Windows 7 Malwarebytes hat "pup.optional.findr.a" gefunden

Haiopei · 06.03.2015, 22:52

Hallo,
seit einiger Zeit stürzt bei mir der Firefox ab wenn der Speicher 75% erreicht hat.
(System windows 7 32bit mit 4 GB RAM)
Deshalb habe ich einen Suchlauf mit Malwarebytes durchgeführt und dieser hat eine Bedrohung festgestellt.
Wie soll ich weiter vorgehen.
Ich bedanke mich im voraus.
Gruß Ernst

Malwarebytes Anti-Malware
xxx.malwarebytes.org

Suchlauf Datum: 06.03.2015
Suchlauf-Zeit: 20:57:42
Logdatei: malwarebytes Log 6 3 2015.txt
Administrator: Ja

Version: 2.00.4.1028
Malware Datenbank: v2015.03.06.06
Rootkit Datenbank: v2015.02.25.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x86
Dateisystem: NTFS
Benutzer: Haiopei

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 414816
Verstrichene Zeit: 20 Min, 36 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Warnen
PUM: Aktiviert

Prozesse: 0
(Keine schädliche Elemente erkannt)

Module: 0
(Keine schädliche Elemente erkannt)

Registrierungsschlüssel: 0
(Keine schädliche Elemente erkannt)

Registrierungswerte: 0
(Keine schädliche Elemente erkannt)

Registrierungsdaten: 0
(Keine schädliche Elemente erkannt)

Ordner: 0
(Keine schädliche Elemente erkannt)

Dateien: 1
PUP.Optional.Findr.A, C:\Users\Haiopei\AppData\Roaming\Mozilla\Firefox\Profiles\ogagtyrs.default\searchplugins\findr.xml, , [92bce65c01899a9c5ca4584e6a992cd4],

Physische Sektoren: 0
(Keine schädliche Elemente erkannt)

(end)

cosinus · 06.03.2015, 23:55

Hallo und

Hast du noch weitere Logs (mit Funden)? Malwarebytes und/oder andere Virenscanner, sind die mal fündig geworden?[/b]

Ich frage deswegen nach => http://www.trojaner-board.de/125889-...tml#post941520

Bitte keine neuen Virenscans machen sondern erst nur schon vorhandene Logs in CODE-Tags posten!
Relevant sind nur Logs der letzten 7 Tage bzw. seitdem das Problem besteht!

Zudem bitte auch ein Log mit Farbars Tool machen:

Scan mit Farbar's Recovery Scan Tool (FRST)

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit.
Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten.
Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

Haiopei · 07.03.2015, 21:18

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 07-03-2015
Ran by Haiopei (administrator) on HAIOPEI-PC on 07-03-2015 21:08:47
Running from C:\Users\Haiopei\Desktop
Loaded Profiles: Haiopei & _ocster_backup_ (Available profiles: Haiopei & _ocster_backup_)
Platform: Microsoft Windows 7 Home Premium  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(ArcSoft Inc.) C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe
(MAGIX AG) C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe
(Firebird Project) C:\Program Files\Firebird\Firebird_2_1\bin\fbguard.exe
(Teruten) C:\Windows\System32\FsUsbExService.Exe
() C:\Program Files\Ocster Backup\bin\backupService-ox.exe
() C:\Windows\System32\PSIService.exe
(Protexis Inc.) C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
() C:\Program Files\Hardcopy\hcdll2_ex_Win32.exe
() C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe
(DEVGURU Co., LTD.) C:\Program Files\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe
(TuneUp Software) C:\Program Files\TuneUp Utilities 2014\TuneUpUtilitiesService32.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft IntelliPoint\ipoint.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(J3S GmbH) C:\Program Files\COMPUTERBILD-Abzockschutz\Bin\COMPUTERBILD-Abzockschutz.exe
(CyberLink) C:\Program Files\CyberLink\Power2Go9\CLMLSvc_P2G9.exe
(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner.exe
(CyberLink Corp.) C:\Program Files\CyberLink\Power2Go9\Power2GoExpress9.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
(TuneUp Software) C:\Program Files\TuneUp Utilities 2014\TuneUpUtilitiesApp32.exe
(Firebird Project) C:\Program Files\Firebird\Firebird_2_1\bin\fbserver.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe
(CPUID) C:\Program Files\CPUID\PC Wizard 2013\pcwizard.dll
(Microsoft Corporation) C:\Windows\System32\taskmgr.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(RealNetworks, Inc.) C:\Program Files\RealNetworks\RealDownloader\recordingmanager.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_16_0_0_305.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_16_0_0_305.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [IntelliPoint] => c:\Program Files\Microsoft IntelliPoint\ipoint.exe [1797008 2010-07-21] (Microsoft Corporation)
HKLM\...\Run: [] => [X]
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [703280 2015-03-04] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [COMPUTERBILD-Abzockschutz] => C:\Program Files\COMPUTERBILD-Abzockschutz\bin\COMPUTERBILD-Abzockschutz.exe [537664 2014-06-19] (J3S GmbH)
HKLM\...\Run: [CLMLServer_For_P2G9] => C:\Program Files\CyberLink\Power2Go9\CLMLSvc_P2G9.exe [110344 2014-08-11] (CyberLink)
HKLM\...\Run: [Avira Systray] => C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe [127792 2015-02-12] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-21-2886736790-1064491100-3460348771-1000\...\Run: [SUPERAntiSpyware] => C:\Program Files\SUPERAntiSpyware.exe [2403568 2010-06-07] (SUPERAntiSpyware.com)
HKU\S-1-5-21-2886736790-1064491100-3460348771-1000\...\Run: [GoogleRadar] => C:\Programme\GoogleClean\GoogleRadar.exe [1540096 2013-07-05] ()
HKU\S-1-5-21-2886736790-1064491100-3460348771-1000\...\Run: [GUDelayStartup] => C:\Program Files\Glary Utilities 5\StartupManager.exe [37152 2015-03-02] (Glarysoft Ltd)
HKU\S-1-5-21-2886736790-1064491100-3460348771-1000\...\Run: [CCleaner Monitoring] => C:\Programme\CCleaner\CCleaner.exe [5489944 2014-12-12] (Piriform Ltd)
HKU\S-1-5-21-2886736790-1064491100-3460348771-1000\...\Run: [Power2GoExpress9] => C:\Program Files\CyberLink\Power2Go9\Power2GoExpress9.exe [2397448 2014-08-11] (CyberLink Corp.)
HKU\S-1-5-21-2886736790-1064491100-3460348771-1000\...\Policies\Explorer: [NoDriveTypeAutoRun] 0x00000000
HKU\S-1-5-21-2886736790-1064491100-3460348771-1000\...\MountPoints2: {4291fe7b-8b40-11df-9bd4-406186643d1c} - I:\setup_vmc_lite.exe /checkApplicationPresence
HKU\S-1-5-21-2886736790-1064491100-3460348771-1000\...\MountPoints2: {78a9f7b3-73af-11df-b30e-406186643d1c} - I:\setup_vmc_lite.exe /checkApplicationPresence
HKU\S-1-5-21-2886736790-1064491100-3460348771-1000\...\MountPoints2: {78a9f7c4-73af-11df-b30e-406186643d1c} - I:\setup_vmc_lite.exe /checkApplicationPresence
HKU\S-1-5-21-2886736790-1064491100-3460348771-1000\...409d6c4515e9\InprocServer32: [Default-shell32]  <==== ATTENTION!
HKU\S-1-5-21-2886736790-1064491100-3460348771-1002\...\Run: [SUPERAntiSpyware] => C:\Program Files\SUPERAntiSpyware.exe [2403568 2010-06-07] (SUPERAntiSpyware.com)
HKU\S-1-5-21-2886736790-1064491100-3460348771-1002\...\Run: [SpybotSD TeaTimer] => C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
HKU\S-1-5-21-2886736790-1064491100-3460348771-1002\...\Run: [] => C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [845168 2013-11-06] (Samsung)
HKU\S-1-5-21-2886736790-1064491100-3460348771-1002\...\Run: [GoogleRadar] => C:\Programme\GoogleClean\GoogleRadar.exe [1540096 2013-07-05] ()
HKU\S-1-5-21-2886736790-1064491100-3460348771-1002\...\RunOnce: [HKCU] => C:\Windows\System32\oobe\info\HKCU.vbs [126 2009-11-12] ()
HKU\S-1-5-21-2886736790-1064491100-3460348771-1002\...\RunOnce: [MEDION] => C:\Windows\Web\Wallpaper\MEDION\start.vbs [129 2009-10-23] ()
HKU\S-1-5-21-2886736790-1064491100-3460348771-1002\...\Policies\Explorer: [NoDriveTypeAutoRun] 0x00000000
HKU\S-1-5-21-2886736790-1064491100-3460348771-1002\...\MountPoints2: {4291fe7b-8b40-11df-9bd4-406186643d1c} - I:\setup_vmc_lite.exe /checkApplicationPresence
HKU\S-1-5-21-2886736790-1064491100-3460348771-1002\...\MountPoints2: {78a9f7b3-73af-11df-b30e-406186643d1c} - I:\setup_vmc_lite.exe /checkApplicationPresence
HKU\S-1-5-21-2886736790-1064491100-3460348771-1002\...\MountPoints2: {78a9f7c4-73af-11df-b30e-406186643d1c} - I:\setup_vmc_lite.exe /checkApplicationPresence
HKU\S-1-5-21-2886736790-1064491100-3460348771-1002\...409d6c4515e9\InprocServer32: [Default-shell32]  <==== ATTENTION!
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
Startup: C:\Users\Haiopei\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Haiopei\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Haiopei\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Haiopei\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Haiopei\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Haiopei\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Haiopei\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Haiopei\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Haiopei\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Haiopei\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
BootExecute: autocheck autochk *  
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=56626&homepage=hxxp://startpage24.com
HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=56626&homepage=hxxp://startpage24.com
HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=56626&homepage=hxxp://startpage24.com
HKU\S-1-5-21-2886736790-1064491100-3460348771-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKU\S-1-5-21-2886736790-1064491100-3460348771-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com
HKU\S-1-5-21-2886736790-1064491100-3460348771-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
HKU\S-1-5-21-2886736790-1064491100-3460348771-1000\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://medion.msn.com
HKU\S-1-5-21-2886736790-1064491100-3460348771-1000\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie
HKU\S-1-5-21-2886736790-1064491100-3460348771-1002\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=56626&homepage=hxxp://startpage24.com
HKU\S-1-5-21-2886736790-1064491100-3460348771-1002\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com
HKU\S-1-5-21-2886736790-1064491100-3460348771-1002\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
HKU\S-1-5-21-2886736790-1064491100-3460348771-1002\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://medion.msn.com
URLSearchHook: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002 - (No Name) - {00000000-6E41-4FD3-8538-502F5495E5FC} -  No File
URLSearchHook: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002 - (No Name) - {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} -  No File
URLSearchHook: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002 - (No Name) - {c840e246-6b95-475e-9bd7-caa1c7eca9f2} -  No File
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000 -> {096EAA6A-BA31-4206-83D7-E46FA4C2365A} URL = hxxp://go.web.de/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000 -> {58DF9CFB-D9CB-4701-9FCC-454FE767AC00} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MEDTDF&pc=MAMD&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={sear
SearchScopes: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000 -> {9DF4904A-E4C5-46B0-8260-4D449C2BB67F} URL = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&type=302398&p={searchTerms}
SearchScopes: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000 -> {A2DC3FEF-AB4D-442c-8517-34EC6E125C8D} URL = hxxp://search.webwebweb.com/search.php?query={searchTerms}&lang=de&zip=&town=&site=&country=&safe=[safe,off,strict]
SearchScopes: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://startsear.ch/?aff=1&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://startsear.ch/?aff=1&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002 -> {096EAA6A-BA31-4206-83D7-E46FA4C2365A} URL = hxxp://go.web.de/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002 -> {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10261&src=kw&q={searchTerms}&locale=en_US&apn_ptnrs=^AGS&apn_dtid=^YYYYYY^YY^DE&apn_uid=078f2bbd-0221-4037-ae14-180c2d26a672&apn_sauid=9083FB08-2610-467D-A3B2-F753B6AC42D4
SearchScopes: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002 -> {29C151B2-4ADA-4A58-93D1-455FC8B95BB0} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2625848
SearchScopes: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002 -> {58DF9CFB-D9CB-4701-9FCC-454FE767AC00} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MEDTDF&pc=MAMD&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={sear
SearchScopes: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002 -> {71588120-FC17-4463-B07D-2C71FE6E057B} URL = hxxp://go.findrsearch.com/search/web?q={searchTerms}
SearchScopes: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002 -> {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxp://isearch.avg.com/search?cid={B0CA9219-7A62-4AEB-BED4-64E2332EC6B9}&mid=454bb8583df047d0825e9128c080d4ef-69f08f21f8c71a4745de92076cea4d25bd309433&lang=de&ds=pd011&pr=sa&d=2012-10-01 20:07:02&v=15.2.0.5&pid=avg&sg=0&sap=dsp&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2410} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=410&sr=0&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002 -> {9DF4904A-E4C5-46B0-8260-4D449C2BB67F} URL = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&type=302398&p={searchTerms}
SearchScopes: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002 -> {A2DC3FEF-AB4D-442c-8517-34EC6E125C8D} URL = hxxp://search.webwebweb.com/search.php?query={searchTerms}&lang=de&zip=&town=&site=&country=&safe=[safe,off,strict]
BHO: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll [2014-04-09] (McAfee, Inc.)
BHO: CBAbzockschutz.InitToolbarBHO -> {2e250b90-0e7a-42a3-9d65-e39f9f227fa4} -> C:\Windows\system32\mscoree.dll [2010-11-05] (Microsoft Corporation)
BHO: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll [2013-08-14] (RealDownloader)
BHO: Soda PDF Helper -> {5CFCAFF6-5BB0-4864-B626-021C99ED82E5} -> C:\Program Files\Soda PDF\PDFIEHelper.dll [2010-12-03] (LULU Software)
BHO: PDF Architect Helper -> {691B33B0-B86E-47F3-81C7-56E4FE3B929C} -> C:\Program Files\PDF Architect 2\creator-ie-helper.dll [2014-10-10] (pdfforge GmbH)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll [2014-08-05] (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
BHO: Startpage24 -> {BBD43808-9D13-4B0B-B023-178FD1FAE442} -> C:\Program Files\Startpage24\Plugin\Version_586\link64_plugin.dll [2011-05-22] (Link64 GmbH)
BHO: WEB.DE Toolbar BHO -> {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} -> C:\Programme\WEB.DE Toolbar IE8\uitb.dll [2010-09-13] (1&&1 Mail && Media GmbH)
BHO: Soda PDF 5 IE Helper -> {C737F472-1193-4281-BF53-A00B67AB3E19} -> C:\Program Files\Soda PDF 5\PDFIEHelper.dll [2013-06-12] (LULU Software Limited)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll [2014-08-05] (Oracle Corporation)
Toolbar: HKLM - Soda PDF Toolbar - {980EB9EC-6EB5-4258-BDDB-EFE25C5F99EF} - C:\Program Files\Soda PDF\PDFIEPlugin.dll [2010-12-03] (LULU Software)
Toolbar: HKLM - Soda PDF 5 IE Toolbar - {F335ABA2-FDB4-4644-92B2-5CC4B0FC91D6} - C:\Program Files\Soda PDF 5\PDFIEPlugin.dll [2013-06-12] (LULU Software Limited)
Toolbar: HKLM - COMPUTERBILD-Abzockschutz - {353e2a48-6254-4bd3-88f4-3b51a0ca7870} - C:\Windows\system32\mscoree.dll [2010-11-05] (Microsoft Corporation)
Toolbar: HKLM - PDF Architect Toolbar - {DEEB13D7-CEA9-45FB-B77C-E039BEC85221} - C:\Program Files\PDF Architect 2\creator-ie-plugin.dll [2014-10-10] (pdfforge GmbH)
Toolbar: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002 -> No Name - {A1E75A0E-4397-4BA8-BB50-E19FB66890F4} -  No File
Toolbar: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002 -> No Name - {C424171E-592A-415A-9EB1-DFD6D95D3530} -  No File
Toolbar: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002 -> No Name - {C840E246-6B95-475E-9BD7-CAA1C7ECA9F2} -  No File
Toolbar: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002 -> No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} -  No File
DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: {1E3F1348-4370-4BBE-A67A-CC7ED824CA85} hxxp://download.microsoft.com/download/7/4/9/749b0dc5-2175-4d5b-a6dd-9c4bc923683e/Selfhelpcontrol.cab
DPF: {233C1507-6A77-46A4-9443-F871F945D258} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll [2009-02-26] (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll [2007-06-08] (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll [2013-02-26] (Skype Technologies)
Handler: startpage24 - {879506D7-73DF-8D45-BBDD-123467926D12} - C:\Program Files\Startpage24\Plugin\Version_586\link64_plugin.dll [2011-05-22] (Link64 GmbH)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Haiopei\AppData\Roaming\Mozilla\Firefox\Profiles\onps37a9.default-1417907599268
FF Homepage: www.google.de
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_16_0_0_305.dll [2015-03-07] ()
FF Plugin: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw_1216156.dll [2015-01-09] (Adobe Systems, Inc.)
FF Plugin: @google.com/npPicasa3,version=3.0.0 -> C:\Programme\Picasa3\npPicasa3.dll [2014-08-13] (Google, Inc.)
FF Plugin: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll [2014-08-05] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll [2014-08-05] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.31211.0\npctrl.dll [2014-12-11] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.)
FF Plugin: @microsoft.com/WLPG,version=14.0.8081.0709 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2009-07-10] (Microsoft Corporation)
FF Plugin: @nitropdf.com/NitroPDF -> C:\Program Files\Nitro\Reader 3\npnitromozilla.dll [2013-07-26] (Nitro PDF)
FF Plugin: @pages.tvunetworks.com/WebPlayer -> C:\Programme\TVUPlayer\npTVUAx.dll [2010-04-23] (TVU networks)
FF Plugin: @real.com/nppl3260;version=16.0.3.51 -> C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll [2015-01-12] (RealNetworks, Inc.)
FF Plugin: @real.com/nprndlchromebrowserrecordext;version=1.3.3 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll [2013-08-14] (RealNetworks, Inc.)
FF Plugin: @real.com/nprndlhtml5videoshim;version=1.3.3 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll [2013-08-14] (RealNetworks, Inc.)
FF Plugin: @real.com/nprndlpepperflashvideoshim;version=1.3.3 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll [2013-08-14] (RealNetworks, Inc.)
FF Plugin: @real.com/nprpplugin;version=16.0.3.51 -> C:\Program Files\Real\RealPlayer\Netscape6\nprpplugin.dll [2015-01-12] (RealPlayer)
FF Plugin: @realnetworks.com/npdlplugin;version=1 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll [2013-08-14] (RealDownloader)
FF Plugin: @startpage24.com/npLin64;Version=4 -> C:\Program Files\Startpage24\Plugin\Version_586\firefox\plugins\nplink64.dll [2011-05-22] (Link64 GmbH)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-06] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-06] (Google Inc.)
FF Plugin: @veetle.com/veetleCorePlugin,version=0.9.19 -> C:\Programme\Veetle TV\plugins\npVeetle.dll [2012-01-14] (Veetle Inc)
FF Plugin: @veetle.com/veetlePlayerPlugin,version=0.9.18 -> C:\Programme\Veetle TV\Player\npvlc.dll [2012-01-14] (Veetle Inc)
FF Plugin: @videolan.org/vlc,version=2.0.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-02-27] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.0.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-02-27] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.0.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-02-27] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-02-27] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-02-27] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.2.0 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-02-27] (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin: PDF Architect 2 -> C:\Program Files\PDF Architect 2\np-previewer.dll [2014-10-10] (pdfforge GmbH)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\np-mswmp.dll [2007-04-10] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npLegitCheckPlugin.dll [2009-06-25] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll [2015-01-31] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll [2015-01-31] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll [2015-01-31] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll [2015-01-31] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll [2015-01-31] (Apple Inc.)
FF Extension: Youtube Downloader - 4K Download - C:\Users\Haiopei\AppData\Roaming\Mozilla\Firefox\Profiles\onps37a9.default-1417907599268\Extensions\paulsaintuzb@gmail.com [2015-03-06]
FF Extension: WOT - C:\Users\Haiopei\AppData\Roaming\Mozilla\Firefox\Profiles\onps37a9.default-1417907599268\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2015-01-31]
FF Extension: DownloadHelper - C:\Users\Haiopei\AppData\Roaming\Mozilla\Firefox\Profiles\onps37a9.default-1417907599268\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2015-03-01]
FF Extension: Flash and Video Download - C:\Users\Haiopei\AppData\Roaming\Mozilla\Firefox\Profiles\onps37a9.default-1417907599268\Extensions\{bee6eb20-01e0-ebd1-da83-080329fb9a3a} [2015-03-01]
FF Extension: All Downloader Professional - C:\Users\Haiopei\AppData\Roaming\Mozilla\Firefox\Profiles\onps37a9.default-1417907599268\Extensions\alldownloader@link64.xpi [2015-01-31]
FF Extension: 1-Click Dailymotion Video Downloader - C:\Users\Haiopei\AppData\Roaming\Mozilla\Firefox\Profiles\onps37a9.default-1417907599268\Extensions\DailymotionVideoDownloader@PeterOlayev.com.xpi [2015-03-01]
FF Extension: Startpage24 incl. Video Downloader professional - C:\Users\Haiopei\AppData\Roaming\Mozilla\Firefox\Profiles\onps37a9.default-1417907599268\Extensions\ffext_basicchromeext@startpage24.xpi [2014-12-07]
FF Extension: Video Downloader professional - C:\Users\Haiopei\AppData\Roaming\Mozilla\Firefox\Profiles\onps37a9.default-1417907599268\Extensions\ffext_basicvideoext@startpage24.xpi [2014-12-07]
FF Extension: Ghostery - C:\Users\Haiopei\AppData\Roaming\Mozilla\Firefox\Profiles\onps37a9.default-1417907599268\Extensions\firefox@ghostery.com.xpi [2015-01-31]
FF Extension: Easiest YouTube Video Downloader - C:\Users\Haiopei\AppData\Roaming\Mozilla\Firefox\Profiles\onps37a9.default-1417907599268\Extensions\manishjain9@hotmail.com_easiestyoutube.xpi [2015-01-31]
FF Extension: Session Manager - C:\Users\Haiopei\AppData\Roaming\Mozilla\Firefox\Profiles\onps37a9.default-1417907599268\Extensions\{1280606b-2510-4fe0-97ef-9b5a22eafe30}.xpi [2014-12-07]
FF Extension: Speed Dial - C:\Users\Haiopei\AppData\Roaming\Mozilla\Firefox\Profiles\onps37a9.default-1417907599268\Extensions\{64161300-e22b-11db-8314-0800200c9a66}.xpi [2014-12-07]
FF Extension: Download Status Bar - C:\Users\Haiopei\AppData\Roaming\Mozilla\Firefox\Profiles\onps37a9.default-1417907599268\Extensions\{6c28e999-e900-4635-a39d-b1ec90ba0c0f}.xpi [2015-03-01]
FF Extension: NoScript - C:\Users\Haiopei\AppData\Roaming\Mozilla\Firefox\Profiles\onps37a9.default-1417907599268\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014-12-07]
FF Extension: Easy Youtube Video Downloader Express - C:\Users\Haiopei\AppData\Roaming\Mozilla\Firefox\Profiles\onps37a9.default-1417907599268\Extensions\{b9acf540-acba-11e1-8ccb-001fd0e08bd4}.xpi [2015-03-01]
FF Extension: Download YouTube Videos as MP4 - C:\Users\Haiopei\AppData\Roaming\Mozilla\Firefox\Profiles\onps37a9.default-1417907599268\Extensions\{b9bfaf1c-a63f-47cd-8b9a-29526ced9060}.xpi [2015-03-01]
FF Extension: Adblock Plus - C:\Users\Haiopei\AppData\Roaming\Mozilla\Firefox\Profiles\onps37a9.default-1417907599268\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-12-07]
FF Extension: BetterPrivacy - C:\Users\Haiopei\AppData\Roaming\Mozilla\Firefox\Profiles\onps37a9.default-1417907599268\Extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi [2015-01-31]
FF Extension: DownThemAll! - C:\Users\Haiopei\AppData\Roaming\Mozilla\Firefox\Profiles\onps37a9.default-1417907599268\Extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi [2015-01-31]
FF Extension: Download Manager Tweak - C:\Users\Haiopei\AppData\Roaming\Mozilla\Firefox\Profiles\onps37a9.default-1417907599268\Extensions\{F8A55C97-3DB6-4961-A81D-0DE0080E53CB}.xpi [2015-03-01]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2015-03-06]
FF HKLM\...\Firefox\Extensions: [ffext@startpage24] - C:\Program Files\Startpage24\Plugin\Version_586\firefox
FF Extension: Startpage24 - C:\Program Files\Startpage24\Plugin\Version_586\firefox [2011-05-22]
FF HKLM\...\Firefox\Extensions: [FFSodaPDFConverter@sodapdf.com] - C:\Program Files\Soda PDF\FFSodaExt
FF Extension: Soda PDF Converter For Firefox - C:\Program Files\Soda PDF\FFSodaExt [2011-02-11]
FF HKLM\...\Firefox\Extensions: [pdf_architect_2_conv@pdfarchitect.org] - C:\Program Files\PDF Architect 2\resources\pdfarchitect2firefoxextension
FF Extension: PDF Architect 2 Creator - C:\Program Files\PDF Architect 2\resources\pdfarchitect2firefoxextension [2014-11-30]
FF HKLM\...\Firefox\Extensions: [{DF153AFF-6948-45d7-AC98-4FC4AF8A08E2}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2015-01-02]
FF HKU\S-1-5-21-2886736790-1064491100-3460348771-1000\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: No Name - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]

Chrome: 
=======
CHR HomePage: Default -> 
CHR StartupUrls: Default -> "hxxp://isearch.avg.com/?cid={B0CA9219-7A62-4AEB-BED4-64E2332EC6B9}&mid=454bb8583df047d0825e9128c080d4ef-69f08f21f8c71a4745de92076cea4d25bd309433&lang=de&ds=pd011&pr=sa&d=2012-10-01 20:07:02&v=18.0.5.292&pid=avg&sg=0&sap=hp"
CHR DefaultSearchKeyword: Default -> bing.com
CHR DefaultSearchURL: Default -> https://www.bing.com/search?setmkt=de-DE&q={searchTerms}
CHR DefaultNewTabURL: Default -> https://www.bing.com/chrome/newtab?setmkt=de-DE
CHR DefaultSuggestURL: Default -> hxxp://api.bing.com/osjson.aspx?query={searchTerms}&language={language}
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\40.0.2214.115\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (QuickTime Plug-in 7.6.8) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.8) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.8) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.8) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.8) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.8) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll No File
CHR Plugin: (QuickTime Plug-in 7.6.8) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll No File
CHR Plugin: (Java Deployment Toolkit 6.0.260.3) - C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U26) - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Mozilla Firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll No File
CHR Plugin: (Shockwave for Director) - C:\Windows\system32\Adobe\Director\np32dsw.dll No File
CHR Plugin: (RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit) ) - C:\Program Files\Mozilla Firefox\plugins\nppl3260.dll No File
CHR Plugin: (RealPlayer Version Plugin) - C:\Program Files\Mozilla Firefox\plugins\nprpjplug.dll No File
CHR Plugin: (RealPlayer(tm) HTML5VideoShim Plug-In (32-bit) ) - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll No File
CHR Plugin: (Microsoft® Windows Media Player Firefox Plugin) - C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll (Microsoft Corporation)
CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\40.0.2214.115\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\40.0.2214.115\pdf.dll ()
CHR Plugin: (vShare.tv plug-in) - C:\Users\Haiopei\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpionmjnkbpcdpcflammlgllecmejgjj\1.3_0\chvsharetvplg.dll No File
CHR Plugin: (vShare.tv plug-in) - C:\Program Files\Mozilla Firefox\plugins\npvsharetvplg.dll No File
CHR Plugin: (downloadUpdater) - C:\Program Files\Mozilla Firefox\plugins\npdnu.dll No File
CHR Plugin: (downloadUpdater2) - C:\Program Files\Mozilla Firefox\plugins\npdnupdater2.dll No File
CHR Plugin: (Windows Genuine Advantage) - C:\Program Files\Mozilla Firefox\plugins\npLegitCheckPlugin.dll (Microsoft Corporation)
CHR Plugin: (RealJukebox NS Plugin) - C:\Program Files\Mozilla Firefox\plugins\nprjplug.dll No File
CHR Plugin: (Winamp Application Detector) - C:\Program Files\Mozilla Firefox\plugins\npwachk.dll No File
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.69\npGoogleUpdate3.dll No File
CHR Plugin: (Startpage24 Startpage) - C:\Program Files\Startpage24\Plugin\Version_586\firefox\plugins\nplink64.dll (Link64 GmbH)
CHR Plugin: (Windows Live® Photo Gallery) - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Picasa) - C:\Programme\Picasa3\npPicasa3.dll (Google, Inc.)
CHR Plugin: (VLC Multimedia Plug-in) - C:\Programme\VLC Mediaplayer\npvlc.dll No File
CHR Plugin: (Veetle TV Player) - C:\Programme\Veetle TV\Player\npvlc.dll (Veetle Inc)
CHR Plugin: (Veetle TV Core) - C:\Programme\Veetle TV\plugins\npVeetle.dll (Veetle Inc)
CHR Plugin: (Default Plug-in) - default_plugin No File
CHR Profile: C:\Users\Haiopei\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Avira Browser Safety) - C:\Users\Haiopei\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2014-08-23]
CHR Extension: (RealDownloader) - C:\Users\Haiopei\AppData\Local\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji [2015-01-06]
CHR Extension: (Google Wallet) - C:\Users\Haiopei\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-02-03]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx [2013-08-14]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 ACDaemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
S3 Adobe LM Service; C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [72704 2014-10-09] (Adobe Systems) [File not signed]
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [432888 2015-03-04] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [432888 2015-03-04] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [992504 2015-03-04] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe [184056 2015-02-12] (Avira Operations GmbH & Co. KG)
R2 Fabs; C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe [1253376 2009-08-27] (MAGIX AG) [File not signed]
R2 FirebirdGuardianDefaultInstance; C:\Program Files\Firebird\Firebird_2_1\bin\fbguard.exe [81920 2008-06-13] (Firebird Project) [File not signed]
R3 FirebirdServerDefaultInstance; C:\Program Files\Firebird\Firebird_2_1\bin\fbserver.exe [2723840 2008-06-13] (Firebird Project) [File not signed]
S3 FirebirdServerMAGIXInstance; C:\Program Files\Common Files\MAGIX Services\Database\bin\fbserver.exe [3276800 2008-08-07] (MAGIX®) [File not signed]
S3 FreeAgentGoNext Service; C:\Programme\Seagate\Sync\FreeAgentService.exe [181544 2009-05-01] (Seagate Technology LLC)
R2 FsUsbExService; C:\Windows\system32\FsUsbExService.Exe [233472 2013-02-05] (Teruten) [File not signed]
S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
S3 MAGIX StartUp Analyze Service; C:\Program Files\MAGIX\PC_Check_Tuning_Free_2011\MXSAS.exe [186368 2010-11-04] (MAGIX AG) [File not signed]
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [235696 2014-04-09] (McAfee, Inc.)
S3 NitroReaderDriverReadSpool3; C:\Program Files\Nitro\Reader 3\NitroPDFReaderDriverService3.exe [196624 2013-07-26] (Nitro PDF Software)
R2 ocster_backup; c:\Programme\Ocster Backup\bin\backupService-ox.exe [18216 2011-01-14] ()
S3 PDF Architect 2; C:\Program Files\PDF Architect 2\ws.exe [1771560 2014-10-10] (pdfforge GmbH)
S3 PDF Architect 2 Creator; C:\Program Files\PDF Architect 2\creator-ws.exe [738856 2014-10-10] (pdfforge GmbH)
S3 pdfforge CrashHandler; C:\Program Files\PDF Architect 2\crash-handler-ws.exe [861736 2014-10-10] (pdfforge GmbH)
U2 ProtexisLicensing; C:\Windows\system32\PSIService.exe [177704 2007-06-05] ()
S3 Radio.fx; C:\Program Files\Tobit Radio.fx\Server\rfx-server.exe [3999512 2013-06-03] ()
R2 RealNetworks Downloader Resolver Service; C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe [39056 2013-08-14] ()
S3 SandraAgentSrv; C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2015\RpcAgentSrv.exe [73200 2014-11-05] (SiSoftware) [File not signed]
S3 Secunia PSI Agent; C:\Program Files\Secunia\PSI\PSIA.exe [1229528 2013-12-06] (Secunia)
S3 Secunia Update Agent; C:\Program Files\Secunia\PSI\sua.exe [662232 2013-12-06] (Secunia)
S3 Soda PDF 5 Helper Service; C:\Program Files\Soda PDF 5\HelperService.exe [1097544 2013-06-12] (LULU Software Limited)
S3 Soda PDF 5 Service; C:\Program Files\Soda PDF 5\ConversionService.exe [794440 2013-06-12] (LULU Software Limited)
S3 Soda PDF Service; C:\Program Files\Soda PDF\ConversionService.exe [807760 2010-12-03] (LULU Software)
S3 SolutoService; C:\Program Files\Soluto\SolutoService.exe [584224 2012-04-24] (Soluto)
R2 ss_conn_service; C:\Program Files\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe [743688 2014-10-13] (DEVGURU Co., LTD.)
R2 TuneUp.UtilitiesSvc; C:\Program Files\TuneUp Utilities 2014\TuneUpUtilitiesService32.exe [1742136 2013-12-18] (TuneUp Software)
S3 w7Svc; C:\Programme\webcam 7\wService.exe [5094200 2012-03-26] (Moonware Studios)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 Afc; C:\Windows\System32\drivers\Afc.sys [18688 2006-11-10] (Arcsoft, Inc.)
R3 Apowersoft_AudioDevice; C:\Windows\System32\drivers\Apowersoft_AudioDevice.sys [26032 2014-04-09] (Wondershare)
S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [165376 2012-10-06] () [File not signed]
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105864 2015-03-04] (Avira Operations GmbH & Co. KG)
R1 avgtp; C:\Windows\system32\drivers\avgtpx86.sys [42272 2014-03-20] (AVG Technologies)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2015-03-04] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-11-26] (Avira Operations GmbH & Co. KG)
R3 CLVirtualBus01; C:\Windows\System32\DRIVERS\CLVirtualBus01.sys [78600 2014-03-12] (CyberLink)
R3 cpuz137; C:\Program Files\CPUID\PC Wizard 2013\pcwiz_x32.sys [26856 2014-02-17] (CPUID)
R3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [37344 2013-02-05] () [File not signed]
R2 giveio; C:\Windows\system32\giveio.sys [5248 1996-04-03] () [File not signed]
R1 GUBootStartup; C:\Windows\System32\drivers\GUBootStartup.sys [17344 2014-10-18] (Glarysoft Ltd)
S3 hwusbfake; C:\Windows\System32\DRIVERS\ewusbfake.sys [101120 2009-11-04] (Huawei Technologies Co., Ltd.)
R3 KMWDFILTERx86; C:\Windows\System32\DRIVERS\KMWDFILTER.sys [25088 2009-04-29] (Windows (R) Codename Longhorn DDK provider)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [18048 2011-02-19] () [File not signed]
S3 PSI; C:\Windows\System32\DRIVERS\psi_mf_x86.sys [16024 2013-12-06] (Secunia)
S3 QCPro; C:\Windows\System32\DRIVERS\p35u.sys [116480 2002-12-10] (Logitech Inc.)
S3 RRNetCap; C:\Windows\System32\DRIVERS\rrnetcap.sys [31848 2011-11-30] (RapidSolution Software AG)
R3 RRNetCapMP; C:\Windows\System32\DRIVERS\rrnetcap.sys [31848 2011-11-30] (RapidSolution Software AG)
S3 SANDRA; C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2015\WNt600x86\Sandra.sys [23112 2009-08-07] (SiSoftware)
R1 SASDIFSV; C:\Program Files\SASDIFSV.SYS [12872 2010-02-17] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SASKUTIL.SYS [67656 2010-05-10] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
S0 Soluto; C:\Windows\System32\Drivers\Soluto.sys [51144 2012-04-24] (Soluto LTD.)
R2 speedfan; C:\Windows\system32\speedfan.sys [24184 2012-12-29] (Almico Software)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)
R3 tbhsd; C:\Windows\System32\drivers\tbhsd.sys [39016 2011-11-30] (RapidSolution Software AG)
R3 TuneUpUtilitiesDrv; C:\Program Files\TuneUp Utilities 2014\TuneUpUtilitiesDriver32.sys [12320 2013-08-21] (TuneUp Software)
S3 cpuz135; \??\C:\Windows\TEMP\cpuz135\cpuz135_x32.sys [X]
S3 ProcObsrv; \??\C:\Programme\Glary Utilities 3\ProcObsrv.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-07 20:05 - 2015-03-07 20:06 - 00083541 _____ () C:\Users\Haiopei\Desktop\2 Addition.txt
2015-03-07 20:04 - 2015-03-07 21:09 - 00043767 _____ () C:\Users\Haiopei\Desktop\FRST.txt
2015-03-07 20:04 - 2015-03-07 20:06 - 00067280 _____ () C:\Users\Haiopei\Desktop\2 FRST.txt
2015-03-07 20:03 - 2015-03-07 21:08 - 00000000 ____D () C:\FRST
2015-03-07 20:03 - 2015-03-07 20:03 - 01134080 _____ (Farbar) C:\Users\Haiopei\Desktop\FRST.exe
2015-03-07 19:44 - 2015-03-07 19:54 - 00000000 ____D () C:\Users\Haiopei\Downloads\alles
2015-03-07 14:58 - 2015-03-07 15:22 - 64486819 _____ () C:\Users\Haiopei\Downloads\▶ James Bay - Hold back the River (Live for Sunday Sessions
2015-03-07 11:19 - 2015-03-07 11:28 - 42869328 _____ (Google Inc.) C:\Users\Haiopei\Downloads\Google_Chrome_v41.0.2272.76.exe
2015-03-07 00:29 - 2015-03-07 00:29 - 00000000 ____D () C:\Users\Haiopei\AppData\Local\CrashRpt
2015-03-06 20:38 - 2015-03-06 20:47 - 00000000 ____D () C:\ProgramData\SecTaskMan
2015-03-06 20:37 - 2015-03-06 20:37 - 02931056 _____ () C:\Users\Haiopei\Downloads\SecurityTaskManager_Setup.exe
2015-03-06 20:34 - 2015-03-06 20:34 - 00540072 _____ (Neuber Software) C:\Users\Haiopei\Downloads\SvchostAnalyzer.exe
2015-03-06 01:14 - 2015-03-06 01:14 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2015-03-04 13:47 - 2015-03-04 13:50 - 14980336 _____ () C:\Users\Haiopei\Downloads\Glary_Utilities_v5.20.0.35.exe
2015-03-04 11:57 - 2015-03-04 12:07 - 48990992 _____ (Dropbox, Inc.) C:\Users\Haiopei\Downloads\Dropbox_v3.2.7.exe
2015-03-04 11:55 - 2015-03-04 11:55 - 00000990 _____ () C:\Users\Public\Desktop\CPUID CPU-Z.lnk
2015-03-04 11:54 - 2015-03-04 11:54 - 00001570 _____ () C:\Users\Haiopei\Desktop\XnView.lnk
2015-03-04 11:18 - 2015-03-04 11:19 - 01582736 _____ ( ) C:\Users\Haiopei\Downloads\CPU_Z_v1.72.0.exe
2015-03-04 11:17 - 2015-03-04 11:30 - 28509232 _____ () C:\Users\Haiopei\Downloads\VLC_Media_Player_(32bit)_v2.2.0.exe
2015-03-04 11:17 - 2015-03-04 11:20 - 05060784 _____ (Gougelet Pierre-e ) C:\Users\Haiopei\Downloads\XnView_v2.31.exe
2015-03-04 11:17 - 2015-03-04 11:19 - 02218504 _____ () C:\Users\Haiopei\Downloads\SpeedFan_v4.51.exe
2015-03-04 08:34 - 2015-01-09 03:48 - 00635904 _____ (Microsoft Corporation) C:\Windows\system32\perftrack.dll
2015-03-04 08:34 - 2015-01-09 03:48 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\wdi.dll
2015-03-04 08:34 - 2015-01-09 03:48 - 00027136 _____ (Microsoft Corporation) C:\Windows\system32\powertracker.dll
2015-02-25 19:46 - 2015-01-09 00:44 - 00419936 _____ () C:\Windows\system32\locale.nls
2015-02-14 01:31 - 2015-02-14 01:34 - 18129584 _____ (Adobe Systems Incorporated) C:\Users\Haiopei\Downloads\Adobe_Flash_Player_(Non_IE)_v16.0.0.305.exe
2015-02-14 01:06 - 2015-02-14 01:07 - 05400507 _____ (CPUID ) C:\Users\Haiopei\Downloads\PC_Wizard_v2014.2.13.exe
2015-02-12 19:37 - 2015-01-23 04:43 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-02-12 19:37 - 2015-01-23 04:17 - 04300800 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-02-12 19:37 - 2015-01-15 08:46 - 00136640 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-02-12 19:37 - 2015-01-15 08:46 - 00067520 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-02-12 19:37 - 2015-01-15 08:43 - 00100352 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-02-12 19:37 - 2015-01-15 08:43 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-02-12 19:37 - 2015-01-15 08:42 - 01061376 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-02-12 19:37 - 2015-01-15 08:42 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-02-12 19:37 - 2015-01-15 08:42 - 00022528 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-02-12 19:37 - 2015-01-15 08:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-02-12 19:37 - 2015-01-15 08:39 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-02-12 19:37 - 2015-01-15 08:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-02-12 19:37 - 2015-01-15 08:37 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-02-12 19:37 - 2015-01-15 05:21 - 00369968 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-02-12 19:03 - 2015-02-15 14:57 - 00000852 _____ () C:\Windows\PFRO.log
2015-02-11 18:46 - 2015-01-14 06:09 - 00342712 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-02-11 18:46 - 2015-01-12 03:25 - 19740160 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-02-11 18:46 - 2015-01-12 03:21 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-02-11 18:46 - 2015-01-12 03:21 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-02-11 18:46 - 2015-01-12 03:08 - 00503296 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-02-11 18:46 - 2015-01-12 03:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-02-11 18:46 - 2015-01-12 03:07 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-02-11 18:46 - 2015-01-12 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-02-11 18:46 - 2015-01-12 03:02 - 02277888 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-02-11 18:46 - 2015-01-12 03:00 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-02-11 18:46 - 2015-01-12 02:59 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-02-11 18:46 - 2015-01-12 02:57 - 00478208 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-02-11 18:46 - 2015-01-12 02:55 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-02-11 18:46 - 2015-01-12 02:55 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-02-11 18:46 - 2015-01-12 02:48 - 00667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-02-11 18:46 - 2015-01-12 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-02-11 18:46 - 2015-01-12 02:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-02-11 18:46 - 2015-01-12 02:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-02-11 18:46 - 2015-01-12 02:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-02-11 18:46 - 2015-01-12 02:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-02-11 18:46 - 2015-01-12 02:23 - 02052608 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-02-11 18:46 - 2015-01-12 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-02-11 18:46 - 2015-01-12 02:23 - 00684544 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-02-11 18:46 - 2015-01-12 02:22 - 01155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-02-11 18:46 - 2015-01-12 02:14 - 12829184 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-02-11 18:46 - 2015-01-12 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-02-11 18:46 - 2015-01-12 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-02-11 18:46 - 2015-01-12 01:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-02-11 18:45 - 2015-01-10 07:27 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-02-11 18:45 - 2015-01-10 07:27 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-02-11 18:45 - 2015-01-10 07:27 - 00248832 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-02-11 18:45 - 2015-01-10 07:27 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-02-11 18:45 - 2015-01-10 07:27 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-02-11 18:45 - 2015-01-10 07:27 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-02-11 18:45 - 2015-01-10 07:27 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-02-11 18:45 - 2015-01-09 02:45 - 02380288 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-02-11 18:43 - 2015-02-04 03:54 - 00482304 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-02-11 18:43 - 2015-02-04 03:53 - 00767488 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-02-11 18:43 - 2015-02-04 03:53 - 00621056 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-02-11 18:43 - 2015-02-04 03:53 - 00325632 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-02-11 18:43 - 2015-02-04 03:53 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-02-11 18:43 - 2015-02-04 03:53 - 00159744 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-02-11 18:43 - 2015-02-04 03:49 - 00886784 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-02-11 18:43 - 2015-01-28 00:36 - 01167520 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2015-02-11 18:43 - 2015-01-14 06:44 - 03972544 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2015-02-11 18:43 - 2015-01-14 06:44 - 03917760 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-02-11 18:43 - 2014-11-26 04:32 - 00571904 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2015-02-11 18:39 - 2014-12-12 06:07 - 01174528 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-02-11 18:39 - 2014-07-07 02:40 - 00179200 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2015-02-11 18:39 - 2014-07-07 02:40 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2015-02-11 18:38 - 2015-01-13 03:49 - 01230336 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-02-11 18:38 - 2014-12-08 03:46 - 00308224 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll
2015-02-09 19:11 - 2015-03-07 10:32 - 00001714 _____ () C:\Windows\setupact.log
2015-02-09 19:11 - 2015-02-09 19:11 - 00000000 _____ () C:\Windows\setuperr.log
2015-02-07 16:41 - 2015-02-07 16:41 - 00000000 ____D () C:\Users\Haiopei\Downloads\Telefon
2015-02-07 16:37 - 2015-02-07 16:38 - 00000000 ____D () C:\Users\Haiopei\Downloads\Hobby
2015-02-07 16:26 - 2015-02-07 16:39 - 00000000 ____D () C:\Users\Haiopei\Downloads\TV
2015-02-06 01:00 - 2015-02-06 01:00 - 00001426 _____ () C:\Users\Public\Desktop\LibreOffice 4.4.lnk
2015-02-06 01:00 - 2015-02-06 01:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LibreOffice 4.4
2015-02-06 00:52 - 2015-02-06 01:00 - 00000000 ____D () C:\Program Files\LibreOffice 4

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-07 21:09 - 2011-01-30 20:09 - 00000000 ___HD () C:\ProgramData\sysnfxo
2015-03-07 20:57 - 2010-09-22 16:19 - 01584663 _____ () C:\Windows\WindowsUpdate.log
2015-03-07 20:30 - 2011-02-13 10:04 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-03-07 20:16 - 2010-04-11 21:48 - 00000000 ____D () C:\Users\Haiopei\AppData\Roaming\TeraCopy
2015-03-07 19:54 - 2012-04-04 15:53 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-03-07 19:54 - 2012-04-04 15:52 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2015-03-07 19:54 - 2011-07-06 17:27 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2015-03-07 19:45 - 2010-04-30 20:16 - 00000000 ____D () C:\Users\Haiopei\Downloads\Modellbau
2015-03-07 19:30 - 2010-11-06 18:39 - 00000000 ____D () C:\Users\Haiopei\Downloads\PC
2015-03-07 18:30 - 2011-02-13 10:04 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-03-07 16:32 - 2012-10-20 21:50 - 00000000 ____D () C:\Users\Haiopei\Downloads\Musik
2015-03-07 15:38 - 2012-10-21 23:48 - 00000000 ____D () C:\Users\Haiopei\AppData\Roaming\vlc
2015-03-07 13:09 - 2009-07-14 05:34 - 00018704 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-03-07 13:09 - 2009-07-14 05:34 - 00018704 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-03-07 10:34 - 2014-06-05 23:46 - 00000000 ___RD () C:\Users\Haiopei\Dropbox
2015-03-07 10:34 - 2014-06-05 22:50 - 00000000 ____D () C:\Users\Haiopei\AppData\Roaming\Dropbox
2015-03-07 10:33 - 2014-10-13 19:54 - 00000326 _____ () C:\Windows\Tasks\GlaryInitialize 5.job
2015-03-07 10:33 - 2014-10-13 19:54 - 00000000 ____D () C:\Program Files\Glary Utilities 5
2015-03-07 10:32 - 2009-07-14 05:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-03-07 01:43 - 2010-03-03 17:49 - 00000000 ____D () C:\Users\Haiopei
2015-03-06 20:57 - 2014-09-07 18:44 - 00114904 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-03-06 20:30 - 2009-07-14 05:53 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-03-06 20:19 - 2012-04-29 18:47 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2015-03-06 17:18 - 2012-10-10 18:49 - 00000000 ____D () C:\Users\Haiopei\Downloads\winhttrack
2015-03-06 16:27 - 2015-01-10 12:45 - 00001086 _____ () C:\Users\Haiopei\Desktop\PC Wizard 2013.lnk
2015-03-05 22:16 - 2014-08-20 01:03 - 00000000 ____D () C:\ProgramData\Package Cache
2015-03-05 22:15 - 2013-02-23 13:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-03-05 22:15 - 2013-02-23 12:53 - 00000000 ____D () C:\Program Files\Avira
2015-03-05 10:06 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\tracing
2015-03-04 14:28 - 2013-05-08 18:09 - 00037896 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2015-03-04 14:28 - 2013-02-23 12:53 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2015-03-04 14:28 - 2013-02-23 12:53 - 00105864 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2015-03-04 13:52 - 2014-10-13 19:54 - 00001018 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glary Utilities 5.lnk
2015-03-04 13:52 - 2014-10-13 19:54 - 00001006 _____ () C:\Users\Public\Desktop\Glary Utilities 5.lnk
2015-03-04 13:01 - 2014-06-05 23:46 - 00000989 _____ () C:\Users\Haiopei\Desktop\Dropbox.lnk
2015-03-04 13:01 - 2014-06-05 22:51 - 00000000 ____D () C:\Users\Haiopei\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-03-04 11:54 - 2014-11-15 22:17 - 00000933 _____ () C:\Users\Haiopei\Desktop\SpeedFan.lnk
2015-03-04 11:54 - 2014-11-15 22:17 - 00000045 _____ () C:\Windows\system32\initdebug.nfo
2015-03-04 11:54 - 2014-11-15 22:17 - 00000000 ____D () C:\Users\Haiopei\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpeedFan
2015-03-04 11:54 - 2014-11-15 22:17 - 00000000 ____D () C:\Program Files\SpeedFan
2015-03-04 11:54 - 2010-05-22 13:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XnView
2015-03-04 11:54 - 2010-05-22 13:08 - 00000000 ____D () C:\Program Files\XnView
2015-03-04 11:53 - 2013-01-26 17:42 - 00000992 _____ () C:\Users\Public\Desktop\VLC media player.lnk
2015-03-03 20:54 - 2012-05-24 18:55 - 00000000 ____D () C:\Users\Haiopei\AppData\Roaming\Nitro PDF
2015-02-25 22:18 - 2011-02-11 21:44 - 00000000 ____D () C:\Users\Haiopei\AppData\Roaming\PDF Software
2015-02-23 21:49 - 2014-02-04 20:30 - 00002472 _____ () C:\Users\Haiopei\Desktop\Google Chrome.lnk
2015-02-14 01:03 - 2014-10-13 19:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glary Utilities 5
2015-02-13 23:16 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\rescache
2015-02-13 20:43 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\system32\de-DE
2015-02-12 19:04 - 2009-07-14 05:33 - 00894256 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-02-12 09:41 - 2014-12-10 18:49 - 00000000 ____D () C:\Windows\system32\appraiser
2015-02-12 09:41 - 2014-04-25 01:31 - 00000000 ___SD () C:\Windows\system32\CompatTel
2015-02-12 09:39 - 2013-07-14 13:14 - 00000000 ____D () C:\Windows\system32\MRT
2015-02-12 03:10 - 2009-11-16 11:03 - 113756392 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-02-12 03:09 - 2009-11-16 12:26 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-02-08 22:41 - 2015-01-01 19:14 - 18129584 _____ (Adobe Systems Incorporated) C:\Users\Haiopei\Downloads\install_flash_player.exe
2015-02-08 22:12 - 2010-03-05 20:04 - 00000000 ____D () C:\Users\Haiopei\AppData\Roaming\BOM
2015-02-08 20:19 - 2012-08-01 18:50 - 00000000 ____D () C:\Program Files\Biet-O-Matic
2015-02-08 13:20 - 2012-10-26 21:27 - 00000000 ____D () C:\Program Files\PDFCreator
2015-02-06 01:45 - 2010-03-03 17:49 - 00276656 _____ () C:\Users\Haiopei\AppData\Local\GDIPFONTCACHEV1.DAT

==================== Files in the root of some directories =======

2007-10-02 22:08 - 2007-10-02 22:08 - 0122168 _____ (SuperAdBlocker.com) C:\Program Files\BootSafe.exe
2004-05-20 21:28 - 2004-05-20 21:28 - 0002048 _____ () C:\Program Files\detect.wav
2006-09-19 23:55 - 2006-09-19 23:55 - 0360448 _____ (SuperAntiSpyware.com) C:\Program Files\deupx.dll
2013-05-20 22:22 - 2014-03-20 21:49 - 0003730 _____ () C:\Program Files\Mozilla Firefoxavg-secure-search.xml
2004-05-07 23:31 - 2004-05-07 23:31 - 0348160 _____ (Microsoft Corporation) C:\Program Files\msvcr71.dll
2010-06-10 11:15 - 2010-06-10 11:15 - 27213372 _____ () C:\Program Files\PROCESSLIST.DB
2010-06-10 11:15 - 2010-06-10 11:15 - 1474074 _____ () C:\Program Files\PROCESSLISTRELATED.DB
2010-03-24 21:53 - 2010-03-24 21:53 - 0299520 _____ () C:\Program Files\RUNSAS.EXE
2010-06-07 18:02 - 2010-06-07 18:02 - 0111104 _____ (SUPERAntiSpyware.com) C:\Program Files\SASCore.exe
2007-02-27 20:39 - 2007-02-27 20:39 - 0061440 _____ (SUPERAntiSpyware.com) C:\Program Files\SASCTXMN.DLL
2010-02-17 19:25 - 2010-02-17 19:25 - 0012872 _____ (SUPERAdBlocker.com and SUPERAntiSpyware.com) C:\Program Files\sasdifsv.sys
2010-02-17 19:15 - 2010-02-17 19:15 - 0012872 _____ ( SUPERAdBlocker.com and SUPERAntiSpyware.com) C:\Program Files\SASENUM.SYS
2008-03-12 19:29 - 2008-03-12 19:29 - 0024576 _____ () C:\Program Files\SASINST.EXE
2010-05-10 19:41 - 2010-05-10 19:41 - 0067656 _____ (SUPERAdBlocker.com and SUPERAntiSpyware.com) C:\Program Files\SASKUTIL.SYS
2008-07-28 19:10 - 2008-07-28 19:10 - 0411136 _____ () C:\Program Files\SASREPAIRS.STG
2008-05-13 18:13 - 2008-05-13 18:13 - 0077824 _____ (SuperAdBlocker.com) C:\Program Files\SASSEH.DLL
2010-06-09 00:16 - 2010-06-09 00:16 - 0101832 _____ (SUPERAntiSpyware.com) C:\Program Files\SASUNINST.EXE
2009-09-03 23:21 - 2009-09-03 23:21 - 0548352 _____ (SUPERAntiSpyware.com) C:\Program Files\SASWINLO.DLL
2010-06-07 18:13 - 2010-06-07 18:13 - 0256752 _____ (SUPERAntiSpyware.com) C:\Program Files\SSUpdate.exe
2007-11-27 21:12 - 2007-11-27 21:12 - 1088725 _____ () C:\Program Files\SUPERAntiSpyware.chm
2010-06-07 18:13 - 2010-06-07 18:13 - 2403568 _____ (SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware.exe
2011-01-12 01:00 - 2011-01-12 01:00 - 0146944 _____ () C:\Program Files\Common Files\dsfFLACDecoder.dll
2011-01-12 01:00 - 2011-01-12 01:00 - 0221184 _____ () C:\Program Files\Common Files\dsfFLACEncoder.dll
2011-01-12 01:00 - 2011-01-12 01:00 - 0204800 _____ () C:\Program Files\Common Files\dsfNativeFLACSource.dll
2012-05-11 13:16 - 2012-05-11 13:16 - 0171520 _____ () C:\Program Files\Common Files\dsfOggDemux2.dll
2011-01-12 01:00 - 2011-01-12 01:00 - 0240128 _____ () C:\Program Files\Common Files\dsfVorbisDecoder.dll
2009-07-11 22:08 - 2009-07-11 22:08 - 0001860 _____ () C:\Program Files\Common Files\Microsoft.VC90.CRT.manifest
2011-04-18 21:51 - 2011-04-18 21:51 - 0569680 _____ (Microsoft Corporation) C:\Program Files\Common Files\MSVCP90.dll
2011-04-18 21:51 - 2011-04-18 21:51 - 0653136 _____ (Microsoft Corporation) C:\Program Files\Common Files\MSVCR90.dll
2010-12-16 20:39 - 2010-12-16 20:39 - 0412672 _____ (Google) C:\Program Files\Common Files\vp8decoder.dll
2010-12-16 20:39 - 2010-12-16 20:39 - 0701440 _____ (Google) C:\Program Files\Common Files\vp8encoder.dll
2010-12-16 20:39 - 2010-12-16 20:39 - 0302592 _____ (Google) C:\Program Files\Common Files\webmmux.dll
2010-12-16 20:39 - 2010-12-16 20:39 - 0292352 _____ (Google) C:\Program Files\Common Files\webmsplit.dll
2011-01-12 01:00 - 2011-01-12 01:00 - 0030208 _____ () C:\Program Files\Common Files\wmpinfo.dll
2012-10-06 18:11 - 2012-10-06 18:11 - 0027648 ____H () C:\Users\Haiopei\AppData\Roaming\MBSRegistrationPlugin4987.dll
2012-10-06 18:11 - 2012-10-06 18:11 - 0052224 ____H () C:\Users\Haiopei\AppData\Roaming\MBSResPlugin4707.dll
2010-05-23 17:50 - 2011-02-28 00:22 - 0030138 _____ () C:\Users\Haiopei\AppData\Roaming\mdbu.bin
2012-10-06 18:11 - 2012-10-06 18:11 - 0088576 ____H () C:\Users\Haiopei\AppData\Roaming\rbap550.dll
2014-11-20 21:06 - 2014-11-20 22:58 - 14344192 _____ () C:\Users\Haiopei\AppData\Roaming\Sandra.mdb
2011-07-09 00:46 - 2011-07-09 00:46 - 0000000 _____ () C:\Users\Haiopei\AppData\Roaming\wklnhst.dat
2010-05-22 13:11 - 2014-10-11 13:07 - 0011264 _____ () C:\Users\Haiopei\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-09-21 18:41 - 2013-09-21 18:41 - 0001399 _____ () C:\Users\Haiopei\AppData\Local\recently-used.xbel
2011-08-08 20:35 - 2011-08-08 20:35 - 0000000 _____ () C:\Users\Haiopei\AppData\Local\{D3658853-4D5E-4D05-A4DE-30C83734AF6B}
2010-09-10 16:08 - 2010-09-10 16:08 - 0000008 ____N () C:\ProgramData\613AD1B23E.sys
2011-12-12 20:45 - 2012-01-15 20:59 - 1025382 _____ () C:\ProgramData\bdinstall.bin
2010-11-05 20:50 - 2010-11-08 22:11 - 0000056 ____H () C:\ProgramData\ezsidmv.dat
2010-09-10 16:08 - 2010-09-10 16:09 - 0005642 ___SH () C:\ProgramData\KGyGaAvL.sys
2011-08-18 18:03 - 2012-03-22 19:21 - 0000193 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc
2011-12-20 21:17 - 2011-12-20 21:55 - 0002816 _____ () C:\ProgramData\search_result.xml

Some content of TEMP:
====================
C:\Users\Haiopei\AppData\Local\Temp\avgnt.exe
C:\Users\Haiopei\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmphhmsue.dll
C:\Users\Haiopei\AppData\Local\Temp\sfextra.dll
C:\Users\Haiopei\AppData\Local\Temp\SSUPDATE.EXE


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-03-05 12:50

==================== End Of Log ============================

--- --- ---

--- --- ---

Haiopei · 07.03.2015, 21:24

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 07-03-2015
Ran by Haiopei at 2015-03-07 21:09:21
Running from C:\Users\Haiopei\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

µTorrent (HKLM\...\uTorrent) (Version: 3.1.3 - )
7-Zip 9.34 alpha (HKLM\...\7-Zip) (Version:  - )
Activation Assistant for the 2007 Microsoft Office suites (HKLM\...\Activation Assistant for the 2007 Microsoft Office suites) (Version:  - Microsoft Corporation)
Activation Assistant for the 2007 Microsoft Office suites (Version: 1.0 - Microsoft Corporation) Hidden
Adobe Digital Editions 2.0 (HKLM\...\Adobe Digital Editions 2.0) (Version: 2.0 - Adobe Systems Incorporated)
Adobe Flash Player 16 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 16.0.0.296 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Flash Player 16 PPAPI (HKLM\...\Adobe Flash Player PPAPI) (Version: 16.0.0.296 - Adobe Systems Incorporated)
Adobe Photoshop CS2 (HKLM\...\Adobe Photoshop CS2 - {236BB7C4-4419-42FD-0407-1E257A25E34D}) (Version: 9.0 - Adobe Systems, Inc.)
Adobe Reader XI (11.0.09) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.09 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) (HKLM\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.1 (HKLM\...\Adobe Shockwave Player) (Version: 12.1.6.156 - Adobe Systems, Inc.)
Aiseesoft TRP Konverter 6.2.16 (HKLM\...\{641C2187-AB15-415b-9587-D5B310A19ADC}_is1) (Version:  - )
ALDI Foto Service (HKLM\...\ALDI Foto Service D) (Version: 4.5.9.141 - MAGIX AG)
ALDI Nord Foto Manager Free (HKLM\...\ALDI Nord Foto Manager Free D) (Version: 6.0.1.491 - MAGIX AG)
Aldi Nord Fotoservice (HKLM\...\Aldi Nord Fotoservice_is1) (Version:  - )
ALDI Nord Online Druck Service (HKLM\...\ALDI Nord Online Druck Service D) (Version: 4.5.1.0 - MAGIX AG)
AllDup 3.4.24 (HKLM\...\AllDup_is1) (Version: 3.4.24 - Michael Thummerer Software Design)
AM-DeadLink 4.1 (HKLM\...\aignesamdeadlink_is1) (Version: 4.1 - www.aignes.com)
Any Video Converter 5.7.6 (HKLM\...\Any Video Converter_is1) (Version:  - Any-Video-Converter.com)
Apple Application Support (HKLM\...\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.)
Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Archivarius 3000 (Version 4.44/x32) (HKLM\...\Archivarius 3000_is1) (Version:  - Likasoft)
ArcSoft MediaImpression 2 (HKLM\...\{81FC0476-9507-4CD3-95A7-2BE60E256D1D}) (Version: 2.0.27.846 - ArcSoft)
Ashampoo ClipFinder HD v.2.3.2 (HKLM\...\Ashampoo ClipFinder HD_is1) (Version: 2.3.2 - Ashampoo GmbH & Co. KG)
Ashampoo Music Studio 2012 v.1.0.0 (HKLM\...\Ashampoo Music Studio 2012_is1) (Version: 1.0.0 - Ashampoo GmbH & Co. KG)
Ashampoo Photo Commander 11 v.11.1.6 (HKLM\...\{C92AB6F1-0F9C-8526-5DF1-0A2FD0FB33D9}_is1) (Version: 11.1.6 - Ashampoo GmbH & Co. KG)
Ashampoo Photo Commander 7.60 (HKLM\...\Ashampoo Photo Commander 7_is1) (Version: 7.6.0 - ashampoo GmbH & Co. KG)
Ashampoo Photo Converter v.1.0.1 (HKLM\...\Ashampoo Photo Converter_is1) (Version: 1.0.1 - Ashampoo GmbH & Co. KG)
Atomuhr (HKLM\...\{F5CEAB8C-19F8-4A29-9977-FED8D5DE6D31}) (Version: 1.0.1 - A. Weintrub)
Audials (HKLM\...\{89740E68-3E04-4A02-96BD-7B17AC443938}) (Version: 9.0.55304.400 - RapidSolution Software AG)
Audials TV (HKLM\...\{1A0B8239-664B-434A-99D8-C50793513249}) (Version: 1.3.10800.0 - RapidSolution Software AG)
AudialsOne (HKLM\...\{80C7431E-CB45-40F4-AB4E-090E8AD4706D}) (Version: 4.0.33916.1600 - RapidSolution Software AG)
Audiograbber 1.83 SE  (HKLM\...\Audiograbber) (Version: 1.83 SE  - Audiograbber Deutschland)
Audiograbber Lame-MP3-Plugin (HKLM\...\Audiograbber-Lame) (Version: 1.0 - AG)
Avira (HKLM\...\{d9ed6dcf-6bfc-4fbb-802e-81dd5b767d6e}) (Version: 1.1.32.25147 - Avira Operations & Co. KG)
Avira (Version: 1.1.32.25147 - Avira Operations & Co. KG) Hidden
Avira Free Antivirus (HKLM\...\Avira AntiVir Desktop) (Version: 15.0.8.650 - Avira)
BenVista PhotoZoom Classic 2.0 (HKLM\...\PhotoZoom Classic 2) (Version: 2.0 - BenVista Ltd)
Biet-O-Matic v2.14.8 (HKLM\...\Biet-O-Matic v2.14.8) (Version: 2.14.8 - BOM Development Team)
CCleaner (HKLM\...\CCleaner) (Version: 5.01 - Piriform)
Compatibility Pack für 2007 Office System (HKLM\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Computer Schiffe Versenken XXL Deluxe (HKLM\...\Computer Schiffe Versenken XXL Deluxe_is1) (Version:  - media Verlagsgesellschaft mbH)
COMPUTERBILD-Abzockschutz (HKLM\...\{2664E454-FECE-42E9-A7EF-6B5EB62AC67B}) (Version: 1.0.58 - J3S)
COMPUTERBILD-PC-Schnellstarter (HKLM\...\{729713E3-CFD5-4E9F-A301-5BD8EA25A28B}) (Version: 1.0.7 - J3S)
Contents (Version: 1.6.1.109 - Corel Corporation) Hidden
Corel MediaOne (HKLM\...\{A062A15F-9CAC-4B88-98DF-87628A0BD721}) (Version: 2.100.0000 - Corel Corporation)
Corel Paint Shop Pro Photo X2 (HKLM\...\{64E72FB1-2343-4977-B4A8-262CD53D0BD3}) (Version: 12.50.0000 - Corel Corporation)
Corel Painter Photo Essentials 4 (HKLM\...\_{707EB912-C597-49D8-9460-46CC9AB03EBE}) (Version:  - Corel Corporation)
Corel Painter Photo Essentials 4 (Version: 4.0 - Corel Corporation) Hidden
Corel PaintShop Photo Pro X3 (HKLM\...\_{D1AEB5DB-04FA-489D-94EF-8600898B93EE}) (Version: 1.6.1.109 - Corel Corporation)
Corel PaintShop Photo Pro X3 (Version: 1.00.0000 - Corel Corporation) Hidden
CorelDRAW Essential Edition 3 (HKLM\...\_{ADDBE07D-95B8-4789-9C76-187FFF9624B4}) (Version:  - Corel Corporation)
CorelDRAW Essential Edition 3 (Version: 3.0 - Corel Corporation) Hidden
CPUID CPU-Z 1.72 (HKLM\...\CPUID CPU-Z_is1) (Version:  - )
CyberLink LabelPrint 2.5 (HKLM\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.0.6603 - CyberLink Corp.)
CyberLink Power2Go (HKLM\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.1.3213 - CyberLink Corp.)
CyberLink Power2Go 9 (HKLM\...\InstallShield_{57D68FAE-CB5E-4fd6-AE3B-A0B43375AF18}) (Version: 9.0.1827.0 - CyberLink Corp.)
CyberLink PowerDVD Copy (HKLM\...\{E3D04529-6EDB-11D8-A372-0050BAE317E1}) (Version: 1.0.6720 - CyberLink Corp.)
CyberLink WaveEditor 2 (HKLM\...\InstallShield_{324F76CC-D8DD-4D87-B77D-D4AF5E1AA7B3}) (Version: 2.0.0.4203 - CyberLink Corp.)
D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden
DE (Version: 3.0 - Corel Corporation) Hidden
DeepBurner v1.9.0.228 (HKLM\...\{2ADE2157-7A5E-122C-B51D-EB8A01B15943}) (Version:  - )
DeviceIO (Version: 1.6.1.109 - Corel Corporation) Hidden
Dropbox (HKU\S-1-5-21-2886736790-1064491100-3460348771-1000\...\Dropbox) (Version: 3.2.7 - Dropbox, Inc.)
DSL-Speedtest (HKLM\...\{5C98D841-6392-41F1-A80E-B1A741F32A95}) (Version: 1.00.0000 - COMPUTER BILD)
EA SPORTS online 2005 (HKLM\...\82A44D22-9452-49FB-00FB-CEC7DCAF7E23) (Version:  - )
Exact Audio Copy 1.0beta3 (HKLM\...\Exact Audio Copy) (Version: 1.0beta3 - Andre Wiethoff)
FIFA 09 (HKLM\...\{2315B23D-3E21-4920-837D-AE6460934ECB}) (Version: 1.0.1.1 - Electronic Arts)
FIFA 2005 (HKLM\...\{E4E3E62E-16D7-425E-009C-DCB5E64F5955}) (Version:  - )
Firebird 2.1.1.17910 (Win32) (HKLM\...\FBDBServer_2_1_is1) (Version: 2.1.1.17910 - Firebird Project)
Firebird SQL Server - MAGIX Edition (HKLM\...\{34EB6245-C8D0-4D8A-B8D8-EEBFF7A91485}) (Version: 2.1.27.0 - MAGIX AG)
FlightGear v2.0.0 (HKLM\...\FlightGear_is1) (Version:  - The FlightGear Team)
Formatwandler 2013 (HKLM\...\{98C7891F-4BA8-48D3-0001-D4DD055B2886}) (Version: 5.0.12.625 - S.A.D.)
Formatwandler 5 (HKLM\...\{CC5A25E6-7564-48FF-0001-D4DD055B2886}) (Version: 5.0.13.610 - S.A.D.)
Fraps (HKLM\...\Fraps) (Version:  - )
Free Mp3 Wma Converter V 2.2 (HKLM\...\Free Mp3 Wma Converter_is1) (Version: 2.2.0.0 - Koyote Lab Inc.)
Free Video Editor version 1.4.5.923 (HKLM\...\Free Video Editor_is1) (Version: 1.4.5.923 - DVDVideoSoft Ltd.)
Free YouTube to MP3 Converter version 3.9.32 (HKLM\...\Free YouTube to MP3 Converter_is1) (Version:  - DVDVideoSoft Limited.)
FreeCommander 2009.02 (HKLM\...\FreeCommander_is1) (Version: 2009.02 - Marek Jasinski)
GetFoldersize 2.2.3 (HKLM\...\GetFoldersize_is1) (Version: 2.2.3 - Michael Thummerer Software Design)
GIMP 2.8.14 (HKLM\...\GIMP-2_is1) (Version: 2.8.14 - The GIMP Team)
Glary Utilities 5.20 (HKLM\...\Glary Utilities 5) (Version: 5.20.0.35 - Glarysoft Ltd)
Google Chrome (HKLM\...\Google Chrome) (Version: 40.0.2214.115 - Google Inc.)
Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (Version: 1.3.26.9 - Google Inc.) Hidden
GoogleClean (HKLM\...\{4281435C-AD1D-4C8A-B9C0-3961C08EF142}_is1) (Version: 4.0.112 - Abelssoft)
Grand Prix 4 (HKLM\...\{C7D27207-0F86-4B6F-859C-21800A2C592E}) (Version:  - )
Half-Life (HKLM\...\Half-Life) (Version:  - )
Hardcopy (C:\Program Files\Hardcopy) (HKLM\...\Hardcopy(C__Program Files_Hardcopy)) (Version: 2011.12.02 - www.hardcopy.de)
HD Tune 2.55 (HKLM\...\HD Tune_is1) (Version:  - EFD Software)
ICA (Version: 1.6.1.109 - Corel Corporation) Hidden
IkaPdfLite (HKU\S-1-5-21-2886736790-1064491100-3460348771-1000\...\812ed091a76d5b25) (Version: 1.0.0.21 - IKaGen)
IkaPdfLite (HKU\S-1-5-21-2886736790-1064491100-3460348771-1002\...\812ed091a76d5b25) (Version: 1.0.0.21 - IKaGen)
Intel(R) Rapid Storage Technology (HKLM\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 9.5.0.1037 - Intel Corporation)
IPM_PSP_Pro (Version: 1.00.0000 - Corel Corporation) Hidden
IrfanView (remove only) (HKLM\...\IrfanView) (Version: 4.38 - Irfan Skiljan)
JAP (HKLM\...\JAP) (Version: 00.16.006 - JAP-Team)
Java 7 Update 67 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F03217067FF}) (Version: 7.0.670 - Oracle)
Java(TM) 6 Update 35 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83216035FF}) (Version: 6.0.350 - Oracle)
Junk Mail filter update (Version: 14.0.8089.726 - Microsoft Corporation) Hidden
Karaoke 5 ver. 39.24 (HKLM\...\Karaoke 5_is1) (Version: 39.24 - MediaSoft)
K-Lite Mega Codec Pack 6.8.0 (HKLM\...\KLiteCodecPack_is1) (Version: 6.8.0 - )
LibreOffice 4.4.0.3 (HKLM\...\{8BEE1CDD-F95D-4759-952D-6B38DF99D1F0}) (Version: 4.4.0.3 - The Document Foundation)
Listary version 3.23 (HKLM\...\Listary_is1) (Version: 3.23 - )
Loadstreet Highspeed Surfer 2.0 Professional (HKLM\...\{AED7E4B5-381E-4E47-BB54-E5127B5A28E0}_is1) (Version: 2.0 - Reohix)
MAGIX Foto Designer 7 (HKLM\...\MAGIX_{2DCD52EE-1AE1-4128-9819-A79F7D09B6B3}) (Version: 7.0.1.1 - MAGIX AG)
MAGIX Foto Designer 7 (Version: 7.0.1.1 - MAGIX AG) Hidden
MAGIX Foto Manager 10 (HKLM\...\MAGIX_MSI_Foto_Manager_10) (Version: 8.0.1.137 - MAGIX AG)
MAGIX Foto Manager 10 (Version: 8.0.1.137 - MAGIX AG) Hidden
MAGIX Online Druck Service (HKLM\...\{3E0E4F57-8FE0-4812-840B-56EB8CC3DB7B}) (Version: 3.4.3.0 - MAGIX AG)
MAGIX PC Check & Tuning Free 2011 (HKLM\...\MAGIX_MSI_PC_Check_Tuning_Free_2011) (Version: 6.0.403.1050 - MAGIX AG)
MAGIX PC Check & Tuning Free 2011 (Version: 6.0.403.1050 - MAGIX AG) Hidden
MAGIX Screenshare (HKLM\...\{B63DFA23-5C10-44B4-881D-45EFBF4A4761}) (Version: 4.3.6.1987 - MAGIX AG)
Mahjong City (HKLM\...\Mahjong City_is1) (Version:  - )
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.150.1 - McAfee, Inc.)
MEDION Fotos auf CD & DVD SE Nord (HKLM\...\MEDION Fotos auf CD & DVD SE Nord D) (Version: 8.0.3.4 - MAGIX AG)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Age of Empires II (HKLM\...\Age of Empires 2.0) (Version:  - )
Microsoft Combat Flight Simulator 3.0 (HKLM\...\Combat Flight Simulator 3.0) (Version:  - )
Microsoft Encarta 99 Enzyklopädie (HKLM\...\Encarta99D) (Version: 99D - Microsoft Corporation)
Microsoft Flight Simulator X (HKLM\...\InstallShield_{9527A496-5DF9-412A-ADC7-168BA5379CA6}) (Version: 10.0.60905 - Microsoft Game Studios)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{90120000-0100-0407-0000-0000000FF1CE}_OMUI.de-de_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}) (Version:  - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office Enterprise 2007 (HKLM\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (HKLM\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Language Pack 2007 - German/Deutsch (HKLM\...\OMUI.de-de) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office PowerPoint Viewer 2007 (German) (HKLM\...\{95120000-00AF-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.31211.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [DEU] (HKLM\...\{BAC80EF3-E106-4AEA-8C57-F217F9BC7358}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual Basic PowerPacks 1.2 (HKLM\...\{EE96B6C8-3660-3B5E-AC95-843CDF03D613}) (Version: 9.0.30729 - Microsoft)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022.218 (HKLM\...\{E503B4BF-F7BB-3D5F-8BC8-F694B1CFF942}) (Version: 9.0.21022.218 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM\...\{3C3D696B-0DB7-3C6D-A356-3DB8CE541918}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Works (HKLM\...\{39D0E034-1042-4905-BECB-5502909FCB7C}) (Version: 9.7.0621 - Microsoft Corporation)
MLE (Version: 1.0.0.23 - Corel Corporation) Hidden
Mozilla Firefox 36.0.1 (x86 de) (HKLM\...\Mozilla Firefox 36.0.1 (x86 de)) (Version: 36.0.1 - Mozilla)
Mozilla Firefox 6.0 (x86 de) (HKLM\...\Mozilla Firefox 6.0 (x86 de)) (Version: 6.0 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 34.0.5 - Mozilla)
MP3Find pro v4.93 (HKLM\...\{22AE56FC-D99B-4A65-A4EE-4FD9DF1415E9}) (Version: 4.93.001 - hxxp://www.mp3find-online.de)
Mp3tag v2.66 (HKLM\...\Mp3tag) (Version: v2.66 - Florian Heidenreich)
MSI to redistribute MS VS2005 CRT libraries (HKLM\...\{A8D93648-9F7F-407D-915C-62044644C3DA}) (Version: 8.0.50727.42 - The Firebird Project)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP2 Parser und SDK (HKLM\...\{716E0306-8318-4364-8B8F-0CC4E9376BAC}) (Version: 4.20.9818.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (HKLM\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2721691) (HKLM\...\{355B5AC0-CEEE-42C5-AD4D-7F3CFD806C36}) (Version: 4.30.2114.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
mufin player 2.0 (HKLM\...\MAGIX_MSI_mufin_player_2) (Version: 2.0.0.135 - mufin GmbH)
mufin player 2.0 (Version: 2.0.0.135 - mufin GmbH) Hidden
MusicBee 2.4 (HKLM\...\MusicBee) (Version: 2.4 - Steven Mayall)
MyFreeCodec (HKU\S-1-5-21-2886736790-1064491100-3460348771-1002\...\MyFreeCodec) (Version:  - )
MyPhoneExplorer (HKLM\...\MPE) (Version: 1.8.6 - F.J. Wechselberger)
Nero - Burning Rom (HKLM\...\Nero - Burning Rom) (Version:  - )
Netzmanager (HKLM\...\Netzmanager) (Version: 1.045 - Deutsche Telekom AG)
Nitro Reader 3 (HKLM\...\{F5451D00-B448-4E9A-82DC-1929F4F1910D}) (Version: 3.5.6.5 - Nitro)
NVIDIA Display Control Panel (HKLM\...\NVIDIA Display Control Panel) (Version: 6.14.11.9745 - NVIDIA Corporation)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.10.59.37 - NVIDIA Corporation)
NVIDIA PhysX (HKLM\...\{E10DB5DA-E576-40EA-A7FC-1CB2A7B283A6}) (Version: 9.09.1112 - NVIDIA Corporation)
Ocster Backup Business 6.07 (HKLM\...\Ocster Backup) (Version: 6.07 - Ocster GmbH & Co. KG)
Office-Bibliothek (HKLM\...\{5C81B189-5456-40C4-9313-7FE6FA6DD64C}) (Version: 5.00.3 - Bibliographisches Institut & F.A. Brockhaus AG)
OGA Notifier 2.0.0048.0 (Version: 2.0.0048.0 - Microsoft Corporation) Hidden
OpenAL (HKLM\...\OpenAL) (Version:  - )
OpenOffice 4.1.0 (HKLM\...\{E19483E2-6C18-494D-A307-D4498BCFD2C7}) (Version: 4.10.9764 - Apache Software Foundation)
Opera Stable 24.0.1558.64 (HKLM\...\Opera 24.0.1558.64) (Version: 24.0.1558.64 - Opera Software ASA)
Paint Shop Pro 7 Evaluation (HKLM\...\{D6DE02C7-1F47-11D4-9515-00105AE4B89A}) (Version: 7.0.0.0000 - Jasc Software Inc)
Panda Batch File Renamer 2.3 (HKLM\...\{CDA3670E-687A-4EC2-8383-3D1AF8767AAA}_is1) (Version: 2.3 - Animal Software)
Partition Commander 11 (32-Bit) (HKLM\...\{69742A9A-B7C4-433B-98B2-53D597598793}_is1) (Version:  - Avanquest Deutschland GmbH)
PC Wizard 2010.1.94 (HKLM\...\PC Wizard 2010_is1) (Version:  - Laurent KUTIL & Franck DELATTRE)
PC Wizard 2013.2.12 (HKLM\...\PC Wizard 2013_is1) (Version:  - CPUID)
PDASkat (remove only) (HKLM\...\PDASkat) (Version:  - )
PDF Architect 2 (HKLM\...\PDF Architect 2) (Version: 2.0.51.17865 - pdfforge GmbH)
PDF Architect 2 Create Module (Version: 2.1.6.19758 - pdfforge GmbH) Hidden
PDF Architect 2 Edit Module (Version: 2.1.6.19758 - pdfforge GmbH) Hidden
PDF Architect 2 View Module (Version: 2.1.6.19758 - pdfforge GmbH) Hidden
PDFCreator (HKLM\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 2.0.2 - pdfforge)
PDFTK Builder 3.5.3 (HKLM\...\PDFTK Builder_is1) (Version:  - )
PHOTORECOVERY LE (HKLM\...\{8D03A164-B586-4318-AFE6-870A5E2739C1}) (Version: 1.0.0 - LC Technology International)
Picasa 3 (HKLM\...\Picasa 3) (Version: 3.9 - Google, Inc.)
Pimero 2012 R1 (HKLM\...\Pimero 2012 R1_is1) (Version:  - soft-evolution)
PixiePack Codec Pack (HKLM\...\{A8D647C8-65AC-409F-B7B2-3C0FEE1A32F2}) (Version: 1.1.1200.0 - None)
Polipo 1.0.4.1 (HKLM\...\Polipo) (Version:  - )
PSPH10Pro (Version: 1.00.0000 - Corel Corporation) Hidden
PSPPContent (Version: 1.00.0000 - Corel Corporation) Hidden
PSPPRO_DCRAW (Version: 13.0.0 - Corel Corporation) Hidden
PureHD (Version: 1.6.1.109 - Corel Corporation) Hidden
PVSonyDll (Version: 1.00.0001 - NVIDIA Corporation) Hidden
QuickTime 7 (HKLM\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)
Radio.fx (HKLM\...\Tobit Radio.fx Server) (Version:  - Tobit.Software)
Radiotracker (HKLM\...\{1E863F44-2D2D-4BD7-B25B-EDA9FF622267}) (Version: 6.2.13700.0 - RapidSolution Software AG)
RealDownloader (Version: 1.3.3 - RealNetworks, Inc.) Hidden
RealNetworks - Microsoft Visual C++ 2008 Runtime (Version: 9.0 - RealNetworks, Inc) Hidden
RealNetworks - Microsoft Visual C++ 2010 Runtime (Version: 10.0 - RealNetworks, Inc) Hidden
RealPlayer (HKLM\...\RealPlayer 16.0) (Version: 16.0.3 - RealNetworks)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5910 - Realtek Semiconductor Corp.)
RealUpgrade 1.1 (Version: 1.1.0 - RealNetworks, Inc.) Hidden
Revo Uninstaller 1.95 (HKLM\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Rossmann Fotowelt Software 4.12.1 (HKLM\...\Rossmann Fotowelt Software) (Version: 4.12.1 - ORWO Net)
Samsung Kies (HKLM\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.6.0.13064_2 - Samsung Electronics Co., Ltd.)
Samsung Kies (Version: 2.6.0.13064_2 - Samsung Electronics Co., Ltd.) Hidden
Samsung Kies3 (HKLM\...\InstallShield_{88547073-C566-4895-9005-EBE98EA3F7C7}) (Version: 3.2.14113.3 - Samsung Electronics Co., Ltd.)
Samsung Kies3 (Version: 3.2.14113.3 - Samsung Electronics Co., Ltd.) Hidden
Samsung Story Album Viewer (HKLM\...\InstallShield_{698BBAD8-B116-495D-B879-0F07A533E57F}) (Version: 1.0.0.13054_1 - Samsung Electronics Co., Ltd.)
Samsung Story Album Viewer (Version: 1.0.0.13054_1 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.49.0 - SAMSUNG Electronics Co., Ltd.)
Schachmeister 2011 (HKLM\...\{4B5DFDB3-62F9-4F60-BBA8-797A1509EC66}) (Version: 11.0 - ChessBase)
Schachmeister 2011 (Version: 11.0 - ChessBase) Hidden
Seagate Manager Installer (HKLM\...\InstallShield_{E6F019F1-DFB6-4853-A87D-6E31624755A9}) (Version: 2.02.0109 - Seagate)
Seagate Manager Installer (Version: 2.02.0109 - Seagate) Hidden
Secunia PSI (3.0.0.9016) (HKLM\...\Secunia PSI) (Version: 3.0.0.9016 - Secunia)
Security Task Manager 1.8d (HKLM\...\Security Task Manager) (Version: 1.8d - Neuber Software)
Serif PhotoPlus X2 (HKLM\...\{FC935397-C56E-4EE3-B9BC-1F7F3EA6CE41}) (Version: 12.0.3.013 - Serif (Europe) Ltd)
Setup (Version: 1.6.1.109 - Corel Corporation) Hidden
Share (Version: 1.6.1.109 - Corel Corporation) Hidden
Sid Meier's Civilization 4 (HKLM\...\{CFBCE791-2D53-4FCE-B3FB-D6E01F4112E8}) (Version: 1.00.0000 - Firaxis Games)
Sid Meier's Civilization 4 (Version: 1.00.0000 - Firaxis Games) Hidden
Sierra Utilities (HKLM\...\Sierra Utilities) (Version:  - )
SiSoftware Sandra Lite 2015 (HKLM\...\{C3113E55-7BCB-4de3-8EBF-60E6CE6B2496}_is1) (Version: 21.10.2015.1 - SiSoftware)
Skype™ 6.11 (HKLM\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
SL-6640 Black Widow Flightstick (HKLM\...\InstallShield_{10D4F38B-5436-4673-B861-F301929B373B}) (Version: 3.1 - Joellenbeck GmbH)
SL-6640 Black Widow Flightstick (Version: 3.1 - Joellenbeck GmbH) Hidden
Soda PDF (HKLM\...\{4B6B2E2E-FE08-4EC5-9EE0-9B1D454AC995}) (Version: 1.2.26 - LULU Software)
Soda PDF 5 (HKLM\...\{DC25D68D-38AF-4768-83F2-680FD72285DF}) (Version: 5.1.192.10803 - LULU Software Limited)
SoftMaker Office 2008 (C:\Programme\SoftMaker Office 2008) (HKLM\...\sm-un1.u32) (Version:  - SoftMaker Software GmbH)
Soluto (HKLM\...\{CD616D0D-48E4-4B6E-AACA-76ABA3147057}) (Version: 1.3.729.0 - Soluto)
SopCast 3.9.3 (HKLM\...\SopCast) (Version: 3.9.3 - www.sopcast.com)
SpeedFan (remove only) (HKLM\...\SpeedFan) (Version:  - )
Spelling Dictionaries Support For Adobe Reader 9 (HKLM\...\{AC76BA86-7AD7-5464-3428-900000000004}) (Version: 9.0.0 - Adobe Systems Incorporated)
Spider Player 2.5.3 (HKLM\...\Spider Player_is1) (Version: 2.5.3.0 - VIT Software, LLC)
Startpage24 (HKLM\...\Startpage24) (Version:  - Link64)
SUPER © v2012.build.51 (April 7, 2012) Version v2012.build.51 (HKLM\...\{B93DCF58-AA57-41EC-8D69-B05C66C6312D}_is1) (Version: v2012.build.51 - eRightSoft)
SUPERAntiSpyware (HKLM\...\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}) (Version: 4.39.1002 - SUPERAntiSpyware.com)
swMSM (Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
TeraCopy 2.12 (HKLM\...\TeraCopy_is1) (Version:  - Code Sector Inc.)
Texas Hold ‘Em Poker Deluxe DEMO 1.0 (HKLM\...\{C88DD9B7-AC6C-412F-AE1A-ED7D7B9F1259}_is1) (Version: Texas Hold ‘Em Poker Deluxe DEMO - Zone 2 Media GmbH)
Texas Hold'em Poker (HKLM\...\{A8C8EF21-88F1-4845-A0BF-5B2D66B5DD33}_is1) (Version: 1.0 - rondomedia)
ThumbsPlus Version 2002-R (Standard-Edition) (HKLM\...\ThumbsPlus 2002) (Version:  - )
Tor 0.2.1.26 (HKLM\...\Tor) (Version:  - )
Total Commander (Remove or Repair) (HKLM\...\Totalcmd) (Version: 8.51a - Ghisler Software GmbH)
Trendpoker 3D - Texas Hold'em Poker - DEMO (HKLM\...\{E3F696A6-98D9-438E-B942-B498087C015B}_is1) (Version: 1.9 - BUFOproject)
TuneUp Utilities 2014 (de-DE) (Version: 14.0.1000.221 - TuneUp Software) Hidden
TuneUp Utilities 2014 (HKLM\...\TuneUp Utilities) (Version: 14.0.1000.221 - TuneUp Software)
TuneUp Utilities 2014 (Version: 14.0.1000.221 - TuneUp Software) Hidden
TuneUp Utilities Language Pack (de-DE) (Version: 10.0.4600.4 - TuneUp Software) Hidden
TuneUp Utilities Language Pack (de-DE) (Version: 12.0.3600.114 - TuneUp Software) Hidden
TuneUp Utilities Language Pack (de-DE) (Version: 13.0.4000.271 - TuneUp Software) Hidden
TuneUp Utilities Language Pack (de-DE) (Version: 9.0.6020.1 - TuneUp Software) Hidden
TurboFLOORPLAN Garten- & Landschaftsarchitekt (HKLM\...\InstallShield_{EC36B80D-3A0B-44D2-A066-9F346FE05D54}) (Version: 12.1 - IMSIDesign)
TVUPlayer 2.5.3.1 (HKLM\...\TVUPlayer) (Version: 2.5.3.1 - TVU networks)
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM\...\{90120000-001A-0407-0000-0000000FF1CE}_OMUI.de-de_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
Update Manager (Version: 4.60 - Corel Corporation) Hidden
Veetle TV (HKLM\...\Veetle TV) (Version: 0.9.19 - Veetle, Inc)
Vidalia 0.2.9 (HKLM\...\Vidalia) (Version:  - )
Video Download Capture Version 4.9.1 (HKLM\...\{3C9D008D-3716-4C3F-90CD-38ED57568FAB}_is1) (Version: 4.9.1 - APOWERSOFT LIMITED)
VIO (Version: 1.6.1.109 - Corel Corporation) Hidden
VLC media player (HKLM\...\VLC media player) (Version: 2.2.0 - VideoLAN)
WEB.DE Toolbar für Internet Explorer 8 (HKLM\...\1&1 Mail & Media GmbH Toolbar IE8) (Version: 1.2.20.0 - 1&1 Mail & Media GmbH)
WEB.DE Toolbar MSVC90 CRT (Version: 1.0.0 - 1&1 Mail & Media GmbH) Hidden
webcam 7 (HKLM\...\webcam 7) (Version: 0.9.9.43 - Moonware Studios)
Winamp (HKLM\...\Winamp) (Version: 5.666  - Nullsoft, Inc)
Windows Live Sync (HKLM\...\{76618402-179D-4699-A66B-D351C59436BC}) (Version: 14.0.8089.726 - Microsoft Corporation)
Windows Live-Uploadtool (HKLM\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
Windows Media Encoder 9 Series (HKLM\...\Windows Media Encoder 9) (Version:  - )
Windows Media Player Firefox Plugin (HKLM\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)
Windows Mobile Device Center Driver Update (HKLM\...\{E7044E25-3038-4A76-9064-344AC038043E}) (Version: 6.1.6965.0 - Microsoft Corporation)
Windows Mobile®-Gerätehandbuch (HKLM\...\Windows Mobile Device Handbook) (Version: 1.0 - Microsoft Corporation)
Windows Mobile-Gerätecenter (HKLM\...\{904CCF62-818D-4675-BC76-D37EB399F917}) (Version: 6.1.6965.0 - Microsoft Corporation)
WinHTTrack Website Copier 3.48-13 (HKLM\...\WinHTTrack Website Copier_is1) (Version: 3.48.13 - HTTrack)
WinZip (HKLM\...\WinZip) (Version:  - )
Xfire (remove only) (HKLM\...\Xfire) (Version:  - )
XMedia Recode 2.2.8.3 (HKLM\...\XMedia Recode) (Version: 2.2.8.3 - Sebastian Dörfler)
XnView 2.31 (HKLM\...\XnView_is1) (Version: 2.31 - Gougelet Pierre-e)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Haiopei\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{00EEBF57-477D-4084-9921-7AB3C2C9459D}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{0295691A-D674-4904-805C-BDFE165B771B}\localserver32 -> C:\Programme\SoftMaker Office 2008\TextMaker.exe (SoftMaker Software GmbH)
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{06EEE834-461C-42C2-8DCF-1502B527B1F9}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{078759D3-423B-48AD-AB6A-5638C2884DBE}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{08244EE6-92F0-47F2-9FC9-929BAA2E7235}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{0AF10CEC-2ECD-4B92-9581-34F6AE0637F3}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{0B91A74B-AD7C-4A9D-B563-29EEF9167172}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{0C15D503-D017-47CE-9016-7B3F978721CC}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{14074E0B-7216-4862-96E6-53CADA442A56}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{16F3DD56-1AF5-4347-846D-7C10C4192619}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{217FC9C0-3AEA-1069-A2DB-08002B30309D}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32 -> C:\Program Files\7-Zip\7-zip.dll (Igor Pavlov)
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{2916C86E-86A6-43FE-8112-43ABE6BF8DCC}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{30291A01-707C-11d0-B457-4446490043BF}\localserver32 -> C:\Programme\SoftMaker Office 2008\TextMaker.exe (SoftMaker Software GmbH)
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{35786D3C-B075-49B9-88DD-029876E11C01}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{3AD05575-8857-4850-9277-11B85BDB8E09}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{3D154A2D-D911-437E-A30C-5F56A9B7081D}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{3D1975AF-48C6-4F8E-A182-BE0E08FA86A9}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{40DD6E20-7C17-11CE-A804-00AA003CA9F6}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32 -> C:\Program Files\Microsoft Office\Office12\msohevi.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{49F371E1-8C5C-4D9C-9A3B-54A6827F513C}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{4DB26476-6787-4046-B836-E8412A9E8A27}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{603D3801-BD81-11D0-A3A5-00C04FD706EC}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{6311429E-2F1A-4777-880F-C7289FD10169}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{640167B4-59B0-47A6-B335-A6B3C0695AEA}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{693BE9C0-BEC3-11D2-B4C1-C33BBD3AD64B}\InprocServer32 -> C:\ProgramData\AllDup\FEShlExt.dll (Alex Yakovlev)
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{6B9228DA-9C15-419E-856C-19E768A13BDC}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{76D0CB12-7604-4048-B83C-1005C7DDC503}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{7B4A83B6-F704-4B77-8E3D-C6087E3A21D2}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{7BD29E01-76C1-11CF-9DD0-00A0C9034933}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{807C1E6C-1D00-453F-B920-B61BB7CDD997}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{82C588E7-E54B-408C-9F8C-6AF9ADF6F1E9}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{85BBD920-42A0-1069-A2E4-08002B30309D}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{896664F7-12E1-490F-8782-C0835AFD98FC}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{9113A02D-00A3-46B9-BC5F-9C04DADDD5D7}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{920E6DB1-9907-4370-B3A0-BAFC03D81399}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{942BC614-676C-464E-B384-D3202AAA02DA}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{99FD978C-D287-4F50-827F-B2C658EDA8E7}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{9CFC2DF3-6BA3-46EF-A836-E519E81F0EC4}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{A4A1A128-768F-41E0-BF75-E4FDDD701CBA}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{A70C977A-BF00-412C-90B7-034C51DA2439}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{A8005AF0-D6E8-48AF-8DFA-023B1CF660A7}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{AB968F1E-E20B-403A-9EB8-72EB0EB6797E}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{AE054212-3535-4430-83ED-D501AA6680E6}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{B056521A-9B10-425E-B616-1FCD828DB3B1}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{B155BDF8-02F0-451E-9A26-AE317CFD7779}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{B8967F85-58AE-4F46-9FB2-5D7904798F4B}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{bf608490-5373-11d0-8efb-4446490043bf}\localserver32 -> C:\Programme\SoftMaker Office 2008\TextMaker.exe (SoftMaker Software GmbH)
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{C529C7EF-A3AF-45F2-8A47-767B33AA5CC0}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{E88DCCE0-B7B3-11D1-A9F0-00AA0060FA31}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Haiopei\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{EDB5F444-CB8D-445A-A523-EC5AB6EA33C7}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{F81E9010-6EA4-11CE-A7FF-00AA003CA9F6}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Haiopei\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Haiopei\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Haiopei\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Haiopei\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Haiopei\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Haiopei\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Haiopei\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Haiopei\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{FE841493-835C-4FA3-B6CC-B4B2D4719848}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{FF393560-C2A7-11CF-BFF4-444553540000}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{FFE2A43C-56B9-4BF5-9A79-CC6D4285608A}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\_ocster_backup_\AppData\Roaming\Dropbox\bin\Dropbox.exe /autoplay No File
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{00EEBF57-477D-4084-9921-7AB3C2C9459D}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{0295691A-D674-4904-805C-BDFE165B771B}\localserver32 -> C:\Programme\SoftMaker Office 2008\TextMaker.exe (SoftMaker Software GmbH)
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{039B2CA5-3B41-4D93-AD77-47D3293FC5CB}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{06EEE834-461C-42C2-8DCF-1502B527B1F9}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{078759D3-423B-48AD-AB6A-5638C2884DBE}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{08244EE6-92F0-47F2-9FC9-929BAA2E7235}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{0AF10CEC-2ECD-4B92-9581-34F6AE0637F3}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{0B91A74B-AD7C-4A9D-B563-29EEF9167172}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{0C15D503-D017-47CE-9016-7B3F978721CC}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{14074E0B-7216-4862-96E6-53CADA442A56}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{16C8C46E-C811-4977-BF0A-B5CC1FA78D95}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{16F3DD56-1AF5-4347-846D-7C10C4192619}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{20C62CA0-15DA-101B-B9A8-444553540000}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{20C62CAB-15DA-101B-B9A8-444553540000}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{217FC9C0-3AEA-1069-A2DB-08002B30309D}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32 -> C:\Program Files\7-Zip\7-zip.dll (Igor Pavlov)
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{2916C86E-86A6-43FE-8112-43ABE6BF8DCC}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{30291A01-707C-11d0-B457-4446490043BF}\localserver32 -> C:\Programme\SoftMaker Office 2008\TextMaker.exe (SoftMaker Software GmbH)
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{35786D3C-B075-49B9-88DD-029876E11C01}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{3AD05575-8857-4850-9277-11B85BDB8E09}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{3D154A2D-D911-437E-A30C-5F56A9B7081D}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{3D1975AF-48C6-4F8E-A182-BE0E08FA86A9}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{40DD6E20-7C17-11CE-A804-00AA003CA9F6}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32 -> C:\Program Files\Microsoft Office\Office12\msohevi.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{42481700-CF3C-4D05-8EC6-F9A1C57E8DC0}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{4516CEE1-97DA-4030-A444-2D8E296B96B6}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{49F371E1-8C5C-4D9C-9A3B-54A6827F513C}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{4DB26476-6787-4046-B836-E8412A9E8A27}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{603D3801-BD81-11D0-A3A5-00C04FD706EC}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{6311429E-2F1A-4777-880F-C7289FD10169}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{640167B4-59B0-47A6-B335-A6B3C0695AEA}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{693BE9C0-BEC3-11D2-B4C1-C33BBD3AD64B}\InprocServer32 -> C:\ProgramData\AllDup\FEShlExt.dll (Alex Yakovlev)
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{6B9228DA-9C15-419E-856C-19E768A13BDC}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{6F237DF9-9DDB-47AD-B218-400D54C286AD}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{76D0CB12-7604-4048-B83C-1005C7DDC503}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{7B4A83B6-F704-4B77-8E3D-C6087E3A21D2}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{7BD29E01-76C1-11CF-9DD0-00A0C9034933}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{807C1E6C-1D00-453F-B920-B61BB7CDD997}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{80A95F12-94C2-4B1D-8AE3-F0CBE5E96E85}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{82C588E7-E54B-408C-9F8C-6AF9ADF6F1E9}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{85BBD920-42A0-1069-A2E4-08002B30309D}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{896664F7-12E1-490F-8782-C0835AFD98FC}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{9113A02D-00A3-46B9-BC5F-9C04DADDD5D7}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{920E6DB1-9907-4370-B3A0-BAFC03D81399}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{942BC614-676C-464E-B384-D3202AAA02DA}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{99FD978C-D287-4F50-827F-B2C658EDA8E7}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{9CFC2DF3-6BA3-46EF-A836-E519E81F0EC4}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{A0359AE6-F410-4425-A975-684AAB785ABD}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{A4A1A128-768F-41E0-BF75-E4FDDD701CBA}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{A70C977A-BF00-412C-90B7-034C51DA2439}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{A8005AF0-D6E8-48AF-8DFA-023B1CF660A7}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{AB968F1E-E20B-403A-9EB8-72EB0EB6797E}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{AE054212-3535-4430-83ED-D501AA6680E6}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{B056521A-9B10-425E-B616-1FCD828DB3B1}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{B155BDF8-02F0-451E-9A26-AE317CFD7779}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{B8967F85-58AE-4F46-9FB2-5D7904798F4B}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{BB1AE0D0-634E-11CF-8996-00AA00688B10}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{BB1AE0D1-634E-11CF-8996-00AA00688B10}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{BB6410D8-F879-4184-9C5C-6A02D16AE0B3}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{bf608490-5373-11d0-8efb-4446490043bf}\localserver32 -> C:\Programme\SoftMaker Office 2008\TextMaker.exe (SoftMaker Software GmbH)
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{C529C7EF-A3AF-45F2-8A47-767B33AA5CC0}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{CA1073A2-5F3F-4445-8E5E-7109BDCEDDBE}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{D0D38C6E-BF64-4C42-840D-3E0019D9F7A6}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{D5A55D2D-C59D-42C3-A5BF-4C08EEE74339}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{E88DCCE0-B7B3-11D1-A9F0-00AA0060FA31}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{EDB5F444-CB8D-445A-A523-EC5AB6EA33C7}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{F81E9010-6EA4-11CE-A7FF-00AA003CA9F6}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\_ocster_backup_\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll No File
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\_ocster_backup_\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll No File
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\_ocster_backup_\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll No File
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\_ocster_backup_\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll No File
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\_ocster_backup_\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll No File
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\_ocster_backup_\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll No File
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\_ocster_backup_\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll No File
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\_ocster_backup_\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll No File
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{FE841493-835C-4FA3-B6CC-B4B2D4719848}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{FF393560-C2A7-11CF-BFF4-444553540000}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{FFE2A43C-56B9-4BF5-9A79-CC6D4285608A}\InprocServer32 -> No File Path

==================== Restore Points  =========================


==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:04 - 2011-06-25 01:23 - 00435366 ____N C:\Windows\system32\Drivers\etc\hosts
127.0.0.1	www.007guard.com
127.0.0.1	007guard.com
127.0.0.1	008i.com
127.0.0.1	www.008k.com
127.0.0.1	008k.com
127.0.0.1	www.00hq.com
127.0.0.1	00hq.com
127.0.0.1	010402.com
127.0.0.1	www.032439.com
127.0.0.1	032439.com
127.0.0.1	www.0scan.com
127.0.0.1	0scan.com
127.0.0.1	1000gratisproben.com
127.0.0.1	www.1000gratisproben.com
127.0.0.1	1001namen.com
127.0.0.1	www.1001namen.com
127.0.0.1	100888290cs.com
127.0.0.1	www.100888290cs.com
127.0.0.1	www.100sexlinks.com
127.0.0.1	100sexlinks.com
127.0.0.1	10sek.com
127.0.0.1	www.10sek.com
127.0.0.1	www.1-2005-search.com
127.0.0.1	1-2005-search.com
127.0.0.1	123fporn.info
127.0.0.1	www.123fporn.info
127.0.0.1	123haustiereundmehr.com
127.0.0.1	www.123haustiereundmehr.com
127.0.0.1	123moviedownload.com

There are 1000 more lines.


==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0B34F9DC-3AB6-4932-AB64-2DB37F624CFA} - System32\Tasks\{CE569BE0-C271-4DEA-A332-12544FB191A2} => Firefox.exe 
Task: {1E0D205C-D572-4F8B-9885-53257A8D9E83} - System32\Tasks\GU5SkipUAC => C:\Program Files\Glary Utilities 5\Integrator.exe [2015-03-02] (Glarysoft Ltd)
Task: {1E64C155-D2F2-4AC2-A7B1-4BCA4DEC1AAD} - System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-2886736790-1064491100-3460348771-1000 => C:\Program Files\RealNetworks\RealDownloader\realupgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {28ED0DE1-E891-4D70-A9FF-7D38681FD4FB} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-2886736790-1064491100-3460348771-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {2F99C29F-A347-445E-A166-05D74CCFE0EC} - System32\Tasks\{0C4AFE2E-43CB-4B15-B34C-711558BE554A} => Firefox.exe 
Task: {320675B3-4A94-4A2C-A637-EF1CCEA0EE22} - System32\Tasks\{8B37E9A7-EF86-4CA1-A04B-B2F5324037D6} => Firefox.exe 
Task: {3519FBB7-A099-4335-B681-E7192DA2D1FC} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-03] (Adobe Systems Incorporated)
Task: {3801F3D3-3D23-4E95-8D0D-30AB5A0BFD00} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-22] (Google Inc.)
Task: {53247EFD-3E87-486D-9A6E-DD75B7FC5D3F} - System32\Tasks\CCleanerSkipUAC => C:\Programme\CCleaner\CCleaner.exe [2014-12-12] (Piriform Ltd)
Task: {565CCAD8-A117-44FC-A596-57D05DC20F9D} - System32\Tasks\{BD63E6D8-90E4-486B-BA8D-197E0762A552} => pcalua.exe -a "C:\Users\Haiopei\Downloads\PC\DVD Cover\setup.exe" -d "C:\Users\Haiopei\Downloads\PC\DVD Cover"
Task: {5761DAC6-2589-45D3-B989-0ACBB627F055} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 => C:\Program Files\TuneUp Utilities 2014\OneClick.exe [2013-12-18] (TuneUp Software)
Task: {595A97A6-3B81-4EAE-B080-E086151D554C} - System32\Tasks\GlaryInitialize 5 => C:\Program Files\Glary Utilities 5\Initialize.exe [2015-03-02] (Glarysoft Ltd)
Task: {5AF7E931-A7C5-4053-BF87-23522E7DF791} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {5BEB57AB-151D-42AD-A0C0-A9309D0F671C} - System32\Tasks\{BAA3C6F7-921C-409C-86FA-BBCEEFCB8B3A} => C:\Programme\Spybot - Search &amp; Destroy\SpybotSD.exe
Task: {5FBCE2D2-05DC-4DFB-9726-9697CD57A32B} - System32\Tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-2886736790-1064491100-3460348771-1000 => C:\Program Files\RealNetworks\RealDownloader\recordingmanager.exe [2013-08-14] (RealNetworks, Inc.)
Task: {62A1E959-DBF8-4401-A445-00641BD05D7A} - System32\Tasks\{45E57954-8759-4AC2-B31E-F31729B16E84} => C:\Program Files\Skype\\Phone\Skype.exe [2013-11-14] (Skype Technologies S.A.)
Task: {69854816-4EFC-43D0-AF8E-924FE1B1405D} - System32\Tasks\Opera scheduled Autoupdate 1410124067 => C:\Program Files\Opera\launcher.exe [2014-09-25] (Opera Software)
Task: {6DBC62A5-48B7-49A5-9F42-F8F7EB3DBED7} - System32\Tasks\{EA559904-6759-4EA9-B514-1A7F44DDEFF4} => C:\Programme\Spybot - Search &amp; Destroy\SpybotSD.exe
Task: {7011E7E9-40E5-4CD8-939E-BD7D324A89DD} - System32\Tasks\{70F35CB7-4C4B-4B45-B853-07255C71735E} => pcalua.exe -a E:\Setup.exe -d E:\
Task: {7E781DDA-E24C-4F15-8B06-97DD249543C4} - System32\Tasks\Microsoft_Hardware_Launch_IPoint_exe => c:\Program Files\Microsoft IntelliPoint\IPoint.exe [2010-07-21] (Microsoft Corporation)
Task: {82C9BF33-E362-467C-9DCD-D5FB842EC0D0} - System32\Tasks\{889FF1A2-B3C4-4AE4-8B33-797BA67A5B39} => Firefox.exe hxxp://ui.skype.com/ui/0/5.0.0.152/de/eula
Task: {895887F7-46E3-423B-9970-979A45ACBA0D} - System32\Tasks\{726F3EC3-83FC-48DB-919B-5B29331C6B81} => pcalua.exe -a C:\Users\Haiopei\Downloads\3DTexasHoldemPoker10.exe -d C:\Users\Haiopei\Downloads
Task: {8F1C4A3D-8997-4887-92C2-1B768E24D0F6} - System32\Tasks\Real Player-Online-Aktualisierungsprogramm => C:\Program Files\Real\RealPlayer\Update\realsched.exe [2015-01-12] (RealNetworks, Inc.)
Task: {99C37699-128E-4BC6-87AB-3C3C8BDBBDA6} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-2886736790-1064491100-3460348771-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {B9F2BC8A-D5CD-48C7-8CD3-29FC97F5BE6D} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-2886736790-1064491100-3460348771-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {C0237CD9-CBBC-4EFE-BED6-9F0A0ADEA149} - System32\Tasks\{FA71B14D-52F1-4343-AF8D-51241208EF24} => Firefox.exe 
Task: {C0A774E7-DBDD-4CD7-9B2F-CD6E027A55DE} - System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-2886736790-1064491100-3460348771-1000 => C:\Program Files\RealNetworks\RealDownloader\realupgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {C14937D5-7F84-4A0E-BEFC-A81FFF81B8E3} - System32\Tasks\{57069C1B-2D1E-4BD8-BECF-7BB823C0469E} => C:\Programme\PaintShop Photo Pro\Corel PaintShop Photo Pro\X3\PSPClassic\Corel Paint Shop Pro Photo.exe [2009-12-30] (Corel, Inc.)
Task: {C53A5B16-F5FB-4D90-8644-C8988DB71FDF} - System32\Tasks\Java Update Scheduler => C:\Program Files\Common Files\Java\Java Update\jusched.exe [2014-07-25] (Oracle Corporation)
Task: {C55BE85D-CAFF-479C-92EA-9AD7ED8AF31A} - System32\Tasks\{34E58C4B-57F9-428F-8546-F5B7E49381DC} => pcalua.exe -a C:\Users\Haiopei\Downloads\smartControlPremium_Setup.exe -d C:\Users\Haiopei\Downloads
Task: {C8B29618-7164-429F-8832-B95B476EC765} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-22] (Google Inc.)
Task: {E3D1572B-272F-45C8-B46E-324BE26B6B91} - System32\Tasks\hcdll2_ex_Win32 => C:\Program Files\Hardcopy\hcdll2_ex_Win32.exe [2011-03-18] ()
Task: {E42DA9F0-7A04-48B5-BCDB-E7792F8D8CF5} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-03-07] (Adobe Systems Incorporated)
Task: {E4A24687-A384-43C3-B54C-3DF68AAD26B5} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-2886736790-1064491100-3460348771-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {F5038AB4-4DC4-4BAF-BEDC-2BFDED2886E6} - System32\Tasks\PCCT - MAGIX AG => C:\Program Files\MAGIX\PC_Check_Tuning_Free_2011\MxTray.exe [2010-11-08] ()
Task: {F5EE8BD0-C7F1-4BEA-A023-8D378074F0B5} - System32\Tasks\{0754E28A-0AB7-4ED1-BCE9-F601C6F7D6E0} => C:\Program Files\Firaxis Games\Sid Meier's Civilization 4\Civilization4.exe [2005-10-18] (Firaxis Games)
Task: {F67ECC62-57C7-4593-B6E4-AFDE0175A07A} - System32\Tasks\ArcSoft Connect Daemon => C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [2010-10-27] (ArcSoft Inc.)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GlaryInitialize 5.job => C:\Program Files\Glary Utilities 5\Initialize.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\PCCT - MAGIX AG.job => C:\Program Files\MAGIX\PC_Check_Tuning_Free_2011\MxTray.exe

==================== Loaded Modules (whitelisted) ==============

2010-04-11 21:48 - 2009-06-21 22:26 - 00305664 _____ () C:\Program Files\TeraCopy\TeraCopyExt.dll
2010-04-11 21:48 - 2009-07-13 19:50 - 00325120 _____ () C:\Program Files\TeraCopy\TeraCopy.dll
2010-05-22 13:08 - 2013-07-18 13:50 - 01716224 _____ () C:\Programme\XnView\ShellEx\XnViewShellExt.dll
2009-12-30 17:48 - 2009-12-30 17:48 - 00102032 _____ () c:\Programme\PaintShop Photo Pro\Corel PaintShop Photo Pro\X3\PSPClassic\PSPContextMenu.dll
2011-01-14 12:36 - 2011-01-14 12:36 - 00018216 _____ () c:\Programme\Ocster Backup\bin\backupService-ox.exe
2011-01-14 12:36 - 2011-01-14 12:36 - 00071464 _____ () c:\Programme\Ocster Backup\bin\backupServiceLib.dll
2011-01-14 12:36 - 2011-01-14 12:36 - 05350696 _____ () c:\Programme\Ocster Backup\bin\backupCore.dll
2011-01-14 12:36 - 2011-01-14 12:36 - 00131368 _____ () c:\Programme\Ocster Backup\bin\netutil.dll
2011-01-14 12:36 - 2011-01-14 12:36 - 01795880 _____ () c:\Programme\Ocster Backup\bin\ox.dll
2011-01-14 12:36 - 2011-01-14 12:36 - 00037672 _____ () c:\Programme\Ocster Backup\bin\lzmaUtil.dll
2010-12-29 12:23 - 2010-12-29 12:23 - 00040960 _____ () c:\Programme\Ocster Backup\bin\lzma.dll
2011-01-14 12:36 - 2011-01-14 12:36 - 00294696 _____ () c:\Programme\Ocster Backup\bin\twirl.dll
2010-06-23 15:20 - 2010-06-23 15:20 - 00061952 _____ () c:\Programme\Ocster Backup\bin\zdll.dll
2011-01-14 12:36 - 2011-01-14 12:36 - 00242984 _____ () c:\Programme\Ocster Backup\bin\tomb.dll
2011-01-14 12:36 - 2011-01-14 12:36 - 00076584 _____ () c:\Programme\Ocster Backup\bin\scoolite.dll
2010-12-29 12:22 - 2010-12-29 12:22 - 00438784 _____ () c:\Programme\Ocster Backup\bin\sqlite.dll
2011-01-14 12:36 - 2011-01-14 12:36 - 00106280 _____ () c:\Programme\Ocster Backup\bin\deemon.dll
2007-06-05 13:20 - 2007-06-05 13:20 - 00177704 _____ () C:\Windows\system32\PSIService.exe
2012-01-01 19:52 - 2011-03-18 08:11 - 00031744 _____ () C:\Program Files\Hardcopy\hcdll2_ex_Win32.exe
2013-08-14 15:19 - 2013-08-14 15:19 - 00039056 _____ () C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe
2013-12-18 10:01 - 2013-12-18 10:01 - 00608056 _____ () C:\Program Files\TuneUp Utilities 2014\avgreplibx.dll
2009-11-16 14:20 - 2009-10-02 13:18 - 00058880 _____ () C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2015-01-11 13:53 - 2013-05-20 04:01 - 00627672 _____ () C:\Program Files\CyberLink\Power2Go9\CLMediaLibrary.dll
2013-05-20 11:02 - 2013-05-20 11:02 - 00016856 _____ () C:\Program Files\CyberLink\Power2Go9\CLMLSvcPS.dll
2010-06-30 10:23 - 2012-04-17 18:36 - 00063488 _____ () C:\Users\Haiopei\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10006.dll
2010-06-30 10:23 - 2010-06-30 10:23 - 00052224 _____ () C:\Users\Haiopei\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2011-01-15 13:47 - 2015-03-07 10:33 - 00052736 _____ () C:\Users\Haiopei\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10007.dll
2014-12-12 23:24 - 2014-12-12 23:24 - 00047104 _____ () C:\Programme\CCleaner\lang\lang-1031.dll
2015-01-11 13:53 - 2014-08-11 07:35 - 00866056 _____ () C:\Program Files\CyberLink\Power2Go9\UNO.dll
2015-01-11 13:53 - 2014-03-06 10:30 - 09488856 _____ () C:\Program Files\CyberLink\Power2Go9\Language\DEU\P2GRC.dll
2015-01-11 13:53 - 2014-08-11 07:35 - 00175880 _____ () C:\Program Files\CyberLink\Power2Go9\CLVistaAudioMixer.dll
2015-01-10 12:45 - 2012-04-22 11:37 - 00040448 _____ () C:\Program Files\CPUID\PC Wizard 2013\Language\pcwl0407.dll
2015-01-10 12:45 - 2010-03-27 12:37 - 00028160 _____ () C:\Program Files\CPUID\PC Wizard 2013\pcwizdx.DLL
2015-02-08 23:00 - 2015-03-07 19:54 - 16852144 _____ () C:\Windows\system32\Macromed\Flash\NPSWF32_16_0_0_305.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SolutoService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MSIServer => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SolutoService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\vsmon => ""="Service"

==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)



HKU\S-1-5-21-2886736790-1064491100-3460348771-1000\Software\Classes\.exe:  =>  <===== ATTENTION!

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2886736790-1064491100-3460348771-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Haiopei\AppData\Roaming\Mozilla\Firefox\Desktop-Hintergrund.bmp
HKU\S-1-5-21-2886736790-1064491100-3460348771-1002\Control Panel\Desktop\\Wallpaper -> C:\Windows\Web\Wallpaper\MEDION\Wallpaper.jpg
DNS Servers: 192.168.2.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Radio.fx.LNK => C:\Windows\pss\Radio.fx.LNK.CommonStartup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: Ocster Backup => "C:\Programme\Ocster Backup\bin\backupClient-ox.exe" --hidden
MSCONFIG\startupreg: RfxSrvTray => "C:\Program Files\Tobit Radio.fx\Client\rfx-tray.exe"
MSCONFIG\startupreg: WinampAgent => "C:\Program Files\Winamp\winampa.exe"

==================== Accounts: =============================

Administrator (S-1-5-21-2886736790-1064491100-3460348771-500 - Administrator - Disabled)
Gast (S-1-5-21-2886736790-1064491100-3460348771-501 - Limited - Disabled)
Haiopei (S-1-5-21-2886736790-1064491100-3460348771-1000 - Administrator - Enabled) => C:\Users\Haiopei
_ocster_backup_ (S-1-5-21-2886736790-1064491100-3460348771-1002 - Administrator - Enabled) => C:\Users\_ocster_backup_

==================== Faulty Device Manager Devices =============

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (03/07/2015 01:15:34 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (03/07/2015 01:14:58 PM) (Source: SideBySide) (EventID: 63) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "*" des "language"-Attributs im assemblyIdentity-Element ist ungültig.

Error: (03/07/2015 01:09:47 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"1".
Die abhängige Assemblierung "Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (03/07/2015 01:09:47 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1".
Die abhängige Assemblierung "Microsoft.VC80.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (03/07/2015 01:08:11 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (03/07/2015 01:07:08 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"1".
Die abhängige Assemblierung "Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (03/07/2015 01:07:03 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"1".
Die abhängige Assemblierung "Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (03/07/2015 01:07:02 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"1".
Die abhängige Assemblierung "Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (03/07/2015 01:06:08 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "rpshellextension.1.0,language="&#x2a;",type="win32",version="1.0.0.0"1".
Die abhängige Assemblierung "rpshellextension.1.0,language="&#x2a;",type="win32",version="1.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (03/06/2015 03:04:43 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".


System errors:
=============
Error: (03/07/2015 03:53:14 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Adobe Acrobat Update Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (03/07/2015 02:22:35 PM) (Source: volsnap) (EventID: 36) (User: )
Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.

Error: (03/07/2015 10:34:04 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
Soluto

Error: (03/07/2015 10:32:52 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "atksgt" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1275

Error: (03/07/2015 10:32:52 AM) (Source: Application Popup) (EventID: 875) (User: )
Description: Treiber atksgt.sys konnte nicht geladen werden.

Error: (03/06/2015 11:34:15 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Protexis Licensing V2" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (03/06/2015 08:32:08 PM) (Source: Service Control Manager) (EventID: 7032) (User: )
Description: Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden des Dienstes "Windows-Verwaltungsinstrumentation" Korrekturmaßnahmen (Neustart des Diensts) durchzuführen, ist fehlgeschlagen. Fehler: 
%%1056

Error: (03/06/2015 08:31:51 PM) (Source: Service Control Manager) (EventID: 7032) (User: )
Description: Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden des Dienstes "Programmkompatibilitäts-Assistent-Dienst" Korrekturmaßnahmen (Neustart des Diensts) durchzuführen, ist fehlgeschlagen. Fehler: 
%%1056

Error: (03/06/2015 08:31:20 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Adobe Acrobat Update Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (03/06/2015 08:30:51 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Driver Foundation - Benutzermodus-Treiberframework" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.


Microsoft Office Sessions:
=========================
Error: (04/26/2012 08:02:00 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6612.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 72 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (04/26/2012 07:57:32 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6612.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 35 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (03/03/2010 06:00:24 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 341 seconds with 0 seconds of active time.  This session ended with a crash.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i3 CPU 530 @ 2.93GHz
Percentage of memory in use: 51%
Total physical RAM: 3063.11 MB
Available physical RAM: 1498.21 MB
Total Pagefile: 6124.52 MB
Available Pagefile: 3461.21 MB
Total Virtual: 2047.88 MB
Available Virtual: 1902.36 MB

==================== Drives ================================

Drive c: (Boot) (Fixed) (Total:910.41 GB) (Free:417.94 GB) NTFS
Drive d: (Recover) (Fixed) (Total:20 GB) (Free:11.61 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: F98D6E74)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=910.4 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=20 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=1 GB) - (Type=12)

==================== End Of Log ============================

Hallo,
schon mal vielen Dank für die schnelle Rückfrage.
Ich habe sonst keine scans mehr vorliegen.
Gruss Ernst

cosinus · 07.03.2015, 23:51

Warum ist auf dem Rechner nur ein 32-Bit-Windows drauf? Die Hardware ist aktuell....

Haiopei · 08.03.2015, 02:33

Es handelt sich um einen Medion PC der mit dem 32 bit Windows 7 ausgeliefert wurde.
Das dumme ist natürlich die nur sehr eingeschränkte Nutzung von RAM.
Bisher bin ich davon ausgegangen, dass das System so reicht und ein Umstieg auf 64bit nicht nötig ist.

cosinus · 08.03.2015, 15:29

Da hat der Hersteller aber Mist gebaut...liefert einen Rechner mit 4 GiB RAM nur mit einem 32-Bit-Windows aus

Ich hätte ja an deiner Stelle das Ding gleich geplättest und ein 64-Bit-Windows neu installiert.

Haiopei · 08.03.2015, 17:04

Da gebe ich Dir völlig recht; aber bisher hat so wirklich gereicht.
Das mit dem Umstieg ist eine natürlich eine künftige Option.
Sorgt der von MBAM gefundene "PUP" für eine Gefahr? Hat sich da noch mehr im System eingenistet.
Was soll ich tun?
Gruß

cosinus · 08.03.2015, 17:09

Adware/Junkware/Toolbars entfernen

Alte Versionen von adwCleaner und falls vorhanden JRT vorher löschen, danach neu runterladen auf den Desktop!
Virenscanner jetzt vor dem Einsatz dieser Tools bitte komplett deaktivieren!

1. Schritt: adwCleaner

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

2. Schritt: JRT - Junkware Removal Tool

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

3. Schritt: Frisches Log mit FRST

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Haiopei · 08.03.2015, 18:25

Code:

ATTFilter

# AdwCleaner v4.111 - Bericht erstellt 08/03/2015 um 18:05:41
# Aktualisiert 18/02/2015 von Xplode
# Datenbank : 2015-03-05.1 [Server]
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (x86)
# Benutzername : Haiopei - HAIOPEI-PC
# Gestarted von : C:\Users\Haiopei\Desktop\AdwCleaner_4.111.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\SecTaskMan
Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FLV Player
Ordner Gelöscht : C:\Program Files\FLV Player
Ordner Gelöscht : C:\Users\Haiopei\AppData\Roaming\pdfforge

***** [ Geplante Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\systweak
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\B696D3C37BD0D6C33A65D38BEC459181
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Installer\Features\B696D3C37BD0D6C33A65D38BEC459181
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Installer\Products\B696D3C37BD0D6C33A65D38BEC459181
Daten Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - <-loopback>

***** [ Internetbrowser ] *****

-\\ Internet Explorer v11.0.9600.17631


-\\ Mozilla Firefox v36.0.1 (x86 de)


-\\ Google Chrome v40.0.2214.115

[C:\Users\Haiopei\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://isearch.avg.com/search?cmpid=&q={searchTerms}&sap=hp&lang=de&mid=454bb8583df047d0825e9128c080d4ef-69f08f21f8c71a4745de92076cea4d25bd309433&cid=%7BB0CA9219-7A62-4AEB-BED4-64E2332EC6B9%7D&v=18.0.5.292&ds=pd011&d=2012-10-01+20%3A07%3A02&pr=sa&snd=hp&sap_acp=1&ctc=+&pid=avg&sg=0

-\\ Opera v24.0.1558.64

[C:\Users\Haiopei\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://isearch.avg.com/search?cmpid=&q={searchTerms}&sap=hp&lang=de&mid=454bb8583df047d0825e9128c080d4ef-69f08f21f8c71a4745de92076cea4d25bd309433&cid=%7BB0CA9219-7A62-4AEB-BED4-64E2332EC6B9%7D&v=18.0.5.292&ds=pd011&d=2012-10-01+20%3A07%3A02&pr=sa&snd=hp&sap_acp=1&ctc=+&pid=avg&sg=0

*************************

AdwCleaner[R0].txt - [131669 Bytes] - [25/03/2014 18:26:54]
AdwCleaner[R1].txt - [1551 Bytes] - [25/03/2014 18:52:29]
AdwCleaner[R2].txt - [1611 Bytes] - [26/03/2014 18:07:04]
AdwCleaner[R3].txt - [1353 Bytes] - [27/03/2014 16:40:15]
AdwCleaner[R4].txt - [10076 Bytes] - [11/01/2015 22:07:33]
AdwCleaner[R5].txt - [10138 Bytes] - [11/01/2015 22:55:23]
AdwCleaner[R6].txt - [329 Bytes] - [08/03/2015 17:56:35]
AdwCleaner[R7].txt - [2634 Bytes] - [08/03/2015 18:00:46]
AdwCleaner[S0].txt - [128905 Bytes] - [25/03/2014 18:29:12]
AdwCleaner[S1].txt - [1257 Bytes] - [26/03/2014 18:08:05]
AdwCleaner[S2].txt - [1414 Bytes] - [27/03/2014 16:42:23]
AdwCleaner[S3].txt - [11630 Bytes] - [11/01/2015 23:10:24]
AdwCleaner[S4].txt - [2945 Bytes] - [08/03/2015 18:05:41]

########## EOF - C:\AdwCleaner\AdwCleaner[S4].txt - [3004  Bytes] ##########

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.3 (03.01.2015:1)
OS: Windows 7 Home Premium x86
Ran by Haiopei on 08.03.2015 at 18:19:13,99
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{16C8C46E-C811-4977-BF0A-B5CC1FA78D95}
Successfully deleted: [Registry Key] "hkey_current_user\software\microsoft\internet explorer\low rights\elevationpolicy\{a5aa24ea-11b8-4113-95ae-9ed71deaf12a}"
Successfully deleted: [Registry Key] "hkey_local_machine\software\classes\installer\upgradecodes\f928123a039649549966d4c29d35b1c9"



~~~ Files



~~~ Folders



~~~ FireFox

Emptied folder: C:\Users\Haiopei\AppData\Roaming\mozilla\firefox\profiles\onps37a9.default-1417907599268\minidumps [25 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 08.03.2015 at 18:21:07,67
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 08-03-2015 03
Ran by Haiopei (administrator) on HAIOPEI-PC on 08-03-2015 18:22:18
Running from C:\Users\Haiopei\Desktop
Loaded Profiles: Haiopei & _ocster_backup_ (Available profiles: Haiopei & _ocster_backup_)
Platform: Microsoft Windows 7 Home Premium  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(ArcSoft Inc.) C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe
(MAGIX AG) C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe
(Firebird Project) C:\Program Files\Firebird\Firebird_2_1\bin\fbguard.exe
(Teruten) C:\Windows\System32\FsUsbExService.Exe
() C:\Program Files\Hardcopy\hcdll2_ex_Win32.exe
() C:\Program Files\Ocster Backup\bin\backupService-ox.exe
() C:\Windows\System32\PSIService.exe
(Protexis Inc.) C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
() C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe
(DEVGURU Co., LTD.) C:\Program Files\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files\Microsoft IntelliPoint\ipoint.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(CyberLink) C:\Program Files\CyberLink\Power2Go9\CLMLSvc_P2G9.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Firebird Project) C:\Program Files\Firebird\Firebird_2_1\bin\fbserver.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner.exe
(Microsoft Corporation) C:\Windows\System32\taskmgr.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe
(Thisisu) C:\Users\Haiopei\Desktop\JRT.exe
(Microsoft Corporation) C:\Windows\System32\cmd.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [IntelliPoint] => c:\Program Files\Microsoft IntelliPoint\ipoint.exe [1797008 2010-07-21] (Microsoft Corporation)
HKLM\...\Run: [] => [X]
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [703280 2015-03-04] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [COMPUTERBILD-Abzockschutz] => C:\Program Files\COMPUTERBILD-Abzockschutz\bin\COMPUTERBILD-Abzockschutz.exe [537664 2014-06-19] (J3S GmbH)
HKLM\...\Run: [CLMLServer_For_P2G9] => C:\Program Files\CyberLink\Power2Go9\CLMLSvc_P2G9.exe [110344 2014-08-11] (CyberLink)
HKLM\...\Run: [Avira Systray] => C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe [127792 2015-02-12] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-21-2886736790-1064491100-3460348771-1000\...\Run: [SUPERAntiSpyware] => C:\Program Files\SUPERAntiSpyware.exe [2403568 2010-06-07] (SUPERAntiSpyware.com)
HKU\S-1-5-21-2886736790-1064491100-3460348771-1000\...\Run: [GoogleRadar] => C:\Programme\GoogleClean\GoogleRadar.exe [1540096 2013-07-05] ()
HKU\S-1-5-21-2886736790-1064491100-3460348771-1000\...\Run: [GUDelayStartup] => C:\Program Files\Glary Utilities 5\StartupManager.exe [37152 2015-03-02] (Glarysoft Ltd)
HKU\S-1-5-21-2886736790-1064491100-3460348771-1000\...\Run: [CCleaner Monitoring] => C:\Programme\CCleaner\CCleaner.exe [5489944 2014-12-12] (Piriform Ltd)
HKU\S-1-5-21-2886736790-1064491100-3460348771-1000\...\Run: [Power2GoExpress9] => C:\Program Files\CyberLink\Power2Go9\Power2GoExpress9.exe [2397448 2014-08-11] (CyberLink Corp.)
HKU\S-1-5-21-2886736790-1064491100-3460348771-1000\...\Policies\Explorer: [NoDriveTypeAutoRun] 0x00000000
HKU\S-1-5-21-2886736790-1064491100-3460348771-1000\...\MountPoints2: {4291fe7b-8b40-11df-9bd4-406186643d1c} - I:\setup_vmc_lite.exe /checkApplicationPresence
HKU\S-1-5-21-2886736790-1064491100-3460348771-1000\...\MountPoints2: {78a9f7b3-73af-11df-b30e-406186643d1c} - I:\setup_vmc_lite.exe /checkApplicationPresence
HKU\S-1-5-21-2886736790-1064491100-3460348771-1000\...\MountPoints2: {78a9f7c4-73af-11df-b30e-406186643d1c} - I:\setup_vmc_lite.exe /checkApplicationPresence
HKU\S-1-5-21-2886736790-1064491100-3460348771-1000\...409d6c4515e9\InprocServer32: [Default-shell32]  <==== ATTENTION!
HKU\S-1-5-21-2886736790-1064491100-3460348771-1002\...\Run: [SUPERAntiSpyware] => C:\Program Files\SUPERAntiSpyware.exe [2403568 2010-06-07] (SUPERAntiSpyware.com)
HKU\S-1-5-21-2886736790-1064491100-3460348771-1002\...\Run: [SpybotSD TeaTimer] => C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
HKU\S-1-5-21-2886736790-1064491100-3460348771-1002\...\Run: [] => C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [845168 2013-11-06] (Samsung)
HKU\S-1-5-21-2886736790-1064491100-3460348771-1002\...\Run: [GoogleRadar] => C:\Programme\GoogleClean\GoogleRadar.exe [1540096 2013-07-05] ()
HKU\S-1-5-21-2886736790-1064491100-3460348771-1002\...\RunOnce: [HKCU] => C:\Windows\System32\oobe\info\HKCU.vbs [126 2009-11-12] ()
HKU\S-1-5-21-2886736790-1064491100-3460348771-1002\...\RunOnce: [MEDION] => C:\Windows\Web\Wallpaper\MEDION\start.vbs [129 2009-10-23] ()
HKU\S-1-5-21-2886736790-1064491100-3460348771-1002\...\Policies\Explorer: [NoDriveTypeAutoRun] 0x00000000
HKU\S-1-5-21-2886736790-1064491100-3460348771-1002\...\MountPoints2: {4291fe7b-8b40-11df-9bd4-406186643d1c} - I:\setup_vmc_lite.exe /checkApplicationPresence
HKU\S-1-5-21-2886736790-1064491100-3460348771-1002\...\MountPoints2: {78a9f7b3-73af-11df-b30e-406186643d1c} - I:\setup_vmc_lite.exe /checkApplicationPresence
HKU\S-1-5-21-2886736790-1064491100-3460348771-1002\...\MountPoints2: {78a9f7c4-73af-11df-b30e-406186643d1c} - I:\setup_vmc_lite.exe /checkApplicationPresence
HKU\S-1-5-21-2886736790-1064491100-3460348771-1002\...409d6c4515e9\InprocServer32: [Default-shell32]  <==== ATTENTION!
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
Startup: C:\Users\Haiopei\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Haiopei\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Haiopei\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Haiopei\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Haiopei\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Haiopei\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Haiopei\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Haiopei\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Haiopei\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Haiopei\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
BootExecute: autocheck autochk *  
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=56626&homepage=hxxp://startpage24.com
HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=56626&homepage=hxxp://startpage24.com
HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=56626&homepage=hxxp://startpage24.com
HKU\S-1-5-21-2886736790-1064491100-3460348771-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKU\S-1-5-21-2886736790-1064491100-3460348771-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com
HKU\S-1-5-21-2886736790-1064491100-3460348771-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
HKU\S-1-5-21-2886736790-1064491100-3460348771-1000\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://medion.msn.com
HKU\S-1-5-21-2886736790-1064491100-3460348771-1000\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie
HKU\S-1-5-21-2886736790-1064491100-3460348771-1002\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=56626&homepage=hxxp://startpage24.com
HKU\S-1-5-21-2886736790-1064491100-3460348771-1002\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com
HKU\S-1-5-21-2886736790-1064491100-3460348771-1002\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
HKU\S-1-5-21-2886736790-1064491100-3460348771-1002\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://medion.msn.com
URLSearchHook: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002 - (No Name) - {00000000-6E41-4FD3-8538-502F5495E5FC} -  No File
URLSearchHook: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002 - (No Name) - {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} -  No File
URLSearchHook: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002 - (No Name) - {c840e246-6b95-475e-9bd7-caa1c7eca9f2} -  No File
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000 -> {096EAA6A-BA31-4206-83D7-E46FA4C2365A} URL = hxxp://go.web.de/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000 -> {58DF9CFB-D9CB-4701-9FCC-454FE767AC00} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MEDTDF&pc=MAMD&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={sear
SearchScopes: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000 -> {9DF4904A-E4C5-46B0-8260-4D449C2BB67F} URL = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&type=302398&p={searchTerms}
SearchScopes: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000 -> {A2DC3FEF-AB4D-442c-8517-34EC6E125C8D} URL = hxxp://search.webwebweb.com/search.php?query={searchTerms}&lang=de&zip=&town=&site=&country=&safe=[safe,off,strict]
SearchScopes: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://startsear.ch/?aff=1&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://startsear.ch/?aff=1&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002 -> {096EAA6A-BA31-4206-83D7-E46FA4C2365A} URL = hxxp://go.web.de/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002 -> {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10261&src=kw&q={searchTerms}&locale=en_US&apn_ptnrs=^AGS&apn_dtid=^YYYYYY^YY^DE&apn_uid=078f2bbd-0221-4037-ae14-180c2d26a672&apn_sauid=9083FB08-2610-467D-A3B2-F753B6AC42D4
SearchScopes: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002 -> {29C151B2-4ADA-4A58-93D1-455FC8B95BB0} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2625848
SearchScopes: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002 -> {58DF9CFB-D9CB-4701-9FCC-454FE767AC00} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MEDTDF&pc=MAMD&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={sear
SearchScopes: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002 -> {71588120-FC17-4463-B07D-2C71FE6E057B} URL = hxxp://go.findrsearch.com/search/web?q={searchTerms}
SearchScopes: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002 -> {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxp://isearch.avg.com/search?cid={B0CA9219-7A62-4AEB-BED4-64E2332EC6B9}&mid=454bb8583df047d0825e9128c080d4ef-69f08f21f8c71a4745de92076cea4d25bd309433&lang=de&ds=pd011&pr=sa&d=2012-10-01 20:07:02&v=15.2.0.5&pid=avg&sg=0&sap=dsp&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2410} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=410&sr=0&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002 -> {9DF4904A-E4C5-46B0-8260-4D449C2BB67F} URL = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&type=302398&p={searchTerms}
SearchScopes: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002 -> {A2DC3FEF-AB4D-442c-8517-34EC6E125C8D} URL = hxxp://search.webwebweb.com/search.php?query={searchTerms}&lang=de&zip=&town=&site=&country=&safe=[safe,off,strict]
BHO: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll [2014-04-09] (McAfee, Inc.)
BHO: CBAbzockschutz.InitToolbarBHO -> {2e250b90-0e7a-42a3-9d65-e39f9f227fa4} -> C:\Windows\system32\mscoree.dll [2010-11-05] (Microsoft Corporation)
BHO: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll [2013-08-14] (RealDownloader)
BHO: Soda PDF Helper -> {5CFCAFF6-5BB0-4864-B626-021C99ED82E5} -> C:\Program Files\Soda PDF\PDFIEHelper.dll [2010-12-03] (LULU Software)
BHO: PDF Architect Helper -> {691B33B0-B86E-47F3-81C7-56E4FE3B929C} -> C:\Program Files\PDF Architect 2\creator-ie-helper.dll [2014-10-10] (pdfforge GmbH)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll [2014-08-05] (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
BHO: Startpage24 -> {BBD43808-9D13-4B0B-B023-178FD1FAE442} -> C:\Program Files\Startpage24\Plugin\Version_586\link64_plugin.dll [2011-05-22] (Link64 GmbH)
BHO: WEB.DE Toolbar BHO -> {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} -> C:\Programme\WEB.DE Toolbar IE8\uitb.dll [2010-09-13] (1&&1 Mail && Media GmbH)
BHO: Soda PDF 5 IE Helper -> {C737F472-1193-4281-BF53-A00B67AB3E19} -> C:\Program Files\Soda PDF 5\PDFIEHelper.dll [2013-06-12] (LULU Software Limited)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll [2014-08-05] (Oracle Corporation)
Toolbar: HKLM - Soda PDF Toolbar - {980EB9EC-6EB5-4258-BDDB-EFE25C5F99EF} - C:\Program Files\Soda PDF\PDFIEPlugin.dll [2010-12-03] (LULU Software)
Toolbar: HKLM - Soda PDF 5 IE Toolbar - {F335ABA2-FDB4-4644-92B2-5CC4B0FC91D6} - C:\Program Files\Soda PDF 5\PDFIEPlugin.dll [2013-06-12] (LULU Software Limited)
Toolbar: HKLM - COMPUTERBILD-Abzockschutz - {353e2a48-6254-4bd3-88f4-3b51a0ca7870} - C:\Windows\system32\mscoree.dll [2010-11-05] (Microsoft Corporation)
Toolbar: HKLM - PDF Architect Toolbar - {DEEB13D7-CEA9-45FB-B77C-E039BEC85221} - C:\Program Files\PDF Architect 2\creator-ie-plugin.dll [2014-10-10] (pdfforge GmbH)
Toolbar: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002 -> No Name - {A1E75A0E-4397-4BA8-BB50-E19FB66890F4} -  No File
Toolbar: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002 -> No Name - {C424171E-592A-415A-9EB1-DFD6D95D3530} -  No File
Toolbar: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002 -> No Name - {C840E246-6B95-475E-9BD7-CAA1C7ECA9F2} -  No File
Toolbar: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002 -> No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} -  No File
DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: {1E3F1348-4370-4BBE-A67A-CC7ED824CA85} hxxp://download.microsoft.com/download/7/4/9/749b0dc5-2175-4d5b-a6dd-9c4bc923683e/Selfhelpcontrol.cab
DPF: {233C1507-6A77-46A4-9443-F871F945D258} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll [2009-02-26] (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll [2007-06-08] (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll [2013-02-26] (Skype Technologies)
Handler: startpage24 - {879506D7-73DF-8D45-BBDD-123467926D12} - C:\Program Files\Startpage24\Plugin\Version_586\link64_plugin.dll [2011-05-22] (Link64 GmbH)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Haiopei\AppData\Roaming\Mozilla\Firefox\Profiles\onps37a9.default-1417907599268
FF Homepage: www.google.de
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_16_0_0_305.dll [2015-03-07] ()
FF Plugin: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw_1216156.dll [2015-01-09] (Adobe Systems, Inc.)
FF Plugin: @google.com/npPicasa3,version=3.0.0 -> C:\Programme\Picasa3\npPicasa3.dll [2014-08-13] (Google, Inc.)
FF Plugin: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll [2014-08-05] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll [2014-08-05] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.31211.0\npctrl.dll [2014-12-11] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.)
FF Plugin: @microsoft.com/WLPG,version=14.0.8081.0709 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2009-07-10] (Microsoft Corporation)
FF Plugin: @nitropdf.com/NitroPDF -> C:\Program Files\Nitro\Reader 3\npnitromozilla.dll [2013-07-26] (Nitro PDF)
FF Plugin: @pages.tvunetworks.com/WebPlayer -> C:\Programme\TVUPlayer\npTVUAx.dll [2010-04-23] (TVU networks)
FF Plugin: @real.com/nppl3260;version=16.0.3.51 -> C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll [2015-01-12] (RealNetworks, Inc.)
FF Plugin: @real.com/nprndlchromebrowserrecordext;version=1.3.3 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll [2013-08-14] (RealNetworks, Inc.)
FF Plugin: @real.com/nprndlhtml5videoshim;version=1.3.3 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll [2013-08-14] (RealNetworks, Inc.)
FF Plugin: @real.com/nprndlpepperflashvideoshim;version=1.3.3 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll [2013-08-14] (RealNetworks, Inc.)
FF Plugin: @real.com/nprpplugin;version=16.0.3.51 -> C:\Program Files\Real\RealPlayer\Netscape6\nprpplugin.dll [2015-01-12] (RealPlayer)
FF Plugin: @realnetworks.com/npdlplugin;version=1 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll [2013-08-14] (RealDownloader)
FF Plugin: @startpage24.com/npLin64;Version=4 -> C:\Program Files\Startpage24\Plugin\Version_586\firefox\plugins\nplink64.dll [2011-05-22] (Link64 GmbH)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-06] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-06] (Google Inc.)
FF Plugin: @veetle.com/veetleCorePlugin,version=0.9.19 -> C:\Programme\Veetle TV\plugins\npVeetle.dll [2012-01-14] (Veetle Inc)
FF Plugin: @veetle.com/veetlePlayerPlugin,version=0.9.18 -> C:\Programme\Veetle TV\Player\npvlc.dll [2012-01-14] (Veetle Inc)
FF Plugin: @videolan.org/vlc,version=2.0.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-02-27] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.0.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-02-27] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.0.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-02-27] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-02-27] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-02-27] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.2.0 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-02-27] (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin: PDF Architect 2 -> C:\Program Files\PDF Architect 2\np-previewer.dll [2014-10-10] (pdfforge GmbH)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\np-mswmp.dll [2007-04-10] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npLegitCheckPlugin.dll [2009-06-25] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll [2015-01-31] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll [2015-01-31] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll [2015-01-31] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll [2015-01-31] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll [2015-01-31] (Apple Inc.)
FF Extension: Youtube Downloader - 4K Download - C:\Users\Haiopei\AppData\Roaming\Mozilla\Firefox\Profiles\onps37a9.default-1417907599268\Extensions\paulsaintuzb@gmail.com [2015-03-06]
FF Extension: WOT - C:\Users\Haiopei\AppData\Roaming\Mozilla\Firefox\Profiles\onps37a9.default-1417907599268\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2015-01-31]
FF Extension: DownloadHelper - C:\Users\Haiopei\AppData\Roaming\Mozilla\Firefox\Profiles\onps37a9.default-1417907599268\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2015-03-01]
FF Extension: Flash and Video Download - C:\Users\Haiopei\AppData\Roaming\Mozilla\Firefox\Profiles\onps37a9.default-1417907599268\Extensions\{bee6eb20-01e0-ebd1-da83-080329fb9a3a} [2015-03-01]
FF Extension: All Downloader Professional - C:\Users\Haiopei\AppData\Roaming\Mozilla\Firefox\Profiles\onps37a9.default-1417907599268\Extensions\alldownloader@link64.xpi [2015-01-31]
FF Extension: 1-Click Dailymotion Video Downloader - C:\Users\Haiopei\AppData\Roaming\Mozilla\Firefox\Profiles\onps37a9.default-1417907599268\Extensions\DailymotionVideoDownloader@PeterOlayev.com.xpi [2015-03-01]
FF Extension: Startpage24 incl. Video Downloader professional - C:\Users\Haiopei\AppData\Roaming\Mozilla\Firefox\Profiles\onps37a9.default-1417907599268\Extensions\ffext_basicchromeext@startpage24.xpi [2014-12-07]
FF Extension: Video Downloader professional - C:\Users\Haiopei\AppData\Roaming\Mozilla\Firefox\Profiles\onps37a9.default-1417907599268\Extensions\ffext_basicvideoext@startpage24.xpi [2014-12-07]
FF Extension: Ghostery - C:\Users\Haiopei\AppData\Roaming\Mozilla\Firefox\Profiles\onps37a9.default-1417907599268\Extensions\firefox@ghostery.com.xpi [2015-01-31]
FF Extension: Easiest YouTube Video Downloader - C:\Users\Haiopei\AppData\Roaming\Mozilla\Firefox\Profiles\onps37a9.default-1417907599268\Extensions\manishjain9@hotmail.com_easiestyoutube.xpi [2015-01-31]
FF Extension: Session Manager - C:\Users\Haiopei\AppData\Roaming\Mozilla\Firefox\Profiles\onps37a9.default-1417907599268\Extensions\{1280606b-2510-4fe0-97ef-9b5a22eafe30}.xpi [2014-12-07]
FF Extension: Speed Dial - C:\Users\Haiopei\AppData\Roaming\Mozilla\Firefox\Profiles\onps37a9.default-1417907599268\Extensions\{64161300-e22b-11db-8314-0800200c9a66}.xpi [2014-12-07]
FF Extension: Download Status Bar - C:\Users\Haiopei\AppData\Roaming\Mozilla\Firefox\Profiles\onps37a9.default-1417907599268\Extensions\{6c28e999-e900-4635-a39d-b1ec90ba0c0f}.xpi [2015-03-01]
FF Extension: NoScript - C:\Users\Haiopei\AppData\Roaming\Mozilla\Firefox\Profiles\onps37a9.default-1417907599268\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014-12-07]
FF Extension: Easy Youtube Video Downloader Express - C:\Users\Haiopei\AppData\Roaming\Mozilla\Firefox\Profiles\onps37a9.default-1417907599268\Extensions\{b9acf540-acba-11e1-8ccb-001fd0e08bd4}.xpi [2015-03-01]
FF Extension: Download YouTube Videos as MP4 - C:\Users\Haiopei\AppData\Roaming\Mozilla\Firefox\Profiles\onps37a9.default-1417907599268\Extensions\{b9bfaf1c-a63f-47cd-8b9a-29526ced9060}.xpi [2015-03-01]
FF Extension: Adblock Plus - C:\Users\Haiopei\AppData\Roaming\Mozilla\Firefox\Profiles\onps37a9.default-1417907599268\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-12-07]
FF Extension: BetterPrivacy - C:\Users\Haiopei\AppData\Roaming\Mozilla\Firefox\Profiles\onps37a9.default-1417907599268\Extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi [2015-01-31]
FF Extension: DownThemAll! - C:\Users\Haiopei\AppData\Roaming\Mozilla\Firefox\Profiles\onps37a9.default-1417907599268\Extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi [2015-01-31]
FF Extension: Download Manager Tweak - C:\Users\Haiopei\AppData\Roaming\Mozilla\Firefox\Profiles\onps37a9.default-1417907599268\Extensions\{F8A55C97-3DB6-4961-A81D-0DE0080E53CB}.xpi [2015-03-01]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2015-03-06]
FF HKLM\...\Firefox\Extensions: [ffext@startpage24] - C:\Program Files\Startpage24\Plugin\Version_586\firefox
FF Extension: Startpage24 - C:\Program Files\Startpage24\Plugin\Version_586\firefox [2011-05-22]
FF HKLM\...\Firefox\Extensions: [FFSodaPDFConverter@sodapdf.com] - C:\Program Files\Soda PDF\FFSodaExt
FF Extension: Soda PDF Converter For Firefox - C:\Program Files\Soda PDF\FFSodaExt [2011-02-11]
FF HKLM\...\Firefox\Extensions: [pdf_architect_2_conv@pdfarchitect.org] - C:\Program Files\PDF Architect 2\resources\pdfarchitect2firefoxextension
FF Extension: PDF Architect 2 Creator - C:\Program Files\PDF Architect 2\resources\pdfarchitect2firefoxextension [2014-11-30]
FF HKLM\...\Firefox\Extensions: [{DF153AFF-6948-45d7-AC98-4FC4AF8A08E2}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2015-01-02]
FF HKU\S-1-5-21-2886736790-1064491100-3460348771-1000\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: No Name - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]

Chrome: 
=======
CHR HomePage: Default -> 
CHR StartupUrls: Default -> "hxxp://isearch.avg.com/?cid={B0CA9219-7A62-4AEB-BED4-64E2332EC6B9}&mid=454bb8583df047d0825e9128c080d4ef-69f08f21f8c71a4745de92076cea4d25bd309433&lang=de&ds=pd011&pr=sa&d=2012-10-01 20:07:02&v=18.0.5.292&pid=avg&sg=0&sap=hp"
CHR DefaultSearchKeyword: Default -> bing.com
CHR DefaultSearchURL: Default -> https://www.bing.com/search?setmkt=de-DE&q={searchTerms}
CHR DefaultNewTabURL: Default -> https://www.bing.com/chrome/newtab?setmkt=de-DE
CHR DefaultSuggestURL: Default -> hxxp://api.bing.com/osjson.aspx?query={searchTerms}&language={language}
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\40.0.2214.115\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (QuickTime Plug-in 7.6.8) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.8) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.8) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.8) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.8) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.8) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll No File
CHR Plugin: (QuickTime Plug-in 7.6.8) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll No File
CHR Plugin: (Java Deployment Toolkit 6.0.260.3) - C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U26) - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Mozilla Firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll No File
CHR Plugin: (Shockwave for Director) - C:\Windows\system32\Adobe\Director\np32dsw.dll No File
CHR Plugin: (RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit) ) - C:\Program Files\Mozilla Firefox\plugins\nppl3260.dll No File
CHR Plugin: (RealPlayer Version Plugin) - C:\Program Files\Mozilla Firefox\plugins\nprpjplug.dll No File
CHR Plugin: (RealPlayer(tm) HTML5VideoShim Plug-In (32-bit) ) - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll No File
CHR Plugin: (Microsoft® Windows Media Player Firefox Plugin) - C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll (Microsoft Corporation)
CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\40.0.2214.115\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\40.0.2214.115\pdf.dll ()
CHR Plugin: (vShare.tv plug-in) - C:\Users\Haiopei\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpionmjnkbpcdpcflammlgllecmejgjj\1.3_0\chvsharetvplg.dll No File
CHR Plugin: (vShare.tv plug-in) - C:\Program Files\Mozilla Firefox\plugins\npvsharetvplg.dll No File
CHR Plugin: (downloadUpdater) - C:\Program Files\Mozilla Firefox\plugins\npdnu.dll No File
CHR Plugin: (downloadUpdater2) - C:\Program Files\Mozilla Firefox\plugins\npdnupdater2.dll No File
CHR Plugin: (Windows Genuine Advantage) - C:\Program Files\Mozilla Firefox\plugins\npLegitCheckPlugin.dll (Microsoft Corporation)
CHR Plugin: (RealJukebox NS Plugin) - C:\Program Files\Mozilla Firefox\plugins\nprjplug.dll No File
CHR Plugin: (Winamp Application Detector) - C:\Program Files\Mozilla Firefox\plugins\npwachk.dll No File
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.69\npGoogleUpdate3.dll No File
CHR Plugin: (Startpage24 Startpage) - C:\Program Files\Startpage24\Plugin\Version_586\firefox\plugins\nplink64.dll (Link64 GmbH)
CHR Plugin: (Windows Live® Photo Gallery) - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Picasa) - C:\Programme\Picasa3\npPicasa3.dll (Google, Inc.)
CHR Plugin: (VLC Multimedia Plug-in) - C:\Programme\VLC Mediaplayer\npvlc.dll No File
CHR Plugin: (Veetle TV Player) - C:\Programme\Veetle TV\Player\npvlc.dll (Veetle Inc)
CHR Plugin: (Veetle TV Core) - C:\Programme\Veetle TV\plugins\npVeetle.dll (Veetle Inc)
CHR Plugin: (Default Plug-in) - default_plugin No File
CHR Profile: C:\Users\Haiopei\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Avira Browser Safety) - C:\Users\Haiopei\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2014-08-23]
CHR Extension: (RealDownloader) - C:\Users\Haiopei\AppData\Local\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji [2015-01-06]
CHR Extension: (Google Wallet) - C:\Users\Haiopei\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-02-03]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx [2013-08-14]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 ACDaemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
S3 Adobe LM Service; C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [72704 2014-10-09] (Adobe Systems) [File not signed]
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [432888 2015-03-04] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [432888 2015-03-04] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [992504 2015-03-04] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe [184056 2015-02-12] (Avira Operations GmbH & Co. KG)
R2 Fabs; C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe [1253376 2009-08-27] (MAGIX AG) [File not signed]
R2 FirebirdGuardianDefaultInstance; C:\Program Files\Firebird\Firebird_2_1\bin\fbguard.exe [81920 2008-06-13] (Firebird Project) [File not signed]
R3 FirebirdServerDefaultInstance; C:\Program Files\Firebird\Firebird_2_1\bin\fbserver.exe [2723840 2008-06-13] (Firebird Project) [File not signed]
S3 FirebirdServerMAGIXInstance; C:\Program Files\Common Files\MAGIX Services\Database\bin\fbserver.exe [3276800 2008-08-07] (MAGIX®) [File not signed]
S3 FreeAgentGoNext Service; C:\Programme\Seagate\Sync\FreeAgentService.exe [181544 2009-05-01] (Seagate Technology LLC)
R2 FsUsbExService; C:\Windows\system32\FsUsbExService.Exe [233472 2013-02-05] (Teruten) [File not signed]
S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
S3 MAGIX StartUp Analyze Service; C:\Program Files\MAGIX\PC_Check_Tuning_Free_2011\MXSAS.exe [186368 2010-11-04] (MAGIX AG) [File not signed]
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [235696 2014-04-09] (McAfee, Inc.)
S3 NitroReaderDriverReadSpool3; C:\Program Files\Nitro\Reader 3\NitroPDFReaderDriverService3.exe [196624 2013-07-26] (Nitro PDF Software)
R2 ocster_backup; c:\Programme\Ocster Backup\bin\backupService-ox.exe [18216 2011-01-14] ()
S3 PDF Architect 2; C:\Program Files\PDF Architect 2\ws.exe [1771560 2014-10-10] (pdfforge GmbH)
S3 PDF Architect 2 Creator; C:\Program Files\PDF Architect 2\creator-ws.exe [738856 2014-10-10] (pdfforge GmbH)
S3 pdfforge CrashHandler; C:\Program Files\PDF Architect 2\crash-handler-ws.exe [861736 2014-10-10] (pdfforge GmbH)
R2 ProtexisLicensing; C:\Windows\system32\PSIService.exe [177704 2007-06-05] ()
S3 Radio.fx; C:\Program Files\Tobit Radio.fx\Server\rfx-server.exe [3999512 2013-06-03] ()
R2 RealNetworks Downloader Resolver Service; C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe [39056 2013-08-14] ()
S3 SandraAgentSrv; C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2015\RpcAgentSrv.exe [73200 2014-11-05] (SiSoftware) [File not signed]
S3 Secunia PSI Agent; C:\Program Files\Secunia\PSI\PSIA.exe [1229528 2013-12-06] (Secunia)
S3 Secunia Update Agent; C:\Program Files\Secunia\PSI\sua.exe [662232 2013-12-06] (Secunia)
S3 Soda PDF 5 Helper Service; C:\Program Files\Soda PDF 5\HelperService.exe [1097544 2013-06-12] (LULU Software Limited)
S3 Soda PDF 5 Service; C:\Program Files\Soda PDF 5\ConversionService.exe [794440 2013-06-12] (LULU Software Limited)
S3 Soda PDF Service; C:\Program Files\Soda PDF\ConversionService.exe [807760 2010-12-03] (LULU Software)
S3 SolutoService; C:\Program Files\Soluto\SolutoService.exe [584224 2012-04-24] (Soluto)
R2 ss_conn_service; C:\Program Files\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe [743688 2014-10-13] (DEVGURU Co., LTD.)
S2 TuneUp.UtilitiesSvc; C:\Program Files\TuneUp Utilities 2014\TuneUpUtilitiesService32.exe [1742136 2013-12-18] (TuneUp Software)
S3 w7Svc; C:\Programme\webcam 7\wService.exe [5094200 2012-03-26] (Moonware Studios)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 Afc; C:\Windows\System32\drivers\Afc.sys [18688 2006-11-10] (Arcsoft, Inc.)
R3 Apowersoft_AudioDevice; C:\Windows\System32\drivers\Apowersoft_AudioDevice.sys [26032 2014-04-09] (Wondershare)
S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [165376 2012-10-06] () [File not signed]
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105864 2015-03-04] (Avira Operations GmbH & Co. KG)
R1 avgtp; C:\Windows\system32\drivers\avgtpx86.sys [42272 2014-03-20] (AVG Technologies)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2015-03-04] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-11-26] (Avira Operations GmbH & Co. KG)
R3 CLVirtualBus01; C:\Windows\System32\DRIVERS\CLVirtualBus01.sys [78600 2014-03-12] (CyberLink)
S3 cpuz137; C:\Program Files\CPUID\PC Wizard 2013\pcwiz_x32.sys [26856 2014-02-17] (CPUID)
R3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [37344 2013-02-05] () [File not signed]
R2 giveio; C:\Windows\system32\giveio.sys [5248 1996-04-03] () [File not signed]
R1 GUBootStartup; C:\Windows\System32\drivers\GUBootStartup.sys [17344 2014-10-18] (Glarysoft Ltd)
S3 hwusbfake; C:\Windows\System32\DRIVERS\ewusbfake.sys [101120 2009-11-04] (Huawei Technologies Co., Ltd.)
R3 KMWDFILTERx86; C:\Windows\System32\DRIVERS\KMWDFILTER.sys [25088 2009-04-29] (Windows (R) Codename Longhorn DDK provider)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [18048 2011-02-19] () [File not signed]
S3 PSI; C:\Windows\System32\DRIVERS\psi_mf_x86.sys [16024 2013-12-06] (Secunia)
S3 QCPro; C:\Windows\System32\DRIVERS\p35u.sys [116480 2002-12-10] (Logitech Inc.)
S3 RRNetCap; C:\Windows\System32\DRIVERS\rrnetcap.sys [31848 2011-11-30] (RapidSolution Software AG)
R3 RRNetCapMP; C:\Windows\System32\DRIVERS\rrnetcap.sys [31848 2011-11-30] (RapidSolution Software AG)
S3 SANDRA; C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2015\WNt600x86\Sandra.sys [23112 2009-08-07] (SiSoftware)
R1 SASDIFSV; C:\Program Files\SASDIFSV.SYS [12872 2010-02-17] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SASKUTIL.SYS [67656 2010-05-10] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
S0 Soluto; C:\Windows\System32\Drivers\Soluto.sys [51144 2012-04-24] (Soluto LTD.)
R2 speedfan; C:\Windows\system32\speedfan.sys [24184 2012-12-29] (Almico Software)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)
R3 tbhsd; C:\Windows\System32\drivers\tbhsd.sys [39016 2011-11-30] (RapidSolution Software AG)
R3 TuneUpUtilitiesDrv; C:\Program Files\TuneUp Utilities 2014\TuneUpUtilitiesDriver32.sys [12320 2013-08-21] (TuneUp Software)
S3 cpuz135; \??\C:\Windows\TEMP\cpuz135\cpuz135_x32.sys [X]
S3 ProcObsrv; \??\C:\Programme\Glary Utilities 3\ProcObsrv.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-08 18:22 - 2015-03-08 18:22 - 00042964 _____ () C:\Users\Haiopei\Desktop\FRST.txt
2015-03-08 18:21 - 2015-03-08 18:21 - 00001171 _____ () C:\Users\Haiopei\Desktop\JRT.txt
2015-03-08 18:13 - 2015-03-08 18:13 - 01388333 _____ (Thisisu) C:\Users\Haiopei\Desktop\JRT.exe
2015-03-08 18:13 - 2015-03-08 18:13 - 01134592 _____ (Farbar) C:\Users\Haiopei\Desktop\FRST.exe
2015-03-08 17:54 - 2015-03-08 17:54 - 02126848 _____ () C:\Users\Haiopei\Desktop\AdwCleaner_4.111.exe
2015-03-07 21:09 - 2015-03-07 21:09 - 00083539 _____ () C:\Users\Haiopei\Desktop\3 Addition.txt
2015-03-07 20:05 - 2015-03-07 20:06 - 00083541 _____ () C:\Users\Haiopei\Desktop\2 Addition.txt
2015-03-07 20:04 - 2015-03-07 21:09 - 00067464 _____ () C:\Users\Haiopei\Desktop\3 FRST.txt
2015-03-07 20:04 - 2015-03-07 20:06 - 00067280 _____ () C:\Users\Haiopei\Desktop\2 FRST.txt
2015-03-07 20:03 - 2015-03-08 18:22 - 00000000 ____D () C:\FRST
2015-03-07 19:44 - 2015-03-07 19:54 - 00000000 ____D () C:\Users\Haiopei\Downloads\alles
2015-03-07 14:58 - 2015-03-07 15:22 - 64486819 _____ () C:\Users\Haiopei\Downloads\▶ James Bay - Hold back the River (Live for Sunday Sessions
2015-03-07 11:19 - 2015-03-07 11:28 - 42869328 _____ (Google Inc.) C:\Users\Haiopei\Downloads\Google_Chrome_v41.0.2272.76.exe
2015-03-07 00:29 - 2015-03-07 00:29 - 00000000 ____D () C:\Users\Haiopei\AppData\Local\CrashRpt
2015-03-06 20:37 - 2015-03-06 20:37 - 02931056 _____ () C:\Users\Haiopei\Downloads\SecurityTaskManager_Setup.exe
2015-03-06 20:34 - 2015-03-06 20:34 - 00540072 _____ (Neuber Software) C:\Users\Haiopei\Downloads\SvchostAnalyzer.exe
2015-03-06 01:14 - 2015-03-06 01:14 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2015-03-04 13:47 - 2015-03-04 13:50 - 14980336 _____ () C:\Users\Haiopei\Downloads\Glary_Utilities_v5.20.0.35.exe
2015-03-04 11:57 - 2015-03-04 12:07 - 48990992 _____ (Dropbox, Inc.) C:\Users\Haiopei\Downloads\Dropbox_v3.2.7.exe
2015-03-04 11:55 - 2015-03-04 11:55 - 00000990 _____ () C:\Users\Public\Desktop\CPUID CPU-Z.lnk
2015-03-04 11:54 - 2015-03-04 11:54 - 00001570 _____ () C:\Users\Haiopei\Desktop\XnView.lnk
2015-03-04 11:18 - 2015-03-04 11:19 - 01582736 _____ ( ) C:\Users\Haiopei\Downloads\CPU_Z_v1.72.0.exe
2015-03-04 11:17 - 2015-03-04 11:30 - 28509232 _____ () C:\Users\Haiopei\Downloads\VLC_Media_Player_(32bit)_v2.2.0.exe
2015-03-04 11:17 - 2015-03-04 11:20 - 05060784 _____ (Gougelet Pierre-e ) C:\Users\Haiopei\Downloads\XnView_v2.31.exe
2015-03-04 11:17 - 2015-03-04 11:19 - 02218504 _____ () C:\Users\Haiopei\Downloads\SpeedFan_v4.51.exe
2015-03-04 08:34 - 2015-01-09 03:48 - 00635904 _____ (Microsoft Corporation) C:\Windows\system32\perftrack.dll
2015-03-04 08:34 - 2015-01-09 03:48 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\wdi.dll
2015-03-04 08:34 - 2015-01-09 03:48 - 00027136 _____ (Microsoft Corporation) C:\Windows\system32\powertracker.dll
2015-02-25 19:46 - 2015-01-09 00:44 - 00419936 _____ () C:\Windows\system32\locale.nls
2015-02-14 01:31 - 2015-02-14 01:34 - 18129584 _____ (Adobe Systems Incorporated) C:\Users\Haiopei\Downloads\Adobe_Flash_Player_(Non_IE)_v16.0.0.305.exe
2015-02-14 01:06 - 2015-02-14 01:07 - 05400507 _____ (CPUID ) C:\Users\Haiopei\Downloads\PC_Wizard_v2014.2.13.exe
2015-02-12 19:37 - 2015-01-23 04:43 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-02-12 19:37 - 2015-01-23 04:17 - 04300800 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-02-12 19:37 - 2015-01-15 08:46 - 00136640 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-02-12 19:37 - 2015-01-15 08:46 - 00067520 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-02-12 19:37 - 2015-01-15 08:43 - 00100352 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-02-12 19:37 - 2015-01-15 08:43 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-02-12 19:37 - 2015-01-15 08:42 - 01061376 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-02-12 19:37 - 2015-01-15 08:42 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-02-12 19:37 - 2015-01-15 08:42 - 00022528 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-02-12 19:37 - 2015-01-15 08:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-02-12 19:37 - 2015-01-15 08:39 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-02-12 19:37 - 2015-01-15 08:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-02-12 19:37 - 2015-01-15 08:37 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-02-12 19:37 - 2015-01-15 05:21 - 00369968 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-02-12 19:03 - 2015-02-15 14:57 - 00000852 _____ () C:\Windows\PFRO.log
2015-02-11 18:46 - 2015-01-14 06:09 - 00342712 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-02-11 18:46 - 2015-01-12 03:25 - 19740160 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-02-11 18:46 - 2015-01-12 03:21 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-02-11 18:46 - 2015-01-12 03:21 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-02-11 18:46 - 2015-01-12 03:08 - 00503296 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-02-11 18:46 - 2015-01-12 03:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-02-11 18:46 - 2015-01-12 03:07 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-02-11 18:46 - 2015-01-12 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-02-11 18:46 - 2015-01-12 03:02 - 02277888 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-02-11 18:46 - 2015-01-12 03:00 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-02-11 18:46 - 2015-01-12 02:59 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-02-11 18:46 - 2015-01-12 02:57 - 00478208 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-02-11 18:46 - 2015-01-12 02:55 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-02-11 18:46 - 2015-01-12 02:55 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-02-11 18:46 - 2015-01-12 02:48 - 00667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-02-11 18:46 - 2015-01-12 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-02-11 18:46 - 2015-01-12 02:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-02-11 18:46 - 2015-01-12 02:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-02-11 18:46 - 2015-01-12 02:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-02-11 18:46 - 2015-01-12 02:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-02-11 18:46 - 2015-01-12 02:23 - 02052608 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-02-11 18:46 - 2015-01-12 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-02-11 18:46 - 2015-01-12 02:23 - 00684544 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-02-11 18:46 - 2015-01-12 02:22 - 01155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-02-11 18:46 - 2015-01-12 02:14 - 12829184 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-02-11 18:46 - 2015-01-12 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-02-11 18:46 - 2015-01-12 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-02-11 18:46 - 2015-01-12 01:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-02-11 18:45 - 2015-01-10 07:27 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-02-11 18:45 - 2015-01-10 07:27 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-02-11 18:45 - 2015-01-10 07:27 - 00248832 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-02-11 18:45 - 2015-01-10 07:27 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-02-11 18:45 - 2015-01-10 07:27 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-02-11 18:45 - 2015-01-10 07:27 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-02-11 18:45 - 2015-01-10 07:27 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-02-11 18:45 - 2015-01-09 02:45 - 02380288 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-02-11 18:43 - 2015-02-04 03:54 - 00482304 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-02-11 18:43 - 2015-02-04 03:53 - 00767488 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-02-11 18:43 - 2015-02-04 03:53 - 00621056 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-02-11 18:43 - 2015-02-04 03:53 - 00325632 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-02-11 18:43 - 2015-02-04 03:53 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-02-11 18:43 - 2015-02-04 03:53 - 00159744 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-02-11 18:43 - 2015-02-04 03:49 - 00886784 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-02-11 18:43 - 2015-01-28 00:36 - 01167520 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2015-02-11 18:43 - 2015-01-14 06:44 - 03972544 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2015-02-11 18:43 - 2015-01-14 06:44 - 03917760 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-02-11 18:43 - 2014-11-26 04:32 - 00571904 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2015-02-11 18:39 - 2014-12-12 06:07 - 01174528 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-02-11 18:39 - 2014-07-07 02:40 - 00179200 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2015-02-11 18:39 - 2014-07-07 02:40 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2015-02-11 18:38 - 2015-01-13 03:49 - 01230336 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-02-11 18:38 - 2014-12-08 03:46 - 00308224 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll
2015-02-09 19:11 - 2015-03-08 18:07 - 00001882 _____ () C:\Windows\setupact.log
2015-02-09 19:11 - 2015-02-09 19:11 - 00000000 _____ () C:\Windows\setuperr.log
2015-02-07 16:41 - 2015-02-07 16:41 - 00000000 ____D () C:\Users\Haiopei\Downloads\Telefon
2015-02-07 16:37 - 2015-02-07 16:38 - 00000000 ____D () C:\Users\Haiopei\Downloads\Hobby
2015-02-07 16:26 - 2015-02-07 16:39 - 00000000 ____D () C:\Users\Haiopei\Downloads\TV
2015-02-06 01:00 - 2015-02-06 01:00 - 00001426 _____ () C:\Users\Public\Desktop\LibreOffice 4.4.lnk
2015-02-06 01:00 - 2015-02-06 01:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LibreOffice 4.4
2015-02-06 00:52 - 2015-02-06 01:00 - 00000000 ____D () C:\Program Files\LibreOffice 4

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-08 18:23 - 2011-01-30 20:09 - 00000000 ___HD () C:\ProgramData\sysnfxo
2015-03-08 18:17 - 2010-04-11 21:48 - 00000000 ____D () C:\Users\Haiopei\AppData\Roaming\TeraCopy
2015-03-08 18:16 - 2009-07-14 05:34 - 00018704 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-03-08 18:16 - 2009-07-14 05:34 - 00018704 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-03-08 18:12 - 2010-09-22 16:19 - 01645210 _____ () C:\Windows\WindowsUpdate.log
2015-03-08 18:09 - 2014-06-05 23:46 - 00000000 ___RD () C:\Users\Haiopei\Dropbox
2015-03-08 18:09 - 2014-06-05 22:50 - 00000000 ____D () C:\Users\Haiopei\AppData\Roaming\Dropbox
2015-03-08 18:08 - 2014-10-13 19:54 - 00000326 _____ () C:\Windows\Tasks\GlaryInitialize 5.job
2015-03-08 18:08 - 2014-10-13 19:54 - 00000000 ____D () C:\Program Files\Glary Utilities 5
2015-03-08 18:07 - 2011-02-13 10:04 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-03-08 18:07 - 2009-07-14 05:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-03-08 18:05 - 2014-03-25 18:26 - 00000000 ____D () C:\AdwCleaner
2015-03-08 17:52 - 2010-11-06 18:39 - 00000000 ____D () C:\Users\Haiopei\Downloads\PC
2015-03-08 17:30 - 2011-02-13 10:04 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-03-08 15:03 - 2012-10-21 23:48 - 00000000 ____D () C:\Users\Haiopei\AppData\Roaming\vlc
2015-03-08 13:56 - 2012-10-20 21:50 - 00000000 ____D () C:\Users\Haiopei\Downloads\Musik
2015-03-08 08:54 - 2012-04-04 15:53 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-03-07 19:54 - 2012-04-04 15:52 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2015-03-07 19:54 - 2011-07-06 17:27 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2015-03-07 19:45 - 2010-04-30 20:16 - 00000000 ____D () C:\Users\Haiopei\Downloads\Modellbau
2015-03-07 01:43 - 2010-03-03 17:49 - 00000000 ____D () C:\Users\Haiopei
2015-03-06 20:57 - 2014-09-07 18:44 - 00114904 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-03-06 20:30 - 2009-07-14 05:53 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-03-06 20:19 - 2012-04-29 18:47 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2015-03-06 17:18 - 2012-10-10 18:49 - 00000000 ____D () C:\Users\Haiopei\Downloads\winhttrack
2015-03-06 16:27 - 2015-01-10 12:45 - 00001086 _____ () C:\Users\Haiopei\Desktop\PC Wizard 2013.lnk
2015-03-05 22:16 - 2014-08-20 01:03 - 00000000 ____D () C:\ProgramData\Package Cache
2015-03-05 22:15 - 2013-02-23 13:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-03-05 22:15 - 2013-02-23 12:53 - 00000000 ____D () C:\Program Files\Avira
2015-03-05 10:06 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\tracing
2015-03-04 14:28 - 2013-05-08 18:09 - 00037896 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2015-03-04 14:28 - 2013-02-23 12:53 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2015-03-04 14:28 - 2013-02-23 12:53 - 00105864 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2015-03-04 13:52 - 2014-10-13 19:54 - 00001018 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glary Utilities 5.lnk
2015-03-04 13:52 - 2014-10-13 19:54 - 00001006 _____ () C:\Users\Public\Desktop\Glary Utilities 5.lnk
2015-03-04 13:01 - 2014-06-05 23:46 - 00000989 _____ () C:\Users\Haiopei\Desktop\Dropbox.lnk
2015-03-04 13:01 - 2014-06-05 22:51 - 00000000 ____D () C:\Users\Haiopei\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-03-04 11:54 - 2014-11-15 22:17 - 00000933 _____ () C:\Users\Haiopei\Desktop\SpeedFan.lnk
2015-03-04 11:54 - 2014-11-15 22:17 - 00000045 _____ () C:\Windows\system32\initdebug.nfo
2015-03-04 11:54 - 2014-11-15 22:17 - 00000000 ____D () C:\Users\Haiopei\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpeedFan
2015-03-04 11:54 - 2014-11-15 22:17 - 00000000 ____D () C:\Program Files\SpeedFan
2015-03-04 11:54 - 2010-05-22 13:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XnView
2015-03-04 11:54 - 2010-05-22 13:08 - 00000000 ____D () C:\Program Files\XnView
2015-03-04 11:53 - 2013-01-26 17:42 - 00000992 _____ () C:\Users\Public\Desktop\VLC media player.lnk
2015-03-03 20:54 - 2012-05-24 18:55 - 00000000 ____D () C:\Users\Haiopei\AppData\Roaming\Nitro PDF
2015-02-25 22:18 - 2011-02-11 21:44 - 00000000 ____D () C:\Users\Haiopei\AppData\Roaming\PDF Software
2015-02-23 21:49 - 2014-02-04 20:30 - 00002472 _____ () C:\Users\Haiopei\Desktop\Google Chrome.lnk
2015-02-14 01:03 - 2014-10-13 19:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glary Utilities 5
2015-02-13 23:16 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\rescache
2015-02-13 20:43 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\system32\de-DE
2015-02-12 19:04 - 2009-07-14 05:33 - 00894256 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-02-12 09:41 - 2014-12-10 18:49 - 00000000 ____D () C:\Windows\system32\appraiser
2015-02-12 09:41 - 2014-04-25 01:31 - 00000000 ___SD () C:\Windows\system32\CompatTel
2015-02-12 09:39 - 2013-07-14 13:14 - 00000000 ____D () C:\Windows\system32\MRT
2015-02-12 03:10 - 2009-11-16 11:03 - 113756392 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-02-12 03:09 - 2009-11-16 12:26 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-02-08 22:41 - 2015-01-01 19:14 - 18129584 _____ (Adobe Systems Incorporated) C:\Users\Haiopei\Downloads\install_flash_player.exe
2015-02-08 22:12 - 2010-03-05 20:04 - 00000000 ____D () C:\Users\Haiopei\AppData\Roaming\BOM
2015-02-08 20:19 - 2012-08-01 18:50 - 00000000 ____D () C:\Program Files\Biet-O-Matic
2015-02-08 13:20 - 2012-10-26 21:27 - 00000000 ____D () C:\Program Files\PDFCreator
2015-02-06 01:45 - 2010-03-03 17:49 - 00276656 _____ () C:\Users\Haiopei\AppData\Local\GDIPFONTCACHEV1.DAT

==================== Files in the root of some directories =======

2007-10-02 22:08 - 2007-10-02 22:08 - 0122168 _____ (SuperAdBlocker.com) C:\Program Files\BootSafe.exe
2004-05-20 21:28 - 2004-05-20 21:28 - 0002048 _____ () C:\Program Files\detect.wav
2006-09-19 23:55 - 2006-09-19 23:55 - 0360448 _____ (SuperAntiSpyware.com) C:\Program Files\deupx.dll
2013-05-20 22:22 - 2014-03-20 21:49 - 0003730 _____ () C:\Program Files\Mozilla Firefoxavg-secure-search.xml
2004-05-07 23:31 - 2004-05-07 23:31 - 0348160 _____ (Microsoft Corporation) C:\Program Files\msvcr71.dll
2010-06-10 11:15 - 2010-06-10 11:15 - 27213372 _____ () C:\Program Files\PROCESSLIST.DB
2010-06-10 11:15 - 2010-06-10 11:15 - 1474074 _____ () C:\Program Files\PROCESSLISTRELATED.DB
2010-03-24 21:53 - 2010-03-24 21:53 - 0299520 _____ () C:\Program Files\RUNSAS.EXE
2010-06-07 18:02 - 2010-06-07 18:02 - 0111104 _____ (SUPERAntiSpyware.com) C:\Program Files\SASCore.exe
2007-02-27 20:39 - 2007-02-27 20:39 - 0061440 _____ (SUPERAntiSpyware.com) C:\Program Files\SASCTXMN.DLL
2010-02-17 19:25 - 2010-02-17 19:25 - 0012872 _____ (SUPERAdBlocker.com and SUPERAntiSpyware.com) C:\Program Files\sasdifsv.sys
2010-02-17 19:15 - 2010-02-17 19:15 - 0012872 _____ ( SUPERAdBlocker.com and SUPERAntiSpyware.com) C:\Program Files\SASENUM.SYS
2008-03-12 19:29 - 2008-03-12 19:29 - 0024576 _____ () C:\Program Files\SASINST.EXE
2010-05-10 19:41 - 2010-05-10 19:41 - 0067656 _____ (SUPERAdBlocker.com and SUPERAntiSpyware.com) C:\Program Files\SASKUTIL.SYS
2008-07-28 19:10 - 2008-07-28 19:10 - 0411136 _____ () C:\Program Files\SASREPAIRS.STG
2008-05-13 18:13 - 2008-05-13 18:13 - 0077824 _____ (SuperAdBlocker.com) C:\Program Files\SASSEH.DLL
2010-06-09 00:16 - 2010-06-09 00:16 - 0101832 _____ (SUPERAntiSpyware.com) C:\Program Files\SASUNINST.EXE
2009-09-03 23:21 - 2009-09-03 23:21 - 0548352 _____ (SUPERAntiSpyware.com) C:\Program Files\SASWINLO.DLL
2010-06-07 18:13 - 2010-06-07 18:13 - 0256752 _____ (SUPERAntiSpyware.com) C:\Program Files\SSUpdate.exe
2007-11-27 21:12 - 2007-11-27 21:12 - 1088725 _____ () C:\Program Files\SUPERAntiSpyware.chm
2010-06-07 18:13 - 2010-06-07 18:13 - 2403568 _____ (SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware.exe
2011-01-12 01:00 - 2011-01-12 01:00 - 0146944 _____ () C:\Program Files\Common Files\dsfFLACDecoder.dll
2011-01-12 01:00 - 2011-01-12 01:00 - 0221184 _____ () C:\Program Files\Common Files\dsfFLACEncoder.dll
2011-01-12 01:00 - 2011-01-12 01:00 - 0204800 _____ () C:\Program Files\Common Files\dsfNativeFLACSource.dll
2012-05-11 13:16 - 2012-05-11 13:16 - 0171520 _____ () C:\Program Files\Common Files\dsfOggDemux2.dll
2011-01-12 01:00 - 2011-01-12 01:00 - 0240128 _____ () C:\Program Files\Common Files\dsfVorbisDecoder.dll
2009-07-11 22:08 - 2009-07-11 22:08 - 0001860 _____ () C:\Program Files\Common Files\Microsoft.VC90.CRT.manifest
2011-04-18 21:51 - 2011-04-18 21:51 - 0569680 _____ (Microsoft Corporation) C:\Program Files\Common Files\MSVCP90.dll
2011-04-18 21:51 - 2011-04-18 21:51 - 0653136 _____ (Microsoft Corporation) C:\Program Files\Common Files\MSVCR90.dll
2010-12-16 20:39 - 2010-12-16 20:39 - 0412672 _____ (Google) C:\Program Files\Common Files\vp8decoder.dll
2010-12-16 20:39 - 2010-12-16 20:39 - 0701440 _____ (Google) C:\Program Files\Common Files\vp8encoder.dll
2010-12-16 20:39 - 2010-12-16 20:39 - 0302592 _____ (Google) C:\Program Files\Common Files\webmmux.dll
2010-12-16 20:39 - 2010-12-16 20:39 - 0292352 _____ (Google) C:\Program Files\Common Files\webmsplit.dll
2011-01-12 01:00 - 2011-01-12 01:00 - 0030208 _____ () C:\Program Files\Common Files\wmpinfo.dll
2012-10-06 18:11 - 2012-10-06 18:11 - 0027648 ____H () C:\Users\Haiopei\AppData\Roaming\MBSRegistrationPlugin4987.dll
2012-10-06 18:11 - 2012-10-06 18:11 - 0052224 ____H () C:\Users\Haiopei\AppData\Roaming\MBSResPlugin4707.dll
2010-05-23 17:50 - 2011-02-28 00:22 - 0030138 _____ () C:\Users\Haiopei\AppData\Roaming\mdbu.bin
2012-10-06 18:11 - 2012-10-06 18:11 - 0088576 ____H () C:\Users\Haiopei\AppData\Roaming\rbap550.dll
2014-11-20 21:06 - 2014-11-20 22:58 - 14344192 _____ () C:\Users\Haiopei\AppData\Roaming\Sandra.mdb
2011-07-09 00:46 - 2011-07-09 00:46 - 0000000 _____ () C:\Users\Haiopei\AppData\Roaming\wklnhst.dat
2010-05-22 13:11 - 2014-10-11 13:07 - 0011264 _____ () C:\Users\Haiopei\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-09-21 18:41 - 2013-09-21 18:41 - 0001399 _____ () C:\Users\Haiopei\AppData\Local\recently-used.xbel
2011-08-08 20:35 - 2011-08-08 20:35 - 0000000 _____ () C:\Users\Haiopei\AppData\Local\{D3658853-4D5E-4D05-A4DE-30C83734AF6B}
2010-09-10 16:08 - 2010-09-10 16:08 - 0000008 ____N () C:\ProgramData\613AD1B23E.sys
2011-12-12 20:45 - 2012-01-15 20:59 - 1025382 _____ () C:\ProgramData\bdinstall.bin
2010-11-05 20:50 - 2010-11-08 22:11 - 0000056 ____H () C:\ProgramData\ezsidmv.dat
2010-09-10 16:08 - 2010-09-10 16:09 - 0005642 ___SH () C:\ProgramData\KGyGaAvL.sys
2011-08-18 18:03 - 2012-03-22 19:21 - 0000193 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc
2011-12-20 21:17 - 2011-12-20 21:55 - 0002816 _____ () C:\ProgramData\search_result.xml

Some content of TEMP:
====================
C:\Users\Haiopei\AppData\Local\Temp\avgnt.exe
C:\Users\Haiopei\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpf4navs.dll
C:\Users\Haiopei\AppData\Local\Temp\Quarantine.exe
C:\Users\Haiopei\AppData\Local\Temp\sfextra.dll
C:\Users\Haiopei\AppData\Local\Temp\sqlite3.dll
C:\Users\Haiopei\AppData\Local\Temp\SSUPDATE.EXE


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-03-05 12:50

==================== End Of Log ============================

--- --- ---

--- --- ---

Haiopei · 08.03.2015, 18:29

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 08-03-2015 03
Ran by Haiopei at 2015-03-08 18:23:18
Running from C:\Users\Haiopei\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

µTorrent (HKLM\...\uTorrent) (Version: 3.1.3 - )
7-Zip 9.34 alpha (HKLM\...\7-Zip) (Version:  - )
Activation Assistant for the 2007 Microsoft Office suites (HKLM\...\Activation Assistant for the 2007 Microsoft Office suites) (Version:  - Microsoft Corporation)
Activation Assistant for the 2007 Microsoft Office suites (Version: 1.0 - Microsoft Corporation) Hidden
Adobe Digital Editions 2.0 (HKLM\...\Adobe Digital Editions 2.0) (Version: 2.0 - Adobe Systems Incorporated)
Adobe Flash Player 16 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 16.0.0.296 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Flash Player 16 PPAPI (HKLM\...\Adobe Flash Player PPAPI) (Version: 16.0.0.296 - Adobe Systems Incorporated)
Adobe Photoshop CS2 (HKLM\...\Adobe Photoshop CS2 - {236BB7C4-4419-42FD-0407-1E257A25E34D}) (Version: 9.0 - Adobe Systems, Inc.)
Adobe Reader XI (11.0.09) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.09 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) (HKLM\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.1 (HKLM\...\Adobe Shockwave Player) (Version: 12.1.6.156 - Adobe Systems, Inc.)
Aiseesoft TRP Konverter 6.2.16 (HKLM\...\{641C2187-AB15-415b-9587-D5B310A19ADC}_is1) (Version:  - )
ALDI Foto Service (HKLM\...\ALDI Foto Service D) (Version: 4.5.9.141 - MAGIX AG)
ALDI Nord Foto Manager Free (HKLM\...\ALDI Nord Foto Manager Free D) (Version: 6.0.1.491 - MAGIX AG)
Aldi Nord Fotoservice (HKLM\...\Aldi Nord Fotoservice_is1) (Version:  - )
ALDI Nord Online Druck Service (HKLM\...\ALDI Nord Online Druck Service D) (Version: 4.5.1.0 - MAGIX AG)
AllDup 3.4.24 (HKLM\...\AllDup_is1) (Version: 3.4.24 - Michael Thummerer Software Design)
AM-DeadLink 4.1 (HKLM\...\aignesamdeadlink_is1) (Version: 4.1 - www.aignes.com)
Any Video Converter 5.7.6 (HKLM\...\Any Video Converter_is1) (Version:  - Any-Video-Converter.com)
Apple Application Support (HKLM\...\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.)
Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Archivarius 3000 (Version 4.44/x32) (HKLM\...\Archivarius 3000_is1) (Version:  - Likasoft)
ArcSoft MediaImpression 2 (HKLM\...\{81FC0476-9507-4CD3-95A7-2BE60E256D1D}) (Version: 2.0.27.846 - ArcSoft)
Ashampoo ClipFinder HD v.2.3.2 (HKLM\...\Ashampoo ClipFinder HD_is1) (Version: 2.3.2 - Ashampoo GmbH & Co. KG)
Ashampoo Music Studio 2012 v.1.0.0 (HKLM\...\Ashampoo Music Studio 2012_is1) (Version: 1.0.0 - Ashampoo GmbH & Co. KG)
Ashampoo Photo Commander 11 v.11.1.6 (HKLM\...\{C92AB6F1-0F9C-8526-5DF1-0A2FD0FB33D9}_is1) (Version: 11.1.6 - Ashampoo GmbH & Co. KG)
Ashampoo Photo Commander 7.60 (HKLM\...\Ashampoo Photo Commander 7_is1) (Version: 7.6.0 - ashampoo GmbH & Co. KG)
Ashampoo Photo Converter v.1.0.1 (HKLM\...\Ashampoo Photo Converter_is1) (Version: 1.0.1 - Ashampoo GmbH & Co. KG)
Atomuhr (HKLM\...\{F5CEAB8C-19F8-4A29-9977-FED8D5DE6D31}) (Version: 1.0.1 - A. Weintrub)
Audials (HKLM\...\{89740E68-3E04-4A02-96BD-7B17AC443938}) (Version: 9.0.55304.400 - RapidSolution Software AG)
Audials TV (HKLM\...\{1A0B8239-664B-434A-99D8-C50793513249}) (Version: 1.3.10800.0 - RapidSolution Software AG)
AudialsOne (HKLM\...\{80C7431E-CB45-40F4-AB4E-090E8AD4706D}) (Version: 4.0.33916.1600 - RapidSolution Software AG)
Audiograbber 1.83 SE  (HKLM\...\Audiograbber) (Version: 1.83 SE  - Audiograbber Deutschland)
Audiograbber Lame-MP3-Plugin (HKLM\...\Audiograbber-Lame) (Version: 1.0 - AG)
Avira (HKLM\...\{d9ed6dcf-6bfc-4fbb-802e-81dd5b767d6e}) (Version: 1.1.32.25147 - Avira Operations & Co. KG)
Avira (Version: 1.1.32.25147 - Avira Operations & Co. KG) Hidden
Avira Free Antivirus (HKLM\...\Avira AntiVir Desktop) (Version: 15.0.8.650 - Avira)
BenVista PhotoZoom Classic 2.0 (HKLM\...\PhotoZoom Classic 2) (Version: 2.0 - BenVista Ltd)
Biet-O-Matic v2.14.8 (HKLM\...\Biet-O-Matic v2.14.8) (Version: 2.14.8 - BOM Development Team)
CCleaner (HKLM\...\CCleaner) (Version: 5.01 - Piriform)
Compatibility Pack für 2007 Office System (HKLM\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Computer Schiffe Versenken XXL Deluxe (HKLM\...\Computer Schiffe Versenken XXL Deluxe_is1) (Version:  - media Verlagsgesellschaft mbH)
COMPUTERBILD-Abzockschutz (HKLM\...\{2664E454-FECE-42E9-A7EF-6B5EB62AC67B}) (Version: 1.0.58 - J3S)
COMPUTERBILD-PC-Schnellstarter (HKLM\...\{729713E3-CFD5-4E9F-A301-5BD8EA25A28B}) (Version: 1.0.7 - J3S)
Contents (Version: 1.6.1.109 - Corel Corporation) Hidden
Corel MediaOne (HKLM\...\{A062A15F-9CAC-4B88-98DF-87628A0BD721}) (Version: 2.100.0000 - Corel Corporation)
Corel Paint Shop Pro Photo X2 (HKLM\...\{64E72FB1-2343-4977-B4A8-262CD53D0BD3}) (Version: 12.50.0000 - Corel Corporation)
Corel Painter Photo Essentials 4 (HKLM\...\_{707EB912-C597-49D8-9460-46CC9AB03EBE}) (Version:  - Corel Corporation)
Corel Painter Photo Essentials 4 (Version: 4.0 - Corel Corporation) Hidden
Corel PaintShop Photo Pro X3 (HKLM\...\_{D1AEB5DB-04FA-489D-94EF-8600898B93EE}) (Version: 1.6.1.109 - Corel Corporation)
Corel PaintShop Photo Pro X3 (Version: 1.00.0000 - Corel Corporation) Hidden
CorelDRAW Essential Edition 3 (HKLM\...\_{ADDBE07D-95B8-4789-9C76-187FFF9624B4}) (Version:  - Corel Corporation)
CorelDRAW Essential Edition 3 (Version: 3.0 - Corel Corporation) Hidden
CPUID CPU-Z 1.72 (HKLM\...\CPUID CPU-Z_is1) (Version:  - )
CyberLink LabelPrint 2.5 (HKLM\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.0.6603 - CyberLink Corp.)
CyberLink Power2Go (HKLM\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.1.3213 - CyberLink Corp.)
CyberLink Power2Go 9 (HKLM\...\InstallShield_{57D68FAE-CB5E-4fd6-AE3B-A0B43375AF18}) (Version: 9.0.1827.0 - CyberLink Corp.)
CyberLink PowerDVD Copy (HKLM\...\{E3D04529-6EDB-11D8-A372-0050BAE317E1}) (Version: 1.0.6720 - CyberLink Corp.)
CyberLink WaveEditor 2 (HKLM\...\InstallShield_{324F76CC-D8DD-4D87-B77D-D4AF5E1AA7B3}) (Version: 2.0.0.4203 - CyberLink Corp.)
D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden
DE (Version: 3.0 - Corel Corporation) Hidden
DeepBurner v1.9.0.228 (HKLM\...\{2ADE2157-7A5E-122C-B51D-EB8A01B15943}) (Version:  - )
DeviceIO (Version: 1.6.1.109 - Corel Corporation) Hidden
Dropbox (HKU\S-1-5-21-2886736790-1064491100-3460348771-1000\...\Dropbox) (Version: 3.2.7 - Dropbox, Inc.)
DSL-Speedtest (HKLM\...\{5C98D841-6392-41F1-A80E-B1A741F32A95}) (Version: 1.00.0000 - COMPUTER BILD)
EA SPORTS online 2005 (HKLM\...\82A44D22-9452-49FB-00FB-CEC7DCAF7E23) (Version:  - )
Exact Audio Copy 1.0beta3 (HKLM\...\Exact Audio Copy) (Version: 1.0beta3 - Andre Wiethoff)
FIFA 09 (HKLM\...\{2315B23D-3E21-4920-837D-AE6460934ECB}) (Version: 1.0.1.1 - Electronic Arts)
FIFA 2005 (HKLM\...\{E4E3E62E-16D7-425E-009C-DCB5E64F5955}) (Version:  - )
Firebird 2.1.1.17910 (Win32) (HKLM\...\FBDBServer_2_1_is1) (Version: 2.1.1.17910 - Firebird Project)
Firebird SQL Server - MAGIX Edition (HKLM\...\{34EB6245-C8D0-4D8A-B8D8-EEBFF7A91485}) (Version: 2.1.27.0 - MAGIX AG)
FlightGear v2.0.0 (HKLM\...\FlightGear_is1) (Version:  - The FlightGear Team)
Formatwandler 2013 (HKLM\...\{98C7891F-4BA8-48D3-0001-D4DD055B2886}) (Version: 5.0.12.625 - S.A.D.)
Formatwandler 5 (HKLM\...\{CC5A25E6-7564-48FF-0001-D4DD055B2886}) (Version: 5.0.13.610 - S.A.D.)
Fraps (HKLM\...\Fraps) (Version:  - )
Free Mp3 Wma Converter V 2.2 (HKLM\...\Free Mp3 Wma Converter_is1) (Version: 2.2.0.0 - Koyote Lab Inc.)
Free Video Editor version 1.4.5.923 (HKLM\...\Free Video Editor_is1) (Version: 1.4.5.923 - DVDVideoSoft Ltd.)
Free YouTube to MP3 Converter version 3.9.32 (HKLM\...\Free YouTube to MP3 Converter_is1) (Version:  - DVDVideoSoft Limited.)
FreeCommander 2009.02 (HKLM\...\FreeCommander_is1) (Version: 2009.02 - Marek Jasinski)
GetFoldersize 2.2.3 (HKLM\...\GetFoldersize_is1) (Version: 2.2.3 - Michael Thummerer Software Design)
GIMP 2.8.14 (HKLM\...\GIMP-2_is1) (Version: 2.8.14 - The GIMP Team)
Glary Utilities 5.20 (HKLM\...\Glary Utilities 5) (Version: 5.20.0.35 - Glarysoft Ltd)
Google Chrome (HKLM\...\Google Chrome) (Version: 40.0.2214.115 - Google Inc.)
Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (Version: 1.3.26.9 - Google Inc.) Hidden
GoogleClean (HKLM\...\{4281435C-AD1D-4C8A-B9C0-3961C08EF142}_is1) (Version: 4.0.112 - Abelssoft)
Grand Prix 4 (HKLM\...\{C7D27207-0F86-4B6F-859C-21800A2C592E}) (Version:  - )
Half-Life (HKLM\...\Half-Life) (Version:  - )
Hardcopy (C:\Program Files\Hardcopy) (HKLM\...\Hardcopy(C__Program Files_Hardcopy)) (Version: 2011.12.02 - www.hardcopy.de)
HD Tune 2.55 (HKLM\...\HD Tune_is1) (Version:  - EFD Software)
ICA (Version: 1.6.1.109 - Corel Corporation) Hidden
IkaPdfLite (HKU\S-1-5-21-2886736790-1064491100-3460348771-1000\...\812ed091a76d5b25) (Version: 1.0.0.21 - IKaGen)
IkaPdfLite (HKU\S-1-5-21-2886736790-1064491100-3460348771-1002\...\812ed091a76d5b25) (Version: 1.0.0.21 - IKaGen)
Intel(R) Rapid Storage Technology (HKLM\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 9.5.0.1037 - Intel Corporation)
IPM_PSP_Pro (Version: 1.00.0000 - Corel Corporation) Hidden
IrfanView (remove only) (HKLM\...\IrfanView) (Version: 4.38 - Irfan Skiljan)
JAP (HKLM\...\JAP) (Version: 00.16.006 - JAP-Team)
Java 7 Update 67 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F03217067FF}) (Version: 7.0.670 - Oracle)
Java(TM) 6 Update 35 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83216035FF}) (Version: 6.0.350 - Oracle)
Junk Mail filter update (Version: 14.0.8089.726 - Microsoft Corporation) Hidden
Karaoke 5 ver. 39.24 (HKLM\...\Karaoke 5_is1) (Version: 39.24 - MediaSoft)
K-Lite Mega Codec Pack 6.8.0 (HKLM\...\KLiteCodecPack_is1) (Version: 6.8.0 - )
LibreOffice 4.4.0.3 (HKLM\...\{8BEE1CDD-F95D-4759-952D-6B38DF99D1F0}) (Version: 4.4.0.3 - The Document Foundation)
Listary version 3.23 (HKLM\...\Listary_is1) (Version: 3.23 - )
Loadstreet Highspeed Surfer 2.0 Professional (HKLM\...\{AED7E4B5-381E-4E47-BB54-E5127B5A28E0}_is1) (Version: 2.0 - Reohix)
MAGIX Foto Designer 7 (HKLM\...\MAGIX_{2DCD52EE-1AE1-4128-9819-A79F7D09B6B3}) (Version: 7.0.1.1 - MAGIX AG)
MAGIX Foto Designer 7 (Version: 7.0.1.1 - MAGIX AG) Hidden
MAGIX Foto Manager 10 (HKLM\...\MAGIX_MSI_Foto_Manager_10) (Version: 8.0.1.137 - MAGIX AG)
MAGIX Foto Manager 10 (Version: 8.0.1.137 - MAGIX AG) Hidden
MAGIX Online Druck Service (HKLM\...\{3E0E4F57-8FE0-4812-840B-56EB8CC3DB7B}) (Version: 3.4.3.0 - MAGIX AG)
MAGIX PC Check & Tuning Free 2011 (HKLM\...\MAGIX_MSI_PC_Check_Tuning_Free_2011) (Version: 6.0.403.1050 - MAGIX AG)
MAGIX PC Check & Tuning Free 2011 (Version: 6.0.403.1050 - MAGIX AG) Hidden
MAGIX Screenshare (HKLM\...\{B63DFA23-5C10-44B4-881D-45EFBF4A4761}) (Version: 4.3.6.1987 - MAGIX AG)
Mahjong City (HKLM\...\Mahjong City_is1) (Version:  - )
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.150.1 - McAfee, Inc.)
MEDION Fotos auf CD & DVD SE Nord (HKLM\...\MEDION Fotos auf CD & DVD SE Nord D) (Version: 8.0.3.4 - MAGIX AG)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Age of Empires II (HKLM\...\Age of Empires 2.0) (Version:  - )
Microsoft Combat Flight Simulator 3.0 (HKLM\...\Combat Flight Simulator 3.0) (Version:  - )
Microsoft Encarta 99 Enzyklopädie (HKLM\...\Encarta99D) (Version: 99D - Microsoft Corporation)
Microsoft Flight Simulator X (HKLM\...\InstallShield_{9527A496-5DF9-412A-ADC7-168BA5379CA6}) (Version: 10.0.60905 - Microsoft Game Studios)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{90120000-0100-0407-0000-0000000FF1CE}_OMUI.de-de_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}) (Version:  - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office Enterprise 2007 (HKLM\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (HKLM\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Language Pack 2007 - German/Deutsch (HKLM\...\OMUI.de-de) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office PowerPoint Viewer 2007 (German) (HKLM\...\{95120000-00AF-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.31211.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [DEU] (HKLM\...\{BAC80EF3-E106-4AEA-8C57-F217F9BC7358}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual Basic PowerPacks 1.2 (HKLM\...\{EE96B6C8-3660-3B5E-AC95-843CDF03D613}) (Version: 9.0.30729 - Microsoft)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022.218 (HKLM\...\{E503B4BF-F7BB-3D5F-8BC8-F694B1CFF942}) (Version: 9.0.21022.218 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM\...\{3C3D696B-0DB7-3C6D-A356-3DB8CE541918}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Works (HKLM\...\{39D0E034-1042-4905-BECB-5502909FCB7C}) (Version: 9.7.0621 - Microsoft Corporation)
MLE (Version: 1.0.0.23 - Corel Corporation) Hidden
Mozilla Firefox 36.0.1 (x86 de) (HKLM\...\Mozilla Firefox 36.0.1 (x86 de)) (Version: 36.0.1 - Mozilla)
Mozilla Firefox 6.0 (x86 de) (HKLM\...\Mozilla Firefox 6.0 (x86 de)) (Version: 6.0 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 34.0.5 - Mozilla)
MP3Find pro v4.93 (HKLM\...\{22AE56FC-D99B-4A65-A4EE-4FD9DF1415E9}) (Version: 4.93.001 - hxxp://www.mp3find-online.de)
Mp3tag v2.66 (HKLM\...\Mp3tag) (Version: v2.66 - Florian Heidenreich)
MSI to redistribute MS VS2005 CRT libraries (HKLM\...\{A8D93648-9F7F-407D-915C-62044644C3DA}) (Version: 8.0.50727.42 - The Firebird Project)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP2 Parser und SDK (HKLM\...\{716E0306-8318-4364-8B8F-0CC4E9376BAC}) (Version: 4.20.9818.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (HKLM\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2721691) (HKLM\...\{355B5AC0-CEEE-42C5-AD4D-7F3CFD806C36}) (Version: 4.30.2114.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
mufin player 2.0 (HKLM\...\MAGIX_MSI_mufin_player_2) (Version: 2.0.0.135 - mufin GmbH)
mufin player 2.0 (Version: 2.0.0.135 - mufin GmbH) Hidden
MusicBee 2.4 (HKLM\...\MusicBee) (Version: 2.4 - Steven Mayall)
MyFreeCodec (HKU\S-1-5-21-2886736790-1064491100-3460348771-1002\...\MyFreeCodec) (Version:  - )
MyPhoneExplorer (HKLM\...\MPE) (Version: 1.8.6 - F.J. Wechselberger)
Nero - Burning Rom (HKLM\...\Nero - Burning Rom) (Version:  - )
Netzmanager (HKLM\...\Netzmanager) (Version: 1.045 - Deutsche Telekom AG)
Nitro Reader 3 (HKLM\...\{F5451D00-B448-4E9A-82DC-1929F4F1910D}) (Version: 3.5.6.5 - Nitro)
NVIDIA Display Control Panel (HKLM\...\NVIDIA Display Control Panel) (Version: 6.14.11.9745 - NVIDIA Corporation)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.10.59.37 - NVIDIA Corporation)
NVIDIA PhysX (HKLM\...\{E10DB5DA-E576-40EA-A7FC-1CB2A7B283A6}) (Version: 9.09.1112 - NVIDIA Corporation)
Ocster Backup Business 6.07 (HKLM\...\Ocster Backup) (Version: 6.07 - Ocster GmbH & Co. KG)
Office-Bibliothek (HKLM\...\{5C81B189-5456-40C4-9313-7FE6FA6DD64C}) (Version: 5.00.3 - Bibliographisches Institut & F.A. Brockhaus AG)
OGA Notifier 2.0.0048.0 (Version: 2.0.0048.0 - Microsoft Corporation) Hidden
OpenAL (HKLM\...\OpenAL) (Version:  - )
OpenOffice 4.1.0 (HKLM\...\{E19483E2-6C18-494D-A307-D4498BCFD2C7}) (Version: 4.10.9764 - Apache Software Foundation)
Opera Stable 24.0.1558.64 (HKLM\...\Opera 24.0.1558.64) (Version: 24.0.1558.64 - Opera Software ASA)
Paint Shop Pro 7 Evaluation (HKLM\...\{D6DE02C7-1F47-11D4-9515-00105AE4B89A}) (Version: 7.0.0.0000 - Jasc Software Inc)
Panda Batch File Renamer 2.3 (HKLM\...\{CDA3670E-687A-4EC2-8383-3D1AF8767AAA}_is1) (Version: 2.3 - Animal Software)
Partition Commander 11 (32-Bit) (HKLM\...\{69742A9A-B7C4-433B-98B2-53D597598793}_is1) (Version:  - Avanquest Deutschland GmbH)
PC Wizard 2010.1.94 (HKLM\...\PC Wizard 2010_is1) (Version:  - Laurent KUTIL & Franck DELATTRE)
PC Wizard 2013.2.12 (HKLM\...\PC Wizard 2013_is1) (Version:  - CPUID)
PDASkat (remove only) (HKLM\...\PDASkat) (Version:  - )
PDF Architect 2 (HKLM\...\PDF Architect 2) (Version: 2.0.51.17865 - pdfforge GmbH)
PDF Architect 2 Create Module (Version: 2.1.6.19758 - pdfforge GmbH) Hidden
PDF Architect 2 Edit Module (Version: 2.1.6.19758 - pdfforge GmbH) Hidden
PDF Architect 2 View Module (Version: 2.1.6.19758 - pdfforge GmbH) Hidden
PDFCreator (HKLM\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 2.0.2 - pdfforge)
PDFTK Builder 3.5.3 (HKLM\...\PDFTK Builder_is1) (Version:  - )
PHOTORECOVERY LE (HKLM\...\{8D03A164-B586-4318-AFE6-870A5E2739C1}) (Version: 1.0.0 - LC Technology International)
Picasa 3 (HKLM\...\Picasa 3) (Version: 3.9 - Google, Inc.)
Pimero 2012 R1 (HKLM\...\Pimero 2012 R1_is1) (Version:  - soft-evolution)
PixiePack Codec Pack (HKLM\...\{A8D647C8-65AC-409F-B7B2-3C0FEE1A32F2}) (Version: 1.1.1200.0 - None)
Polipo 1.0.4.1 (HKLM\...\Polipo) (Version:  - )
PSPH10Pro (Version: 1.00.0000 - Corel Corporation) Hidden
PSPPContent (Version: 1.00.0000 - Corel Corporation) Hidden
PSPPRO_DCRAW (Version: 13.0.0 - Corel Corporation) Hidden
PureHD (Version: 1.6.1.109 - Corel Corporation) Hidden
PVSonyDll (Version: 1.00.0001 - NVIDIA Corporation) Hidden
QuickTime 7 (HKLM\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)
Radio.fx (HKLM\...\Tobit Radio.fx Server) (Version:  - Tobit.Software)
Radiotracker (HKLM\...\{1E863F44-2D2D-4BD7-B25B-EDA9FF622267}) (Version: 6.2.13700.0 - RapidSolution Software AG)
RealDownloader (Version: 1.3.3 - RealNetworks, Inc.) Hidden
RealNetworks - Microsoft Visual C++ 2008 Runtime (Version: 9.0 - RealNetworks, Inc) Hidden
RealNetworks - Microsoft Visual C++ 2010 Runtime (Version: 10.0 - RealNetworks, Inc) Hidden
RealPlayer (HKLM\...\RealPlayer 16.0) (Version: 16.0.3 - RealNetworks)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5910 - Realtek Semiconductor Corp.)
RealUpgrade 1.1 (Version: 1.1.0 - RealNetworks, Inc.) Hidden
Revo Uninstaller 1.95 (HKLM\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Rossmann Fotowelt Software 4.12.1 (HKLM\...\Rossmann Fotowelt Software) (Version: 4.12.1 - ORWO Net)
Samsung Kies (HKLM\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.6.0.13064_2 - Samsung Electronics Co., Ltd.)
Samsung Kies (Version: 2.6.0.13064_2 - Samsung Electronics Co., Ltd.) Hidden
Samsung Kies3 (HKLM\...\InstallShield_{88547073-C566-4895-9005-EBE98EA3F7C7}) (Version: 3.2.14113.3 - Samsung Electronics Co., Ltd.)
Samsung Kies3 (Version: 3.2.14113.3 - Samsung Electronics Co., Ltd.) Hidden
Samsung Story Album Viewer (HKLM\...\InstallShield_{698BBAD8-B116-495D-B879-0F07A533E57F}) (Version: 1.0.0.13054_1 - Samsung Electronics Co., Ltd.)
Samsung Story Album Viewer (Version: 1.0.0.13054_1 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.49.0 - SAMSUNG Electronics Co., Ltd.)
Schachmeister 2011 (HKLM\...\{4B5DFDB3-62F9-4F60-BBA8-797A1509EC66}) (Version: 11.0 - ChessBase)
Schachmeister 2011 (Version: 11.0 - ChessBase) Hidden
Seagate Manager Installer (HKLM\...\InstallShield_{E6F019F1-DFB6-4853-A87D-6E31624755A9}) (Version: 2.02.0109 - Seagate)
Seagate Manager Installer (Version: 2.02.0109 - Seagate) Hidden
Secunia PSI (3.0.0.9016) (HKLM\...\Secunia PSI) (Version: 3.0.0.9016 - Secunia)
Security Task Manager 1.8d (HKLM\...\Security Task Manager) (Version: 1.8d - Neuber Software)
Serif PhotoPlus X2 (HKLM\...\{FC935397-C56E-4EE3-B9BC-1F7F3EA6CE41}) (Version: 12.0.3.013 - Serif (Europe) Ltd)
Setup (Version: 1.6.1.109 - Corel Corporation) Hidden
Share (Version: 1.6.1.109 - Corel Corporation) Hidden
Sid Meier's Civilization 4 (HKLM\...\{CFBCE791-2D53-4FCE-B3FB-D6E01F4112E8}) (Version: 1.00.0000 - Firaxis Games)
Sid Meier's Civilization 4 (Version: 1.00.0000 - Firaxis Games) Hidden
Sierra Utilities (HKLM\...\Sierra Utilities) (Version:  - )
SiSoftware Sandra Lite 2015 (HKLM\...\{C3113E55-7BCB-4de3-8EBF-60E6CE6B2496}_is1) (Version: 21.10.2015.1 - SiSoftware)
Skype™ 6.11 (HKLM\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
SL-6640 Black Widow Flightstick (HKLM\...\InstallShield_{10D4F38B-5436-4673-B861-F301929B373B}) (Version: 3.1 - Joellenbeck GmbH)
SL-6640 Black Widow Flightstick (Version: 3.1 - Joellenbeck GmbH) Hidden
Soda PDF (HKLM\...\{4B6B2E2E-FE08-4EC5-9EE0-9B1D454AC995}) (Version: 1.2.26 - LULU Software)
Soda PDF 5 (HKLM\...\{DC25D68D-38AF-4768-83F2-680FD72285DF}) (Version: 5.1.192.10803 - LULU Software Limited)
SoftMaker Office 2008 (C:\Programme\SoftMaker Office 2008) (HKLM\...\sm-un1.u32) (Version:  - SoftMaker Software GmbH)
Soluto (HKLM\...\{CD616D0D-48E4-4B6E-AACA-76ABA3147057}) (Version: 1.3.729.0 - Soluto)
SopCast 3.9.3 (HKLM\...\SopCast) (Version: 3.9.3 - www.sopcast.com)
SpeedFan (remove only) (HKLM\...\SpeedFan) (Version:  - )
Spelling Dictionaries Support For Adobe Reader 9 (HKLM\...\{AC76BA86-7AD7-5464-3428-900000000004}) (Version: 9.0.0 - Adobe Systems Incorporated)
Spider Player 2.5.3 (HKLM\...\Spider Player_is1) (Version: 2.5.3.0 - VIT Software, LLC)
Startpage24 (HKLM\...\Startpage24) (Version:  - Link64)
SUPER © v2012.build.51 (April 7, 2012) Version v2012.build.51 (HKLM\...\{B93DCF58-AA57-41EC-8D69-B05C66C6312D}_is1) (Version: v2012.build.51 - eRightSoft)
SUPERAntiSpyware (HKLM\...\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}) (Version: 4.39.1002 - SUPERAntiSpyware.com)
swMSM (Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
TeraCopy 2.12 (HKLM\...\TeraCopy_is1) (Version:  - Code Sector Inc.)
Texas Hold ‘Em Poker Deluxe DEMO 1.0 (HKLM\...\{C88DD9B7-AC6C-412F-AE1A-ED7D7B9F1259}_is1) (Version: Texas Hold ‘Em Poker Deluxe DEMO - Zone 2 Media GmbH)
Texas Hold'em Poker (HKLM\...\{A8C8EF21-88F1-4845-A0BF-5B2D66B5DD33}_is1) (Version: 1.0 - rondomedia)
ThumbsPlus Version 2002-R (Standard-Edition) (HKLM\...\ThumbsPlus 2002) (Version:  - )
Tor 0.2.1.26 (HKLM\...\Tor) (Version:  - )
Total Commander (Remove or Repair) (HKLM\...\Totalcmd) (Version: 8.51a - Ghisler Software GmbH)
Trendpoker 3D - Texas Hold'em Poker - DEMO (HKLM\...\{E3F696A6-98D9-438E-B942-B498087C015B}_is1) (Version: 1.9 - BUFOproject)
TuneUp Utilities 2014 (de-DE) (Version: 14.0.1000.221 - TuneUp Software) Hidden
TuneUp Utilities 2014 (HKLM\...\TuneUp Utilities) (Version: 14.0.1000.221 - TuneUp Software)
TuneUp Utilities 2014 (Version: 14.0.1000.221 - TuneUp Software) Hidden
TuneUp Utilities Language Pack (de-DE) (Version: 10.0.4600.4 - TuneUp Software) Hidden
TuneUp Utilities Language Pack (de-DE) (Version: 12.0.3600.114 - TuneUp Software) Hidden
TuneUp Utilities Language Pack (de-DE) (Version: 13.0.4000.271 - TuneUp Software) Hidden
TuneUp Utilities Language Pack (de-DE) (Version: 9.0.6020.1 - TuneUp Software) Hidden
TurboFLOORPLAN Garten- & Landschaftsarchitekt (HKLM\...\InstallShield_{EC36B80D-3A0B-44D2-A066-9F346FE05D54}) (Version: 12.1 - IMSIDesign)
TVUPlayer 2.5.3.1 (HKLM\...\TVUPlayer) (Version: 2.5.3.1 - TVU networks)
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM\...\{90120000-001A-0407-0000-0000000FF1CE}_OMUI.de-de_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
Update Manager (Version: 4.60 - Corel Corporation) Hidden
Veetle TV (HKLM\...\Veetle TV) (Version: 0.9.19 - Veetle, Inc)
Vidalia 0.2.9 (HKLM\...\Vidalia) (Version:  - )
Video Download Capture Version 4.9.1 (HKLM\...\{3C9D008D-3716-4C3F-90CD-38ED57568FAB}_is1) (Version: 4.9.1 - APOWERSOFT LIMITED)
VIO (Version: 1.6.1.109 - Corel Corporation) Hidden
VLC media player (HKLM\...\VLC media player) (Version: 2.2.0 - VideoLAN)
WEB.DE Toolbar für Internet Explorer 8 (HKLM\...\1&1 Mail & Media GmbH Toolbar IE8) (Version: 1.2.20.0 - 1&1 Mail & Media GmbH)
WEB.DE Toolbar MSVC90 CRT (Version: 1.0.0 - 1&1 Mail & Media GmbH) Hidden
webcam 7 (HKLM\...\webcam 7) (Version: 0.9.9.43 - Moonware Studios)
Winamp (HKLM\...\Winamp) (Version: 5.666  - Nullsoft, Inc)
Windows Live Sync (HKLM\...\{76618402-179D-4699-A66B-D351C59436BC}) (Version: 14.0.8089.726 - Microsoft Corporation)
Windows Live-Uploadtool (HKLM\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
Windows Media Encoder 9 Series (HKLM\...\Windows Media Encoder 9) (Version:  - )
Windows Media Player Firefox Plugin (HKLM\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)
Windows Mobile Device Center Driver Update (HKLM\...\{E7044E25-3038-4A76-9064-344AC038043E}) (Version: 6.1.6965.0 - Microsoft Corporation)
Windows Mobile®-Gerätehandbuch (HKLM\...\Windows Mobile Device Handbook) (Version: 1.0 - Microsoft Corporation)
Windows Mobile-Gerätecenter (HKLM\...\{904CCF62-818D-4675-BC76-D37EB399F917}) (Version: 6.1.6965.0 - Microsoft Corporation)
WinHTTrack Website Copier 3.48-13 (HKLM\...\WinHTTrack Website Copier_is1) (Version: 3.48.13 - HTTrack)
WinZip (HKLM\...\WinZip) (Version:  - )
Xfire (remove only) (HKLM\...\Xfire) (Version:  - )
XMedia Recode 2.2.8.3 (HKLM\...\XMedia Recode) (Version: 2.2.8.3 - Sebastian Dörfler)
XnView 2.31 (HKLM\...\XnView_is1) (Version: 2.31 - Gougelet Pierre-e)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Haiopei\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{00EEBF57-477D-4084-9921-7AB3C2C9459D}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{0295691A-D674-4904-805C-BDFE165B771B}\localserver32 -> C:\Programme\SoftMaker Office 2008\TextMaker.exe (SoftMaker Software GmbH)
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{06EEE834-461C-42C2-8DCF-1502B527B1F9}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{078759D3-423B-48AD-AB6A-5638C2884DBE}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{08244EE6-92F0-47F2-9FC9-929BAA2E7235}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{0AF10CEC-2ECD-4B92-9581-34F6AE0637F3}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{0B91A74B-AD7C-4A9D-B563-29EEF9167172}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{0C15D503-D017-47CE-9016-7B3F978721CC}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{14074E0B-7216-4862-96E6-53CADA442A56}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{16F3DD56-1AF5-4347-846D-7C10C4192619}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{217FC9C0-3AEA-1069-A2DB-08002B30309D}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32 -> C:\Program Files\7-Zip\7-zip.dll (Igor Pavlov)
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{2916C86E-86A6-43FE-8112-43ABE6BF8DCC}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{30291A01-707C-11d0-B457-4446490043BF}\localserver32 -> C:\Programme\SoftMaker Office 2008\TextMaker.exe (SoftMaker Software GmbH)
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{35786D3C-B075-49B9-88DD-029876E11C01}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{3AD05575-8857-4850-9277-11B85BDB8E09}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{3D154A2D-D911-437E-A30C-5F56A9B7081D}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{3D1975AF-48C6-4F8E-A182-BE0E08FA86A9}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{40DD6E20-7C17-11CE-A804-00AA003CA9F6}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32 -> C:\Program Files\Microsoft Office\Office12\msohevi.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{49F371E1-8C5C-4D9C-9A3B-54A6827F513C}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{4DB26476-6787-4046-B836-E8412A9E8A27}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{603D3801-BD81-11D0-A3A5-00C04FD706EC}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{6311429E-2F1A-4777-880F-C7289FD10169}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{640167B4-59B0-47A6-B335-A6B3C0695AEA}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{693BE9C0-BEC3-11D2-B4C1-C33BBD3AD64B}\InprocServer32 -> C:\ProgramData\AllDup\FEShlExt.dll (Alex Yakovlev)
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{6B9228DA-9C15-419E-856C-19E768A13BDC}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{76D0CB12-7604-4048-B83C-1005C7DDC503}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{7B4A83B6-F704-4B77-8E3D-C6087E3A21D2}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{7BD29E01-76C1-11CF-9DD0-00A0C9034933}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{807C1E6C-1D00-453F-B920-B61BB7CDD997}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{82C588E7-E54B-408C-9F8C-6AF9ADF6F1E9}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{85BBD920-42A0-1069-A2E4-08002B30309D}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{896664F7-12E1-490F-8782-C0835AFD98FC}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{9113A02D-00A3-46B9-BC5F-9C04DADDD5D7}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{920E6DB1-9907-4370-B3A0-BAFC03D81399}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{942BC614-676C-464E-B384-D3202AAA02DA}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{99FD978C-D287-4F50-827F-B2C658EDA8E7}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{9CFC2DF3-6BA3-46EF-A836-E519E81F0EC4}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{A4A1A128-768F-41E0-BF75-E4FDDD701CBA}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{A70C977A-BF00-412C-90B7-034C51DA2439}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{A8005AF0-D6E8-48AF-8DFA-023B1CF660A7}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{AB968F1E-E20B-403A-9EB8-72EB0EB6797E}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{AE054212-3535-4430-83ED-D501AA6680E6}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{B056521A-9B10-425E-B616-1FCD828DB3B1}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{B155BDF8-02F0-451E-9A26-AE317CFD7779}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{B8967F85-58AE-4F46-9FB2-5D7904798F4B}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{bf608490-5373-11d0-8efb-4446490043bf}\localserver32 -> C:\Programme\SoftMaker Office 2008\TextMaker.exe (SoftMaker Software GmbH)
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{C529C7EF-A3AF-45F2-8A47-767B33AA5CC0}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{E88DCCE0-B7B3-11D1-A9F0-00AA0060FA31}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Haiopei\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{EDB5F444-CB8D-445A-A523-EC5AB6EA33C7}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{F81E9010-6EA4-11CE-A7FF-00AA003CA9F6}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Haiopei\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Haiopei\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Haiopei\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Haiopei\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Haiopei\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Haiopei\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Haiopei\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Haiopei\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{FE841493-835C-4FA3-B6CC-B4B2D4719848}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{FF393560-C2A7-11CF-BFF4-444553540000}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000_Classes\CLSID\{FFE2A43C-56B9-4BF5-9A79-CC6D4285608A}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\_ocster_backup_\AppData\Roaming\Dropbox\bin\Dropbox.exe /autoplay No File
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{00EEBF57-477D-4084-9921-7AB3C2C9459D}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{0295691A-D674-4904-805C-BDFE165B771B}\localserver32 -> C:\Programme\SoftMaker Office 2008\TextMaker.exe (SoftMaker Software GmbH)
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{039B2CA5-3B41-4D93-AD77-47D3293FC5CB}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{06EEE834-461C-42C2-8DCF-1502B527B1F9}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{078759D3-423B-48AD-AB6A-5638C2884DBE}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{08244EE6-92F0-47F2-9FC9-929BAA2E7235}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{0AF10CEC-2ECD-4B92-9581-34F6AE0637F3}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{0B91A74B-AD7C-4A9D-B563-29EEF9167172}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{0C15D503-D017-47CE-9016-7B3F978721CC}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{14074E0B-7216-4862-96E6-53CADA442A56}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{16C8C46E-C811-4977-BF0A-B5CC1FA78D95}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{16F3DD56-1AF5-4347-846D-7C10C4192619}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{20C62CA0-15DA-101B-B9A8-444553540000}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{20C62CAB-15DA-101B-B9A8-444553540000}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{217FC9C0-3AEA-1069-A2DB-08002B30309D}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32 -> C:\Program Files\7-Zip\7-zip.dll (Igor Pavlov)
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{2916C86E-86A6-43FE-8112-43ABE6BF8DCC}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{30291A01-707C-11d0-B457-4446490043BF}\localserver32 -> C:\Programme\SoftMaker Office 2008\TextMaker.exe (SoftMaker Software GmbH)
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{35786D3C-B075-49B9-88DD-029876E11C01}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{3AD05575-8857-4850-9277-11B85BDB8E09}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{3D154A2D-D911-437E-A30C-5F56A9B7081D}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{3D1975AF-48C6-4F8E-A182-BE0E08FA86A9}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{40DD6E20-7C17-11CE-A804-00AA003CA9F6}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32 -> C:\Program Files\Microsoft Office\Office12\msohevi.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{42481700-CF3C-4D05-8EC6-F9A1C57E8DC0}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{4516CEE1-97DA-4030-A444-2D8E296B96B6}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{49F371E1-8C5C-4D9C-9A3B-54A6827F513C}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{4DB26476-6787-4046-B836-E8412A9E8A27}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{603D3801-BD81-11D0-A3A5-00C04FD706EC}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{6311429E-2F1A-4777-880F-C7289FD10169}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{640167B4-59B0-47A6-B335-A6B3C0695AEA}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{693BE9C0-BEC3-11D2-B4C1-C33BBD3AD64B}\InprocServer32 -> C:\ProgramData\AllDup\FEShlExt.dll (Alex Yakovlev)
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{6B9228DA-9C15-419E-856C-19E768A13BDC}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{6F237DF9-9DDB-47AD-B218-400D54C286AD}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{76D0CB12-7604-4048-B83C-1005C7DDC503}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{7B4A83B6-F704-4B77-8E3D-C6087E3A21D2}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{7BD29E01-76C1-11CF-9DD0-00A0C9034933}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{807C1E6C-1D00-453F-B920-B61BB7CDD997}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{80A95F12-94C2-4B1D-8AE3-F0CBE5E96E85}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{82C588E7-E54B-408C-9F8C-6AF9ADF6F1E9}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{85BBD920-42A0-1069-A2E4-08002B30309D}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{896664F7-12E1-490F-8782-C0835AFD98FC}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{9113A02D-00A3-46B9-BC5F-9C04DADDD5D7}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{920E6DB1-9907-4370-B3A0-BAFC03D81399}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{942BC614-676C-464E-B384-D3202AAA02DA}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{99FD978C-D287-4F50-827F-B2C658EDA8E7}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{9CFC2DF3-6BA3-46EF-A836-E519E81F0EC4}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{A0359AE6-F410-4425-A975-684AAB785ABD}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{A4A1A128-768F-41E0-BF75-E4FDDD701CBA}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{A70C977A-BF00-412C-90B7-034C51DA2439}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{A8005AF0-D6E8-48AF-8DFA-023B1CF660A7}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{AB968F1E-E20B-403A-9EB8-72EB0EB6797E}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{AE054212-3535-4430-83ED-D501AA6680E6}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{B056521A-9B10-425E-B616-1FCD828DB3B1}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{B155BDF8-02F0-451E-9A26-AE317CFD7779}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{B8967F85-58AE-4F46-9FB2-5D7904798F4B}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{BB1AE0D0-634E-11CF-8996-00AA00688B10}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{BB1AE0D1-634E-11CF-8996-00AA00688B10}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{BB6410D8-F879-4184-9C5C-6A02D16AE0B3}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{bf608490-5373-11d0-8efb-4446490043bf}\localserver32 -> C:\Programme\SoftMaker Office 2008\TextMaker.exe (SoftMaker Software GmbH)
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{C529C7EF-A3AF-45F2-8A47-767B33AA5CC0}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{CA1073A2-5F3F-4445-8E5E-7109BDCEDDBE}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{D0D38C6E-BF64-4C42-840D-3E0019D9F7A6}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{D5A55D2D-C59D-42C3-A5BF-4C08EEE74339}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{E88DCCE0-B7B3-11D1-A9F0-00AA0060FA31}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{EDB5F444-CB8D-445A-A523-EC5AB6EA33C7}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{F81E9010-6EA4-11CE-A7FF-00AA003CA9F6}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\_ocster_backup_\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll No File
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\_ocster_backup_\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll No File
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\_ocster_backup_\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll No File
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\_ocster_backup_\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll No File
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\_ocster_backup_\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll No File
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\_ocster_backup_\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll No File
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\_ocster_backup_\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll No File
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\_ocster_backup_\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll No File
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{FE841493-835C-4FA3-B6CC-B4B2D4719848}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{FF393560-C2A7-11CF-BFF4-444553540000}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002_Classes\CLSID\{FFE2A43C-56B9-4BF5-9A79-CC6D4285608A}\InprocServer32 -> No File Path

==================== Restore Points  =========================

08-03-2015 00:58:24 Geplanter Prüfpunkt

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:04 - 2011-06-25 01:23 - 00435366 ____N C:\Windows\system32\Drivers\etc\hosts
127.0.0.1	www.007guard.com
127.0.0.1	007guard.com
127.0.0.1	008i.com
127.0.0.1	www.008k.com
127.0.0.1	008k.com
127.0.0.1	www.00hq.com
127.0.0.1	00hq.com
127.0.0.1	010402.com
127.0.0.1	www.032439.com
127.0.0.1	032439.com
127.0.0.1	www.0scan.com
127.0.0.1	0scan.com
127.0.0.1	1000gratisproben.com
127.0.0.1	www.1000gratisproben.com
127.0.0.1	1001namen.com
127.0.0.1	www.1001namen.com
127.0.0.1	100888290cs.com
127.0.0.1	www.100888290cs.com
127.0.0.1	www.100sexlinks.com
127.0.0.1	100sexlinks.com
127.0.0.1	10sek.com
127.0.0.1	www.10sek.com
127.0.0.1	www.1-2005-search.com
127.0.0.1	1-2005-search.com
127.0.0.1	123fporn.info
127.0.0.1	www.123fporn.info
127.0.0.1	123haustiereundmehr.com
127.0.0.1	www.123haustiereundmehr.com
127.0.0.1	123moviedownload.com

There are 1000 more lines.


==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0B34F9DC-3AB6-4932-AB64-2DB37F624CFA} - System32\Tasks\{CE569BE0-C271-4DEA-A332-12544FB191A2} => Firefox.exe 
Task: {1E0D205C-D572-4F8B-9885-53257A8D9E83} - System32\Tasks\GU5SkipUAC => C:\Program Files\Glary Utilities 5\Integrator.exe [2015-03-02] (Glarysoft Ltd)
Task: {2F99C29F-A347-445E-A166-05D74CCFE0EC} - System32\Tasks\{0C4AFE2E-43CB-4B15-B34C-711558BE554A} => Firefox.exe 
Task: {320675B3-4A94-4A2C-A637-EF1CCEA0EE22} - System32\Tasks\{8B37E9A7-EF86-4CA1-A04B-B2F5324037D6} => Firefox.exe 
Task: {3519FBB7-A099-4335-B681-E7192DA2D1FC} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-03] (Adobe Systems Incorporated)
Task: {3801F3D3-3D23-4E95-8D0D-30AB5A0BFD00} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-22] (Google Inc.)
Task: {41A746D8-57EF-4CBD-BF69-7C1FD0196AF9} - System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-2886736790-1064491100-3460348771-1000 => C:\Program Files\RealNetworks\RealDownloader\realupgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {42673108-028B-433B-956C-1F8F405EF01E} - System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-2886736790-1064491100-3460348771-1000 => C:\Program Files\RealNetworks\RealDownloader\realupgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {53247EFD-3E87-486D-9A6E-DD75B7FC5D3F} - System32\Tasks\CCleanerSkipUAC => C:\Programme\CCleaner\CCleaner.exe [2014-12-12] (Piriform Ltd)
Task: {565CCAD8-A117-44FC-A596-57D05DC20F9D} - System32\Tasks\{BD63E6D8-90E4-486B-BA8D-197E0762A552} => pcalua.exe -a "C:\Users\Haiopei\Downloads\PC\DVD Cover\setup.exe" -d "C:\Users\Haiopei\Downloads\PC\DVD Cover"
Task: {5761DAC6-2589-45D3-B989-0ACBB627F055} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 => C:\Program Files\TuneUp Utilities 2014\OneClick.exe [2013-12-18] (TuneUp Software)
Task: {595A97A6-3B81-4EAE-B080-E086151D554C} - System32\Tasks\GlaryInitialize 5 => C:\Program Files\Glary Utilities 5\Initialize.exe [2015-03-02] (Glarysoft Ltd)
Task: {5AC95D02-FC34-484D-B060-D1B6769FD1CE} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-2886736790-1064491100-3460348771-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {5AF7E931-A7C5-4053-BF87-23522E7DF791} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {5BEB57AB-151D-42AD-A0C0-A9309D0F671C} - System32\Tasks\{BAA3C6F7-921C-409C-86FA-BBCEEFCB8B3A} => C:\Programme\Spybot - Search &amp; Destroy\SpybotSD.exe
Task: {5FBCE2D2-05DC-4DFB-9726-9697CD57A32B} - System32\Tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-2886736790-1064491100-3460348771-1000 => C:\Program Files\RealNetworks\RealDownloader\recordingmanager.exe [2013-08-14] (RealNetworks, Inc.)
Task: {62A1E959-DBF8-4401-A445-00641BD05D7A} - System32\Tasks\{45E57954-8759-4AC2-B31E-F31729B16E84} => C:\Program Files\Skype\\Phone\Skype.exe [2013-11-14] (Skype Technologies S.A.)
Task: {69854816-4EFC-43D0-AF8E-924FE1B1405D} - System32\Tasks\Opera scheduled Autoupdate 1410124067 => C:\Program Files\Opera\launcher.exe [2014-09-25] (Opera Software)
Task: {6DBC62A5-48B7-49A5-9F42-F8F7EB3DBED7} - System32\Tasks\{EA559904-6759-4EA9-B514-1A7F44DDEFF4} => C:\Programme\Spybot - Search &amp; Destroy\SpybotSD.exe
Task: {7011E7E9-40E5-4CD8-939E-BD7D324A89DD} - System32\Tasks\{70F35CB7-4C4B-4B45-B853-07255C71735E} => pcalua.exe -a E:\Setup.exe -d E:\
Task: {7CF05038-3235-46B6-9A96-4C1366555FD7} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-2886736790-1064491100-3460348771-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {7E781DDA-E24C-4F15-8B06-97DD249543C4} - System32\Tasks\Microsoft_Hardware_Launch_IPoint_exe => c:\Program Files\Microsoft IntelliPoint\IPoint.exe [2010-07-21] (Microsoft Corporation)
Task: {82C9BF33-E362-467C-9DCD-D5FB842EC0D0} - System32\Tasks\{889FF1A2-B3C4-4AE4-8B33-797BA67A5B39} => Firefox.exe hxxp://ui.skype.com/ui/0/5.0.0.152/de/eula
Task: {895887F7-46E3-423B-9970-979A45ACBA0D} - System32\Tasks\{726F3EC3-83FC-48DB-919B-5B29331C6B81} => pcalua.exe -a C:\Users\Haiopei\Downloads\3DTexasHoldemPoker10.exe -d C:\Users\Haiopei\Downloads
Task: {8F1C4A3D-8997-4887-92C2-1B768E24D0F6} - System32\Tasks\Real Player-Online-Aktualisierungsprogramm => C:\Program Files\Real\RealPlayer\Update\realsched.exe [2015-01-12] (RealNetworks, Inc.)
Task: {99C37699-128E-4BC6-87AB-3C3C8BDBBDA6} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-2886736790-1064491100-3460348771-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {C0237CD9-CBBC-4EFE-BED6-9F0A0ADEA149} - System32\Tasks\{FA71B14D-52F1-4343-AF8D-51241208EF24} => Firefox.exe 
Task: {C14937D5-7F84-4A0E-BEFC-A81FFF81B8E3} - System32\Tasks\{57069C1B-2D1E-4BD8-BECF-7BB823C0469E} => C:\Programme\PaintShop Photo Pro\Corel PaintShop Photo Pro\X3\PSPClassic\Corel Paint Shop Pro Photo.exe [2009-12-30] (Corel, Inc.)
Task: {C53A5B16-F5FB-4D90-8644-C8988DB71FDF} - System32\Tasks\Java Update Scheduler => C:\Program Files\Common Files\Java\Java Update\jusched.exe [2014-07-25] (Oracle Corporation)
Task: {C55BE85D-CAFF-479C-92EA-9AD7ED8AF31A} - System32\Tasks\{34E58C4B-57F9-428F-8546-F5B7E49381DC} => pcalua.exe -a C:\Users\Haiopei\Downloads\smartControlPremium_Setup.exe -d C:\Users\Haiopei\Downloads
Task: {C8B29618-7164-429F-8832-B95B476EC765} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-22] (Google Inc.)
Task: {E3D1572B-272F-45C8-B46E-324BE26B6B91} - System32\Tasks\hcdll2_ex_Win32 => C:\Program Files\Hardcopy\hcdll2_ex_Win32.exe [2011-03-18] ()
Task: {E42DA9F0-7A04-48B5-BCDB-E7792F8D8CF5} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-03-07] (Adobe Systems Incorporated)
Task: {E4A24687-A384-43C3-B54C-3DF68AAD26B5} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-2886736790-1064491100-3460348771-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {F5038AB4-4DC4-4BAF-BEDC-2BFDED2886E6} - System32\Tasks\PCCT - MAGIX AG => C:\Program Files\MAGIX\PC_Check_Tuning_Free_2011\MxTray.exe [2010-11-08] ()
Task: {F5EE8BD0-C7F1-4BEA-A023-8D378074F0B5} - System32\Tasks\{0754E28A-0AB7-4ED1-BCE9-F601C6F7D6E0} => C:\Program Files\Firaxis Games\Sid Meier's Civilization 4\Civilization4.exe [2005-10-18] (Firaxis Games)
Task: {F67ECC62-57C7-4593-B6E4-AFDE0175A07A} - System32\Tasks\ArcSoft Connect Daemon => C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [2010-10-27] (ArcSoft Inc.)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GlaryInitialize 5.job => C:\Program Files\Glary Utilities 5\Initialize.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\PCCT - MAGIX AG.job => C:\Program Files\MAGIX\PC_Check_Tuning_Free_2011\MxTray.exe

==================== Loaded Modules (whitelisted) ==============

2012-01-01 19:52 - 2011-03-18 08:11 - 00031744 _____ () C:\Program Files\Hardcopy\hcdll2_ex_Win32.exe
2011-01-14 12:36 - 2011-01-14 12:36 - 00018216 _____ () c:\Programme\Ocster Backup\bin\backupService-ox.exe
2011-01-14 12:36 - 2011-01-14 12:36 - 00071464 _____ () c:\Programme\Ocster Backup\bin\backupServiceLib.dll
2011-01-14 12:36 - 2011-01-14 12:36 - 05350696 _____ () c:\Programme\Ocster Backup\bin\backupCore.dll
2011-01-14 12:36 - 2011-01-14 12:36 - 00131368 _____ () c:\Programme\Ocster Backup\bin\netutil.dll
2011-01-14 12:36 - 2011-01-14 12:36 - 01795880 _____ () c:\Programme\Ocster Backup\bin\ox.dll
2011-01-14 12:36 - 2011-01-14 12:36 - 00037672 _____ () c:\Programme\Ocster Backup\bin\lzmaUtil.dll
2010-12-29 12:23 - 2010-12-29 12:23 - 00040960 _____ () c:\Programme\Ocster Backup\bin\lzma.dll
2011-01-14 12:36 - 2011-01-14 12:36 - 00294696 _____ () c:\Programme\Ocster Backup\bin\twirl.dll
2010-06-23 15:20 - 2010-06-23 15:20 - 00061952 _____ () c:\Programme\Ocster Backup\bin\zdll.dll
2011-01-14 12:36 - 2011-01-14 12:36 - 00242984 _____ () c:\Programme\Ocster Backup\bin\tomb.dll
2011-01-14 12:36 - 2011-01-14 12:36 - 00076584 _____ () c:\Programme\Ocster Backup\bin\scoolite.dll
2010-12-29 12:22 - 2010-12-29 12:22 - 00438784 _____ () c:\Programme\Ocster Backup\bin\sqlite.dll
2011-01-14 12:36 - 2011-01-14 12:36 - 00106280 _____ () c:\Programme\Ocster Backup\bin\deemon.dll
2007-06-05 13:20 - 2007-06-05 13:20 - 00177704 _____ () C:\Windows\system32\PSIService.exe
2013-08-14 15:19 - 2013-08-14 15:19 - 00039056 _____ () C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe
2009-11-16 14:20 - 2009-10-02 13:18 - 00058880 _____ () C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2015-01-11 13:53 - 2013-05-20 04:01 - 00627672 _____ () C:\Program Files\CyberLink\Power2Go9\CLMediaLibrary.dll
2013-05-20 11:02 - 2013-05-20 11:02 - 00016856 _____ () C:\Program Files\CyberLink\Power2Go9\CLMLSvcPS.dll
2014-12-12 23:24 - 2014-12-12 23:24 - 00047104 _____ () C:\Programme\CCleaner\lang\lang-1031.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SolutoService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MSIServer => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SolutoService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\vsmon => ""="Service"

==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)



HKU\S-1-5-21-2886736790-1064491100-3460348771-1000\Software\Classes\.exe:  =>  <===== ATTENTION!

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2886736790-1064491100-3460348771-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Haiopei\AppData\Roaming\Mozilla\Firefox\Desktop-Hintergrund.bmp
HKU\S-1-5-21-2886736790-1064491100-3460348771-1002\Control Panel\Desktop\\Wallpaper -> C:\Windows\Web\Wallpaper\MEDION\Wallpaper.jpg
DNS Servers: 192.168.2.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Radio.fx.LNK => C:\Windows\pss\Radio.fx.LNK.CommonStartup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: Ocster Backup => "C:\Programme\Ocster Backup\bin\backupClient-ox.exe" --hidden
MSCONFIG\startupreg: RfxSrvTray => "C:\Program Files\Tobit Radio.fx\Client\rfx-tray.exe"
MSCONFIG\startupreg: WinampAgent => "C:\Program Files\Winamp\winampa.exe"

==================== Accounts: =============================

Administrator (S-1-5-21-2886736790-1064491100-3460348771-500 - Administrator - Disabled)
Gast (S-1-5-21-2886736790-1064491100-3460348771-501 - Limited - Disabled)
Haiopei (S-1-5-21-2886736790-1064491100-3460348771-1000 - Administrator - Enabled) => C:\Users\Haiopei
_ocster_backup_ (S-1-5-21-2886736790-1064491100-3460348771-1002 - Administrator - Enabled) => C:\Users\_ocster_backup_

==================== Faulty Device Manager Devices =============

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============

Microsoft Office Sessions:
=========================
Error: (04/26/2012 08:02:00 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6612.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 72 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (04/26/2012 07:57:32 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6612.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 35 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (03/03/2010 06:00:24 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 341 seconds with 0 seconds of active time.  This session ended with a crash.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i3 CPU 530 @ 2.93GHz
Percentage of memory in use: 42%
Total physical RAM: 3063.11 MB
Available physical RAM: 1766.75 MB
Total Pagefile: 6124.52 MB
Available Pagefile: 4645.48 MB
Total Virtual: 2047.88 MB
Available Virtual: 1901.31 MB

==================== Drives ================================

Drive c: (Boot) (Fixed) (Total:910.41 GB) (Free:417.11 GB) NTFS
Drive d: (Recover) (Fixed) (Total:20 GB) (Free:11.61 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: F98D6E74)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=910.4 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=20 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=1 GB) - (Type=12)

==================== End Of Log ============================

Hallo,
das hier sind nun die aktuellen Scans.
Gruß Ernst

cosinus · 09.03.2015, 10:32

FRST-Fix

Virenscanner jetzt bitte komplett deaktivieren, damit sichergestellt ist, dass der Fix sauber durchläuft!

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

HKLM\...\Run: [] => [X]
HKU\S-1-5-21-2886736790-1064491100-3460348771-1000\...409d6c4515e9\InprocServer32: [Default-shell32]  <==== ATTENTION!
HKU\S-1-5-21-2886736790-1064491100-3460348771-1002\...409d6c4515e9\InprocServer32: [Default-shell32]  <==== ATTENTION!
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
URLSearchHook: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002 - (No Name) - {00000000-6E41-4FD3-8538-502F5495E5FC} -  No File
URLSearchHook: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002 - (No Name) - {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} -  No File
URLSearchHook: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002 - (No Name) - {c840e246-6b95-475e-9bd7-caa1c7eca9f2} -  No File
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://startsear.ch/?aff=1&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000 -> {A2DC3FEF-AB4D-442c-8517-34EC6E125C8D} URL = http://search.webwebweb.com/search.php?query={searchTerms}&lang=de&zip=&town=&site=&country=&safe=[safe,off,strict]
SearchScopes: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://startsear.ch/?aff=1&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002 -> {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL = http://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10261&src=kw&q={searchTerms}&locale=en_US&apn_ptnrs=^AGS&apn_dtid=^YYYYYY^YY^DE&apn_uid=078f2bbd-0221-4037-ae14-180c2d26a672&apn_sauid=9083FB08-2610-467D-A3B2-F753B6AC42D4
SearchScopes: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002 -> {29C151B2-4ADA-4A58-93D1-455FC8B95BB0} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2625848
SearchScopes: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002 -> {A2DC3FEF-AB4D-442c-8517-34EC6E125C8D} URL = http://search.webwebweb.com/search.php?query={searchTerms}&lang=de&zip=&town=&site=&country=&safe=[safe,off,strict]
Toolbar: HKLM - PDF Architect Toolbar - {DEEB13D7-CEA9-45FB-B77C-E039BEC85221} - C:\Program Files\PDF Architect 2\creator-ie-plugin.dll [2014-10-10] (pdfforge GmbH)
Toolbar: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002 -> No Name - {A1E75A0E-4397-4BA8-BB50-E19FB66890F4} -  No File
Toolbar: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002 -> No Name - {C424171E-592A-415A-9EB1-DFD6D95D3530} -  No File
Toolbar: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002 -> No Name - {C840E246-6B95-475E-9BD7-CAA1C7ECA9F2} -  No File
Toolbar: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002 -> No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} -  No File
SearchScopes: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2410} URL = http://dts.search-results.com/sr?src=ieb&appid=0&systemid=410&sr=0&q={searchTerms}
C:\Users\Haiopei\AppData\Local\{D3658853-4D5E-4D05-A4DE-30C83734AF6B}
C:\ProgramData\613AD1B23E.sys
EmptyTemp:
Hosts:

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Haiopei · 09.03.2015, 12:12

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 08-03-2015 03
Ran by Haiopei at 2015-03-09 11:30:01 Run:1
Running from C:\Users\Haiopei\Desktop
Loaded Profiles: Haiopei & _ocster_backup_ (Available profiles: Haiopei & _ocster_backup_)
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
HKLM\...\Run: [] => [X]
HKU\S-1-5-21-2886736790-1064491100-3460348771-1000\...409d6c4515e9\InprocServer32: [Default-shell32]  <==== ATTENTION!
HKU\S-1-5-21-2886736790-1064491100-3460348771-1002\...409d6c4515e9\InprocServer32: [Default-shell32]  <==== ATTENTION!
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
URLSearchHook: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002 - (No Name) - {00000000-6E41-4FD3-8538-502F5495E5FC} -  No File
URLSearchHook: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002 - (No Name) - {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} -  No File
URLSearchHook: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002 - (No Name) - {c840e246-6b95-475e-9bd7-caa1c7eca9f2} -  No File
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://startsear.ch/?aff=1&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2886736790-1064491100-3460348771-1000 -> {A2DC3FEF-AB4D-442c-8517-34EC6E125C8D} URL = hxxp://search.webwebweb.com/search.php?query={searchTerms}&lang=de&zip=&town=&site=&country=&safe=[safe,off,strict]
SearchScopes: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://startsear.ch/?aff=1&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002 -> {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10261&src=kw&q={searchTerms}&locale=en_US&apn_ptnrs=^AGS&apn_dtid=^YYYYYY^YY^DE&apn_uid=078f2bbd-0221-4037-ae14-180c2d26a672&apn_sauid=9083FB08-2610-467D-A3B2-F753B6AC42D4
SearchScopes: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002 -> {29C151B2-4ADA-4A58-93D1-455FC8B95BB0} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2625848
SearchScopes: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002 -> {A2DC3FEF-AB4D-442c-8517-34EC6E125C8D} URL = hxxp://search.webwebweb.com/search.php?query={searchTerms}&lang=de&zip=&town=&site=&country=&safe=[safe,off,strict]
Toolbar: HKLM - PDF Architect Toolbar - {DEEB13D7-CEA9-45FB-B77C-E039BEC85221} - C:\Program Files\PDF Architect 2\creator-ie-plugin.dll [2014-10-10] (pdfforge GmbH)
Toolbar: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002 -> No Name - {A1E75A0E-4397-4BA8-BB50-E19FB66890F4} -  No File
Toolbar: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002 -> No Name - {C424171E-592A-415A-9EB1-DFD6D95D3530} -  No File
Toolbar: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002 -> No Name - {C840E246-6B95-475E-9BD7-CAA1C7ECA9F2} -  No File
Toolbar: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002 -> No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} -  No File
SearchScopes: HKU\S-1-5-21-2886736790-1064491100-3460348771-1002 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2410} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=410&sr=0&q={searchTerms}
C:\Users\Haiopei\AppData\Local\{D3658853-4D5E-4D05-A4DE-30C83734AF6B}
C:\ProgramData\613AD1B23E.sys
EmptyTemp:
Hosts:
*****************

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\ => value deleted successfully.
"HKU\S-1-5-21-2886736790-1064491100-3460348771-1000\Software\Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}" => Key deleted successfully.
"HKU\S-1-5-21-2886736790-1064491100-3460348771-1002\Software\Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}" => Key deleted successfully.
"HKLM\SOFTWARE\Policies\Google" => Key deleted successfully.
HKU\S-1-5-21-2886736790-1064491100-3460348771-1002\Software\Microsoft\Internet Explorer\URLSearchHooks\\{00000000-6E41-4FD3-8538-502F5495E5FC} => value deleted successfully.
HKU\S-1-5-21-2886736790-1064491100-3460348771-1002\Software\Microsoft\Internet Explorer\URLSearchHooks\\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4} => value deleted successfully.
HKU\S-1-5-21-2886736790-1064491100-3460348771-1002\Software\Microsoft\Internet Explorer\URLSearchHooks\\{c840e246-6b95-475e-9bd7-caa1c7eca9f2} => value deleted successfully.
HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-21-2886736790-1064491100-3460348771-1002\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
"HKU\S-1-5-21-2886736790-1064491100-3460348771-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{A2DC3FEF-AB4D-442c-8517-34EC6E125C8D}" => Key deleted successfully.
HKCR\CLSID\{A2DC3FEF-AB4D-442c-8517-34EC6E125C8D} => Key not found. 
"HKU\S-1-5-21-2886736790-1064491100-3460348771-1002\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => Key deleted successfully.
HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => Key not found. 
"HKU\S-1-5-21-2886736790-1064491100-3460348771-1002\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}" => Key deleted successfully.
HKCR\CLSID\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} => Key not found. 
"HKU\S-1-5-21-2886736790-1064491100-3460348771-1002\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{29C151B2-4ADA-4A58-93D1-455FC8B95BB0}" => Key deleted successfully.
HKCR\CLSID\{29C151B2-4ADA-4A58-93D1-455FC8B95BB0} => Key not found. 
"HKU\S-1-5-21-2886736790-1064491100-3460348771-1002\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{A2DC3FEF-AB4D-442c-8517-34EC6E125C8D}" => Key deleted successfully.
HKCR\CLSID\{A2DC3FEF-AB4D-442c-8517-34EC6E125C8D} => Key not found. 
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{DEEB13D7-CEA9-45FB-B77C-E039BEC85221} => value deleted successfully.
"HKCR\CLSID\{DEEB13D7-CEA9-45FB-B77C-E039BEC85221}" => Key deleted successfully.
HKU\S-1-5-21-2886736790-1064491100-3460348771-1002\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{A1E75A0E-4397-4BA8-BB50-E19FB66890F4} => value deleted successfully.
HKCR\CLSID\{A1E75A0E-4397-4BA8-BB50-E19FB66890F4} => Key not found. 
HKU\S-1-5-21-2886736790-1064491100-3460348771-1002\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{C424171E-592A-415A-9EB1-DFD6D95D3530} => value deleted successfully.
HKCR\CLSID\{C424171E-592A-415A-9EB1-DFD6D95D3530} => Key not found. 
HKU\S-1-5-21-2886736790-1064491100-3460348771-1002\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{C840E246-6B95-475E-9BD7-CAA1C7ECA9F2} => value deleted successfully.
HKCR\CLSID\{C840E246-6B95-475E-9BD7-CAA1C7ECA9F2} => Key not found. 
HKU\S-1-5-21-2886736790-1064491100-3460348771-1002\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} => value deleted successfully.
HKCR\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} => Key not found. 
"HKU\S-1-5-21-2886736790-1064491100-3460348771-1002\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2410}" => Key deleted successfully.
HKCR\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2410} => Key not found. 
C:\Users\Haiopei\AppData\Local\{D3658853-4D5E-4D05-A4DE-30C83734AF6B} => Moved successfully.
C:\ProgramData\613AD1B23E.sys => Moved successfully.
C:\Windows\System32\Drivers\etc\hosts => Moved successfully.
Hosts was reset successfully.
EmptyTemp: => Removed 2.8 GB temporary data.


The system needed a reboot. 

==== End of Fixlog 11:47:43 ====

cosinus · 09.03.2015, 15:26

Okay, dann Kontrollscans mit MBAM und ESET bitte:

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Haiopei · 10.03.2015, 16:13

HTML-Code:

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 11.01.2015
Suchlauf-Zeit: 22:17:40
Logdatei: MBAM.txt
Administrator: Ja

Version: 2.00.4.1028
Malware Datenbank: v2015.01.11.11
Rootkit Datenbank: v2015.01.07.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x86
Dateisystem: NTFS
Benutzer: Haiopei

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 407119
Verstrichene Zeit: 31 Min, 56 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Warnen
PUM: Aktiviert

Prozesse: 0
(Keine schädliche Elemente erkannt)

Module: 0
(Keine schädliche Elemente erkannt)

Registrierungsschlüssel: 0
(Keine schädliche Elemente erkannt)

Registrierungswerte: 0
(Keine schädliche Elemente erkannt)

Registrierungsdaten: 0
(Keine schädliche Elemente erkannt)

Ordner: 0
(Keine schädliche Elemente erkannt)

Dateien: 0
(Keine schädliche Elemente erkannt)

Physische Sektoren: 0
(Keine schädliche Elemente erkannt)


(end)

HTML-Code:

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=24a5323b27ecf647aa0c947459ececc8
# engine=22824
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-03-10 06:05:27
# local_time=2015-03-10 07:05:27 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 51368436 177598718 0 0
# scanned=2323737
# found=90
# cleaned=0
# scan_time=48740
sh=E5AD99CE7C7362CA566156033ECB0F04F9437CA7 ft=1 fh=f45d83e01e1c8734 vn="Win32/Toolbar.Conduit.Q evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\DVDVideoSoftTB\DVDVideoSoftTBToolbarHelper.exe.vir"
sh=E5AD99CE7C7362CA566156033ECB0F04F9437CA7 ft=1 fh=f45d83e01e1c8734 vn="Win32/Toolbar.Conduit.Q evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\DVDVideoSoftTB\DVDVideoSoftTBToolbarHelper1.exe.vir"
sh=1E00782FEC3CA539AE30F866502633FF550356C6 ft=1 fh=46da0b21d76c5220 vn="Variante von Win32/Toolbar.Conduit.P evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\DVDVideoSoftTB\ldrtbDVD2.dll.vir"
sh=1E00782FEC3CA539AE30F866502633FF550356C6 ft=1 fh=46da0b21d76c5220 vn="Variante von Win32/Toolbar.Conduit.P evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\DVDVideoSoftTB\ldrtbDVDV.dll.vir"
sh=A2D929A9864513C0E8ED84AAD622EF6ADCC9B950 ft=1 fh=22c06217fc444ec5 vn="Win32/Toolbar.Conduit.O evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\DVDVideoSoftTB\prxtbDVD2.dll.vir"
sh=A2D929A9864513C0E8ED84AAD622EF6ADCC9B950 ft=1 fh=22c06217fc444ec5 vn="Win32/Toolbar.Conduit.O evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\DVDVideoSoftTB\prxtbDVDV.dll.vir"
sh=0C73CCC63EC56232CA1EF6BF8573B3A9AB323052 ft=1 fh=d014c1be8c7ac6c1 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\DVDVideoSoftTB\tbDVD0.dll.vir"
sh=3664B7B546B41FBFB469128DEA194DBA1AF556AC ft=1 fh=532d857584187cdc vn="Win32/Toolbar.Conduit.Y evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\DVDVideoSoftTB\tbDVD1.dll.vir"
sh=E5AD99CE7C7362CA566156033ECB0F04F9437CA7 ft=1 fh=f45d83e01e1c8734 vn="Win32/Toolbar.Conduit.Q evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\DVDVideoSoftTB_DE\DVDVideoSoftTB_DEToolbarHelper.exe.vir"
sh=0460B794834ED78BE69BA5EB9C0E6211EBEAD9B6 ft=1 fh=0f8145e534b0e78b vn="Variante von Win32/Toolbar.Conduit.P evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\DVDVideoSoftTB_DE\ldrtbDVDV.dll.vir"
sh=A2D929A9864513C0E8ED84AAD622EF6ADCC9B950 ft=1 fh=22c06217fc444ec5 vn="Win32/Toolbar.Conduit.O evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\DVDVideoSoftTB_DE\prxtbDVDV.dll.vir"
sh=8CA209A796CAB152BC9907BCEF283C221AC5F058 ft=1 fh=16efebacbcd5a9c9 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\DVDVideoSoftTB_DE\tbDVDV.dll.vir"
sh=1E00782FEC3CA539AE30F866502633FF550356C6 ft=1 fh=46da0b21d76c5220 vn="Variante von Win32/Toolbar.Conduit.P evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\MyAshampoo\ldrtbMyA0.dll.vir"
sh=E5AD99CE7C7362CA566156033ECB0F04F9437CA7 ft=1 fh=f45d83e01e1c8734 vn="Win32/Toolbar.Conduit.Q evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\MyAshampoo\MyAshampooToolbarHelper1.exe.vir"
sh=A2D929A9864513C0E8ED84AAD622EF6ADCC9B950 ft=1 fh=22c06217fc444ec5 vn="Win32/Toolbar.Conduit.O evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\MyAshampoo\prxtbMyA0.dll.vir"
sh=419716F712489099B040AB846B565D808119B5E8 ft=1 fh=562d50baf79e8eca vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\MyAshampoo\tbMyA1.dll.vir"
sh=57CD8DEAF43DF3A2F4703E5219A69935B119D0DB ft=1 fh=311781f1ea21501f vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\MyAshampoo\tbMyA2.dll.vir"
sh=4E8BC33C6DFBDD9727988EB0AA95AF115C08FA8F ft=1 fh=efa4d311e75fd867 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\MyAshampoo\tbMyAs.dll.vir"
sh=1E00782FEC3CA539AE30F866502633FF550356C6 ft=1 fh=46da0b21d76c5220 vn="Variante von Win32/Toolbar.Conduit.P evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\uTorrentBar_DE\ldrtbuTo0.dll.vir"
sh=1E00782FEC3CA539AE30F866502633FF550356C6 ft=1 fh=46da0b21d76c5220 vn="Variante von Win32/Toolbar.Conduit.P evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\uTorrentBar_DE\ldrtbuTor.dll.vir"
sh=A2D929A9864513C0E8ED84AAD622EF6ADCC9B950 ft=1 fh=22c06217fc444ec5 vn="Win32/Toolbar.Conduit.O evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\uTorrentBar_DE\prxtbuTo0.dll.vir"
sh=A2D929A9864513C0E8ED84AAD622EF6ADCC9B950 ft=1 fh=22c06217fc444ec5 vn="Win32/Toolbar.Conduit.O evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\uTorrentBar_DE\prxtbuTor.dll.vir"
sh=3E30150D840AC9A0C0A7969D2FFD45118BE827D6 ft=1 fh=afbdb7c39edb934a vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\uTorrentBar_DE\tbuTo0.dll.vir"
sh=4C5834A9F0D646B35A7719A4E352093C0240BA5F ft=1 fh=f68058267a38e609 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\uTorrentBar_DE\tbuTor.dll.vir"
sh=E5AD99CE7C7362CA566156033ECB0F04F9437CA7 ft=1 fh=f45d83e01e1c8734 vn="Win32/Toolbar.Conduit.Q evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\uTorrentBar_DE\uTorrentBar_DEToolbarHelper.exe.vir"
sh=E5AD99CE7C7362CA566156033ECB0F04F9437CA7 ft=1 fh=f45d83e01e1c8734 vn="Win32/Toolbar.Conduit.Q evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\uTorrentBar_DE\uTorrentBar_DEToolbarHelper1.exe.vir"
sh=8EE9FB5AE2B8B6679E36388F102438C3C72C628E ft=1 fh=fc1817d8cca0d243 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Haiopei\AppData\Local\Conduit\CT2269050\DVDVideoSoftTBAutoUpdateHelper.exe.vir"
sh=0DDC9EFBCBB739ECBC9645E0D81144ACB0DC139F ft=1 fh=2cd04407df9b26ee vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Haiopei\AppData\Local\Conduit\CT2269050\DVDVideoSoftTBAutoUpdaterHelper.exe.vir"
sh=8EE9FB5AE2B8B6679E36388F102438C3C72C628E ft=1 fh=fc1817d8cca0d243 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Haiopei\AppData\Local\Conduit\CT2475029\MyAshampooAutoUpdaterHelper.exe.vir"
sh=E5AD99CE7C7362CA566156033ECB0F04F9437CA7 ft=1 fh=f45d83e01e1c8734 vn="Win32/Toolbar.Conduit.Q evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Haiopei\AppData\Local\Conduit\CT2625848\DVDVideoSoftTB_DEAutoUpdateHelper.exe.vir"
sh=8EE9FB5AE2B8B6679E36388F102438C3C72C628E ft=1 fh=fc1817d8cca0d243 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Haiopei\AppData\Local\Conduit\CT2851647\uTorrentBar_DEAutoUpdateHelper.exe.vir"
sh=1E00782FEC3CA539AE30F866502633FF550356C6 ft=1 fh=46da0b21d76c5220 vn="Variante von Win32/Toolbar.Conduit.P evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Haiopei\AppData\LocalLow\DVDVideoSoftTB\ldrtbDVD2.dll.vir"
sh=1E00782FEC3CA539AE30F866502633FF550356C6 ft=1 fh=46da0b21d76c5220 vn="Variante von Win32/Toolbar.Conduit.P evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Haiopei\AppData\LocalLow\DVDVideoSoftTB\ldrtbDVDV.dll.vir"
sh=4C5834A9F0D646B35A7719A4E352093C0240BA5F ft=1 fh=f68058267a38e609 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Haiopei\AppData\LocalLow\DVDVideoSoftTB\tbDVD0.dll.vir"
sh=B4267CC9FBAA1133921BBF40835E07DAA481E025 ft=1 fh=39d86043333a1074 vn="Variante von Win32/Toolbar.Conduit.Y evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Haiopei\AppData\LocalLow\DVDVideoSoftTB\tbDVD1.dll.vir"
sh=3E30150D840AC9A0C0A7969D2FFD45118BE827D6 ft=1 fh=afbdb7c39edb934a vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Haiopei\AppData\LocalLow\DVDVideoSoftTB\tbDVD2.dll.vir"
sh=7A5B168BB2B8C06B2A9134B656BBF195830D21C2 ft=1 fh=55d4f387d8566cf4 vn="Variante von Win32/PriceGong.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Haiopei\AppData\LocalLow\DVDVideoSoftTB\plugins\{5E1360DC-8FA8-40df-A8CD-FC3831B3634B}\3.1.1\bin\PriceGongIE.dll.vir"
sh=0460B794834ED78BE69BA5EB9C0E6211EBEAD9B6 ft=1 fh=0f8145e534b0e78b vn="Variante von Win32/Toolbar.Conduit.P evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Haiopei\AppData\LocalLow\DVDVideoSoftTB_DE\ldrtbDVDV.dll.vir"
sh=8CA209A796CAB152BC9907BCEF283C221AC5F058 ft=1 fh=16efebacbcd5a9c9 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Haiopei\AppData\LocalLow\DVDVideoSoftTB_DE\tbDVDV.dll.vir"
sh=1E00782FEC3CA539AE30F866502633FF550356C6 ft=1 fh=46da0b21d76c5220 vn="Variante von Win32/Toolbar.Conduit.P evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Haiopei\AppData\LocalLow\MyAshampoo\ldrtbMyA0.dll.vir"
sh=3E30150D840AC9A0C0A7969D2FFD45118BE827D6 ft=1 fh=afbdb7c39edb934a vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Haiopei\AppData\LocalLow\MyAshampoo\tbMyA0.dll.vir"
sh=B4267CC9FBAA1133921BBF40835E07DAA481E025 ft=1 fh=39d86043333a1074 vn="Variante von Win32/Toolbar.Conduit.Y evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Haiopei\AppData\LocalLow\MyAshampoo\tbMyA1.dll.vir"
sh=57CD8DEAF43DF3A2F4703E5219A69935B119D0DB ft=1 fh=311781f1ea21501f vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Haiopei\AppData\LocalLow\MyAshampoo\tbMyA2.dll.vir"
sh=7A5B168BB2B8C06B2A9134B656BBF195830D21C2 ft=1 fh=55d4f387d8566cf4 vn="Variante von Win32/PriceGong.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Haiopei\AppData\LocalLow\MyAshampoo\plugins\{5E1360DC-8FA8-40df-A8CD-FC3831B3634B}\3.1.1\bin\PriceGongIE.dll.vir"
sh=1E00782FEC3CA539AE30F866502633FF550356C6 ft=1 fh=46da0b21d76c5220 vn="Variante von Win32/Toolbar.Conduit.P evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Haiopei\AppData\LocalLow\uTorrentBar_DE\ldrtbuTo0.dll.vir"
sh=1E00782FEC3CA539AE30F866502633FF550356C6 ft=1 fh=46da0b21d76c5220 vn="Variante von Win32/Toolbar.Conduit.P evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Haiopei\AppData\LocalLow\uTorrentBar_DE\ldrtbuTor.dll.vir"
sh=3E30150D840AC9A0C0A7969D2FFD45118BE827D6 ft=1 fh=afbdb7c39edb934a vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Haiopei\AppData\LocalLow\uTorrentBar_DE\tbuTo0.dll.vir"
sh=B4267CC9FBAA1133921BBF40835E07DAA481E025 ft=1 fh=39d86043333a1074 vn="Variante von Win32/Toolbar.Conduit.Y evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Haiopei\AppData\LocalLow\uTorrentBar_DE\tbuTo1.dll.vir"
sh=4C5834A9F0D646B35A7719A4E352093C0240BA5F ft=1 fh=f68058267a38e609 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Haiopei\AppData\LocalLow\uTorrentBar_DE\tbuTor.dll.vir"
sh=ABF759CA3BFB16DE62197DD7C417AC5039A43AE0 ft=1 fh=1801af74030ebca1 vn="Variante von Win32/PriceGong.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Haiopei\AppData\LocalLow\uTorrentBar_DE\plugins\{5E1360DC-8FA8-40df-A8CD-FC3831B3634B}\3.5.3\bin\PriceGongIE.dll.vir"
sh=A011DFD8D93BBA7B75833C0F85FF6E1D25594B84 ft=1 fh=049679d5506e563e vn="Variante von Win32/Conduit.SearchProtect.N evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Haiopei\AppData\Roaming\Mozilla\Firefox\Profiles\ogagtyrs.default\Extensions\{0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff}\Plugins\npConduitFirefoxPlugin.dll.vir"
sh=A011DFD8D93BBA7B75833C0F85FF6E1D25594B84 ft=1 fh=049679d5506e563e vn="Variante von Win32/Conduit.SearchProtect.N evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Haiopei\AppData\Roaming\Mozilla\Firefox\Profiles\ogagtyrs.default\Extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\Plugins\npConduitFirefoxPlugin.dll.vir"
sh=37824D4B366B35F9C84237C48E66DF9687EEDEC6 ft=1 fh=c570259d3a36278d vn="Variante von Win32/Conduit.SearchProtect.N evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Haiopei\AppData\Roaming\Mozilla\Firefox\Profiles\ogagtyrs.default\Extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\Plugins\npConduitFirefoxPlugin.dll.vir"
sh=A011DFD8D93BBA7B75833C0F85FF6E1D25594B84 ft=1 fh=049679d5506e563e vn="Variante von Win32/Conduit.SearchProtect.N evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Haiopei\AppData\Roaming\Mozilla\Firefox\Profiles\ogagtyrs.default\Extensions\{C840E246-6B95-475E-9BD7-CAA1C7ECA9F2}\Plugins\npConduitFirefoxPlugin.dll.vir"
sh=282E43766D30716E793A5122951C2AE76FD8CBCC ft=0 fh=0000000000000000 vn="Win32/DealPly.J evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Haiopei\AppData\Roaming\Mozilla\Firefox\Profiles\ogagtyrs.default\Extensions\{EB9394A3-4AD6-4918-9537-31A1FD8E8EDF}\chrome\content\dealply.xul.vir"
sh=A011DFD8D93BBA7B75833C0F85FF6E1D25594B84 ft=1 fh=049679d5506e563e vn="Variante von Win32/Conduit.SearchProtect.N evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Haiopei\AppData\Roaming\Mozilla\Firefox\Profiles\ogagtyrs.default\Extensions\{fc2b76fc-2132-4d80-a9a3-1f5c6e49066b}\Plugins\npConduitFirefoxPlugin.dll.vir"
sh=ABA32A0BF4960B1AB88953C36CF160625C78AC9B ft=1 fh=47eacc88b34b8f30 vn="MSIL/AdvancedSystemProtector.D evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files\CPUID\PC Wizard 2013\systweakasp_c.exe"
sh=6BACEE658526F4F1597581AE945F3B2A5150CD8E ft=1 fh=04a3da4c16b7212f vn="MSIL/AdvancedSystemProtector.D evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Haiopei\Downloads\PC_Wizard_v2014.2.13.exe"
sh=B21629F1A8BFF2AA1ED364E9125256F7901E218B ft=1 fh=1d2b54166a234c18 vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Haiopei\Downloads\PC\ashampoo_clipfinder_hd_e2.2.3_sm.exe"
sh=35C96F72A5D6A44FCE7CE68DF1BCAF7B48350091 ft=1 fh=a22e4ae349e54c97 vn="Variante von Win32/Speedchecker.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Haiopei\Downloads\PC\PCSU_Update.exe"
sh=6BACEE658526F4F1597581AE945F3B2A5150CD8E ft=1 fh=04a3da4c16b7212f vn="MSIL/AdvancedSystemProtector.D evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Haiopei\Downloads\PC\PC_Wizard_v2014.2.13.exe"
sh=47DA0A4A23B5F6FA4C8DD6BD9B6055691E4339EB ft=1 fh=2ec24482c96e1f8f vn="Win32/InstallMonetizer.AQ evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Haiopei\Downloads\PC\PDFCreator-1_9_3-setup.exe"
sh=1DC26BBEAFBAF69A274CAFE534156EACE3A49A8D ft=1 fh=07386e4897eae14b vn="Win32/InstallMonetizer.AQ evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Haiopei\Downloads\PC\PDFCreator_v2.0.2.751.exe"
sh=9DCF9DE3316A313CB714981372FE752A4B073539 ft=0 fh=0000000000000000 vn="Variante von Win32/Systweak.L evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Haiopei\Downloads\PC\winzip_en_32.msi"
sh=A0867E6C018019D4E76B0DA3E067413C1E9193D5 ft=1 fh=25de646db16c1e53 vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Haiopei\Downloads\PC\Install Programme\ashampoo_burning_studio_6_free_6.83_4312.exe"
sh=698A03A88D3C1D0613EFCE82138248A3EA21E3E0 ft=1 fh=8b635154fd9f4e78 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Haiopei\Downloads\PC\Install Programme\ashampoo_photo_commander_7_7.60_7659.exe"
sh=C39290481337FF67AD4A1B2378F16E97C82674AC ft=1 fh=1c0ae5a2e92660d0 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Haiopei\Downloads\PC\Install Programme\ashampoo_photo_converter_1.0.1_sm.exe"
sh=44E4670ACD61BC87762706D445FC22178CD844B1 ft=1 fh=e3d9b34ec8401920 vn="Variante von Win32/SoftonicDownloader.E evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Haiopei\Downloads\PC\Install Programme\COMPUTER_BILD_Download_Manager_fuer_alldup.exe"
sh=C66A6356E21DD97E8F2C4ECA0FE918A07AAB26D6 ft=1 fh=92ce818f15b4e3d4 vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Haiopei\Downloads\PC\Install Programme\FreeStudio.exe"
sh=F10F970F4FD617510AA6F50DE1EB080BFAB66151 ft=1 fh=6e286c4d20937765 vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Haiopei\Downloads\PC\Install Programme\FreeVideoToMP3Converter(1).exe"
sh=F6D8158C0F478A3F6D3697A384E972AF816B85FF ft=1 fh=2549abab46087ac0 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Haiopei\Downloads\PC\Install Programme\FreeVideoToMp3Converter.exe"
sh=F60FD592F0D32FB7E9B348F4CCB66028170E3F33 ft=1 fh=c84e7d801701c8c4 vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Haiopei\Downloads\PC\Install Programme\FreeVideoToMP3Converter_2.exe"
sh=FF2AAFDE2839FDAA36DF872C17544795B1F7D7F3 ft=1 fh=0933c48fc410b35d vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Haiopei\Downloads\PC\Install Programme\FreeVideoToMP3Converter_3.exe"
sh=0CE48DA603A5E7431002CE4ACA1F1546C5D6579E ft=1 fh=a7cab65addc4a365 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Haiopei\Downloads\PC\Install Programme\FreeYouTubeToMP3Converter32.exe"
sh=07C3A8DE40271B9ECD674AF867A2C7F61D40DFBA ft=1 fh=8a8ff7b630139cd7 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Haiopei\Downloads\PC\Install Programme\FreeYouTubeToMp3Converter35.exe"
sh=D0357617961BF3D526BEFAAB0048CBB983EA4DF9 ft=1 fh=c604c933e8b9509f vn="Win32/InstallMonetizer.AQ evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Haiopei\Downloads\PC\Install Programme\PDFCreator-1_7_0_setup.exe"
sh=8BE4C277A62F2400C3B0A20F39297D310774E2AC ft=1 fh=d69c639933d87dfe vn="Win32/Toolbar.SearchSuite evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Haiopei\Downloads\PC\Install Programme\Setup21_FreeConverter.exe"
sh=EAC9A1478067B309FC46B89BAB809269B6D76F8C ft=1 fh=3e7e9fd31ff4dc88 vn="Variante von Win32/SoftonicDownloader.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Haiopei\Downloads\PC\Install Programme\SoftonicDownloader44422.exe"
sh=C812760931B78743B14D59D728BCFE3C000AEE6A ft=0 fh=0000000000000000 vn="Variante von Win32/PriceGong.A evtl. unerwünschte Anwendung" ac=I fn="F:\HAIOPEI-PC\Backup Set 2011-02-15 180641\Backup Files 2011-02-15 180641\Backup files 65.zip"
sh=EC37AE5903EC281E2E9EB50017F5382479BFB27E ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="F:\HAIOPEI-PC\Backup Set 2011-02-15 180641\Backup Files 2011-02-15 180641\Backup files 67.zip"
sh=D591A8075B8F882697A0CFA601F4DDBDECD3304F ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="F:\HAIOPEI-PC\Backup Set 2011-02-15 180641\Backup Files 2011-02-15 180641\Backup files 68.zip"
sh=EA59C75BCBC16335330BCB12F6F05086F7A7BBAC ft=0 fh=0000000000000000 vn="Variante von Win32/SoftonicDownloader.A evtl. unerwünschte Anwendung" ac=I fn="F:\HAIOPEI-PC\Backup Set 2011-02-15 180641\Backup Files 2011-02-15 180641\Backup files 69.zip"
sh=2882DE29EDF00D19475B74850E52D8327C0CB52D ft=0 fh=0000000000000000 vn="Variante von Win32/Adware.ADON evtl. unerwünschte Anwendung" ac=I fn="F:\HAIOPEI-PC\Backup Set 2011-02-15 180641\Backup Files 2011-02-15 180641\Backup files 208.zip"
sh=C3161A23850E86A6E263250BE10CA3659AFA5F6D ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="F:\HAIOPEI-PC\Backup Set 2011-02-15 180641\Backup Files 2011-03-02 225237\Backup files 4.zip"
sh=CF00DBC4E4F512A2935B329250F3538128C73983 ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="F:\HAIOPEI-PC\Backup Set 2011-02-15 180641\Backup Files 2011-08-11 202424\Backup files 4.zip"
sh=BD829023E2B5E734CE9538EA0628F6464240AD4F ft=0 fh=0000000000000000 vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="F:\HAIOPEI-PC\Backup Set 2011-09-17 005025\Backup Files 2011-09-17 005025\Backup files 2.zip"
sh=D374EA8FB62B6C87774A80F9C2A5B2E8BB05AA60 ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="F:\HAIOPEI-PC\Backup Set 2011-09-17 005025\Backup Files 2011-09-17 005025\Backup files 21.zip"
sh=63ADE9F825A60CA8865FF1C2688953CC86C2EDF9 ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="F:\HAIOPEI-PC\Backup Set 2011-09-17 005025\Backup Files 2011-09-17 005025\Backup files 23.zip"
sh=24619400CC04CEDE107D0CF06815A0C3FCE85A29 ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="F:\HAIOPEI-PC\Backup Set 2011-09-17 005025\Backup Files 2011-09-17 005025\Backup files 27.zip"
sh=EACBE191005E7B01E0986CDEBD92FA8F99102D24 ft=0 fh=0000000000000000 vn="Variante von Win32/SoftonicDownloader.A evtl. unerwünschte Anwendung" ac=I fn="F:\HAIOPEI-PC\Backup Set 2011-09-17 005025\Backup Files 2011-09-17 005025\Backup files 29.zip"

Hier also die nächsten logfiles.
Was ich nur nicht verstehe: Die MBAM Datei zeigt als Datum den11.1.2015, aber das Erstellungsdatum ist der 9.3.15.
Ist das so ok??

07.03.2015, 23:51	#5
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Windows 7 Malwarebytes hat "pup.optional.findr.a" gefunden Warum ist auf dem Rechner nur ein 32-Bit-Windows drauf? Die Hardware ist aktuell.... __________________ Logfiles bitte immer in CODE-Tags posten

08.03.2015, 15:29	#7
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Windows 7 Malwarebytes hat "pup.optional.findr.a" gefunden Da hat der Hersteller aber Mist gebaut...liefert einen Rechner mit 4 GiB RAM nur mit einem 32-Bit-Windows aus Ich hätte ja an deiner Stelle das Ding gleich geplättest und ein 64-Bit-Windows neu installiert. __________________ Logfiles bitte immer in CODE-Tags posten

Windows 7 Malwarebytes hat "pup.optional.findr.a" gefunden

Plagegeister aller Art und deren Bekämpfung: Windows 7 Malwarebytes hat "pup.optional.findr.a" gefunden