazan Wagner.mp4
2015-03-05 18:14 - 2015-03-05 18:14 - 08821007 _____ () C:\Users\Mika\Downloads\Studie -Bildung%2C Milieu und Migration- - Interview mit Sakire Efe.mp4
2015-03-05 16:15 - 2015-03-03 21:15 - 00032512 _____ (Sophos Limited) C:\Windows\system32\Drivers\swi_callout.sys
2015-03-05 15:46 - 2015-03-05 17:46 - 00000000 ____D () C:\Users\Mika\AppData\Roaming\WinPatrol
2015-03-05 15:46 - 2015-03-05 15:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinPatrol
2015-03-05 15:46 - 2015-03-05 15:46 - 00000000 ____D () C:\ProgramData\InstallMate
2015-03-05 15:46 - 2015-03-05 15:46 - 00000000 ____D () C:\Program Files (x86)\WinPatrol
2015-03-05 15:35 - 2015-03-05 15:35 - 01081688 _____ (WinPatrol) C:\Users\Mika\Downloads\wpsetup.exe
2015-03-05 15:34 - 2015-03-07 18:26 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-03-05 15:34 - 2015-03-05 15:34 - 00001120 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-03-05 15:34 - 2015-03-05 15:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-03-05 15:34 - 2015-03-05 15:34 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-03-05 15:34 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-03-05 15:34 - 2014-11-21 06:14 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-03-05 15:34 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-03-05 15:33 - 2015-03-05 15:33 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Mika\Downloads\mbam-setup-2.0.4.1028.exe
2015-03-05 15:25 - 2015-03-05 15:25 - 00448512 _____ (OldTimer Tools) C:\Users\Mika\Downloads\TFC.exe
2015-03-05 15:23 - 2015-03-05 15:23 - 00001091 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Secunia PSI.lnk
2015-03-05 15:23 - 2015-03-05 15:23 - 00000000 ____D () C:\Users\Mika\AppData\Local\Secunia PSI
2015-03-05 15:23 - 2015-03-05 15:23 - 00000000 ____D () C:\Program Files (x86)\Secunia
2015-03-05 15:22 - 2015-03-05 15:23 - 05490752 _____ (Secunia) C:\Users\Mika\Downloads\PSISetup10004.exe
2015-03-05 15:04 - 2015-03-05 15:06 - 00001479 _____ () C:\DelFix.txt
2015-03-05 13:20 - 2015-03-05 13:20 - 00003130 _____ () C:\Windows\System32\Tasks\{EF9F9432-56D5-4276-9BC8-1E4A4270E62B}
2015-03-05 13:13 - 2015-03-05 13:13 - 00000000 ____D () C:\Users\Mika\AppData\Roaming\dlg
2015-03-05 13:12 - 2015-03-05 13:12 - 00000000 __SHD () C:\Users\Mika\AppData\Local\EmieBrowserModeList
2015-03-05 13:10 - 2015-03-05 13:10 - 00000000 ____D () C:\Users\Mika\AppData\Roaming\QuickScan
2015-03-05 13:04 - 2015-03-05 13:04 - 00572432 _____ () C:\Users\Mika\Downloads\gimp-Download.exe
2015-03-05 12:37 - 2015-03-05 13:01 - 00000000 ____D () C:\Users\Mika\Desktop\STA Fotos
2015-03-05 12:35 - 2015-03-05 12:35 - 06593997 _____ () C:\Users\Mika\Downloads\Fotos Milieus Abschlussbericht.7z
2015-03-01 21:42 - 2015-03-01 21:42 - 11157403 _____ () C:\Users\Mika\Downloads\attachments (17).zip
2015-03-01 19:24 - 2015-03-01 19:24 - 06594884 _____ () C:\Users\Mika\Downloads\attachments (16).zip
2015-03-01 10:19 - 2015-03-01 10:19 - 00281848 _____ () C:\Windows\Minidump\030115-28812-01.dmp
2015-02-28 15:37 - 2014-12-13 22:28 - 00513488 _____ () C:\Windows\SysWOW64\locale.nls
2015-02-28 15:37 - 2014-12-13 22:28 - 00513488 _____ () C:\Windows\system32\locale.nls
2015-02-28 15:37 - 2014-10-29 02:27 - 01200128 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Globalization.dll
2015-02-28 15:37 - 2014-10-29 02:27 - 00323072 _____ (Microsoft Corporation) C:\Windows\system32\GlobCollationHost.dll
2015-02-28 15:37 - 2014-10-29 02:04 - 00868352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Globalization.dll
2015-02-28 15:37 - 2014-10-29 02:04 - 00200704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\GlobCollationHost.dll
2015-02-24 17:16 - 2015-02-24 17:16 - 00052893 _____ () C:\Users\Mika\Downloads\Präsentation NEU (3).pptx
2015-02-24 17:01 - 2015-02-24 17:01 - 00052893 _____ () C:\Users\Mika\Downloads\Präsentation NEU (2).pptx
2015-02-24 17:00 - 2015-02-24 17:00 - 00052893 _____ () C:\Users\Mika\Downloads\Präsentation NEU (1).pptx
2015-02-24 16:58 - 2015-02-24 16:58 - 00052893 _____ () C:\Users\Mika\Downloads\Präsentation NEU.pptx
2015-02-24 15:45 - 2015-02-24 15:45 - 03541590 _____ () C:\Users\Mika\Downloads\Zweite Lieferung milieus-gewichtet.xlsx
2015-02-24 15:42 - 2015-02-24 15:42 - 00076472 _____ () C:\Users\Mika\Downloads\Präsentation1.pptx
2015-02-23 13:27 - 2015-02-23 13:27 - 01644971 _____ () C:\Users\Mika\Desktop\Fotosammlung Dereköy verkleinert.zip
2015-02-23 13:22 - 2015-02-23 13:22 - 00001020 _____ () C:\Users\Mika\Desktop\IrfanView.lnk
2015-02-23 13:20 - 2015-02-23 13:20 - 02197648 _____ (Irfan Skiljan) C:\Users\Mika\Downloads\iview438g_setup (1).exe
2015-02-23 13:12 - 2015-02-23 13:18 - 00000000 ____D () C:\Users\Mika\Desktop\Fotosammlung Dereköy verkleinert
2015-02-22 21:58 - 2015-02-22 21:58 - 00000000 ____D () C:\Program Files (x86)\MSECache
2015-02-22 21:57 - 2015-02-22 21:58 - 19998504 _____ (Microsoft Corporation) C:\Users\Mika\Downloads\proofingtools_de-de-x64.exe
2015-02-22 16:52 - 2015-02-22 16:52 - 00000000 ____D () C:\Users\Mika\AppData\Roaming\IrfanView
2015-02-22 16:52 - 2015-02-22 16:52 - 00000000 ____D () C:\Program Files (x86)\IrfanView
2015-02-22 16:51 - 2015-02-22 16:51 - 02197648 _____ (Irfan Skiljan) C:\Users\Mika\Downloads\iview438g_setup (3).exe
2015-02-22 16:51 - 2015-02-22 16:51 - 02197648 _____ (Irfan Skiljan) C:\Users\Mika\Downloads\iview438g_setup (2).exe
2015-02-22 16:47 - 2015-02-22 16:47 - 02197648 _____ (Irfan Skiljan) C:\Users\Mika\Downloads\iview438g_setup.exe
2015-02-22 12:19 - 2015-02-22 12:19 - 01728218 _____ () C:\Users\Mika\Downloads\openvpn-install.exe
2015-02-21 22:26 - 2015-02-21 22:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2015-02-21 22:26 - 2015-02-21 22:26 - 00000000 ____D () C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7
2015-02-21 22:26 - 2015-02-21 22:26 - 00000000 ____D () C:\Program Files\iTunes
2015-02-21 22:26 - 2015-02-21 22:26 - 00000000 ____D () C:\Program Files\iPod
2015-02-21 22:26 - 2015-02-21 22:26 - 00000000 ____D () C:\Program Files (x86)\iTunes
2015-02-20 17:07 - 2015-02-20 17:07 - 00000000 _____ () C:\Users\Mika\Downloads\f.txt
2015-02-20 15:16 - 2015-02-20 15:17 - 00000000 ____D () C:\Users\Mika\Documents\Outlook Files
2015-02-20 15:16 - 2015-02-20 15:16 - 00394049 _____ () C:\Users\Mika\Downloads\noname (1).eml
2015-02-20 15:16 - 2015-02-20 15:16 - 00010158 _____ () C:\Users\Mika\Downloads\noname (2).eml
2015-02-20 15:15 - 2015-02-20 15:15 - 00006023 _____ () C:\Users\Mika\Downloads\noname.eml
2015-02-18 17:32 - 2015-01-23 05:41 - 06041600 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-02-18 17:32 - 2015-01-23 04:17 - 04300800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-02-17 13:40 - 2015-02-17 13:40 - 00073856 _____ (Identiv) C:\Windows\system32\Drivers\S3XXx64.sys
2015-02-16 19:52 - 2015-02-20 15:16 - 00000000 ____D () C:\Users\Mika\AppData\Roaming\Apple Computer
2015-02-16 19:52 - 2015-02-16 19:52 - 00000000 ____D () C:\Users\Mika\AppData\Local\Apple Computer
2015-02-16 19:51 - 2012-10-03 16:14 - 00033240 _____ (GEAR Software Inc.) C:\Windows\system32\Drivers\GEARAspiWDM.sys
2015-02-16 19:50 - 2015-02-16 19:50 - 00000000 ____D () C:\ProgramData\Apple Computer
2015-02-16 19:49 - 2015-02-16 19:49 - 00002535 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
2015-02-16 19:49 - 2015-02-16 19:49 - 00000000 ____D () C:\Windows\System32\Tasks\Apple
2015-02-16 19:49 - 2015-02-16 19:49 - 00000000 ____D () C:\Users\Mika\AppData\Local\Apple
2015-02-16 19:49 - 2015-02-16 19:49 - 00000000 ____D () C:\Program Files\Bonjour
2015-02-16 19:49 - 2015-02-16 19:49 - 00000000 ____D () C:\Program Files (x86)\Bonjour
2015-02-16 19:49 - 2015-02-16 19:49 - 00000000 ____D () C:\Program Files (x86)\Apple Software Update
2015-02-16 19:48 - 2015-02-21 22:26 - 00000000 ____D () C:\Program Files\Common Files\Apple
2015-02-16 19:48 - 2015-02-16 19:49 - 00000000 ____D () C:\ProgramData\Apple
2015-02-16 19:45 - 2015-02-16 19:46 - 152439600 _____ (Apple Inc.) C:\Users\Mika\Downloads\itunes6464setup.exe
2015-02-15 23:08 - 2015-02-15 23:08 - 31398083 _____ () C:\Users\Mika\Downloads\Client Document Package.zip
2015-02-15 22:20 - 2015-02-15 22:20 - 00004034 _____ () C:\Windows\System32\Tasks\PCDoctorBackgroundMonitorTask
2015-02-15 22:20 - 2015-02-15 22:20 - 00003484 _____ () C:\Windows\System32\Tasks\PCDEventLauncherTask
2015-02-15 22:20 - 2015-02-15 22:20 - 00003224 _____ () C:\Windows\System32\Tasks\SystemToolsDailyTest
2015-02-15 22:20 - 2015-02-15 22:20 - 00000000 ____D () C:\ProgramData\PC-Doctor for Windows
2015-02-15 22:20 - 2015-02-15 22:20 - 00000000 ____D () C:\Program Files\Dell Support Center
2015-02-13 19:31 - 2015-02-04 00:38 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-02-13 19:31 - 2015-02-04 00:08 - 00761856 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-02-13 19:31 - 2015-02-04 00:08 - 00414208 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-02-13 19:31 - 2015-02-03 00:11 - 01098752 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-02-13 19:31 - 2015-02-03 00:11 - 00894464 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-02-13 19:31 - 2015-02-03 00:11 - 00609280 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-02-13 19:31 - 2015-01-19 19:42 - 01487976 _____ (Microsoft Corporation) C:\Windows\system32\sppobjs.dll
2015-02-13 19:31 - 2014-12-19 09:57 - 00788680 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2015-02-13 19:31 - 2014-12-19 09:25 - 00602776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2015-02-13 19:31 - 2014-12-09 00:12 - 00391526 _____ () C:\Windows\system32\ApnDatabase.xml
2015-02-10 22:19 - 2015-01-15 23:43 - 00563504 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-02-10 22:19 - 2015-01-15 23:43 - 00177984 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-02-10 22:19 - 2015-01-14 05:22 - 00445440 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-02-10 22:19 - 2015-01-14 04:53 - 00324096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2015-02-10 22:19 - 2015-01-13 23:11 - 01762840 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-02-10 22:19 - 2015-01-13 23:04 - 01489072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2015-02-10 22:19 - 2015-01-12 04:09 - 25056256 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-02-10 22:19 - 2015-01-10 10:10 - 07472960 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-02-10 22:19 - 2015-01-10 10:10 - 01733440 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-02-10 22:19 - 2015-01-10 09:28 - 01498360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-02-10 22:19 - 2015-01-10 08:00 - 00430080 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-02-10 22:19 - 2015-01-10 07:38 - 00359424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-02-10 22:19 - 2014-12-09 04:45 - 00393728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll
2015-02-10 22:19 - 2014-12-09 02:56 - 00538624 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll
2015-02-10 22:19 - 2014-10-29 03:51 - 00154112 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-02-10 22:19 - 2014-10-29 03:50 - 00736768 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-02-10 22:19 - 2014-10-29 03:06 - 00736768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-02-10 22:19 - 2014-10-29 03:06 - 00154112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-02-10 22:19 - 2014-10-29 03:02 - 00285184 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-02-10 22:19 - 2014-10-29 03:02 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-02-10 22:19 - 2014-10-29 02:57 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-02-10 22:19 - 2014-10-29 02:31 - 01441792 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-02-10 22:19 - 2014-10-29 02:15 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-02-10 22:19 - 2014-10-29 02:15 - 00005632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-02-10 22:19 - 2014-10-29 02:14 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-02-10 22:19 - 2014-10-29 02:13 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-02-10 22:19 - 2014-10-29 02:13 - 00008704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-02-10 22:18 - 2015-01-12 03:48 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-02-10 22:18 - 2015-01-12 03:48 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-02-10 22:18 - 2015-01-12 03:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-02-10 22:18 - 2015-01-12 03:34 - 00816128 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-02-10 22:18 - 2015-01-12 03:25 - 19740160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-02-10 22:18 - 2015-01-12 03:21 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-02-10 22:18 - 2015-01-12 03:08 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-02-10 22:18 - 2015-01-12 03:07 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-02-10 22:18 - 2015-01-12 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-02-10 22:18 - 2015-01-12 03:02 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-02-10 22:18 - 2015-01-12 02:58 - 01032704 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2015-02-10 22:18 - 2015-01-12 02:55 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-02-10 22:18 - 2015-01-12 02:51 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2015-02-10 22:18 - 2015-01-12 02:48 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-02-10 22:18 - 2015-01-12 02:48 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-02-10 22:18 - 2015-01-12 02:48 - 00374272 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-02-10 22:18 - 2015-01-12 02:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-02-10 22:18 - 2015-01-12 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-02-10 22:18 - 2015-01-12 02:43 - 14401024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-02-10 22:18 - 2015-01-12 02:34 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2015-02-10 22:18 - 2015-01-12 02:30 - 00880128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2015-02-10 22:18 - 2015-01-12 02:27 - 02865152 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll
2015-02-10 22:18 - 2015-01-12 02:27 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-02-10 22:18 - 2015-01-12 02:25 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2015-02-10 22:18 - 2015-01-12 02:23 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-02-10 22:18 - 2015-01-12 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-02-10 22:18 - 2015-01-12 02:23 - 00327168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-02-10 22:18 - 2015-01-12 02:14 - 12829184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-02-10 22:18 - 2015-01-12 02:14 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-02-10 22:18 - 2015-01-12 02:02 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-02-10 22:18 - 2015-01-12 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-02-10 22:18 - 2015-01-12 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-02-10 22:18 - 2015-01-12 01:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-02-10 22:18 - 2015-01-10 09:22 - 04175872 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-10 23:27 - 2014-01-05 03:01 - 01781925 _____ () C:\Windows\WindowsUpdate.log
2015-03-10 23:00 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\sru
2015-03-10 22:58 - 2014-04-06 16:22 - 00000930 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-03-10 21:35 - 2013-08-22 16:20 - 00000000 ____D () C:\Windows\CbsTemp
2015-03-10 21:30 - 2014-10-07 20:14 - 00000000 ____D () C:\Users\Mika\AppData\Roaming\Skype
2015-03-10 20:42 - 2014-01-05 02:55 - 00865408 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-03-10 20:38 - 2013-08-22 15:46 - 00033986 _____ () C:\Windows\setupact.log
2015-03-10 20:34 - 2014-01-05 03:13 - 00000000 ____D () C:\Program Files (x86)\Dell Backup and Recovery
2015-03-10 20:29 - 2014-04-06 16:22 - 00000926 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-03-10 20:29 - 2014-04-04 06:54 - 00000000 __RDO () C:\Users\Mika\SkyDrive
2015-03-08 19:00 - 2014-04-23 10:49 - 00000000 ____D () C:\Users\Mika\AppData\Local\Adobe
2015-03-08 18:37 - 2013-08-22 15:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-03-08 18:37 - 2013-08-22 14:25 - 00524288 ___SH () C:\Windows\system32\config\BBI
2015-03-08 18:36 - 2014-04-04 06:31 - 00000000 ____D () C:\Users\Mika
2015-03-08 18:18 - 2014-04-13 22:48 - 02032128 ___SH () C:\Users\Mika\Desktop\Thumbs.db
2015-03-08 17:59 - 2014-01-05 02:40 - 00224528 _____ () C:\Windows\PFRO.log
2015-03-07 17:36 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\Performance
2015-03-07 16:53 - 2014-04-04 06:40 - 00003600 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1401536446-3937075962-3797694313-1001
2015-03-06 18:20 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\NDF
2015-03-05 18:55 - 2014-08-22 21:44 - 00001380 _____ () C:\Users\Mika\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk
2015-03-05 18:55 - 2014-04-04 06:34 - 00001448 _____ () C:\Users\Mika\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-03-05 18:54 - 2014-04-24 08:46 - 00002337 _____ () C:\Users\Administrator\Desktop\Google Chrome.lnk
2015-03-05 18:39 - 2014-04-04 06:34 - 00000000 ____D () C:\Users\Mika\AppData\Local\Packages
2015-03-05 18:25 - 2014-04-29 21:48 - 01916928 ___SH () C:\Users\Mika\Downloads\Thumbs.db
2015-03-05 15:19 - 2014-09-05 08:19 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2015-03-05 15:13 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\AppReadiness
2015-03-05 15:07 - 2014-04-24 09:06 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-03-05 11:43 - 2014-08-03 22:40 - 00000000 ____D () C:\Users\Mika\Desktop\Meine Hochzeit
2015-03-05 11:22 - 2015-01-26 16:29 - 00000000 ____D () C:\Users\Mika\AppData\Roaming\vlc
2015-03-05 11:12 - 2014-11-02 21:06 - 00000000 ____D () C:\Users\Mika\AppData\Local\Windows Live
2015-03-05 11:04 - 2014-06-11 09:43 - 00000000 ____D () C:\Users\Mika\MediathekView
2015-03-05 11:03 - 2014-08-16 10:24 - 00000000 ____D () C:\Users\Mika\Downloads\MediathekView_7
2015-03-05 11:03 - 2014-06-11 09:38 - 00000000 ____D () C:\Users\Mika\.mediathek3
2015-03-05 11:03 - 2014-06-11 09:37 - 00000000 ____D () C:\Users\Mika\Downloads\MediathekView_6
2015-03-01 10:19 - 2014-04-24 10:57 - 00000000 ____D () C:\Windows\Minidump
2015-03-01 10:19 - 2014-04-24 10:56 - 558134323 _____ () C:\Windows\MEMORY.DMP
2015-02-18 17:17 - 2013-08-22 15:44 - 05051904 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-02-18 17:15 - 2014-04-07 21:39 - 00000000 ____D () C:\Windows\system32\MRT
2015-02-18 17:12 - 2014-12-25 20:30 - 00000000 ____D () C:\Windows\system32\appraiser
2015-02-18 17:12 - 2014-08-07 21:58 - 00000000 ___SD () C:\Windows\system32\CompatTel
2015-02-17 22:48 - 2014-04-07 21:39 - 116773704 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-02-17 22:47 - 2014-04-24 09:48 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2015-02-17 22:47 - 2014-04-24 09:43 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-02-17 22:10 - 2014-01-05 03:01 - 00000000 ____D () C:\ProgramData\Package Cache
2015-02-17 21:53 - 2013-08-22 14:25 - 00000199 _____ () C:\Windows\win.ini
2015-02-15 22:20 - 2014-01-05 03:09 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dell
2015-02-15 22:19 - 2014-01-05 03:00 - 00000000 ____D () C:\Program Files\Dell

==================== Files in the root of some directories =======

2014-01-05 02:42 - 2014-01-05 02:42 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2014-04-23 10:39 - 2014-04-23 10:40 - 0000315 _____ () C:\ProgramData\NCIDebug.log
2014-01-05 03:08 - 2014-01-05 03:08 - 0000121 _____ () C:\ProgramData\{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}.log
2014-01-05 03:05 - 2014-01-05 03:06 - 0000106 _____ () C:\ProgramData\{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}.log
2014-01-05 03:06 - 2014-01-05 03:07 - 0000111 _____ () C:\ProgramData\{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}.log
2014-01-05 03:07 - 2014-01-05 03:08 - 0000108 _____ () C:\ProgramData\{B46BEA36-0B71-4A4E-AE41-87241643FA0A}.log
2014-01-05 03:05 - 2014-01-05 03:05 - 0000107 _____ () C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log

Some content of TEMP:
====================
C:\Users\Mika\AppData\Local\Temp\Quarantine.exe
C:\Users\Mika\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-01-26 11:39

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

Hallo Schrauber,

ich habe den Laptop jetzt nochmals runter und dann wieder hochgefahren und wenn ich ein Fenst ueber Google Chrome oeffne, dann oeffnen sich immer noch automatisch 5 Tabs zu mystartsearch auf einmal.

Ich freue mich auf deine Rueckmeldung. Ansonsten ist aber alles soweit ganz gut. Es poppt nicht mehr alles auf. Der Laptop ist nur etwas langsamer bei Startup.

Viele Gruesse
Mareike

schrauber · 11.03.2015, 18:00

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.111\chrome.dll

C:\Users\Mika\AppData\Local\Temp\D2F0\temp\TyHelpTFUO.xyz

C:\Users\Mika\Downloads\gimp-Download.exe

C:\Users\Mika\Downloads\MediathekView - CHIP-Installer.exe

C:\Users\Mika\Downloads\Subtitle Edit - CHIP-Installer.exe
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
RemoveProxy:
Emptytemp:

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Revo Uninstaller - Download - Filepony
damit Chrome deinstallieren, keine Daten behalten, Reste entfernen lassen, neu installieren.

Dann:
https://support.google.com/chrome/answer/3296214?hl=de

Java updaten. Frisches FRST log bitte. Noch PRobleme?

Mareike1984 · 22.03.2015, 12:08

Hallo Schrauber,

entschuldige bitte meine super spaete Antwort. Ich war leider ziemlich krank und musste zwischenzeitig sogar ins Krankenhaus. Ich habe jetzt gerade versucht die fixlog.txt zu erstellen. Vielleicht mache ich ja etwas falsch, aber frst hat keine erstellt.

Hallo Schrauber,

die anderen Tasks habe ich nun auch abgearbeitet. Hier noch das neue FRST-Log

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015
Ran by Mika (administrator) on EWBFBM-MBL15 on 22-03-2015 12:00:59
Running from C:\Users\Mika\Downloads
Loaded Profiles: Mika (Available profiles: Mika & Administrator)
Platform: Windows 8.1 (X64) OS Language: English (United States)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Novell, Inc.) C:\Program Files\Novell\Client\XTier\Services\xtsvcmgr.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\ibtrksrv.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psia.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Remote Management System\ManagementAgentNT.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Remote Management System\RouterNT.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_filter.exe
(Sophos Limited) C:\Program Files (x86)\Common Files\Sophos\Web Intelligence\swi_fc.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe
(Uwe Sieber - www.uwe-sieber.de) C:\Program Files (x86)\USBDLM\USBDLM.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Seiko Epson Corporation) C:\Windows\System32\escsvc64.exe
(OCS Inventory NG) C:\Program Files (x86)\OCS Inventory Agent\OcsService.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Uwe Sieber - www.uwe-sieber.de) C:\Program Files (x86)\USBDLM\USBDLM_usr.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Dell Inc.) C:\Program Files\Dell\QuickSet\quickset.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
() C:\Program Files\Novell\Client\nwtray.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Ruiware LLC) C:\Program Files (x86)\WinPatrol\WinPatrol\WinPatrol.exe
(OCS Inventory NG) C:\Program Files (x86)\OCS Inventory Agent\OcsSystray.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psi_tray.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\acrotray.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\AutoUpdate\ALMon.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXRCV.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXSTM.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Dell Products, LP.) C:\Program Files (x86)\Dell Digital Delivery\DeliveryService.exe
(Dell Inc.) C:\Program Files (x86)\Dell Update\DellUpService.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
(SoftThinks SAS) C:\Program Files (x86)\Dell Backup and Recovery\SftService.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(SoftThinks - Dell) C:\Program Files (x86)\Dell Backup and Recovery\Components\DBRUpdate\DBRUpd.exe
(SoftThinks - Dell) C:\Program Files (x86)\Dell Backup and Recovery\Toaster.exe
(Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
() C:\Program Files (x86)\Dell Backup and Recovery\Components\Shell\DBRCrawler.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Oracle Corporation) C:\Users\Mika\AppData\Local\Temp\jre-8u40-windows-au.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Farbar) C:\Users\Mika\Downloads\FRST64 (6).exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7202520 2013-08-20] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1321688 2013-08-07] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_PushButton] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1321688 2013-08-07] (Realtek Semiconductor)
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [287592 2013-08-07] (Intel Corporation)
HKLM\...\Run: [QuickSet] => c:\Program Files\Dell\QuickSet\QuickSet.exe [3760432 2013-08-02] (Dell Inc.)
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll",TrayApp
HKLM\...\Run: [NWTRAY] => C:\Program Files\Novell\Client\nwtray.exe [39992 2013-01-15] ()
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [558496 2014-02-27] (Adobe Systems Incorporated)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [169768 2015-02-13] (Apple Inc.)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS5ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe [406992 2010-02-22] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Acrobat Assistant 8.0] => C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Acrotray.exe [3498728 2014-12-03] (Adobe Systems Inc.)
HKLM-x32\...\Run: [Sophos AutoUpdate Monitor] => C:\Program Files (x86)\Sophos\AutoUpdate\almon.exe [1593640 2015-03-03] (Sophos Limited)
HKLM-x32\...\Run: [FUFAXRCV] => C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXRCV.exe [502912 2012-04-03] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [FUFAXSTM] => C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXSTM.exe [863360 2012-04-03] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [EEventManager] => C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [1058912 2012-04-02] (SEIKO EPSON CORPORATION)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\ScCertProp: wlnotify.dll [X]
HKU\S-1-5-21-1401536446-3937075962-3797694313-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [30878816 2014-12-11] (Skype Technologies S.A.)
HKU\S-1-5-21-1401536446-3937075962-3797694313-1001\...\Run: [WinPatrol] => C:\Program Files (x86)\WinPatrol\WinPatrol\winpatrol.exe [1160536 2015-02-23] (Ruiware LLC)
HKU\S-1-5-18\...\Run: [EPLTarget\P0000000000000000] => C:\Windows\system32\spool\DRIVERS\x64\3\E_YATIHSA.EXE /EPT "EPLTarget\P0000000000000000" /M "WorkForce 845"
HKU\S-1-5-18\...\Run: [EPLTarget\P0000000000000001] => C:\Windows\system32\spool\DRIVERS\x64\3\E_YATIIUE.EXE [283232 2012-02-28] (SEIKO EPSON CORPORATION)
AppInit_DLLs-x32: C:\PROGRA~2\Sophos\SOPHOS~1\SOPHOS~1.DLL => C:\Program Files (x86)\Sophos\Sophos Anti-Virus\sophos_detoured.dll [275352 2015-01-13] (Sophos Limited)
Lsa: [Authentication Packages] msv1_0 ncv1_0
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\OCS Inventory NG Systray.lnk
ShortcutTarget: OCS Inventory NG Systray.lnk -> C:\Program Files (x86)\OCS Inventory Agent\OcsSystray.exe (OCS Inventory NG)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Secunia)
Startup: C:\Users\Mika\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Download.lnk
ShortcutTarget: Download.lnk -> C:\ProgramData\{d6560dff-0f39-a46a-d656-60dff0f337fc}\Download.exe (No File)
ShellIconOverlayIdentifiers: [DBARFileBackuped] -> {831cebdd-6baf-4432-be76-9e0989c14aef} => C:\Windows\system32\mscoree.dll (Microsoft Corporation)
ShellIconOverlayIdentifiers: [DBARFileNotBackuped] -> {275e4fd7-21ef-45cf-a836-832e5d2cc1b3} => C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-1401536446-3937075962-3797694313-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:62005;https=127.0.0.1:62005
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKU\S-1-5-21-1401536446-3937075962-3797694313-1001\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/?gws_rd=ssl
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-1401536446-3937075962-3797694313-1001 -> {12E797B7-A75C-4051-B4D9-8F48480ECCE7} URL = 
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2015-02-10] (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_31\bin\ssv.dll [2015-01-26] (Oracle Corporation)
BHO: Adobe Acrobat Create PDF Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll [2014-05-08] (Adobe Systems Incorporated)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2015-01-21] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-01-26] (Oracle Corporation)
BHO: Adobe Acrobat Create PDF from Selection -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll [2014-05-08] (Adobe Systems Incorporated)
BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2015-02-10] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-01-26] (Oracle Corporation)
BHO-x32: Adobe Acrobat Create PDF Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll [2013-12-21] (Adobe Systems Incorporated)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2015-01-21] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-01-26] (Oracle Corporation)
BHO-x32: Adobe Acrobat Create PDF from Selection -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll [2013-12-21] (Adobe Systems Incorporated)
Toolbar: HKLM - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll [2014-05-08] (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll [2013-12-21] (Adobe Systems Incorporated)
Toolbar: HKU\S-1-5-21-1401536446-3937075962-3797694313-1001 -> Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll [2014-05-08] (Adobe Systems Incorporated)
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2014-03-12] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
StartMenuInternet: IEXPLORE.EXE - iexplore.exe

FireFox:
========
FF ProfilePath: C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default
FF NetworkProxy: "type", 5
FF Plugin: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-01-26] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-01-26] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll [2014-04-28] (Adobe Systems)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-09-04] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-09-04] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-01-26] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-01-26] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2014-03-03] (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office15\NPSPWRAP.DLL [2014-01-22] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-09-13] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-07] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-07] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin-x32: Adobe Acrobat -> C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Air\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll [2014-04-28] (Adobe Systems)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2014-03-03] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn [2014-04-24]
FF Extension: No Name - C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\istart_ffnt@gmail.com [Not Found]
FF Extension: No Name - C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\sbwnjcax.default\extensions\fftoolbar2014@etech.com [Not Found]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [Not Found]

Chrome: 
=======
CHR HomePage: Default -> 
CHR StartupUrls: Default -> "hxxp://www.google.de/"
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}
CHR Profile: C:\Users\Mika\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Mika\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-04-06]
CHR Extension: (Google Drive) - C:\Users\Mika\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-04-06]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Mika\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2015-03-20]
CHR Extension: (YouTube) - C:\Users\Mika\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-04-06]
CHR Extension: (Google Search) - C:\Users\Mika\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-04-06]
CHR Extension: (Adobe Acrobat - Create PDF) - C:\Users\Mika\AppData\Local\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj [2014-04-24]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Mika\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-20]
CHR Extension: (Google Wallet) - C:\Users\Mika\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-04-06]
CHR Extension: (Gmail) - C:\Users\Mika\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-04-06]
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCChromeExtn\WCChromeExtn.crx [2014-12-03]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-01-19] (Apple Inc.)
R2 DellUpdate; C:\Program Files (x86)\Dell Update\DellUpService.exe [150224 2014-09-09] (Dell Inc.)
R2 EpsonScanSvc; C:\Windows\system32\EscSvc64.exe [135824 2011-12-12] (Seiko Epson Corporation)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15720 2013-08-07] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; c:\Program Files\Intel\iCLS Client\HeciServer.exe [733696 2013-05-12] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; c:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-12] (Intel(R) Corporation)
R2 Intel(R) Wireless Bluetooth(R) 4.0 Radio Management; C:\Program Files (x86)\Intel\Bluetooth\ibtrksrv.exe [155448 2013-08-01] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-04] (Intel Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [284912 2013-08-23] ()
R2 OCS Inventory Service; C:\Program Files (x86)\OCS Inventory Agent\OcsService.exe [35840 2012-01-27] (OCS Inventory NG) [File not signed]
S3 OpenVPNService; C:\Program Files (x86)\OpenVPN\bin\openvpnserv.exe [14848 2011-12-15] () [File not signed]
R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [253776 2013-07-30] (CyberLink)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [246488 2013-06-19] (Realtek Semiconductor)
R2 SAVAdminService; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe [288552 2014-05-20] (Sophos Limited)
R2 SAVService; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe [208168 2014-10-17] (Sophos Limited)
R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1363160 2014-11-28] (Secunia)
R2 SftService; C:\Program Files (x86)\Dell Backup and Recovery\sftservice.exe [1924328 2014-09-18] (SoftThinks SAS)
R2 Sophos Agent; C:\Program Files (x86)\Sophos\Remote Management System\ManagementAgentNT.exe [289856 2014-04-24] (Sophos Limited)
R2 Sophos AutoUpdate Service; C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe [340776 2015-03-03] (Sophos Limited)
R2 Sophos Message Router; C:\Program Files (x86)\Sophos\Remote Management System\RouterNT.exe [818240 2014-04-24] (Sophos Limited)
R2 Sophos Web Control Service; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe [341800 2014-10-17] (Sophos Limited)
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
R2 swi_filter; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_filter.exe [300840 2015-01-13] (Sophos Limited)
R2 swi_service; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe [3274536 2015-01-13] (Sophos Limited)
R2 USBDLM; C:\Program Files (x86)\USBDLM\USBDLM.exe [337888 2012-01-15] (Uwe Sieber - www.uwe-sieber.de) [File not signed]
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)
R2 XTSvcMgr; C:\Program Files\Novell\Client\XTier\Services\XTSvcMgr.exe [20536 2013-01-15] (Novell, Inc.)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3667696 2013-08-23] (Intel® Corporation)
S2 McAPExe; "C:\Program Files\McAfee\MSC\McAPExe.exe" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 BthLEEnum; C:\Windows\System32\drivers\BthLEEnum.sys [226304 2013-12-04] (Microsoft Corporation)
R3 btmaux; C:\Windows\system32\DRIVERS\btmaux.sys [132920 2013-04-24] (Motorola Solutions, Inc.)
R3 btmhsf; C:\Windows\system32\DRIVERS\btmhsf.sys [1385784 2013-06-27] (Motorola Solutions, Inc.)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [91712 2013-03-05] (CyberLink)
R3 DellRbtn; C:\Windows\System32\drivers\DellRbtn.sys [10752 2013-01-25] (OSR Open Systems Resources, Inc.)
R3 ibtusb; C:\Windows\system32\DRIVERS\ibtusb.sys [114632 2013-07-01] (Intel Corporation)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-03-07] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\System32\drivers\TeeDriverx64.sys [99288 2013-12-19] (Intel Corporation)
R0 NCFilter; C:\Windows\System32\DRIVERS\NCFilter.sys [112696 2013-01-15] ()
R2 NCFSD; C:\Program Files\Novell\Client\XTier\Drivers\ncfsd.sys [115256 2013-01-15] ()
R2 NCIOCTL; C:\Program Files\Novell\Client\XTier\Drivers\ncioctl.sys [90680 2013-01-15] ()
R0 NCRecognizer; C:\Windows\System32\DRIVERS\NCRecognizer.sys [120376 2013-01-15] ()
R0 NCUncFilter; C:\Windows\System32\DRIVERS\NCUncFilter.sys [26680 2013-01-15] ()
R3 NETwNb64; C:\Windows\system32\DRIVERS\NETwbw02.sys [3589600 2013-09-25] (Intel Corporation)
R1 NICM; C:\Program Files\Novell\Client\XTier\Drivers\nicm.sys [31800 2013-01-15] (Novell, Inc.)
S3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2014-11-28] (Secunia)
S3 S3XXx64; C:\Windows\system32\DRIVERS\S3XXx64.sys [73856 2015-02-17] (Identiv)
R1 SAVOnAccess; C:\Windows\System32\DRIVERS\savonaccess.sys [161024 2014-10-17] (Sophos Limited)
S3 sdcfilter; C:\Windows\system32\DRIVERS\sdcfilter.sys [38144 2014-05-20] (Sophos Limited)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [34544 2013-08-02] (Synaptics Incorporated)
S4 SophosBootDriver; C:\Windows\system32\DRIVERS\SophosBootDriver.sys [27904 2014-05-20] (Sophos Limited)
R1 swi_callout; C:\Windows\system32\DRIVERS\swi_callout.sys [32512 2015-03-03] (Sophos Limited)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)
U3 nccache; C:\Program Files\Novell\Client\XTier\Drivers\nccache.sys [55864 2013-01-15] (Novell, Inc.)
U3 nciom; C:\Program Files\Novell\Client\XTier\Drivers\nciom.sys [80952 2013-01-15] (Novell, Inc.)
U3 ncp; C:\Program Files\Novell\Client\XTier\Drivers\ncp.sys [79416 2013-01-15] (Novell, Inc.)
U3 ncpfsp; C:\Program Files\Novell\Client\XTier\Drivers\ncpfsp.sys [101944 2013-01-15] (Novell, Inc.)
U3 ncpl; C:\Program Files\Novell\Client\XTier\Drivers\ncpl.sys [49720 2013-01-15] (Novell, Inc.)
U3 ndm; C:\Program Files\Novell\Client\XTier\Drivers\ndm.sys [20024 2013-01-15] (Novell, Inc.)
U3 ndmndap; C:\Program Files\Novell\Client\XTier\Drivers\ndmndap.sys [84024 2013-01-15] (Novell, Inc.)
U3 niam; C:\Program Files\Novell\Client\XTier\Drivers\niam.sys [39480 2013-01-15] (Novell, Inc.)
U3 nipctl; C:\Program Files\Novell\Client\XTier\Drivers\nipctl.sys [56376 2013-01-15] (Novell, Inc.)
U3 nscm; C:\Program Files\Novell\Client\XTier\Drivers\nscm.sys [37944 2013-01-15] (Novell, Inc.)
U3 nsns; C:\Program Files\Novell\Client\XTier\Drivers\nsns.sys [25656 2013-01-15] (Novell, Inc.)
U3 nsvccost; C:\Program Files\Novell\Client\XTier\Drivers\nsvccost.sys [36408 2013-01-15] (Novell, Inc.)
U3 xtxplat; C:\Program Files\Novell\Client\XTier\Drivers\xtxplat.sys [59960 2013-01-15] (Novell, Inc.)
S3 PCDSRVC{3B54B31B-D06B6431-06020200}_0; \??\c:\program files\dell\supportassist\pcdsrvc_x64.pkms [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-22 12:00 - 2015-03-22 12:00 - 02095616 _____ (Farbar) C:\Users\Mika\Downloads\FRST64 (6).exe
2015-03-22 11:53 - 2015-03-22 11:53 - 00002281 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-03-22 11:53 - 2015-03-22 11:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-03-22 11:45 - 2015-03-22 11:45 - 00001286 _____ () C:\Users\Mika\Desktop\Revo Uninstaller.lnk
2015-03-22 11:44 - 2015-03-22 11:44 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Mika\Downloads\revosetup95 (1).exe
2015-03-22 11:40 - 2015-03-22 11:40 - 02095616 _____ (Farbar) C:\Users\Mika\Downloads\FRST64 (5).exe
2015-03-22 11:39 - 2015-03-22 11:39 - 02095616 _____ (Farbar) C:\Users\Mika\Downloads\FRST64 (4).exe
2015-03-22 11:37 - 2015-03-22 11:37 - 01135104 _____ (Farbar) C:\Users\Mika\Downloads\FRST.exe
2015-03-22 11:36 - 2015-03-22 11:36 - 00000403 _____ () C:\Users\Mika\Desktop\Fixlist.txt
2015-03-21 19:16 - 2015-03-21 19:16 - 00000000 ____D () C:\Users\Mika\AppData\Roaming\PCDr
2015-03-21 19:15 - 2015-03-21 19:15 - 00000000 ____D () C:\ProgramData\PCDr
2015-03-10 23:30 - 2015-03-10 23:30 - 02095104 _____ (Farbar) C:\Users\Mika\Downloads\FRST64 (3).exe
2015-03-10 23:28 - 2015-03-10 23:28 - 00852604 _____ () C:\Users\Mika\Downloads\SecurityCheck.exe
2015-03-10 22:58 - 2015-02-12 18:40 - 22291584 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2015-03-10 22:58 - 2015-02-12 18:34 - 19731824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2015-03-10 22:57 - 2015-03-06 03:53 - 00430080 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-03-10 22:57 - 2015-03-06 03:33 - 00358912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-03-10 22:57 - 2015-02-26 00:26 - 04178944 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-03-10 22:47 - 2015-02-20 04:03 - 00358912 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-03-10 22:47 - 2015-02-20 03:58 - 00044032 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-03-10 22:47 - 2015-02-20 03:20 - 00301056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2015-03-10 22:47 - 2015-02-20 03:15 - 00035840 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2015-03-10 22:47 - 2014-10-29 03:49 - 00003072 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2015-03-10 22:47 - 2014-10-29 03:44 - 00096256 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2015-03-10 22:47 - 2014-10-29 03:44 - 00014848 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2015-03-10 22:47 - 2014-10-29 03:04 - 00003072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2015-03-10 22:47 - 2014-10-29 03:00 - 00077824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2015-03-10 22:47 - 2014-10-29 03:00 - 00011776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2015-03-10 21:59 - 2015-01-31 00:20 - 00203264 _____ (Microsoft Corporation) C:\Windows\system32\ubpm.dll
2015-03-10 21:59 - 2015-01-28 16:41 - 07472960 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-03-10 21:59 - 2015-01-28 16:41 - 01733440 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-03-10 21:59 - 2015-01-28 16:41 - 01498360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-03-10 21:59 - 2015-01-27 05:22 - 00131584 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2015-03-10 21:59 - 2015-01-27 03:11 - 03547648 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2015-03-10 21:59 - 2014-10-29 04:56 - 00027456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpvideominiport.sys
2015-03-10 21:59 - 2014-10-29 03:37 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\rfxvmt.dll
2015-03-10 21:58 - 2015-02-21 02:16 - 25021440 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-03-10 21:58 - 2015-02-21 01:41 - 12827648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-03-10 21:58 - 2015-02-21 01:27 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-03-10 21:58 - 2015-02-21 01:27 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2015-03-10 21:58 - 2015-02-21 01:25 - 19720192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-03-10 21:58 - 2015-02-21 00:58 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-03-10 21:58 - 2015-02-21 00:32 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-03-10 21:58 - 2015-02-20 03:49 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-03-10 21:58 - 2015-02-20 03:48 - 02886144 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-03-10 21:58 - 2015-02-20 03:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-03-10 21:58 - 2015-02-20 03:35 - 00816128 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-03-10 21:58 - 2015-02-20 03:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-03-10 21:58 - 2015-02-20 03:32 - 06035456 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-03-10 21:58 - 2015-02-20 03:09 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-03-10 21:58 - 2015-02-20 03:07 - 00145408 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2015-03-10 21:58 - 2015-02-20 03:06 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-03-10 21:58 - 2015-02-20 03:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-03-10 21:58 - 2015-02-20 03:03 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-03-10 21:58 - 2015-02-20 02:59 - 01032704 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2015-03-10 21:58 - 2015-02-20 02:56 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-03-10 21:58 - 2015-02-20 02:52 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2015-03-10 21:58 - 2015-02-20 02:49 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-03-10 21:58 - 2015-02-20 02:49 - 00374272 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-03-10 21:58 - 2015-02-20 02:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-03-10 21:58 - 2015-02-20 02:43 - 14398976 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-03-10 21:58 - 2015-02-20 02:30 - 04300288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-03-10 21:58 - 2015-02-20 02:30 - 00880128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2015-03-10 21:58 - 2015-02-20 02:29 - 02865152 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll
2015-03-10 21:58 - 2015-02-20 02:28 - 02358784 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-03-10 21:58 - 2015-02-20 02:26 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2015-03-10 21:58 - 2015-02-20 02:24 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-03-10 21:58 - 2015-02-20 02:24 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-03-10 21:58 - 2015-02-20 02:16 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-03-10 21:58 - 2015-02-20 02:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-03-10 21:58 - 2015-02-20 02:01 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-03-10 21:58 - 2015-02-20 01:57 - 01311232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-03-10 21:58 - 2015-02-20 01:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-03-10 21:56 - 2015-01-29 19:45 - 01763352 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-03-10 21:56 - 2015-01-29 19:34 - 01488040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2015-03-10 21:51 - 2015-01-28 02:31 - 00402432 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2015-03-10 21:51 - 2015-01-28 02:11 - 00357376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2015-03-10 21:50 - 2015-01-21 06:54 - 01384712 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll
2015-03-10 21:50 - 2015-01-21 06:15 - 01123848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msctf.dll
2015-03-10 20:42 - 2015-03-10 20:43 - 02347384 _____ (ESET) C:\Users\Mika\Downloads\esetsmartinstaller_deu.exe
2015-03-08 20:46 - 2015-03-08 20:46 - 00000000 ____D () C:\Users\Mika\Documents\My Received Files
2015-03-08 20:42 - 2015-03-08 20:42 - 02095104 _____ (Farbar) C:\Users\Mika\Downloads\FRST64 (2).exe
2015-03-08 20:41 - 2015-03-08 20:42 - 02095104 _____ (Farbar) C:\Users\Mika\Downloads\FRST64 (1).exe
2015-03-08 20:39 - 2015-03-08 20:39 - 00000902 _____ () C:\Users\Mika\Desktop\JRT.txt
2015-03-08 20:32 - 2015-03-08 20:33 - 01388333 _____ (Thisisu) C:\Users\Mika\Downloads\JRT.exe
2015-03-08 18:31 - 2015-03-08 18:36 - 00000000 ____D () C:\AdwCleaner
2015-03-08 18:30 - 2015-03-08 18:30 - 02126848 _____ () C:\Users\Mika\Downloads\AdwCleaner_4.111.exe
2015-03-06 16:56 - 2015-03-06 16:59 - 00035117 _____ () C:\Users\Mika\Downloads\Addition.txt
2015-03-06 16:53 - 2015-03-22 12:01 - 00000000 ____D () C:\FRST
2015-03-06 16:53 - 2015-03-22 12:00 - 00029936 _____ () C:\Users\Mika\Downloads\FRST.txt
2015-03-06 16:53 - 2015-03-06 16:53 - 02092544 _____ (Farbar) C:\Users\Mika\Downloads\FRST64.exe
2015-03-06 09:05 - 2015-03-06 09:05 - 01728218 _____ () C:\Users\Mika\Downloads\openvpn-install (1).exe
2015-03-05 18:47 - 2015-03-06 13:57 - 00000000 ____D () C:\Program Files (x86)\Cars 2 World Grand Prix Races
2015-03-05 18:44 - 2015-03-06 13:57 - 00000000 ____D () C:\ProgramData\{d6560dff-0f39-a46a-d656-60dff0f337fc}
2015-03-05 18:15 - 2015-03-05 18:16 - 28687167 _____ () C:\Users\Mika\Downloads\Pressekonferenz Studie Bildung%2C Migration%2C Milieu am 04 12 13 in Berlin youtube original.mp4
2015-03-05 18:14 - 2015-03-05 18:15 - 08004264 _____ () C:\Users\Mika\Downloads\Studie Bildung Milieu und Migration Interview mit Hassan El Moussaoui.mp4
2015-03-05 18:14 - 2015-03-05 18:15 - 07664850 _____ () C:\Users\Mika\Downloads\Studie -Bildung%2C Milieu und Migration- - Interview mit Elvida Sabanovic.mp4
2015-03-05 18:14 - 2015-03-05 18:15 - 06494192 _____ () C:\Users\Mika\Downloads\Studie -Bildung%2C Milieu und Migration- - Interview mit Nazan Wagner.mp4
2015-03-05 18:14 - 2015-03-05 18:14 - 08821007 _____ () C:\Users\Mika\Downloads\Studie -Bildung%2C Milieu und Migration- - Interview mit Sakire Efe.mp4
2015-03-05 16:15 - 2015-03-03 21:15 - 00032512 _____ (Sophos Limited) C:\Windows\system32\Drivers\swi_callout.sys
2015-03-05 15:46 - 2015-03-05 17:46 - 00000000 ____D () C:\Users\Mika\AppData\Roaming\WinPatrol
2015-03-05 15:46 - 2015-03-05 15:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinPatrol
2015-03-05 15:46 - 2015-03-05 15:46 - 00000000 ____D () C:\ProgramData\InstallMate
2015-03-05 15:46 - 2015-03-05 15:46 - 00000000 ____D () C:\Program Files (x86)\WinPatrol
2015-03-05 15:35 - 2015-03-05 15:35 - 01081688 _____ (WinPatrol) C:\Users\Mika\Downloads\wpsetup.exe
2015-03-05 15:34 - 2015-03-07 18:26 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-03-05 15:34 - 2015-03-05 15:34 - 00001120 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-03-05 15:34 - 2015-03-05 15:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-03-05 15:34 - 2015-03-05 15:34 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-03-05 15:34 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-03-05 15:34 - 2014-11-21 06:14 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-03-05 15:34 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-03-05 15:33 - 2015-03-05 15:33 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Mika\Downloads\mbam-setup-2.0.4.1028.exe
2015-03-05 15:25 - 2015-03-05 15:25 - 00448512 _____ (OldTimer Tools) C:\Users\Mika\Downloads\TFC.exe
2015-03-05 15:23 - 2015-03-05 15:23 - 00001091 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Secunia PSI.lnk
2015-03-05 15:23 - 2015-03-05 15:23 - 00000000 ____D () C:\Users\Mika\AppData\Local\Secunia PSI
2015-03-05 15:23 - 2015-03-05 15:23 - 00000000 ____D () C:\Program Files (x86)\Secunia
2015-03-05 15:22 - 2015-03-05 15:23 - 05490752 _____ (Secunia) C:\Users\Mika\Downloads\PSISetup10004.exe
2015-03-05 15:04 - 2015-03-05 15:06 - 00001479 _____ () C:\DelFix.txt
2015-03-05 13:20 - 2015-03-05 13:20 - 00003130 _____ () C:\Windows\System32\Tasks\{EF9F9432-56D5-4276-9BC8-1E4A4270E62B}
2015-03-05 13:13 - 2015-03-05 13:13 - 00000000 ____D () C:\Users\Mika\AppData\Roaming\dlg
2015-03-05 13:12 - 2015-03-05 13:12 - 00000000 __SHD () C:\Users\Mika\AppData\Local\EmieBrowserModeList
2015-03-05 13:10 - 2015-03-05 13:10 - 00000000 ____D () C:\Users\Mika\AppData\Roaming\QuickScan
2015-03-05 13:04 - 2015-03-05 13:04 - 00572432 _____ () C:\Users\Mika\Downloads\gimp-Download.exe
2015-03-05 12:37 - 2015-03-05 13:01 - 00000000 ____D () C:\Users\Mika\Desktop\STA Fotos
2015-03-05 12:35 - 2015-03-05 12:35 - 06593997 _____ () C:\Users\Mika\Downloads\Fotos Milieus Abschlussbericht.7z
2015-03-01 21:42 - 2015-03-01 21:42 - 11157403 _____ () C:\Users\Mika\Downloads\attachments (17).zip
2015-03-01 19:24 - 2015-03-01 19:24 - 06594884 _____ () C:\Users\Mika\Downloads\attachments (16).zip
2015-03-01 10:19 - 2015-03-01 10:19 - 00281848 _____ () C:\Windows\Minidump\030115-28812-01.dmp
2015-02-28 15:37 - 2014-12-13 22:28 - 00513488 _____ () C:\Windows\SysWOW64\locale.nls
2015-02-28 15:37 - 2014-12-13 22:28 - 00513488 _____ () C:\Windows\system32\locale.nls
2015-02-28 15:37 - 2014-10-29 02:27 - 01200128 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Globalization.dll
2015-02-28 15:37 - 2014-10-29 02:27 - 00323072 _____ (Microsoft Corporation) C:\Windows\system32\GlobCollationHost.dll
2015-02-28 15:37 - 2014-10-29 02:04 - 00868352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Globalization.dll
2015-02-28 15:37 - 2014-10-29 02:04 - 00200704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\GlobCollationHost.dll
2015-02-24 17:16 - 2015-02-24 17:16 - 00052893 _____ () C:\Users\Mika\Downloads\Präsentation NEU (3).pptx
2015-02-24 17:01 - 2015-02-24 17:01 - 00052893 _____ () C:\Users\Mika\Downloads\Präsentation NEU (2).pptx
2015-02-24 17:00 - 2015-02-24 17:00 - 00052893 _____ () C:\Users\Mika\Downloads\Präsentation NEU (1).pptx
2015-02-24 16:58 - 2015-02-24 16:58 - 00052893 _____ () C:\Users\Mika\Downloads\Präsentation NEU.pptx
2015-02-24 15:45 - 2015-02-24 15:45 - 03541590 _____ () C:\Users\Mika\Downloads\Zweite Lieferung milieus-gewichtet.xlsx
2015-02-24 15:42 - 2015-02-24 15:42 - 00076472 _____ () C:\Users\Mika\Downloads\Präsentation1.pptx
2015-02-23 13:27 - 2015-02-23 13:27 - 01644971 _____ () C:\Users\Mika\Desktop\Fotosammlung Dereköy verkleinert.zip
2015-02-23 13:22 - 2015-02-23 13:22 - 00001020 _____ () C:\Users\Mika\Desktop\IrfanView.lnk
2015-02-23 13:20 - 2015-02-23 13:20 - 02197648 _____ (Irfan Skiljan) C:\Users\Mika\Downloads\iview438g_setup (1).exe
2015-02-23 13:12 - 2015-02-23 13:18 - 00000000 ____D () C:\Users\Mika\Desktop\Fotosammlung Dereköy verkleinert
2015-02-22 21:58 - 2015-02-22 21:58 - 00000000 ____D () C:\Program Files (x86)\MSECache
2015-02-22 21:57 - 2015-02-22 21:58 - 19998504 _____ (Microsoft Corporation) C:\Users\Mika\Downloads\proofingtools_de-de-x64.exe
2015-02-22 16:52 - 2015-02-22 16:52 - 00000000 ____D () C:\Users\Mika\AppData\Roaming\IrfanView
2015-02-22 16:52 - 2015-02-22 16:52 - 00000000 ____D () C:\Program Files (x86)\IrfanView
2015-02-22 16:51 - 2015-02-22 16:51 - 02197648 _____ (Irfan Skiljan) C:\Users\Mika\Downloads\iview438g_setup (3).exe
2015-02-22 16:51 - 2015-02-22 16:51 - 02197648 _____ (Irfan Skiljan) C:\Users\Mika\Downloads\iview438g_setup (2).exe
2015-02-22 16:47 - 2015-02-22 16:47 - 02197648 _____ (Irfan Skiljan) C:\Users\Mika\Downloads\iview438g_setup.exe
2015-02-22 12:19 - 2015-02-22 12:19 - 01728218 _____ () C:\Users\Mika\Downloads\openvpn-install.exe
2015-02-21 22:26 - 2015-02-21 22:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2015-02-21 22:26 - 2015-02-21 22:26 - 00000000 ____D () C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7
2015-02-21 22:26 - 2015-02-21 22:26 - 00000000 ____D () C:\Program Files\iTunes
2015-02-21 22:26 - 2015-02-21 22:26 - 00000000 ____D () C:\Program Files\iPod
2015-02-21 22:26 - 2015-02-21 22:26 - 00000000 ____D () C:\Program Files (x86)\iTunes
2015-02-20 17:07 - 2015-02-20 17:07 - 00000000 _____ () C:\Users\Mika\Downloads\f.txt
2015-02-20 15:16 - 2015-02-20 15:17 - 00000000 ____D () C:\Users\Mika\Documents\Outlook Files
2015-02-20 15:16 - 2015-02-20 15:16 - 00394049 _____ () C:\Users\Mika\Downloads\noname (1).eml
2015-02-20 15:16 - 2015-02-20 15:16 - 00010158 _____ () C:\Users\Mika\Downloads\noname (2).eml
2015-02-20 15:15 - 2015-02-20 15:15 - 00006023 _____ () C:\Users\Mika\Downloads\noname.eml

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-22 12:02 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\sru
2015-03-22 11:58 - 2014-04-06 16:22 - 00000930 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-03-22 11:58 - 2014-04-04 06:40 - 00003598 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1401536446-3937075962-3797694313-1001
2015-03-22 11:52 - 2014-04-06 16:22 - 00000000 ____D () C:\Users\Mika\AppData\Local\Deployment
2015-03-22 11:47 - 2014-01-05 03:01 - 01433754 _____ () C:\Windows\WindowsUpdate.log
2015-03-22 11:45 - 2014-09-05 08:19 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2015-03-22 11:39 - 2014-01-05 03:13 - 00000000 ____D () C:\Program Files (x86)\Dell Backup and Recovery
2015-03-22 11:32 - 2014-04-04 06:54 - 00000000 ___DO () C:\Users\Mika\SkyDrive
2015-03-22 11:31 - 2014-04-06 16:22 - 00000926 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-03-22 11:31 - 2013-08-22 15:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-03-22 11:30 - 2013-08-22 15:46 - 00035262 _____ () C:\Windows\setupact.log
2015-03-21 22:38 - 2014-10-07 20:14 - 00000000 ____D () C:\Users\Mika\AppData\Roaming\Skype
2015-03-21 21:49 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\AppReadiness
2015-03-21 18:29 - 2014-04-23 10:49 - 00000000 ____D () C:\Users\Mika\AppData\Local\Adobe
2015-03-21 17:35 - 2013-08-22 16:20 - 00000000 ____D () C:\Windows\CbsTemp
2015-03-20 20:04 - 2014-04-04 06:31 - 00000000 ____D () C:\Users\Mika
2015-03-20 20:02 - 2013-08-22 14:25 - 00524288 ___SH () C:\Windows\system32\config\BBI
2015-03-20 20:01 - 2013-08-22 15:44 - 05051904 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-03-11 07:36 - 2014-04-04 06:34 - 00000000 ____D () C:\Users\Mika\AppData\Local\Packages
2015-03-11 07:26 - 2014-01-05 02:55 - 00865408 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-03-11 00:05 - 2014-01-05 02:40 - 00225338 _____ () C:\Windows\PFRO.log
2015-03-11 00:01 - 2014-04-24 09:48 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2015-03-11 00:01 - 2013-08-22 16:36 - 00000000 ___RD () C:\Windows\ToastData
2015-03-11 00:00 - 2014-04-24 09:43 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-03-10 23:49 - 2013-08-22 14:25 - 00000199 _____ () C:\Windows\win.ini
2015-03-08 18:18 - 2014-04-13 22:48 - 02032128 ___SH () C:\Users\Mika\Desktop\Thumbs.db
2015-03-07 17:36 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\Performance
2015-03-06 18:20 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\NDF
2015-03-05 18:55 - 2014-04-04 06:34 - 00001448 _____ () C:\Users\Mika\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-03-05 18:54 - 2014-04-24 08:46 - 00002337 _____ () C:\Users\Administrator\Desktop\Google Chrome.lnk
2015-03-05 18:25 - 2014-04-29 21:48 - 01916928 ___SH () C:\Users\Mika\Downloads\Thumbs.db
2015-03-05 15:07 - 2014-04-24 09:06 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-03-05 11:43 - 2014-08-03 22:40 - 00000000 ____D () C:\Users\Mika\Desktop\Meine Hochzeit
2015-03-05 11:22 - 2015-01-26 16:29 - 00000000 ____D () C:\Users\Mika\AppData\Roaming\vlc
2015-03-05 11:12 - 2014-11-02 21:06 - 00000000 ____D () C:\Users\Mika\AppData\Local\Windows Live
2015-03-05 11:04 - 2014-06-11 09:43 - 00000000 ____D () C:\Users\Mika\MediathekView
2015-03-05 11:03 - 2014-08-16 10:24 - 00000000 ____D () C:\Users\Mika\Downloads\MediathekView_7
2015-03-05 11:03 - 2014-06-11 09:38 - 00000000 ____D () C:\Users\Mika\.mediathek3
2015-03-05 11:03 - 2014-06-11 09:37 - 00000000 ____D () C:\Users\Mika\Downloads\MediathekView_6
2015-03-04 22:24 - 2013-08-22 16:38 - 00792032 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-03-04 22:24 - 2013-08-22 16:38 - 00178144 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-03-01 10:19 - 2014-04-24 10:57 - 00000000 ____D () C:\Windows\Minidump
2015-03-01 10:19 - 2014-04-24 10:56 - 558134323 _____ () C:\Windows\MEMORY.DMP
2015-02-21 22:26 - 2015-02-16 19:48 - 00000000 ____D () C:\Program Files\Common Files\Apple
2015-02-20 15:16 - 2015-02-16 19:52 - 00000000 ____D () C:\Users\Mika\AppData\Roaming\Apple Computer

==================== Files in the root of some directories =======

2014-01-05 02:42 - 2014-01-05 02:42 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2014-04-23 10:39 - 2014-04-23 10:40 - 0000315 _____ () C:\ProgramData\NCIDebug.log
2014-01-05 03:08 - 2014-01-05 03:08 - 0000121 _____ () C:\ProgramData\{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}.log
2014-01-05 03:05 - 2014-01-05 03:06 - 0000106 _____ () C:\ProgramData\{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}.log
2014-01-05 03:06 - 2014-01-05 03:07 - 0000111 _____ () C:\ProgramData\{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}.log
2014-01-05 03:07 - 2014-01-05 03:08 - 0000108 _____ () C:\ProgramData\{B46BEA36-0B71-4A4E-AE41-87241643FA0A}.log
2014-01-05 03:05 - 2014-01-05 03:05 - 0000107 _____ () C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log

Some content of TEMP:
====================
C:\Users\Mika\AppData\Local\Temp\cct.dll
C:\Users\Mika\AppData\Local\Temp\JavaIC.dll
C:\Users\Mika\AppData\Local\Temp\jre-8u40-windows-au.exe
C:\Users\Mika\AppData\Local\Temp\msscct32.dll
C:\Users\Mika\AppData\Local\Temp\Quarantine.exe
C:\Users\Mika\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Mika\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-01-26 11:39

==================== End Of Log ============================

--- --- ---

--- --- ---

schrauber · 23.03.2015, 07:42

Hat der Fix nun geklappt oder nicht? BEstehen noch Probleme mit dem System?

07.03.2015, 12:50	#4
schrauber /// the machine /// TB-Ausbilder	Malwarebytes findet mehrere Tage nacheinander immer um die 200 Bedrohungen und einiges laeuft auf meinem Laptop schief Das Log von MBAM? __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

08.03.2015, 19:40	#8
schrauber /// the machine /// TB-Ausbilder	Malwarebytes findet mehrere Tage nacheinander immer um die 200 Bedrohungen und einiges laeuft auf meinem Laptop schief und weiter __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

23.03.2015, 07:42	#14
schrauber /// the machine /// TB-Ausbilder	Malwarebytes findet mehrere Tage nacheinander immer um die 200 Bedrohungen und einiges laeuft auf meinem Laptop schief Hat der Fix nun geklappt oder nicht? BEstehen noch Probleme mit dem System? __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

Malwarebytes findet mehrere Tage nacheinander immer um die 200 Bedrohungen und einiges laeuft auf meinem Laptop schief

Plagegeister aller Art und deren Bekämpfung: Malwarebytes findet mehrere Tage nacheinander immer um die 200 Bedrohungen und einiges laeuft auf meinem Laptop schief