Win 8.1: Nach löschen von Virus mit Avira erscheint jedes Mal nach dem starten ein Fenster mit Auswahl, wie Datei geöffnet werden soll.

cosinus · 24.04.2015, 14:39

FRST-Fix

Virenscanner jetzt bitte komplett deaktivieren, damit sichergestellt ist, dass der Fix sauber durchläuft!

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

C:\Users\Matthias Meister\Downloads\VideoPad\VideoPad\videopad.exe
C:\Users\Matthias Meister\Downloads\VideoPad\VideoPad\videopadsetup_v3.04.exe
EmptyTemp:

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Matmeis · 27.04.2015, 07:36

Guten Morgen cosinus,
da bin ich wieder. Was ist nicht verstehe: Warum konnte ich nicht einfach meinen Downloads-Ordner leeren?

Inhalt der Fixlog-Datei:

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 22-04-2015 01
Ran by Matthias Meister at 2015-04-27 08:32:19 Run:2
Running from C:\Users\Matthias Meister\Desktop
Loaded Profiles: Matthias Meister &  (Available profiles: Matthias Meister & Gast)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
C:\Users\Matthias Meister\Downloads\VideoPad\VideoPad\videopad.exe
C:\Users\Matthias Meister\Downloads\VideoPad\VideoPad\videopadsetup_v3.04.exe
EmptyTemp:
*****************

"C:\Users\Matthias Meister\Downloads\VideoPad\VideoPad\videopad.exe" => File/Directory not found.
"C:\Users\Matthias Meister\Downloads\VideoPad\VideoPad\videopadsetup_v3.04.exe" => File/Directory not found.
EmptyTemp: => Removed 21.7 MB temporary data.


The system needed a reboot. 

==== End of Fixlog 08:32:25 ====

Ich wünsche einen schönen Start in die Woche.

cosinus · 27.04.2015, 18:24

Sieht soweit ok aus

Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) empfehle ich die Erweiterung Ghostery, diese verhindert weitgehend Usertracking bzw. das Anzeigen von Werbebannern.

Info: Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

Matmeis · 28.04.2015, 08:53

HI Cosinus,

Ghostery habe ich schon für mich entdeckt und finde es richtig gut.

Leider kommt nach jedem Neustart immer noch dieses Fenster mit der Aufforderung eine app auszusuchen, mit der ich die Datei öffnen kann. Hast du dir die Datei mal angeschaut? Soll ich sie noch einmal anhängen? Oder soll ich den Inhalt, wie der Editor mir den anzeigt, mal posten?
Leider kann ich irgendwie nicht rausfinden, wo der Speicherort der Datei ist.
Wie schon zu Anfang beschrieben:
Wenn ich den Internet Explorer auswähle, dann lädt mir der Internet Explorer die Datei in den Downloads Ordner. Sie heißt dann einfach "Matthias" und als Autor wird DVDVideoSoft Ltd. angegeben. Wenn ich sie dann mit dem Editor öffne, stehen da jede Menge Hieroglyphen und ein paar verständliche Zeilen. Deswegen habe ich mich ursprünglich an das Trojaner-Board gewendet.

Hast du noch eine Idee, was das sein könnte und wie ich es los werde?

Vielen Dank,
Matmeis

cosinus · 28.04.2015, 20:08

Dann zeig mal frische FRST Logs. Haken setzen bei addition.txt dann auf Scan klicken

Matmeis · 28.04.2015, 21:55

Hi Cosinus,

gerade ist etwas seltsames passiert. Dieses Mal kam nicht ein Fenster, wie ich die Datei öffnen möchte, sondern ein Setup startete mit der Aufforderung Free Youtube Downloads zu installieren. Das ist ein Tool von DVDVideoSoft, das ich vor Jahren mal installiert habe, weil ich einen kurzen Ausschnitt aus einem YoutubeVideo gebraucht habe für eine Hochzeit.
Ich habe nun der Installation zugestimmt und dann FRST laufen lassen. Da bisher die Scans dieses Tool und die versuchte Installation nicht angezeigt haben, habe ich nun die Hoffnung, dass wir nun alles von meinem Laptop runter kriegen. Ich hoffe, das ist Ok? Avira meldet jedenfalls nun ein Problem. Aber wenn ich den Antivirenscanner öffne, zeigt er an, dass alles in Ordnung ist. Seltsam.

Hier die Logdateien:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-04-2015 01
Ran by Matthias Meister (administrator) on MATTHIASMEISTER on 28-04-2015 22:45:45
Running from C:\Users\Matthias Meister\Desktop
Loaded Profiles: Matthias Meister (Available profiles: Matthias Meister & Gast)
Platform: Windows 8.1 Pro (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Lenovo.) C:\Windows\System32\ibmpmsvc.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tphkload.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Lenovo Corporation) C:\Program Files\Lenovo\Communications Utility\AVControlCenter32.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Broadcom Corporation.) C:\Windows\System32\BtwRSupportService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\SettingsDependency\SettingsService.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\micmute.exe
(The OpenVPN Project) C:\Program Files (x86)\Sophos\Sophos SSL VPN Client\bin\openvpnserv.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(SafeNet, Inc.) C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel RMS License Manager\WinNT\lservnt.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiMAX\Bin\AppSrv.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Red Bend Ltd.) C:\Program Files\Intel\WiMAX\Bin\DMAgent.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\BrYNSvc.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
() C:\Program Files (x86)\Lenovo\LocationAware\loctaskmgr.exe
(Lenovo) C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.exe
(Authentec Inc.) C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe
(Lenovo Corporation) C:\Program Files\Lenovo\Communications Utility\avfaudiosw.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tpnumlkd.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tposd.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\shtctky.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20689_x64__8wekyb3d8bbwe\livecomm.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
() C:\Program Files\CONEXANT\ForteConfig\fmapp.exe
(Lenovo.) C:\Windows\System32\TpShocks.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
(Dropbox, Inc.) C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(DVDVideoSoft Ltd.) C:\Users\Matthias Meister\AppData\Local\Temp\is-DI0SM.tmp\netlogger.exe
(Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\csisyncclient.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\msosync.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe
(Lenovo Corporation) C:\Program Files\Lenovo\Communications Utility\tpknrres.exe
(DVDVideoSoft Ltd.                                           ) C:\Users\Matthias Meister\AppData\Local\Temp\FreeYouTubeDownload.exe
() C:\Users\Matthias Meister\AppData\Local\Temp\is-RQHQL.tmp\FreeYouTubeDownload.tmp


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [AcWin7Hlpr] => C:\Program Files (x86)\Lenovo\Access Connections\AcTBenabler.exe [63376 2012-09-07] (Lenovo)
HKLM\...\Run: [ForteConfig] => C:\Program Files\Conexant\ForteConfig\fmapp.exe [49056 2010-10-26] ()
HKLM\...\Run: [TpShocks] => C:\Windows\system32\TpShocks.exe [384344 2014-02-17] (Lenovo.)
HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SACpl.exe [1647616 2012-06-13] (Conexant Systems, Inc.)
HKLM\...\Run: [LenovoOptMouseUpdate] => C:\Program Files\Lenovo\HOTKEY\extapsup.exe [255480 2013-06-20] (Lenovo Group Limited)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2963184 2013-05-29] (Synaptics Incorporated)
HKLM\...\Run: [LnvMobHotspotClient] => C:\Program Files\Lenovo\Lenovo Mobile Hotspot\MobileHotspotclient.exe [938032 2014-03-05] (Lenovo)
HKLM\...\Run: [apmwinapp] => C:\Program Files (x86)\Paragon Software\HFS+ for Windows 8 Free Edition\apmwinsrv.exe [66768 2014-06-17] ()
HKLM\...\Run: [LMCSSTART1] => C:\WINDOWS\SysWOW64\lmcfrundll.exe C:\Program Files\Lenovo\Communications Utility\libmcsrdllb.dll,InitSubsystemProcesses
HKLM\...\Run: [LMCSSTART2] => C:\WINDOWS\SysWOW64\lmcfrundll.exe C:\Program Files\Lenovo\Communications Utility\libstartstub2.dll,ProxyStart
HKLM\...\Run: [LMCSSTART3] => C:\WINDOWS\SysWOW64\lmcfrundll.exe C:\Program Files\Lenovo\Communications Utility\libmcsrdllb.dll,SetupCamplusDrop
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [169768 2015-04-07] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-11-20] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2015-03-20] (Apple Inc.)
HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [115048 2011-09-16] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [726320 2015-04-01] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [BingDesktop] => C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktop.exe [2249352 2013-06-20] (Microsoft Corp.)
HKLM-x32\...\Run: [BrStsMon00] => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [3076096 2012-06-06] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [113656 2013-01-17] (Intel Corporation)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [189480 2014-02-06] (Geek Software GmbH)
HKLM-x32\...\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] => C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe [707472 2014-03-12] (Cisco Systems, Inc.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.)
HKLM-x32\...\Run: [openvpn-gui] => C:\Program Files (x86)\Sophos\Sophos SSL VPN Client\bin\openvpn-gui.exe [480992 2014-08-28] ()
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [129272 2015-03-16] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\psfus: C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll (Authentec Inc.)
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Run: [Google Update] => C:\Users\Matthias Meister\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2013-03-12] (Google Inc.)
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Run: [MusicManager] => C:\Users\Matthias Meister\AppData\Local\Programs\Google\MusicManager\MusicManager.exe [7475200 2015-04-01] (Google Inc.)
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [26232152 2015-02-19] (Google)
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Run: [Skitch] => C:\Program Files (x86)\Evernote\Skitch\Skitch.exe [4851008 2014-05-01] (Evernote)
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Run: [GoogleChromeAutoLaunch_5382C8EB82E9B70BA085EAF9BDB27BD7] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [812872 2015-04-13] (Google Inc.)
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Run: [OneDrive] => C:\Users\Matthias Meister\AppData\Local\Microsoft\OneDrive\OneDrive.exe [281248 2015-03-13] (Microsoft Corporation)
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Run: [Spotify] => C:\Users\Matthias Meister\AppData\Roaming\Spotify\Spotify.exe [7021112 2015-04-04] (Spotify Ltd)
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Run: [Spotify Web Helper] => C:\Users\Matthias Meister\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1806904 2015-04-04] (Spotify Ltd)
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [43816 2014-11-21] (Apple Inc.)
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Run: [iCloudDrive] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe [43816 2014-11-21] (Apple Inc.)
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Run: [Sysinternals Desktops] => C:\Users\Matthias Meister\Documents\Systeminttools\Desktops.exe [116824 2015-04-13] (Sysinternals - www.sysinternals.com)
Lsa: [Notification Packages] scecli ACGina C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll
Startup: C:\Users\Matthias Meister\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\An OneNote senden.lnk [2013-05-23]
ShortcutTarget: An OneNote senden.lnk -> C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\Matthias Meister\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2012-11-28]
ShortcutTarget: Dropbox.lnk -> C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers-x32: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers-x32: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File
ShellIconOverlayIdentifiers-x32: [ SkyDrivePro1 (ErrorConflict)] -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} =>  No File
ShellIconOverlayIdentifiers-x32: [ SkyDrivePro2 (SyncInProgress)] -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} =>  No File
ShellIconOverlayIdentifiers-x32: [ SkyDrivePro3 (InSync)] -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} =>  No File
ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-895578266-524488165-4032655203-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKU\S-1-5-21-895578266-524488165-4032655203-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-02-10] (Microsoft Corporation)
BHO: Citavi Picker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\Windows\system32\mscoree.dll [2013-08-22] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-02-10] (Microsoft Corporation)
BHO-x32: Citavi Picker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\Windows\SysWOW64\mscoree.dll [2013-08-22] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-01-26] (Oracle Corporation)
BHO-x32: Evernote extension -> {92EF2EAD-A7CE-4424-B0DB-499CF856608E} -> C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll [2015-04-02] (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-01-26] (Oracle Corporation)
DPF: HKLM-x32 {55A2C0CD-3DE8-4264-9637-A0B40B05714E} https://col0-sec.mail.live.com/mail/MailMigrationCabFileHolder.aspx?n=1616762545
Handler: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} -  No File
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-02-03] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Matthias Meister\AppData\Roaming\Mozilla\Firefox\Profiles\3uohh0jz.default
FF SelectedSearchEngine: Google
FF Homepage: www.google.de
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_17_0_0_169.dll [2015-04-14] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll No File
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-04-14] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-01-26] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-01-26] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2014-02-03] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-04] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-04] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.2.0 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-02-27] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-895578266-524488165-4032655203-1000: @microsoft.com/Office on Demand;version=1 -> C:\Users\Matthias Meister\AppData\Local\Microsoft\Internet Explorer\Downloaded Program Files\Microsoft Office 15\npofficeondemand.dll [2012-11-10] (Microsoft Corporation)
FF Plugin HKU\S-1-5-21-895578266-524488165-4032655203-1000: @tools.google.com/Google Update;version=3 -> C:\Users\Matthias Meister\AppData\Local\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-06] (Google Inc.)
FF Plugin HKU\S-1-5-21-895578266-524488165-4032655203-1000: @tools.google.com/Google Update;version=9 -> C:\Users\Matthias Meister\AppData\Local\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-06] (Google Inc.)
FF Plugin HKU\S-1-5-21-895578266-524488165-4032655203-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Matthias Meister\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2015-03-24] (Unity Technologies ApS)
FF Plugin HKU\S-1-5-21-895578266-524488165-4032655203-1000: amazon.com/AmazonMP3DownloaderPlugin -> C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101721.dll [2013-01-23] (Amazon.com, Inc.)
FF Extension: Avira Browser Safety - C:\Users\Matthias Meister\AppData\Roaming\Mozilla\Firefox\Profiles\3uohh0jz.default\Extensions\abs@avira.com [2014-08-06]
FF Extension: Reader - C:\Users\Matthias Meister\AppData\Roaming\Mozilla\Firefox\Profiles\3uohh0jz.default\Extensions\{20068ab2-1901-4140-9f3c-81207d4dacc4} [2013-05-16]
FF Extension: DownloadHelper - C:\Users\Matthias Meister\AppData\Roaming\Mozilla\Firefox\Profiles\3uohh0jz.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2013-10-07]
FF Extension: Ghostery - C:\Users\Matthias Meister\AppData\Roaming\Mozilla\Firefox\Profiles\3uohh0jz.default\Extensions\firefox@ghostery.com.xpi [2013-09-19]
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Users\Matthias Meister\AppData\Roaming\Mozilla\Firefox\Profiles\3uohh0jz.default\Extensions\{B64D9B05-48E1-4CEB-BF58-E0643994E900}.xpi [2015-04-28]
FF Extension: Adblock Plus - C:\Users\Matthias Meister\AppData\Roaming\Mozilla\Firefox\Profiles\3uohh0jz.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-11-28]
FF HKLM-x32\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2015-04-23]
FF HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Firefox\Extensions: [{F74D5734-46F5-4B16-96F0-1E7FBF41B750}] - C:\Program Files (x86)\Lenovo\Password Manager\PWM Firefox Extension\2.0b12

Chrome: 
=======
CHR StartupUrls: Default -> "hxxp://www.google.de/"
CHR Profile: C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (ProxFlow) - C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek [2015-04-23]
CHR Extension: (Writebox) - C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default\Extensions\bbehjmjchoiaglkeboicbgkpfafcmhij [2015-04-23]
CHR Extension: (MagicScroll Web Reader) - C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default\Extensions\ecldhagehndokdmaiaigoaecbmbnmfkc [2015-04-23]
CHR Extension: (BetaFish Adblocker) - C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2015-04-23]
CHR Extension: (Bookmark Manager) - C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik [2015-04-23]
CHR Extension: (feedly) - C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default\Extensions\hipbfijinpcgfogaopmgehiegacbhmob [2015-04-23]
CHR Extension: (Google Play Music) - C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default\Extensions\icppfcnhkcmnfdhfhphakoifcfokfdhg [2015-04-23]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-11]
CHR Extension: (Ghostery) - C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default\Extensions\mlomiejdfkolichcflejclcbmpeaniij [2015-04-23]
CHR Extension: (Google Wallet) - C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-04-23]
CHR Extension: (Citavi Picker) - C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default\Extensions\ohgndokldibnndfnjnagojmheejlengn [2014-02-17]
CHR Extension: (AVG PrivacyFix) - C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default\Extensions\pmejhjjecaldkllonlokhkglbdbkdcni [2015-04-23]
CHR HKLM-x32\...\Chrome\Extension: [ohgndokldibnndfnjnagojmheejlengn] - https://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [815920 2015-04-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [434424 2015-04-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [434424 2015-04-01] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1004280 2015-04-01] (Avira Operations GmbH & Co. KG)
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-01-20] (Apple Inc.)
R2 AVControlCenter; C:\Program Files\Lenovo\Communications Utility\AVControlCenter32.exe [560584 2015-01-21] (Lenovo Corporation)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [201008 2015-03-16] (Avira Operations GmbH & Co. KG)
R2 BcmBtRSupport; C:\Windows\system32\BtwRSupportService.exe [2255064 2013-10-28] (Broadcom Corporation.)
S2 BingDesktopUpdate; C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe [173192 2013-06-20] (Microsoft Corp.)
R3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [266240 2012-06-05] (Brother Industries, Ltd.) [File not signed]
S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-10-29] (Microsoft Corporation)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2714800 2015-02-10] (Microsoft Corporation)
R2 DMAgent; C:\Program Files\Intel\WiMAX\Bin\DMAgent.exe [514048 2012-07-18] (Red Bend Ltd.) [File not signed]
R2 Lenovo Settings Service; C:\Program Files\Lenovo\SettingsDependency\SettingsService.exe [2016472 2015-01-23] (Lenovo Group Limited)
S3 LENOVO.TVTVCAM; C:\Program Files\Lenovo\Communications Utility\vcamsvc.exe [626120 2015-01-21] (Lenovo Corporation)
S3 LnvHotSpotSvc; C:\Program Files\Lenovo\Lenovo Mobile Hotspot\LnvHotSpotSvc.exe [474160 2014-03-05] (Lenovo)
R2 LocationTaskManager; C:\Program Files (x86)\Lenovo\LocationAware\loctaskmgr.exe [469720 2015-01-09] ()
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
S3 OpenVPNService; C:\Program Files (x86)\Sophos\Sophos SSL VPN Client\bin\openvpnserv.exe [81024 2014-08-28] (The OpenVPN Project)
R2 OpenVPNServiceInteractive; C:\Program Files (x86)\Sophos\Sophos SSL VPN Client\bin\openvpnserv.exe [81024 2014-08-28] (The OpenVPN Project)
R2 Sentinel RMS License Manager; C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel RMS License Manager\WinNT\lservnt.exe [884736 2010-10-20] (SafeNet, Inc.) [File not signed]
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-04] (Microsoft Corporation)
R2 WiMAXAppSrv; C:\Program Files\Intel\WiMAX\Bin\AppSrv.exe [979456 2012-07-18] (Intel(R) Corporation) [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-04] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3674864 2013-11-20] (Intel® Corporation)
S2 DozeSvc; C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R0 apmwin; C:\Windows\System32\DRIVERS\apmwin.sys [35024 2014-06-17] (Paragon Software Group)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [128536 2015-03-10] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [132120 2015-03-10] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-10-07] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [43576 2015-03-10] (Avira Operations GmbH & Co. KG)
R3 bcbtums; C:\Windows\system32\drivers\bcbtums.sys [170712 2013-10-28] (Broadcom Corporation.)
R3 e1cexpress; C:\Windows\system32\DRIVERS\e1c64x64.sys [468752 2014-06-27] (Intel Corporation)
R0 gpt_loader; C:\Windows\System32\DRIVERS\gpt_loader.sys [61136 2014-06-17] (Paragon Software Group)
S3 Hfsplus; C:\Windows\System32\DRIVERS\hfsplus.sys [206032 2014-06-17] (Paragon Software Group)
R2 HfsplusRec; C:\Windows\System32\DRIVERS\hfsplusrec.sys [15568 2014-06-17] (Paragon Software Group)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2015-04-14] (Malwarebytes Corporation)
R0 mounthlp; C:\Windows\System32\DRIVERS\mounthlp.sys [42704 2014-06-17] (Paragon Software Group)
R3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew00.sys [3346912 2013-10-31] (Intel Corporation)
S3 NETwNs64; C:\Windows\system32\DRIVERS\Netwsw00.sys [11499008 2012-06-03] (Intel Corporation) [File not signed]
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [44784 2013-05-29] (Synaptics Incorporated)
R2 smihlp; C:\Program Files\ThinkVantage Fingerprint Software\smihlp.sys [13128 2011-05-30] (Authentec Inc.)
R3 Tvti2c; C:\Windows\system32\DRIVERS\Tvti2c.sys [40248 2011-05-30] (Lenovo Information Product(ShenZhen China) Inc.)
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2012-12-13] (Apple, Inc.) [File not signed]
S3 vpnva; C:\Windows\system32\DRIVERS\vpnva64-6.sys [52592 2014-03-12] (Cisco Systems, Inc.)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-04] (Microsoft Corporation)
U3 idsvc; No ImagePath
S3 intaud_WaveExtensible; \SystemRoot\system32\drivers\intelaud.sys [X]
S3 iwdbus; \SystemRoot\System32\drivers\iwdbus.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-28 22:45 - 2015-04-28 22:45 - 00001452 _____ () C:\Users\Public\Desktop\Free YouTube Download.lnk
2015-04-28 22:45 - 2015-04-28 22:45 - 00001257 _____ () C:\Users\Public\Desktop\DVDVideoSoft Free Studio.lnk
2015-04-28 22:45 - 2015-04-28 22:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
2015-04-28 22:45 - 2015-04-28 22:45 - 00000000 ____D () C:\Program Files (x86)\Free Codec Pack
2015-04-28 22:44 - 2015-04-28 22:45 - 00000000 ____D () C:\Program Files (x86)\DVDVideoSoft
2015-04-28 22:40 - 2015-04-28 22:40 - 00000000 ____D () C:\Users\Matthias Meister\Desktop\FRST-OlderVersion
2015-04-28 11:24 - 2015-03-13 03:11 - 02162176 _____ (Microsoft Corporation) C:\WINDOWS\system32\SRH.dll
2015-04-28 11:24 - 2015-03-13 02:39 - 01812992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SRH.dll
2015-04-28 11:22 - 2015-03-06 05:08 - 02067968 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpdshext.dll
2015-04-28 11:22 - 2015-03-06 04:43 - 01969664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wpdshext.dll
2015-04-27 08:55 - 2015-04-28 22:13 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Local\1A8F483F-CFB2-4BEC-BFAE-55393764F250.aplzod
2015-04-24 14:03 - 2015-04-24 14:28 - 00136408 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-04-24 14:03 - 2015-04-24 14:03 - 00001114 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-04-24 14:03 - 2015-04-24 14:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-04-24 14:03 - 2015-04-24 14:03 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-04-24 14:03 - 2015-04-14 09:38 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2015-04-24 14:03 - 2015-04-14 09:37 - 00107736 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2015-04-24 14:03 - 2015-04-14 09:37 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2015-04-24 12:17 - 2015-04-27 08:32 - 00005656 _____ () C:\WINDOWS\PFRO.log
2015-04-24 11:29 - 2015-04-24 11:30 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Roaming\FreeFileSync
2015-04-24 11:29 - 2015-04-24 11:30 - 00000000 ____D () C:\ProgramData\TuneUp Software
2015-04-24 11:29 - 2015-04-24 11:29 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2015-04-24 11:29 - 2015-04-24 11:29 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Local\TuneUp Software
2015-04-24 11:28 - 2015-04-24 11:28 - 00000956 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FreeFileSync.lnk
2015-04-24 11:28 - 2015-04-24 11:28 - 00000946 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RealtimeSync.lnk
2015-04-24 11:28 - 2015-04-24 11:28 - 00000944 _____ () C:\Users\Public\Desktop\FreeFileSync.lnk
2015-04-24 11:28 - 2015-04-24 11:28 - 00000934 _____ () C:\Users\Public\Desktop\RealtimeSync.lnk
2015-04-24 11:28 - 2015-04-24 11:28 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Roaming\RHEng
2015-04-24 11:28 - 2015-04-24 11:28 - 00000000 ____D () C:\Program Files\FreeFileSync
2015-04-24 09:09 - 2015-04-27 10:52 - 00001073 _____ () C:\WINDOWS\setupact.log
2015-04-24 09:09 - 2015-04-24 09:09 - 00000000 _____ () C:\WINDOWS\setuperr.log
2015-04-24 08:43 - 2015-04-28 22:45 - 00003594 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-895578266-524488165-4032655203-1000
2015-04-23 16:28 - 2015-04-23 16:28 - 00001016 _____ () C:\Users\Matthias Meister\Desktop\JRT.txt
2015-04-23 16:22 - 2015-04-23 16:22 - 00000207 _____ () C:\WINDOWS\tweaking.com-regbackup-MATTHIASMEISTER-Windows-8.1-Pro-(64-bit).dat
2015-04-23 16:22 - 2015-04-23 16:22 - 00000000 ____D () C:\RegBackup
2015-04-23 16:10 - 2015-04-23 16:10 - 02685470 _____ (Thisisu) C:\Users\Matthias Meister\Desktop\JRT.exe
2015-04-23 16:09 - 2015-04-23 16:09 - 02217984 _____ () C:\Users\Matthias Meister\Desktop\AdwCleaner_4.201.exe
2015-04-23 15:51 - 2015-04-24 08:41 - 00049438 _____ () C:\Users\Matthias Meister\Desktop\Addition.txt
2015-04-23 15:49 - 2015-04-28 22:46 - 00030451 _____ () C:\Users\Matthias Meister\Desktop\FRST.txt
2015-04-23 15:49 - 2015-04-28 22:45 - 00000000 ____D () C:\FRST
2015-04-23 15:47 - 2015-04-28 22:40 - 02100736 _____ (Farbar) C:\Users\Matthias Meister\Desktop\FRST64.exe
2015-04-23 14:22 - 2015-04-23 14:38 - 00000000 ____D () C:\Users\Matthias Meister\Desktop\Trojaner Board
2015-04-23 11:59 - 2015-04-28 09:46 - 00000000 ____D () C:\Users\Matthias Meister\Documents\Citavi 5
2015-04-23 11:58 - 2015-04-23 11:58 - 00001977 _____ () C:\Users\Public\Desktop\Citavi 5.lnk
2015-04-23 11:58 - 2015-04-23 11:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Citavi 5
2015-04-23 11:57 - 2015-04-23 11:58 - 00000000 ____D () C:\Program Files (x86)\Citavi 5
2015-04-23 10:11 - 2015-04-23 10:11 - 00001917 _____ () C:\Users\Public\Desktop\HitmanPro.lnk
2015-04-23 10:11 - 2015-04-23 10:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro
2015-04-23 10:11 - 2015-04-23 10:11 - 00000000 ____D () C:\Program Files\HitmanPro
2015-04-23 10:10 - 2015-04-23 10:16 - 00000000 ____D () C:\ProgramData\HitmanPro
2015-04-23 10:09 - 2015-04-23 10:09 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-04-23 10:08 - 2015-04-23 16:17 - 00000000 ____D () C:\AdwCleaner
2015-04-23 09:05 - 2015-04-23 09:05 - 00002523 _____ () C:\Users\Public\Desktop\Evernote.lnk
2015-04-23 09:05 - 2015-04-23 09:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Evernote
2015-04-22 11:26 - 2015-04-22 11:26 - 00000398 _____ () C:\Users\Matthias Meister\AppData\Local\Citavi Picker Internet Explorer Protocol.txt
2015-04-22 11:26 - 2015-04-22 11:26 - 00000000 __SHD () C:\Users\Matthias Meister\AppData\Local\EmieBrowserModeList
2015-04-15 09:56 - 2015-04-15 21:23 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Roaming\Skype
2015-04-15 09:56 - 2015-04-15 09:58 - 00000000 ___RD () C:\Program Files (x86)\Skype
2015-04-15 09:56 - 2015-04-15 09:58 - 00000000 ____D () C:\ProgramData\Skype
2015-04-15 09:56 - 2015-04-15 09:56 - 00002715 _____ () C:\Users\Public\Desktop\Skype.lnk
2015-04-15 09:56 - 2015-04-15 09:56 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Local\Skype
2015-04-15 09:56 - 2015-04-15 09:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2015-04-15 09:49 - 2014-11-17 22:17 - 00672984 _____ (Microsoft Corporation) C:\WINDOWS\system32\MDMAgent.exe
2015-04-15 09:49 - 2014-11-17 22:17 - 00273240 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsAdminFlows.exe
2015-04-15 09:49 - 2014-11-14 08:58 - 00116736 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsDatabase.dll
2015-04-15 09:49 - 2014-11-14 08:54 - 00463872 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettings.Handlers.dll
2015-04-15 09:49 - 2014-11-14 08:46 - 02171904 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsAdminFlowUI.dll
2015-04-15 09:49 - 2014-11-14 08:39 - 02819584 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers.dll
2015-04-15 09:45 - 2015-03-23 23:59 - 07476032 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2015-04-15 09:45 - 2015-03-23 23:59 - 01733952 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2015-04-15 09:45 - 2015-03-23 23:59 - 00360480 _____ (Microsoft Corporation) C:\WINDOWS\system32\sechost.dll
2015-04-15 09:45 - 2015-03-23 23:58 - 01498872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2015-04-15 09:45 - 2015-03-23 23:45 - 00257216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sechost.dll
2015-04-15 09:45 - 2015-03-20 06:12 - 00246272 _____ (Microsoft Corporation) C:\WINDOWS\system32\microsoft-windows-system-events.dll
2015-04-15 09:45 - 2015-03-20 06:10 - 00285184 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64.dll
2015-04-15 09:45 - 2015-03-20 06:10 - 00013312 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64cpu.dll
2015-04-15 09:45 - 2015-03-20 05:17 - 00411648 _____ (Microsoft Corporation) C:\WINDOWS\system32\tracerpt.exe
2015-04-15 09:45 - 2015-03-20 04:41 - 00369152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tracerpt.exe
2015-04-15 09:45 - 2015-03-20 04:40 - 00950784 _____ (Microsoft Corporation) C:\WINDOWS\system32\tdh.dll
2015-04-15 09:45 - 2015-03-20 04:16 - 00749568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tdh.dll
2015-04-15 09:45 - 2015-03-14 10:20 - 01385256 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctf.dll
2015-04-15 09:45 - 2015-03-14 10:13 - 01124352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctf.dll
2015-04-15 09:45 - 2015-03-13 04:58 - 00259072 _____ (Microsoft Corporation) C:\WINDOWS\system32\pku2u.dll
2015-04-15 09:45 - 2015-03-13 04:37 - 00208896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\pku2u.dll
2015-04-15 09:45 - 2015-02-24 10:32 - 00991552 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\http.sys
2015-04-15 09:45 - 2015-02-21 01:49 - 00780800 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsm.dll
2015-04-15 09:44 - 2015-03-23 00:45 - 00227328 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepdu.dll
2015-04-15 09:44 - 2015-03-23 00:09 - 01111552 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2015-04-15 09:44 - 2015-03-23 00:09 - 00957440 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2015-04-15 09:44 - 2015-03-23 00:09 - 00769024 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
2015-04-15 09:44 - 2015-03-23 00:09 - 00726528 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2015-04-15 09:44 - 2015-03-23 00:09 - 00419328 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2015-04-15 09:44 - 2015-03-23 00:09 - 00030720 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll
2015-04-15 09:44 - 2015-03-14 10:54 - 00133256 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
2015-04-15 09:44 - 2015-03-14 03:56 - 00066048 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups.dll
2015-04-15 09:44 - 2015-03-14 03:56 - 00052224 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups2.dll
2015-04-15 09:44 - 2015-03-14 03:51 - 00015360 _____ (Microsoft Corporation) C:\WINDOWS\system32\wu.upgrade.ps.dll
2015-04-15 09:44 - 2015-03-14 03:37 - 00267264 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinSetupUI.dll
2015-04-15 09:44 - 2015-03-14 03:14 - 00027136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wups.dll
2015-04-15 09:44 - 2015-03-14 02:22 - 03678720 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2015-04-15 09:44 - 2015-03-14 02:12 - 00140288 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuwebv.dll
2015-04-15 09:44 - 2015-03-14 02:12 - 00035840 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapp.exe
2015-04-15 09:44 - 2015-03-14 02:09 - 00200192 _____ (Microsoft Corporation) C:\WINDOWS\system32\storewuauth.dll
2015-04-15 09:44 - 2015-03-14 02:08 - 00408064 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUSettingsProvider.dll
2015-04-15 09:44 - 2015-03-14 02:08 - 00095744 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll
2015-04-15 09:44 - 2015-03-14 02:06 - 02373632 _____ (Microsoft Corporation) C:\WINDOWS\system32\wucltux.dll
2015-04-15 09:44 - 2015-03-14 02:06 - 00891392 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
2015-04-15 09:44 - 2015-03-14 02:02 - 00124928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuwebv.dll
2015-04-15 09:44 - 2015-03-14 02:02 - 00029696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapp.exe
2015-04-15 09:44 - 2015-03-14 01:59 - 00721920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll
2015-04-15 09:44 - 2015-03-14 01:59 - 00081920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll
2015-04-15 09:44 - 2015-03-13 06:32 - 24980480 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2015-04-15 09:44 - 2015-03-13 06:08 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2015-04-15 09:44 - 2015-03-13 06:07 - 02886144 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2015-04-15 09:44 - 2015-03-13 05:53 - 00816128 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2015-04-15 09:44 - 2015-03-13 05:50 - 06025216 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2015-04-15 09:44 - 2015-03-13 05:42 - 19695616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2015-04-15 09:44 - 2015-03-13 05:28 - 00503296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2015-04-15 09:44 - 2015-03-13 05:26 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2015-04-15 09:44 - 2015-03-13 05:22 - 02278400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2015-04-15 09:44 - 2015-03-13 05:17 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2015-04-15 09:44 - 2015-03-13 05:16 - 00664064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2015-04-15 09:44 - 2015-03-13 05:08 - 00720384 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2015-04-15 09:44 - 2015-03-13 05:07 - 00801280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2015-04-15 09:44 - 2015-03-13 05:00 - 14397440 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2015-04-15 09:44 - 2015-03-13 04:50 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2015-04-15 09:44 - 2015-03-13 04:49 - 04305408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2015-04-15 09:44 - 2015-03-13 04:45 - 02358784 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2015-04-15 09:44 - 2015-03-13 04:44 - 00689152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2015-04-15 09:44 - 2015-03-13 04:34 - 12825600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2015-04-15 09:44 - 2015-03-13 04:33 - 01548288 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2015-04-15 09:44 - 2015-03-13 04:22 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2015-04-15 09:44 - 2015-03-13 04:20 - 01888256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2015-04-15 09:44 - 2015-03-13 04:16 - 01311232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2015-04-15 09:44 - 2015-03-13 04:14 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2015-04-15 09:44 - 2015-03-04 12:25 - 00377152 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\clfs.sys
2015-04-15 09:44 - 2015-03-04 05:04 - 00075264 _____ (Microsoft Corporation) C:\WINDOWS\system32\clfsw32.dll
2015-04-15 09:44 - 2015-03-04 04:19 - 00058880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\clfsw32.dll
2015-04-13 14:32 - 2015-04-13 14:33 - 00000000 ____D () C:\Users\Matthias Meister\Documents\Systeminttools
2015-04-13 11:30 - 2015-04-13 14:35 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2015-04-13 11:16 - 2015-04-13 11:16 - 00000550 _____ () C:\Users\Matthias Meister\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ITA (liebenzell.intBereiche) (Z).lnk
2015-04-13 10:46 - 2015-04-28 22:40 - 00000000 ___RD () C:\Users\Matthias Meister\iCloudDrive
2015-04-13 10:46 - 2015-04-13 10:46 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Local\Apple Inc
2015-04-13 10:36 - 2015-04-13 10:36 - 00001765 _____ () C:\Users\Public\Desktop\iTunes.lnk
2015-04-13 10:36 - 2015-04-13 10:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2015-04-13 10:35 - 2015-04-13 10:36 - 00000000 ____D () C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7
2015-04-13 10:35 - 2015-04-13 10:36 - 00000000 ____D () C:\Program Files\iTunes
2015-04-13 10:35 - 2015-04-13 10:35 - 00000000 ____D () C:\Program Files\iPod
2015-04-13 10:35 - 2015-04-13 10:35 - 00000000 ____D () C:\Program Files (x86)\iTunes
2015-04-13 10:27 - 2015-04-13 10:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud
2015-04-04 13:47 - 2015-04-04 13:47 - 00000000 ___SD () C:\WINDOWS\SysWOW64\GWX
2015-04-04 13:47 - 2015-04-04 13:47 - 00000000 ___SD () C:\WINDOWS\system32\GWX
2015-04-04 10:27 - 2015-04-27 15:09 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Local\Spotify
2015-04-04 10:27 - 2015-04-04 10:27 - 00001913 _____ () C:\Users\Matthias Meister\Desktop\Spotify.lnk
2015-04-04 10:27 - 2015-04-04 10:27 - 00001899 _____ () C:\Users\Matthias Meister\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk
2015-04-04 10:26 - 2015-04-27 15:14 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Roaming\Spotify
2015-03-30 23:30 - 2015-03-30 23:30 - 00000000 ____D () C:\Program Files\IBM
2015-03-30 21:07 - 2015-03-30 21:07 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Roaming\Unity
2015-03-30 21:03 - 2015-03-30 21:03 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Local\Unity

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-28 22:45 - 2013-10-07 17:23 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Roaming\DVDVideoSoft
2015-04-28 22:41 - 2015-03-11 21:25 - 03312848 _____ (DVDVideoSoft Ltd. ) C:\Users\Matthias
2015-04-28 22:40 - 2013-05-14 15:50 - 00005208 _____ () C:\WINDOWS\System32\Tasks\Microsoft Office 15 Sync Maintenance for MATTHIASMEISTER-Matthias Meister MatthiasMeister
2015-04-28 22:40 - 2013-04-02 13:21 - 00001146 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2015-04-28 22:40 - 2012-11-29 17:01 - 00000000 __RDO () C:\Users\Matthias Meister\SkyDrive
2015-04-28 22:40 - 2012-11-28 14:12 - 00000000 ___RD () C:\Users\Matthias Meister\Dropbox
2015-04-28 22:40 - 2012-11-28 14:11 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Roaming\Dropbox
2015-04-28 22:14 - 2013-09-30 06:14 - 01776918 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2015-04-28 22:14 - 2013-09-30 05:56 - 00765582 _____ () C:\WINDOWS\system32\perfh007.dat
2015-04-28 22:14 - 2013-09-30 05:56 - 00159366 _____ () C:\WINDOWS\system32\perfc007.dat
2015-04-28 22:10 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2015-04-28 17:04 - 2014-06-05 19:16 - 01421743 _____ () C:\WINDOWS\WindowsUpdate.log
2015-04-28 16:56 - 2012-11-28 12:40 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2015-04-28 16:47 - 2013-10-17 16:40 - 00004002 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{79616768-A823-4D1A-A05A-496DB8C5B27C}
2015-04-28 16:45 - 2014-07-16 10:54 - 00000000 ____D () C:\ProgramData\AccordanceFinalClean
2015-04-28 11:31 - 2013-04-02 13:21 - 00001150 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2015-04-28 11:27 - 2013-03-12 20:24 - 00001196 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-895578266-524488165-4032655203-1000UA.job
2015-04-28 11:27 - 2012-07-26 09:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
2015-04-27 09:32 - 2013-03-12 20:24 - 00001144 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-895578266-524488165-4032655203-1000Core.job
2015-04-27 09:10 - 2012-11-28 17:49 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Local\Packages
2015-04-27 08:33 - 2013-08-22 16:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2015-04-27 08:32 - 2013-08-22 15:25 - 00786432 ___SH () C:\WINDOWS\system32\config\BBI
2015-04-27 08:31 - 2012-11-28 14:11 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-04-27 08:21 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2015-04-24 12:16 - 2013-10-17 16:15 - 00000000 ____D () C:\Users\Matthias Meister
2015-04-24 11:29 - 2012-11-28 10:17 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Roaming\TuneUp Software
2015-04-23 17:10 - 2013-08-22 17:31 - 00000834 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2015-04-23 17:10 - 2013-02-20 10:34 - 00000000 ____D () C:\Program Files\CCleaner
2015-04-23 12:43 - 2013-08-10 16:40 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Local\Microsoft Help
2015-04-23 12:03 - 2014-02-03 15:34 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Roaming\Swiss Academic Software
2015-04-23 12:02 - 2014-02-03 15:33 - 00000000 ____D () C:\Program Files (x86)\Citavi 4
2015-04-23 11:58 - 2014-02-03 15:33 - 00000000 ____D () C:\ProgramData\Swiss Academic Software
2015-04-23 11:56 - 2014-02-03 15:32 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Local\Downloaded Installations
2015-04-22 12:24 - 2013-02-26 18:57 - 00000678 _____ () C:\WINDOWS\BRCALIB.INI
2015-04-20 11:17 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\NDF
2015-04-17 11:11 - 2015-01-11 12:07 - 00000942 _____ () C:\Users\Public\Desktop\calibre 64bit - E-book management.lnk
2015-04-17 11:11 - 2015-01-11 12:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\calibre 64bit - E-book Management
2015-04-17 11:11 - 2015-01-11 12:07 - 00000000 ____D () C:\Program Files\Calibre2
2015-04-16 13:23 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\rescache
2015-04-15 22:42 - 2012-12-05 18:07 - 00000000 ____D () C:\Users\Matthias Meister\Documents\Outlook Files
2015-04-15 11:06 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\AppCompat
2015-04-15 10:15 - 2012-11-28 12:30 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-04-15 10:14 - 2014-12-12 00:14 - 00000000 ____D () C:\WINDOWS\system32\appraiser
2015-04-15 10:14 - 2014-07-09 10:28 - 00000000 ___SD () C:\WINDOWS\system32\CompatTel
2015-04-15 10:14 - 2013-07-23 12:38 - 00000000 ____D () C:\WINDOWS\system32\MRT
2015-04-15 10:03 - 2012-11-28 10:27 - 128913832 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2015-04-15 09:49 - 2013-08-22 17:36 - 00000000 ___RD () C:\WINDOWS\ImmersiveControlPanel
2015-04-15 09:42 - 2014-11-14 15:45 - 00017408 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaext.dll
2015-04-15 08:02 - 2013-10-29 15:16 - 00068145 _____ () C:\Users\Public\Documents\AcSvc.dmp
2015-04-15 08:02 - 2013-10-29 15:16 - 00012288 _____ () C:\Users\Public\Documents\AccConnAdvanced.dat
2015-04-14 20:14 - 2012-11-28 12:40 - 00003796 _____ () C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2015-04-14 17:33 - 2015-01-11 12:08 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Local\calibre-cache
2015-04-14 01:24 - 2013-08-22 17:38 - 00792056 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2015-04-14 01:24 - 2013-08-22 17:38 - 00178168 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2015-04-13 11:31 - 2013-10-17 22:25 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Local\Deployment
2015-04-13 11:00 - 2015-03-12 13:00 - 00002270 ____H () C:\Users\Matthias Meister\Documents\Default.rdp
2015-04-13 10:53 - 2012-11-28 14:38 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Roaming\Apple Computer
2015-04-13 10:35 - 2012-11-28 14:38 - 00000000 ____D () C:\Program Files\Common Files\Apple
2015-04-13 10:18 - 2013-07-23 14:19 - 00000000 ____D () C:\ProgramData\Package Cache
2015-04-13 10:18 - 2012-12-18 13:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-04-13 10:18 - 2012-12-18 13:44 - 00000000 ____D () C:\Program Files (x86)\Avira
2015-04-01 08:25 - 2012-12-18 13:49 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Roaming\Avira
2015-04-01 08:25 - 2012-12-18 13:44 - 00000000 ____D () C:\ProgramData\Avira
2015-03-30 23:57 - 2012-11-28 11:37 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-03-30 23:57 - 2012-11-28 11:05 - 00000000 ____D () C:\Program Files\Lenovo
2015-03-30 23:45 - 2014-05-08 21:52 - 00000000 ____D () C:\Users\Matthias Meister\Desktop\Kathrin SPSS

==================== Files in the root of some directories =======

2015-04-22 11:26 - 2015-04-22 11:26 - 0000398 _____ () C:\Users\Matthias Meister\AppData\Local\Citavi Picker Internet Explorer Protocol.txt
2014-06-04 16:40 - 2014-06-04 16:40 - 0000337 _____ () C:\Users\Matthias Meister\AppData\Local\Perfmon.PerfmonCfg
2014-07-29 08:17 - 2014-07-29 08:17 - 0001490 _____ () C:\Users\Matthias Meister\AppData\Local\recently-used.xbel
2012-12-05 13:15 - 2013-07-21 22:41 - 0007594 _____ () C:\Users\Matthias Meister\AppData\Local\resmon.resmoncfg
2013-02-13 12:45 - 2013-02-13 12:45 - 0009646 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130213.114511.txt
2013-02-13 12:47 - 2013-02-13 12:47 - 0009909 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130213.114706.txt
2013-02-13 12:47 - 2013-02-13 12:47 - 0009969 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130213.114726.txt
2013-02-13 13:02 - 2013-02-13 13:02 - 0010292 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130213.120230.txt
2013-02-13 13:02 - 2013-02-13 13:03 - 0010101 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130213.120247.txt
2013-02-13 13:04 - 2013-02-13 13:04 - 0010032 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130213.120402.txt
2013-02-20 10:46 - 2013-02-20 10:46 - 0010291 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130220.094602.txt
2013-02-20 10:46 - 2013-02-20 10:47 - 0010101 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130220.094618.txt
2013-02-20 10:47 - 2013-02-20 10:47 - 0010073 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130220.094737.txt
2013-02-20 10:48 - 2013-02-20 10:48 - 0010107 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130220.094812.txt
2013-03-05 17:55 - 2013-03-05 17:55 - 0010173 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130305.165512.txt
2013-03-12 15:29 - 2013-03-12 15:29 - 0010216 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130312.142910.txt
2013-04-02 09:46 - 2013-04-02 09:46 - 0010097 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130402.094618.txt
2013-04-03 21:03 - 2013-04-03 21:03 - 0010291 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130403.210334.txt
2013-04-17 16:09 - 2013-04-17 16:09 - 0010173 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130417.160933.txt
2013-04-30 14:49 - 2013-04-30 14:49 - 0010167 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130430.144903.txt
2013-05-06 17:32 - 2013-05-06 17:32 - 0010211 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130506.173211.txt
2013-05-06 17:32 - 2013-05-06 17:33 - 0010032 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130506.173226.txt
2013-06-03 18:31 - 2013-06-03 18:31 - 0010289 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130603.183117.txt
2013-06-03 18:31 - 2013-06-03 18:32 - 0010107 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130603.183133.txt
2013-07-23 12:44 - 2013-07-23 12:44 - 0010291 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130723.124408.txt
2013-07-23 14:14 - 2013-07-23 14:15 - 0009989 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130723.141452.txt
2013-07-23 14:23 - 2013-07-23 14:23 - 0009915 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130723.142335.txt
2013-10-17 14:33 - 2013-10-17 14:33 - 0014208 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20131017.143331.wdl
2014-01-11 15:24 - 2014-01-11 15:27 - 0014685 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20140111.142447.wdl
2014-01-13 12:36 - 2014-01-13 12:36 - 0014684 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20140113.113611.wdl
2014-01-13 12:46 - 2014-01-13 12:47 - 0016917 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20140113.114653.txt
2014-01-14 22:06 - 2014-01-14 22:06 - 0016629 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20140114.210628.wdl

Some content of TEMP:
====================
C:\Users\Matthias Meister\AppData\Local\Temp\avgnt.exe
C:\Users\Matthias Meister\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpwfnd8s.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-04-27 10:39

==================== End Of Log ============================

--- --- ---

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 27-04-2015 01
Ran by Matthias Meister at 2015-04-28 22:47:40
Running from C:\Users\Matthias Meister\Desktop
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-895578266-524488165-4032655203-500 - Administrator - Disabled)
Gast (S-1-5-21-895578266-524488165-4032655203-501 - Limited - Disabled) => C:\Users\Gast
HomeGroupUser$ (S-1-5-21-895578266-524488165-4032655203-1004 - Limited - Enabled)
Matthias Meister (S-1-5-21-895578266-524488165-4032655203-1000 - Administrator - Enabled) => C:\Users\Matthias Meister

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Antivirus (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avira Antivirus (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Accordance (HKLM-x32\...\{9B088535-6E1D-480E-A5F1-510E1DE6B572}_is1) (Version: 10.4.5 - Oaktree Software, Inc.)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 14.0.0.110 - Adobe Systems Incorporated)
Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Amazon MP3-Downloader 1.0.17 (HKLM-x32\...\Amazon MP3-Downloader) (Version: 1.0.17 - Amazon Services LLC)
Anzeige am Bildschirm (HKLM\...\OnScreenDisplay) (Version: 7.12.23 - )
Apple Application Support (32-Bit) (HKLM-x32\...\{AFA1153A-F547-409B-B837-3A0D6C5A3FEC}) (Version: 3.1.3 - Apple Inc.)
Apple Application Support (64-Bit) (HKLM\...\{D7B824DE-DA32-4772-9E5E-39C5158136A7}) (Version: 3.1.3 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{C4123106-B685-48E6-B9BD-E4F911841EB4}) (Version: 8.1.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
AutoHotkey 1.1.14.02 (HKLM\...\AutoHotkey) (Version: 1.1.14.02 - Lexikos)
Avira (HKLM-x32\...\{b5675cc4-ab8b-4945-8c1d-4c5479556d6a}) (Version: 1.1.34.19732 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.34.19732 - Avira Operations GmbH & Co. KG) Hidden
Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.9.504 - Avira Operations GmbH & Co. KG)
Bing-Desktop (HKLM-x32\...\{7D095455-D971-4D4C-9EFD-9AF6A6584F3A}) (Version: 1.3.171.0 - Microsoft Corporation)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Bullzip PDF Printer 9.3.0.1516 (HKLM\...\Bullzip PDF Printer_is1) (Version: 9.3.0.1516 - Bullzip)
calibre 64bit (HKLM\...\{C5D7991D-5C4F-475D-BF58-89A068A2FF14}) (Version: 2.25.0 - Kovid Goyal)
CCleaner (HKLM\...\CCleaner) (Version: 5.05 - Piriform)
Cisco AnyConnect Secure Mobility Client  (HKLM-x32\...\Cisco AnyConnect Secure Mobility Client) (Version: 3.1.05160 - Cisco Systems, Inc.)
Cisco AnyConnect Secure Mobility Client (x32 Version: 3.1.05160 - Cisco Systems, Inc.) Hidden
Citavi 5 (HKLM-x32\...\{7EB278FB-0C3C-445E-8665-4A6CDD9B794E}) (Version: 5.0.0.11 - Swiss Academic Software)
Conexant 20672 SmartAudio HD (HKLM\...\CNXT_AUDIO_HDA) (Version: 8.32.43.0 - Conexant)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dropbox (HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Dropbox) (Version: 3.4.4 - Dropbox, Inc.)
ElsterFormular (HKLM-x32\...\ElsterFormular) (Version: 16.0.16151 - Landesfinanzdirektion Thüringen)
Evernote v. 5.8.5 (HKLM-x32\...\{5EDC25EC-D966-11E4-9E5C-00163E98E7D6}) (Version: 5.8.5.7193 - Evernote Corp.)
FormatFactory 3.0.1 (HKLM-x32\...\FormatFactory) (Version: 3.0.1 - Free Time)
Fotogalerie (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Free YouTube Download version 3.2.58.415 (HKLM-x32\...\Free YouTube Download_is1) (Version: 3.2.58.415 - DVDVideoSoft Ltd.)
FreeFileSync 6.15 (HKLM-x32\...\FreeFileSync) (Version: 6.15 - www.FreeFileSync.org)
GIMP 2.8.10 (HKLM\...\GIMP-2_is1) (Version: 2.8.10 - The GIMP Team)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 42.0.2311.90 - Google Inc.)
Google Drive (HKLM-x32\...\{6C36881B-0E51-4231-9D02-BF2149664D34}) (Version: 1.20.8672.3137 - Google, Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
HitmanPro 3.7 (HKLM\...\HitmanPro37) (Version: 3.7.9.240 - SurfRight B.V.)
HL-4150CDN (HKLM-x32\...\{123DE6D6-9566-4777-AC81-E6D86FFA95DA}) (Version: 1.1.7.0 - Brother Industries, Ltd.)
iCloud (HKLM\...\{309768A4-A2BB-4930-A5A2-8169678C9B4C}) (Version: 4.0.6.28 - Apple Inc.)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.1.70.1205 - Intel Corporation)
Intel(R) Network Connections Drivers (HKLM\...\PROSet) (Version: 16.8 - Intel)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.3347 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
Intel(R) Wireless Display (HKLM\...\{28EF7372-9087-4AC3-9B9F-D9751FCDF830}) (Version:  - )
Intel® PROSet/Wireless Software (HKLM-x32\...\{440d014b-4444-4533-b96d-2910e1ca2bcf}) (Version: 16.7.0 - Intel Corporation)
Intel® PROSet/Wireless WiMAX Software (HKLM\...\{5F588B19-C575-4750-86FD-6ED2B76E61F1}) (Version: 7.50.0000 - Intel Corporation)
Interlinear Scripture Analyzer 2 basic (HKLM\...\{C8F753CF-C578-4138-A870-33149B689FFD}) (Version: 2.1.5.0 - Scripture4all Foundation)
IRISPen 7 (HKLM-x32\...\{699F407B-A9DE-4261-8C46-2C5C42E3172D}) (Version: 1.5.2.330 - Ihr Firmenname)
iTunes (HKLM\...\{93F2A022-6C37-48B8-B241-FFABD9F60C30}) (Version: 12.1.2.27 - Apple Inc.)
Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)
LAME v3.99.3 (for Windows) (HKLM-x32\...\LAME_is1) (Version:  - )
Lenovo Multimedia and Communications Core Runtime (HKLM\...\{033DC0E0-DA89-4C33-B66C-89B64D312CD1}_is1) (Version: 5.0.13.94 - Lenovo Corporation)
Lenovo Patch Utility (x32 Version: 1.3.2.6 - Lenovo Group Limited) Hidden
Lenovo Patch Utility 64 bit (Version: 1.3.2.6 - Lenovo Group Limited) Hidden
Lenovo Power Management Driver (HKLM\...\Power Management Driver) (Version: 1.67.09.03 - )
Lenovo Settings - Camera Audio (HKLM\...\{88C6A6D9-324C-46E8-BA87-563D14021442}_is1) (Version: 4.3.19.209 - Lenovo Corporation)
Lenovo Settings - Location Awareness (HKLM-x32\...\{C79D4402-E622-4922-9C02-89F9080BF081}_is1) (Version: 1.4.0.5 - Lenovo Group Limited)
Lenovo Settings - Power (HKLM-x32\...\{DAC01CEE-5BAE-42D5-81FC-B687E84E8405}) (Version: 7.49.4 - Lenovo Group Limited)
Lenovo Settings Dependency Package (HKLM\...\{3694BA2E-BE31-4B7E-886B-A0B559E69D4D}_is1) (Version: 2.3.3.6 - Lenovo Group Limited)
Lenovo Settings Mobile Hotspot (HKLM\...\{42603F7D-B08D-436B-B0D8-3E2DEF1AFD41}_is1) (Version: 2.3.0.84 - Lenovo)
Lenovo Settings Service (HKLM\...\{8C6F1EBA-17F1-4481-B688-9777E63E985F}_is1) (Version: 2.3.3.7 - Lenovo Group Limited)
Lenovo Settings UMDF driver (HKLM\...\{2BDC7413-65EA-4B99-8C4B-02F11075BE6D}_is1) (Version: 1.2.0.7 - Lenovo Group Limited)
LibreOffice 4.2.7.2 (HKLM-x32\...\{A313C39F-79A7-408B-97EE-8F958407D694}) (Version: 4.2.7.2 - The Document Foundation)
LyX 2.1.0 (HKLM-x32\...\LyX210) (Version: 2.1.0 - LyX Team)
Malwarebytes Anti-Malware Version 2.1.6.1022 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)
Metric Collection SDK (x32 Version: 1.1.0005.00 - Lenovo Group Limited) Hidden
Metric Collection SDK 35 (x32 Version: 1.2.0001.00 - Lenovo Group Limited) Hidden
Microsoft Office 365 - de-de (HKLM\...\O365HomePremRetail - de-de) (Version: 15.0.4701.1002 - Microsoft Corporation)
Microsoft Office on Demand-Browser-Add-Ons (HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Microsoft Office on Demand-Browser-Add-Ons) (Version:  - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\OneDriveSetup.exe) (Version: 17.3.4726.0226 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP1 English (HKLM-x32\...\{E59113EB-0285-4BFD-A37A-B79EAC6B8F4B}) (Version: 3.5.5692.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{4fcf070a-daac-45e9-a8b0-6850941f7ed8}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
MiKTeX 2.9 (HKLM-x32\...\MiKTeX 2.9) (Version: 2.9 - MiKTeX.org)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 26.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 26.0 (x86 de)) (Version: 26.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 31.5.0 - Mozilla)
Mozilla Thunderbird 31.6.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 31.6.0 (x86 de)) (Version: 31.6.0 - Mozilla)
Music Manager (HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\MusicManager) (Version:  - Google, Inc.)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4701.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4701.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4701.1002 - Microsoft Corporation) Hidden
Pandoc 1.12.3 (HKLM-x32\...\{5DFB319D-1BD3-49AE-991A-95ED9E8BBCE8}) (Version: 1.12.3 - John MacFarlane)
Paragon HFS+ for Windows 8 Free Edition (HKLM-x32\...\{456534C0-51E7-11DF-B336-005056C00008}) (Version: 1.00 - Paragon Software)
PDF24 Creator 6.3.2 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)
QuickTime 7 (HKLM-x32\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)
Renesas Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}) (Version: 2.1.36.0 - Renesas Electronics Corporation)
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.1.36.0 - Renesas Electronics Corporation) Hidden
RICOH_Media_Driver_v2.22.18.01 (HKLM-x32\...\{FE041B02-234C-4AAA-9511-80DF6482A458}) (Version: 2.22.18.01 - RICOH)
Samsung Universal Print Driver 2 (HKLM-x32\...\Samsung Universal Print Driver 2) (Version: 2.50.04.00 - Samsung Electronics Co., Ltd.)
Scrivener (HKLM-x32\...\Scrivener 1710) (Version: 1710 - Literature and Latte)
Sentinel RMS License Manager 8.4.1 (HKLM-x32\...\{3213A8E3-81A3-417D-93B2-A116A60666C8}) (Version: 8.4.1 - SafeNet, Inc.)
Skitch (HKLM-x32\...\Skitch 2.3.1.163) (Version: 2.3.1.163 - Evernote Corp.)
Skype™ 7.3 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.3.101 - Skype Technologies S.A.)
Sophos SSL VPN Client 2.1 (HKLM-x32\...\Sophos SSL VPN Client) (Version: 2.1 - )
Spotify (HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Spotify) (Version: 0.9.16.29.g0b5fcb05 - Spotify AB)
Telegram Desktop version 0.8.4 (HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_is1) (Version: 0.8.4 - Telegram Messenger LLP)
ThinkPad UltraNav Driver (HKLM\...\SynTPDeinstKey) (Version: 16.2.19.9 - )
ThinkVantage Access Connections (HKLM-x32\...\{8E537894-A559-4D60-B3CB-F4485E3D24E3}) (Version: 5.97 - Lenovo)
ThinkVantage Fingerprint Software (HKLM\...\{68D50088-CE92-4FF0-A220-D875E2E73151}) (Version: 6.0.0.8102 - Authentec Inc.)
ThinkVantage System für aktiven Festplattenschutz (HKLM\...\{46A84694-59EC-48F0-964C-7E76E9F8A2ED}) (Version: 1.79.00.03 - Lenovo)
Unity Web Player (HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\UnityWebPlayer) (Version: 4.6.4f1 - Unity Technologies ApS)
Visual Studio 2010 x64 Redistributables (HKLM\...\{21B133D6-5979-47F0-BE1C-F6A6B304693F}) (Version: 13.0.0.1 - AVG Technologies)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.0 - VideoLAN)
Windows Driver Package - Silicon Laboratories (silabenm) Ports  (12/10/2012 6.6.1.0) (HKLM\...\F1D0CAF4C0DED9E19E7D560DEA76E9C03A9840DA) (Version: 12/10/2012 6.6.1.0 - Silicon Laboratories)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
Windows Phone app for desktop (HKLM-x32\...\{19773614-FC22-4ACC-AAA3-E6BDA81ACF92}) (Version: 1.1.2726.0 - Microsoft Corporation)
XMind 2013 (v3.4.1) (HKLM-x32\...\XMind_is1) (Version: 3.4.1.201401221918 - XMind Ltd.)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-895578266-524488165-4032655203-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-895578266-524488165-4032655203-1000_Classes\CLSID\{225F8CFE-1B76-48E6-8E75-62CC471AFA28}\InprocServer32 -> C:\Users\Matthias Meister\AppData\Local\Microsoft\Internet Explorer\Downloaded Program Files\Microsoft Office 15\RoamingOfficeActiveX.64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-895578266-524488165-4032655203-1000_Classes\CLSID\{C3BC25C0-FCD3-4F01-AFDD-41373F017C9A}\InprocServer32 -> C:\Users\Matthias Meister\AppData\Local\Google\Update\1.3.26.9\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-895578266-524488165-4032655203-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Matthias Meister\AppData\Local\Google\Update\1.3.26.9\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-895578266-524488165-4032655203-1000_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-895578266-524488165-4032655203-1000_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Matthias Meister\AppData\Local\Microsoft\OneDrive\17.3.4726.0226\amd64\FileSyncApi64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-895578266-524488165-4032655203-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-895578266-524488165-4032655203-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-895578266-524488165-4032655203-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-895578266-524488165-4032655203-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-895578266-524488165-4032655203-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-895578266-524488165-4032655203-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-895578266-524488165-4032655203-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-895578266-524488165-4032655203-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)

==================== Restore Points  =========================

24-04-2015 11:33:16 TuneUp Utilities 2014 wird entfernt
28-04-2015 11:25:33 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {01297DD5-ACC9-45C6-B050-7969EA08F41E} - System32\Tasks\{53107B12-F938-4A02-9F23-8DB6A9939CB9} => pcalua.exe -a "C:\Users\Matthias Meister\Downloads\Setup.exe" -d "C:\Users\Matthias Meister\Downloads"
Task: {05CB891C-C430-44FB-A2E6-BBFD4CBB3BF1} - System32\Tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask => C:\Windows\ehome\mcupdate.exe
Task: {05D33BDF-B8CC-45AA-92D3-D9002AD63BA8} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-04-02] (Google Inc.)
Task: {0CA2C72B-9776-481F-9294-2B023B5C3916} - System32\Tasks\Microsoft\Windows\Media Center\RegisterSearch => C:\Windows\ehome\ehPrivJob.exe
Task: {12E26CAC-355D-413E-8815-1F3D8E3DC4A6} - System32\Tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask => C:\Windows\ehome\mcupdate.exe
Task: {16AC7163-24A3-4CC6-A4C5-B3DFD226F91C} - System32\Tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService => C:\Windows\ehome\ehPrivJob.exe
Task: {2057EB88-B9CB-48EB-AE5E-47B905FD54DD} - System32\Tasks\Microsoft\Windows\Media Center\MediaCenterRecoveryTask => C:\Windows\ehome\mcupdate.exe
Task: {23E3F989-8993-499C-B7E4-0CB50F135014} - System32\Tasks\GenericSettingsHandler\Windows-Credentials\RetrySyncTask_for_S-1-5-21-895578266-524488165-4032655203-1000
Task: {30622C2C-ABD3-42E3-869C-52CB71AAA599} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program 64 35 => C:\Program Files (x86)\Lenovo\Customer Feedback Program 35\Lenovo.TVT.CustomerFeedback.Agent35.exe [2014-05-30] (Lenovo)
Task: {3B54B7EB-6485-41D4-A696-A8BCBCE142D5} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program 64 => C:\Program Files (x86)\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe [2014-02-13] (Lenovo)
Task: {454DB601-A28B-4668-81B4-097FA3E68187} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-04-08] (Piriform Ltd)
Task: {47318851-E293-4F05-B3A8-8A944EE0413A} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-04-02] (Google Inc.)
Task: {5A54D371-C499-41ED-8450-82862B2778BF} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-895578266-524488165-4032655203-1000Core => C:\Users\Matthias Meister\AppData\Local\Google\Update\GoogleUpdate.exe [2013-03-12] (Google Inc.)
Task: {6B3C7E23-AF30-4D60-8654-0D00BF1BBC2B} - System32\Tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks => C:\Windows\ehome\ehPrivJob.exe
Task: {6D236B4F-EB9D-4105-ABC7-107FC05B5652} - System32\Tasks\{577DBEBF-24E0-4DE5-ADCA-0CA1C24DC512} => pcalua.exe -a "C:\Program Files (x86)\InstallShield Installation Information\{DAC01CEE-5BAE-42D5-81FC-B687E84E8405}\Setup.exe" -c -AddRemove
Task: {6DFB74AB-13CA-4EBF-A592-B6547565BB5C} - System32\Tasks\Lenovo\Lenovo Settings Power => Rundll32.exe "C:\Program Files (x86)\ThinkPad\Utilities\PWMTR64V.dll",PwrMgrBkGndMonitor
Task: {6FB9E1DD-2FF2-4C7D-8215-5B0C3D176678} - System32\Tasks\Microsoft\Windows\Media Center\PvrScheduleTask => C:\Windows\ehome\mcupdate.exe
Task: {6FBCF39A-3974-47BD-A7B5-98BD2088E4C6} - System32\Tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch => C:\Windows\ehome\ehPrivJob.exe
Task: {71B27283-ADF6-4D11-A1E2-1C72ADB2FCD7} - System32\Tasks\Microsoft\Windows\Media Center\RecordingRestart => C:\Windows\ehome\ehrec.exe
Task: {73ECEE7A-3F87-4874-90A4-0958C85961B7} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-04-15] (Microsoft Corporation)
Task: {7C002A81-25B3-46B5-B50B-5FBF2C5115C7} - System32\Tasks\Microsoft\Windows\Media Center\PeriodicScanRetry => C:\Windows\ehome\MCUpdate.exe
Task: {7EE0D6E1-D550-47F2-9967-40EB282CDB2A} - System32\Tasks\Microsoft\Windows\Media Center\StartRecording => C:\Windows\ehome\ehrec.exe
Task: {85DAE385-6CC4-4773-8D95-E19701EE0B3E} - System32\Tasks\{65D61D50-655A-4E16-AABB-B4DCEEB47EB6} => pcalua.exe -a "C:\Users\Matthias Meister\Desktop\83ts04ww.exe" -d "C:\Users\Matthias Meister\Desktop"
Task: {894F577B-8062-4C7F-ABEE-F5C484DEAADC} - System32\Tasks\{108EF52A-3187-4CAC-9F1F-2BB07316FD66} => pcalua.exe -a D:\GloAppInstaller\GloAppInstaller.exe -d D:\GloAppInstaller
Task: {99EE5FEC-783F-4ED8-9F14-7EB56177FA8C} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\Windows\ehome\mcupdate.exe
Task: {9B34940D-B95A-49D0-AE30-303BDD79C214} - System32\Tasks\Microsoft\Windows\Media Center\OCURActivate => C:\Windows\ehome\ehPrivJob.exe
Task: {9C8D95FA-3DDC-41AF-8610-C79E58EBD09C} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxcontent => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-24] (Microsoft Corporation)
Task: {9FFC158D-DEEF-479E-8510-BE1594D8198C} - System32\Tasks\Microsoft\Windows\Media Center\ReindexSearchRoot => C:\Windows\ehome\ehPrivJob.exe
Task: {A6BC1F86-E80D-4983-B992-0B129A7E92F8} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW1 => C:\Windows\ehome\ehPrivJob.exe
Task: {A9BA052B-F1B6-408F-B284-AD79DD856F7D} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-02-10] (Microsoft Corporation)
Task: {A9E0DC59-4CF1-4003-85E9-E71028102D66} - System32\Tasks\Microsoft\Windows\Media Center\ehDRMInit => C:\Windows\ehome\ehPrivJob.exe
Task: {AA0925B4-5482-45AE-A8C2-A56168A3B7CD} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW2 => C:\Windows\ehome\ehPrivJob.exe
Task: {AB8ECDA1-3927-46FD-965C-E1C01114EE28} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscovery => C:\Windows\ehome\ehPrivJob.exe
Task: {AD897FB0-A59A-4083-9BCE-DDB66D373347} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-03-24] (Microsoft Corporation)
Task: {B02DF302-AF51-4BD8-AE04-5F7E6C7DBB64} - System32\Tasks\{50A03D00-3269-4A49-BDB1-2CFA24F87A31} => pcalua.exe -a C:\PM\Setup.exe -d C:\PM
Task: {B42F2D24-7C93-40EE-823D-75BF8C9C39CC} - System32\Tasks\Microsoft\Windows\Media Center\PvrRecoveryTask => C:\Windows\ehome\mcupdate.exe
Task: {B4825007-B2A8-4703-8CC3-9D6623DEEA09} - System32\Tasks\TVT\LenovoWERMonitor => C:\Program Files (x86)\Common Files\lenovo\SUP\sup_wermonitor.exe [2014-05-27] (Lenovo)
Task: {B8B4304A-7B6E-4898-A75C-10A9DE78ECB0} - System32\Tasks\Microsoft Office 15 Sync Maintenance for MATTHIASMEISTER-Matthias Meister MatthiasMeister => C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [2015-02-10] (Microsoft Corporation)
Task: {CCD3EB94-2E66-48C3-8EDA-CB164AFD3173} - System32\Tasks\Microsoft\Windows\Media Center\UpdateRecordPath => C:\Windows\ehome\ehPrivJob.exe
Task: {CF171EB8-9D40-4F8F-B63F-8CE4350AF4DA} - System32\Tasks\Microsoft\Windows\Media Center\InstallPlayReady => C:\Windows\ehome\ehPrivJob.exe
Task: {D2185F41-0AC0-4459-8E79-E25722541479} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-04-14] (Adobe Systems Incorporated)
Task: {D95CB13D-D946-42BC-90E6-6F6EF921B25E} - System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-895578266-524488165-4032655203-1000 => %localappdata%\Microsoft\OneDrive\OneDrive.exe
Task: {DB1C2689-BDCA-46B6-A55A-35BFD66756BE} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {DFDF3405-737A-493E-AA97-6BAE78F4875F} - System32\Tasks\Microsoft\Windows\Setup\gwx\runappraiser => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-24] (Microsoft Corporation)
Task: {E50237D5-168F-437E-B928-FCDAA6E20D81} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2015-02-10] (Microsoft Corporation)
Task: {E6D695C1-371F-409F-A8EB-4FFAE6B87AD2} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate => C:\Windows\ehome\mcupdate.exe
Task: {E8F72B08-9E73-4F72-ADBA-C83EB155F071} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-24] (Microsoft Corporation)
Task: {EB07A24C-9C02-4FB0-9EFA-13F716A7BE8B} - System32\Tasks\SidebarExecute => C:\Program Files\Windows Sidebar\sidebar.exe
Task: {EED8DA22-AC11-47B9-B7DE-6B940B00285F} - System32\Tasks\Microsoft\Windows\Media Center\OCURDiscovery => C:\Windows\ehome\ehPrivJob.exe
Task: {EF95BCC9-40DE-4BFC-9D0B-37256C2F70E6} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program => C:\Program Files\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe
Task: {F196D4B9-21B8-496A-8E56-8EAA2A7D9C85} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-02-10] (Microsoft Corporation)
Task: {FE8BC4C2-EC58-4C1C-8FA9-FDB227D1BE65} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-895578266-524488165-4032655203-1000UA => C:\Users\Matthias Meister\AppData\Local\Google\Update\GoogleUpdate.exe [2013-03-12] (Google Inc.)
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-895578266-524488165-4032655203-1000Core.job => C:\Users\Matthias Meister\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-895578266-524488165-4032655203-1000UA.job => C:\Users\Matthias Meister\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\Synaptics TouchPad Enhancements.job => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

==================== Loaded Modules (whitelisted) ==============

2014-06-16 12:08 - 2015-01-16 08:49 - 00118272 ____N () C:\Program Files (x86)\ThinkPad\Utilities\GR\PWMRT64V.dll
2011-03-10 09:14 - 2012-12-19 11:58 - 00015360 _____ () C:\WINDOWS\System32\KOAZCA_L.DLL
2015-03-12 12:55 - 2011-04-11 07:26 - 00034304 _____ () C:\WINDOWS\System32\spe__l.dll
2011-06-22 11:44 - 2011-06-22 11:44 - 00034304 _____ () C:\WINDOWS\System32\sst2cl6.dll
2015-03-12 12:55 - 2013-09-13 09:29 - 01242112 _____ () C:\WINDOWS\system32\spool\DRIVERS\x64\3\spe__du.dll
2015-01-20 23:35 - 2015-01-20 23:35 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-01-20 23:35 - 2015-01-20 23:35 - 01346344 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2014-03-23 08:54 - 2014-05-20 09:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2015-02-19 00:03 - 2015-01-09 16:40 - 00469720 _____ () C:\Program Files (x86)\Lenovo\LocationAware\loctaskmgr.exe
2014-06-16 12:08 - 2015-01-16 08:49 - 00118272 ____N () C:\Program Files (x86)\ThinkPad\Utilities\GR\PWMRT64V.DLL
2014-11-25 15:14 - 2014-11-25 15:14 - 00183296 _____ () C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20689_x64__8wekyb3d8bbwe\ErrorReporting.dll
2012-11-28 11:39 - 2010-10-26 11:40 - 00049056 _____ () C:\Program Files\CONEXANT\ForteConfig\fmapp.exe
2012-12-14 03:42 - 2012-12-14 03:42 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2014-03-12 22:53 - 2014-03-12 22:53 - 00063376 _____ () C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\zlib1.dll
2012-09-06 20:18 - 2012-09-06 20:18 - 00086016 _____ () C:\Program Files (x86)\Lenovo\Access Connections\AcWrpc.dll
2013-02-26 18:56 - 2009-02-27 17:38 - 00139264 ____R () C:\Program Files (x86)\Brother\BrUtilities\BrLogAPI.dll
2015-01-26 10:47 - 2015-01-26 10:47 - 00799232 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Windows.Networking\86865ced79f3180ebdfa736d895e5edb\Windows.Networking.ni.dll
2015-01-26 10:46 - 2015-01-26 10:46 - 00228864 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Windows.Foundation\16c3eb7650767d95d002c998d0c73eb5\Windows.Foundation.ni.dll
2015-01-20 23:35 - 2015-01-20 23:35 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2015-04-28 22:40 - 2015-04-28 22:40 - 00043008 _____ () c:\Users\Matthias Meister\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpwfnd8s.dll
2015-03-04 23:45 - 2015-03-04 23:45 - 00750080 _____ () C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\libGLESv2.dll
2015-03-04 23:45 - 2015-03-04 23:45 - 00047616 _____ () C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\libEGL.dll
2015-03-04 23:45 - 2015-03-04 23:45 - 00865280 _____ () C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll
2015-03-04 23:45 - 2015-03-04 23:45 - 00200704 _____ () C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll
2014-11-21 11:02 - 2014-11-21 11:02 - 00316576 _____ () C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\AppVIsvStream32.dll
2014-11-21 10:59 - 2014-11-21 10:59 - 00316576 _____ () C:\Program Files\Microsoft Office 15\Root\Office15\AppVIsvStream32.dll
2015-04-17 09:33 - 2015-04-13 23:55 - 01252680 _____ () C:\Program Files (x86)\Google\Chrome\Application\42.0.2311.90\libglesv2.dll
2015-04-17 09:33 - 2015-04-13 23:55 - 00080712 _____ () C:\Program Files (x86)\Google\Chrome\Application\42.0.2311.90\libegl.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\Users\Matthias Meister\SkyDrive:ms-properties

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, the associated entry will be removed from the registry.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-895578266-524488165-4032655203-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Matthias Meister\AppData\Local\Microsoft\Windows\Themes\RoamedThemeFiles\DesktopBackground\2015-03-24.jpg
DNS Servers: 192.168.178.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

HKLM\...\StartupApproved\Run: => "MacDrive 9 application"
HKLM\...\StartupApproved\Run: => "LnvMobHotspotClient"
HKLM\...\StartupApproved\Run: => "SmartAudio"
HKLM\...\StartupApproved\Run: => "LenovoOptMouseUpdate"
HKLM\...\StartupApproved\Run: => "iTunesHelper"
HKLM\...\StartupApproved\Run32: => "Adobe ARM"
HKLM\...\StartupApproved\Run32: => "APSDaemon"
HKLM\...\StartupApproved\Run32: => "ApnUpdater"
HKLM\...\StartupApproved\Run32: => "iTunesHelper"
HKLM\...\StartupApproved\Run32: => "QuickTime Task"
HKLM\...\StartupApproved\Run32: => "SweetIM"
HKLM\...\StartupApproved\Run32: => "Sweetpacks Communicator"
HKLM\...\StartupApproved\Run32: => "BingDesktop"
HKLM\...\StartupApproved\Run32: => "Cisco AnyConnect Secure Mobility Agent for Windows"
HKLM\...\StartupApproved\Run32: => "PDFPrint"
HKLM\...\StartupApproved\Run32: => "openvpn-gui"
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\StartupApproved\StartupFolder: => "OneNote 2013 Screen Clipper and Launcher.lnk"
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\StartupApproved\StartupFolder: => "An OneNote senden.lnk"
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\StartupApproved\Run: => "GoogleChromeAutoLaunch_5382C8EB82E9B70BA085EAF9BDB27BD7"
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\StartupApproved\Run: => "GoogleDriveSync"
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\StartupApproved\Run: => "Google Update"
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\StartupApproved\Run: => "MusicManager"
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\StartupApproved\Run: => "Ubuntu One Icon"
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\StartupApproved\Run: => "Ubuntu One"
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\StartupApproved\Run: => "Skitch"
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\StartupApproved\Run: => "Spotify"
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\StartupApproved\Run: => "Spotify Web Helper"

==================== FirewallRules (whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [Wininit-Shutdown-In-Rule-TCP-RPC] => (Allow) %systemroot%\system32\wininit.exe
FirewallRules: [Wininit-Shutdown-In-Rule-TCP-RPC-EPMapper] => (Allow) %systemroot%\system32\wininit.exe
FirewallRules: [ProximityUxHost-Sharing-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\proximityuxhost.exe
FirewallRules: [ProximityUxHost-Sharing-Out-TCP-NoScope] => (Allow) %SystemRoot%\system32\proximityuxhost.exe
FirewallRules: [NETDIS-DAS-In-UDP-Active] => (Allow) %SystemRoot%\system32\dashost.exe
FirewallRules: [NETDIS-DAS-In-UDP] => (Allow) %SystemRoot%\system32\dashost.exe
FirewallRules: [EventForwarder-In-TCP] => (Allow) %SystemRoot%\system32\NetEvtFwdr.exe
FirewallRules: [TPMVSCMGR-Server-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\RmtTpmVscMgrSvr.exe
FirewallRules: [TPMVSCMGR-Server-Out-TCP-NoScope] => (Allow) %SystemRoot%\system32\RmtTpmVscMgrSvr.exe
FirewallRules: [TPMVSCMGR-Server-In-TCP] => (Allow) %SystemRoot%\system32\RmtTpmVscMgrSvr.exe
FirewallRules: [TPMVSCMGR-Server-Out-TCP] => (Allow) %SystemRoot%\system32\RmtTpmVscMgrSvr.exe
FirewallRules: [PlayTo-In-UDP-NoScope] => (Allow) %SystemRoot%\system32\mdeserver.exe
FirewallRules: [PlayTo-In-UDP-LocalSubnetScope] => (Allow) %SystemRoot%\system32\mdeserver.exe
FirewallRules: [PlayTo-In-UDP-PlayToScope] => (Allow) %SystemRoot%\system32\mdeserver.exe
FirewallRules: [PlayTo-Out-UDP-NoScope] => (Allow) %SystemRoot%\system32\mdeserver.exe
FirewallRules: [PlayTo-Out-UDP-LocalSubnetScope] => (Allow) %SystemRoot%\system32\mdeserver.exe
FirewallRules: [PlayTo-Out-UDP-PlayToScope] => (Allow) %SystemRoot%\system32\mdeserver.exe
FirewallRules: [PlayTo-In-RTSP-NoScope] => (Allow) %SystemRoot%\system32\mdeserver.exe
FirewallRules: [PlayTo-In-RTSP-LocalSubnetScope] => (Allow) %SystemRoot%\system32\mdeserver.exe
FirewallRules: [PlayTo-In-RTSP-PlayToScope] => (Allow) %SystemRoot%\system32\mdeserver.exe
FirewallRules: [WFDPRINT-DAFWSD-In-Active] => (Allow) %SystemRoot%\system32\dashost.exe
FirewallRules: [WFDPRINT-DAFWSD-Out-Active] => (Allow) %SystemRoot%\system32\dashost.exe
FirewallRules: [RemoteDesktop-Shadow-In-TCP] => (Allow) %SystemRoot%\system32\RdpSa.exe
FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppextcomobj.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppextcomobj.exe
FirewallRules: [UDP Query User{81EAD92C-2436-4C92-AEC8-8F359922F3D3}C:\users\matthias meister\appdata\roaming\dropbox\bin\dropbox.exe] => (Allow) C:\users\matthias meister\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [TCP Query User{0AE1C93B-1673-48B4-9FC1-BF8DE2F805DC}C:\users\matthias meister\appdata\roaming\dropbox\bin\dropbox.exe] => (Allow) C:\users\matthias meister\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [{8B68C2C2-6F29-4B0C-AB0C-19400F662098}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{E5EA7E1A-98B9-4A3B-BAFE-FE1D602BF61A}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{1DC1BD93-FCD4-46E1-8744-59573531B4D6}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{4155D9C7-E226-4380-81FE-19027DBA872F}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{B41F9AD3-9A36-4D83-9A55-58736C132C94}] => (Allow) C:\Program Files\Intel\WiMAX\Bin\DMAgent.exe
FirewallRules: [{9E9A8BF3-EB73-41C8-909B-2F1C78EECA78}] => (Allow) C:\Program Files\Intel\WiMAX\Bin\DMAgent.exe
FirewallRules: [{1A5D2C45-9673-444D-87E2-FB405C0C9A24}] => (Allow) C:\Program Files\Intel\WiMAX\Bin\AppSrv.exe
FirewallRules: [{8CEEFDD7-7E98-44BD-92EF-ED4070ABAE12}] => (Allow) C:\Program Files\Intel\WiMAX\Bin\AppSrv.exe
FirewallRules: [{F66F10A5-0FCB-453B-BBFE-7862E25DF510}] => (Allow) C:\Windows\SysWOW64\msiexec.exe
FirewallRules: [{90E7027D-5141-4BE8-83AB-8663AEAE065A}] => (Allow) C:\Windows\SysWOW64\msiexec.exe
FirewallRules: [{73F738A2-9782-4E45-8DA7-E57CBFCA75B5}] => (Allow) C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{CCE3B923-5211-472F-8BF8-8E6BC3A43856}] => (Allow) C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{61F0A51F-2618-46F0-865D-767AA1BBB0D1}] => (Allow) C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel RMS License Manager\WinNT\lservnt.exe
FirewallRules: [{DA420B02-43D9-4824-94DE-6FF68B98091F}] => (Allow) C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel RMS License Manager\WinNT\lservnt.exe
FirewallRules: [{BC214D58-6E84-475B-B16C-3D66603897FB}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\outlook.exe
FirewallRules: [{2F097CBC-B1D8-40BB-8EBA-B141F974BE42}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{BA2E681D-AA7F-48B7-84B5-010D22C7062E}] => (Allow) LPort=2869
FirewallRules: [{9B51227D-B737-49C8-9343-678FE5F8953A}] => (Allow) LPort=1900
FirewallRules: [{D07584FC-1D6C-4F22-925E-136343280F71}] => (Allow) C:\Program Files (x86)\Samsung\Samsung Universal Print Driver 2\PrinterSelector\SUPDApp.exe
FirewallRules: [TCP Query User{1993B725-0F67-4D95-89AD-21118005DB70}C:\users\matthias meister\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\matthias meister\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{F9F4FB2B-2FB6-4CB7-AE26-12F7F9A2CDCC}C:\users\matthias meister\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\matthias meister\appdata\roaming\spotify\spotify.exe
FirewallRules: [{49AC4E5F-8E78-4E97-8CB7-374CAB319156}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [TCP Query User{97A6C33D-9800-41EB-858C-E300DFE8ACC2}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [UDP Query User{5FC1940A-8A91-49EF-BEEC-91865E066B52}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [{99D93192-7472-4BAF-9D58-6584A9314BE6}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Faulty Device Manager Devices =============

Name: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64
Description: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: vpnva
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (04/28/2015 10:39:58 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005

Error: (04/28/2015 10:39:57 PM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Überspringen: Eap method DLL path Fehler bei der Überprüfung. Fehler: Type-ID=43, Autor-ID=9, Lieferant-ID=0, Lieferant-Typ=0

Error: (04/28/2015 10:39:57 PM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Überspringen: Eap method DLL path Fehler bei der Überprüfung. Fehler: Type-ID=25, Autor-ID=9, Lieferant-ID=0, Lieferant-Typ=0

Error: (04/28/2015 10:39:57 PM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Überspringen: Eap method DLL path Fehler bei der Überprüfung. Fehler: Type-ID=17, Autor-ID=9, Lieferant-ID=0, Lieferant-Typ=0

Error: (04/28/2015 10:39:57 PM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Überspringen: Eap method DLL path Fehler bei der Überprüfung. Fehler: Type-ID=254, Autor-ID=311, Lieferant-ID=14122, Lieferant-Typ=1

Error: (04/28/2015 10:10:46 PM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Überspringen: Eap method DLL path Fehler bei der Überprüfung. Fehler: Type-ID=43, Autor-ID=9, Lieferant-ID=0, Lieferant-Typ=0

Error: (04/28/2015 10:10:46 PM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Überspringen: Eap method DLL path Fehler bei der Überprüfung. Fehler: Type-ID=25, Autor-ID=9, Lieferant-ID=0, Lieferant-Typ=0

Error: (04/28/2015 10:10:46 PM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Überspringen: Eap method DLL path Fehler bei der Überprüfung. Fehler: Type-ID=17, Autor-ID=9, Lieferant-ID=0, Lieferant-Typ=0

Error: (04/28/2015 10:10:46 PM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Überspringen: Eap method DLL path Fehler bei der Überprüfung. Fehler: Type-ID=254, Autor-ID=311, Lieferant-ID=14122, Lieferant-Typ=1

Error: (04/28/2015 08:13:28 PM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Überspringen: Eap method DLL path Fehler bei der Überprüfung. Fehler: Type-ID=43, Autor-ID=9, Lieferant-ID=0, Lieferant-Typ=0


System errors:
=============
Error: (04/27/2015 08:33:04 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Lenovo Doze Mode Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (04/27/2015 08:33:04 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Bing Desktop Update service erreicht.

Error: (04/27/2015 08:32:59 AM) (Source: Microsoft-Windows-Directory-Services-SAM) (EventID: 16953) (User: NT-AUTORITÄT)
Description: Fehler "126" beim Laden der Kennwortbenachrichtigungs-DLL "ACGina". Stellen Sie sicher, dass der in der Registrierung definierte DLL-Pfad "HKLM\System\CurrentControlSet\Control\Lsa\Notification Packages" sich auf einen korrekten und absoluten Pfad (<Laufwerk>:\<Pfad>\<Dateiname>.<Erw.>) bezieht und nicht auf einen relativen oder ungültigen Pfad. Wenn der DLL-Pfad falsch ist, stellen Sie sicher, dass sich alle Hilfsdateien im gleichen Verzeichnis befinden und dass das Systemkonto sowohl auf den DLL-Pfad als auch die Hilfsdateien Lesezugriff hat.  Wenden Sie sich an den Anbieter der Benachrichtigungs-DLL, um weitere Unterstützung zu erhalten. Weitere Informationen finden Sie im Internet unter "hxxp://go.microsoft.com/fwlink/?LinkId=245898".

Error: (04/27/2015 08:32:33 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Superfetch" wurde mit folgendem Fehler beendet: 
%%1062

Error: (04/24/2015 00:17:52 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Lenovo Doze Mode Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (04/24/2015 00:17:52 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Bing Desktop Update service erreicht.

Error: (04/24/2015 00:17:47 PM) (Source: Microsoft-Windows-Directory-Services-SAM) (EventID: 16953) (User: NT-AUTORITÄT)
Description: Fehler "126" beim Laden der Kennwortbenachrichtigungs-DLL "ACGina". Stellen Sie sicher, dass der in der Registrierung definierte DLL-Pfad "HKLM\System\CurrentControlSet\Control\Lsa\Notification Packages" sich auf einen korrekten und absoluten Pfad (<Laufwerk>:\<Pfad>\<Dateiname>.<Erw.>) bezieht und nicht auf einen relativen oder ungültigen Pfad. Wenn der DLL-Pfad falsch ist, stellen Sie sicher, dass sich alle Hilfsdateien im gleichen Verzeichnis befinden und dass das Systemkonto sowohl auf den DLL-Pfad als auch die Hilfsdateien Lesezugriff hat.  Wenden Sie sich an den Anbieter der Benachrichtigungs-DLL, um weitere Unterstützung zu erhalten. Weitere Informationen finden Sie im Internet unter "hxxp://go.microsoft.com/fwlink/?LinkId=245898".

Error: (04/24/2015 00:17:23 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Superfetch" wurde mit folgendem Fehler beendet: 
%%1062

Error: (04/24/2015 09:09:47 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Lenovo Doze Mode Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (04/24/2015 09:09:47 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Bing Desktop Update service erreicht.


Microsoft Office Sessions:
=========================
Error: (04/28/2015 10:39:58 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005

Error: (04/28/2015 10:39:57 PM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Eap method DLL path43900

Error: (04/28/2015 10:39:57 PM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Eap method DLL path25900

Error: (04/28/2015 10:39:57 PM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Eap method DLL path17900

Error: (04/28/2015 10:39:57 PM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Eap method DLL path254311141221

Error: (04/28/2015 10:10:46 PM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Eap method DLL path43900

Error: (04/28/2015 10:10:46 PM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Eap method DLL path25900

Error: (04/28/2015 10:10:46 PM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Eap method DLL path17900

Error: (04/28/2015 10:10:46 PM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Eap method DLL path254311141221

Error: (04/28/2015 08:13:28 PM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Eap method DLL path43900


CodeIntegrity Errors:
===================================
  Date: 2015-04-15 11:06:07.958
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume2\Windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.stdformat.dll that did not meet the Microsoft signing level requirements.

  Date: 2015-04-15 11:06:07.833
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume2\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\adodb.dll that did not meet the Microsoft signing level requirements.

  Date: 2015-04-15 11:06:07.739
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume2\Windows\assembly\GAC\MSDATASRC\7.0.3300.0__b03f5f7f11d50a3a\msdatasrc.dll that did not meet the Microsoft signing level requirements.

  Date: 2015-04-15 11:06:07.551
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume2\Windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.stdformat.dll that did not meet the Microsoft signing level requirements.

  Date: 2015-04-15 11:06:07.442
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume2\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\adodb.dll that did not meet the Microsoft signing level requirements.

  Date: 2015-04-15 11:06:07.348
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume2\Windows\assembly\GAC\MSDATASRC\7.0.3300.0__b03f5f7f11d50a3a\msdatasrc.dll that did not meet the Microsoft signing level requirements.

  Date: 2015-04-15 11:06:06.458
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume2\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\stdole.dll that did not meet the Microsoft signing level requirements.

  Date: 2015-04-15 11:06:06.114
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume2\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\stdole.dll that did not meet the Microsoft signing level requirements.

  Date: 2015-04-15 11:02:08.759
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume2\Windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.stdformat.dll that did not meet the Microsoft signing level requirements.

  Date: 2015-04-15 11:02:08.556
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume2\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\adodb.dll that did not meet the Microsoft signing level requirements.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i5-2520M CPU @ 2.50GHz
Percentage of memory in use: 51%
Total physical RAM: 3979.21 MB
Available physical RAM: 1922.91 MB
Total Pagefile: 8075.21 MB
Available Pagefile: 5505.66 MB
Total Virtual: 131072 MB
Available Virtual: 131071.83 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:119.14 GB) (Free:24.37 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 119.2 GB) (Disk ID: 0001EDA7)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=119.1 GB) - (Type=07 NTFS)

==================== End Of Log ============================

cosinus · 29.04.2015, 00:16

Lade Dir bitte von hier

Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.

Installiere und starte das Programm. (Bebilderte Anleitung zu Revo Uninstaller)
Klicke auf Optionen und wähle als Sprache Deutsch.
Suche im Uninstallerfeld nach den Programmen:

Free YouTube Download version 3.2.58.415
Wähle die Programme nacheinander aus und klicke jedes Mal auf Uninstall.
Wähle anschließend den Modus "Moderat" aus.
Reste löschen:
Klicke auf dann auf und dann auf .

Matmeis · 29.04.2015, 08:09

Guten Morgen Cosinus,

Uninstall so durchgeführt, wie du geschrieben hast. Avira meldet nun auch kein Problem mehr. Allerdings kommt nach dem Neustart wieder das Fenster von Win 8.1, ich solle eine App auswählen, mit der die Datei geöffnet werden kann. Das Fenster verschwindet dann wieder. Übrigens kam das Fenster auch noch, als das Free Youtube Download Programm installiert war.
Warum kommt denn dieses Fenster nach jedem Neustart? Warum kann ich den Ursprung der Datei nicht finden?
Ach übrigens, was ich ganz vergessen habe zu erwähnen. Mein Computer meldet auch seit ein paar Wochen immer wieder mal, alle paar Tage die Fehlermeldung:
ShellExecuteEx fehlgeschlagen; Code 1155.
Der Angegebenen Datei ist keine Anwendung zugeordnet.

Mehrere Regestrycleans mit CCleaner über die letzten Wochen hat keine Abhilfe geschaffen. Vielleicht hängen ja beide Probleme zusammen?
Ich habe das bisher nicht erwähnt, weil es aufgetreten ist, als ich versucht habe ein Video mit Videopad zu rendern mit einem Codierung, die nicht in meinem System installiert war. Vielleicht hilft diese Info etwas weiter?

ich mache wieder einen FRST Scan, richtig?
Hier die Logdateien:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-04-2015 01
Ran by Matthias Meister (administrator) on MATTHIASMEISTER on 29-04-2015 09:03:08
Running from C:\Users\Matthias Meister\Desktop
Loaded Profiles: Matthias Meister (Available profiles: Matthias Meister & Gast)
Platform: Windows 8.1 Pro (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Lenovo.) C:\Windows\System32\ibmpmsvc.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tphkload.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Lenovo Corporation) C:\Program Files\Lenovo\Communications Utility\AVControlCenter32.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Lenovo Corporation) C:\Program Files\Lenovo\Communications Utility\avfaudiosw.exe
(Broadcom Corporation.) C:\Windows\System32\BtwRSupportService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\SettingsDependency\SettingsService.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\micmute.exe
(The OpenVPN Project) C:\Program Files (x86)\Sophos\Sophos SSL VPN Client\bin\openvpnserv.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(SafeNet, Inc.) C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel RMS License Manager\WinNT\lservnt.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiMAX\Bin\AppSrv.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Red Bend Ltd.) C:\Program Files\Intel\WiMAX\Bin\DMAgent.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.3.9600.17477_none_fa2b7d3b9b36c7b4\TiWorker.exe
(Authentec Inc.) C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tpnumlkd.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tposd.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\shtctky.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20689_x64__8wekyb3d8bbwe\livecomm.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\csisyncclient.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\msosync.exe
() C:\Program Files\CONEXANT\ForteConfig\fmapp.exe
(Lenovo.) C:\Windows\System32\TpShocks.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
(Dropbox, Inc.) C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\BrYNSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
() C:\Program Files (x86)\Lenovo\LocationAware\loctaskmgr.exe
() C:\Program Files (x86)\Lenovo\LocationAware\lpdagent.exe
(Lenovo Corporation) C:\Program Files\Lenovo\Communications Utility\tpknrres.exe
(Lenovo) C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.exe
(Microsoft Corporation) C:\Windows\System32\wbem\WMIADAP.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [AcWin7Hlpr] => C:\Program Files (x86)\Lenovo\Access Connections\AcTBenabler.exe [63376 2012-09-07] (Lenovo)
HKLM\...\Run: [ForteConfig] => C:\Program Files\Conexant\ForteConfig\fmapp.exe [49056 2010-10-26] ()
HKLM\...\Run: [TpShocks] => C:\Windows\system32\TpShocks.exe [384344 2014-02-17] (Lenovo.)
HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SACpl.exe [1647616 2012-06-13] (Conexant Systems, Inc.)
HKLM\...\Run: [LenovoOptMouseUpdate] => C:\Program Files\Lenovo\HOTKEY\extapsup.exe [255480 2013-06-20] (Lenovo Group Limited)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2963184 2013-05-29] (Synaptics Incorporated)
HKLM\...\Run: [LnvMobHotspotClient] => C:\Program Files\Lenovo\Lenovo Mobile Hotspot\MobileHotspotclient.exe [938032 2014-03-05] (Lenovo)
HKLM\...\Run: [apmwinapp] => C:\Program Files (x86)\Paragon Software\HFS+ for Windows 8 Free Edition\apmwinsrv.exe [66768 2014-06-17] ()
HKLM\...\Run: [LMCSSTART1] => C:\WINDOWS\SysWOW64\lmcfrundll.exe C:\Program Files\Lenovo\Communications Utility\libmcsrdllb.dll,InitSubsystemProcesses
HKLM\...\Run: [LMCSSTART2] => C:\WINDOWS\SysWOW64\lmcfrundll.exe C:\Program Files\Lenovo\Communications Utility\libstartstub2.dll,ProxyStart
HKLM\...\Run: [LMCSSTART3] => C:\WINDOWS\SysWOW64\lmcfrundll.exe C:\Program Files\Lenovo\Communications Utility\libmcsrdllb.dll,SetupCamplusDrop
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [169768 2015-04-07] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-11-20] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2015-03-20] (Apple Inc.)
HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [115048 2011-09-16] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [726320 2015-04-01] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [BingDesktop] => C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktop.exe [2249352 2013-06-20] (Microsoft Corp.)
HKLM-x32\...\Run: [BrStsMon00] => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [3076096 2012-06-06] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [113656 2013-01-17] (Intel Corporation)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [189480 2014-02-06] (Geek Software GmbH)
HKLM-x32\...\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] => C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe [707472 2014-03-12] (Cisco Systems, Inc.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.)
HKLM-x32\...\Run: [openvpn-gui] => C:\Program Files (x86)\Sophos\Sophos SSL VPN Client\bin\openvpn-gui.exe [480992 2014-08-28] ()
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [129272 2015-03-16] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\psfus: C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll (Authentec Inc.)
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Run: [Google Update] => C:\Users\Matthias Meister\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2013-03-12] (Google Inc.)
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Run: [MusicManager] => C:\Users\Matthias Meister\AppData\Local\Programs\Google\MusicManager\MusicManager.exe [7475200 2015-04-01] (Google Inc.)
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [26232152 2015-02-19] (Google)
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Run: [Skitch] => C:\Program Files (x86)\Evernote\Skitch\Skitch.exe [4851008 2014-05-01] (Evernote)
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Run: [GoogleChromeAutoLaunch_5382C8EB82E9B70BA085EAF9BDB27BD7] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [812872 2015-04-13] (Google Inc.)
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Run: [OneDrive] => C:\Users\Matthias Meister\AppData\Local\Microsoft\OneDrive\OneDrive.exe [281248 2015-03-13] (Microsoft Corporation)
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Run: [Spotify] => C:\Users\Matthias Meister\AppData\Roaming\Spotify\Spotify.exe [7021112 2015-04-04] (Spotify Ltd)
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Run: [Spotify Web Helper] => C:\Users\Matthias Meister\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1806904 2015-04-04] (Spotify Ltd)
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [43816 2014-11-21] (Apple Inc.)
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Run: [iCloudDrive] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe [43816 2014-11-21] (Apple Inc.)
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Run: [Sysinternals Desktops] => C:\Users\Matthias Meister\Documents\Systeminttools\Desktops.exe [116824 2015-04-13] (Sysinternals - www.sysinternals.com)
Lsa: [Notification Packages] scecli ACGina C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll
Startup: C:\Users\Matthias Meister\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\An OneNote senden.lnk [2013-05-23]
ShortcutTarget: An OneNote senden.lnk -> C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\Matthias Meister\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2012-11-28]
ShortcutTarget: Dropbox.lnk -> C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers-x32: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers-x32: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File
ShellIconOverlayIdentifiers-x32: [ SkyDrivePro1 (ErrorConflict)] -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} =>  No File
ShellIconOverlayIdentifiers-x32: [ SkyDrivePro2 (SyncInProgress)] -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} =>  No File
ShellIconOverlayIdentifiers-x32: [ SkyDrivePro3 (InSync)] -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} =>  No File
ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-895578266-524488165-4032655203-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKU\S-1-5-21-895578266-524488165-4032655203-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-02-10] (Microsoft Corporation)
BHO: Citavi Picker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\Windows\system32\mscoree.dll [2013-08-22] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-02-10] (Microsoft Corporation)
BHO-x32: Citavi Picker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\Windows\SysWOW64\mscoree.dll [2013-08-22] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-01-26] (Oracle Corporation)
BHO-x32: Evernote extension -> {92EF2EAD-A7CE-4424-B0DB-499CF856608E} -> C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll [2015-04-02] (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-01-26] (Oracle Corporation)
DPF: HKLM-x32 {55A2C0CD-3DE8-4264-9637-A0B40B05714E} https://col0-sec.mail.live.com/mail/MailMigrationCabFileHolder.aspx?n=1616762545
Handler: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} -  No File
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-02-03] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Matthias Meister\AppData\Roaming\Mozilla\Firefox\Profiles\3uohh0jz.default
FF SelectedSearchEngine: Google
FF Homepage: www.google.de
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_17_0_0_169.dll [2015-04-14] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll No File
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-04-14] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-01-26] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-01-26] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2014-02-03] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-04] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-04] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.2.0 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-02-27] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-895578266-524488165-4032655203-1000: @microsoft.com/Office on Demand;version=1 -> C:\Users\Matthias Meister\AppData\Local\Microsoft\Internet Explorer\Downloaded Program Files\Microsoft Office 15\npofficeondemand.dll [2012-11-10] (Microsoft Corporation)
FF Plugin HKU\S-1-5-21-895578266-524488165-4032655203-1000: @tools.google.com/Google Update;version=3 -> C:\Users\Matthias Meister\AppData\Local\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-06] (Google Inc.)
FF Plugin HKU\S-1-5-21-895578266-524488165-4032655203-1000: @tools.google.com/Google Update;version=9 -> C:\Users\Matthias Meister\AppData\Local\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-06] (Google Inc.)
FF Plugin HKU\S-1-5-21-895578266-524488165-4032655203-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Matthias Meister\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2015-03-24] (Unity Technologies ApS)
FF Plugin HKU\S-1-5-21-895578266-524488165-4032655203-1000: amazon.com/AmazonMP3DownloaderPlugin -> C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101721.dll [2013-01-23] (Amazon.com, Inc.)
FF Extension: Avira Browser Safety - C:\Users\Matthias Meister\AppData\Roaming\Mozilla\Firefox\Profiles\3uohh0jz.default\Extensions\abs@avira.com [2014-08-06]
FF Extension: Reader - C:\Users\Matthias Meister\AppData\Roaming\Mozilla\Firefox\Profiles\3uohh0jz.default\Extensions\{20068ab2-1901-4140-9f3c-81207d4dacc4} [2013-05-16]
FF Extension: DownloadHelper - C:\Users\Matthias Meister\AppData\Roaming\Mozilla\Firefox\Profiles\3uohh0jz.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2013-10-07]
FF Extension: Ghostery - C:\Users\Matthias Meister\AppData\Roaming\Mozilla\Firefox\Profiles\3uohh0jz.default\Extensions\firefox@ghostery.com.xpi [2013-09-19]
FF Extension: Adblock Plus - C:\Users\Matthias Meister\AppData\Roaming\Mozilla\Firefox\Profiles\3uohh0jz.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-11-28]
FF HKLM-x32\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2015-04-23]
FF HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Firefox\Extensions: [{F74D5734-46F5-4B16-96F0-1E7FBF41B750}] - C:\Program Files (x86)\Lenovo\Password Manager\PWM Firefox Extension\2.0b12

Chrome: 
=======
CHR StartupUrls: Default -> "hxxp://www.google.de/"
CHR Profile: C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (ProxFlow) - C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek [2015-04-23]
CHR Extension: (Writebox) - C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default\Extensions\bbehjmjchoiaglkeboicbgkpfafcmhij [2015-04-23]
CHR Extension: (MagicScroll Web Reader) - C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default\Extensions\ecldhagehndokdmaiaigoaecbmbnmfkc [2015-04-23]
CHR Extension: (BetaFish Adblocker) - C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2015-04-23]
CHR Extension: (Bookmark Manager) - C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik [2015-04-23]
CHR Extension: (feedly) - C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default\Extensions\hipbfijinpcgfogaopmgehiegacbhmob [2015-04-23]
CHR Extension: (Google Play Music) - C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default\Extensions\icppfcnhkcmnfdhfhphakoifcfokfdhg [2015-04-23]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-11]
CHR Extension: (Ghostery) - C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default\Extensions\mlomiejdfkolichcflejclcbmpeaniij [2015-04-23]
CHR Extension: (Google Wallet) - C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-04-23]
CHR Extension: (Citavi Picker) - C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default\Extensions\ohgndokldibnndfnjnagojmheejlengn [2014-02-17]
CHR Extension: (AVG PrivacyFix) - C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default\Extensions\pmejhjjecaldkllonlokhkglbdbkdcni [2015-04-23]
CHR HKLM-x32\...\Chrome\Extension: [ohgndokldibnndfnjnagojmheejlengn] - https://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [815920 2015-04-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [434424 2015-04-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [434424 2015-04-01] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1004280 2015-04-01] (Avira Operations GmbH & Co. KG)
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-01-20] (Apple Inc.)
R2 AVControlCenter; C:\Program Files\Lenovo\Communications Utility\AVControlCenter32.exe [560584 2015-01-21] (Lenovo Corporation)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [201008 2015-03-16] (Avira Operations GmbH & Co. KG)
R2 BcmBtRSupport; C:\Windows\system32\BtwRSupportService.exe [2255064 2013-10-28] (Broadcom Corporation.)
S2 BingDesktopUpdate; C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe [173192 2013-06-20] (Microsoft Corp.)
R3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [266240 2012-06-05] (Brother Industries, Ltd.) [File not signed]
S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-10-29] (Microsoft Corporation)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2714800 2015-02-10] (Microsoft Corporation)
R2 DMAgent; C:\Program Files\Intel\WiMAX\Bin\DMAgent.exe [514048 2012-07-18] (Red Bend Ltd.) [File not signed]
R2 Lenovo Settings Service; C:\Program Files\Lenovo\SettingsDependency\SettingsService.exe [2016472 2015-01-23] (Lenovo Group Limited)
S3 LENOVO.TVTVCAM; C:\Program Files\Lenovo\Communications Utility\vcamsvc.exe [626120 2015-01-21] (Lenovo Corporation)
S3 LnvHotSpotSvc; C:\Program Files\Lenovo\Lenovo Mobile Hotspot\LnvHotSpotSvc.exe [474160 2014-03-05] (Lenovo)
R2 LocationTaskManager; C:\Program Files (x86)\Lenovo\LocationAware\loctaskmgr.exe [469720 2015-01-09] ()
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
S3 OpenVPNService; C:\Program Files (x86)\Sophos\Sophos SSL VPN Client\bin\openvpnserv.exe [81024 2014-08-28] (The OpenVPN Project)
R2 OpenVPNServiceInteractive; C:\Program Files (x86)\Sophos\Sophos SSL VPN Client\bin\openvpnserv.exe [81024 2014-08-28] (The OpenVPN Project)
R2 Sentinel RMS License Manager; C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel RMS License Manager\WinNT\lservnt.exe [884736 2010-10-20] (SafeNet, Inc.) [File not signed]
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-04] (Microsoft Corporation)
R2 WiMAXAppSrv; C:\Program Files\Intel\WiMAX\Bin\AppSrv.exe [979456 2012-07-18] (Intel(R) Corporation) [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-04] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3674864 2013-11-20] (Intel® Corporation)
S2 DozeSvc; C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R0 apmwin; C:\Windows\System32\DRIVERS\apmwin.sys [35024 2014-06-17] (Paragon Software Group)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [128536 2015-03-10] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [132120 2015-03-10] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-10-07] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [43576 2015-03-10] (Avira Operations GmbH & Co. KG)
R3 bcbtums; C:\Windows\system32\drivers\bcbtums.sys [170712 2013-10-28] (Broadcom Corporation.)
R3 e1cexpress; C:\Windows\system32\DRIVERS\e1c64x64.sys [468752 2014-06-27] (Intel Corporation)
R0 gpt_loader; C:\Windows\System32\DRIVERS\gpt_loader.sys [61136 2014-06-17] (Paragon Software Group)
S3 Hfsplus; C:\Windows\System32\DRIVERS\hfsplus.sys [206032 2014-06-17] (Paragon Software Group)
R2 HfsplusRec; C:\Windows\System32\DRIVERS\hfsplusrec.sys [15568 2014-06-17] (Paragon Software Group)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2015-04-14] (Malwarebytes Corporation)
R0 mounthlp; C:\Windows\System32\DRIVERS\mounthlp.sys [42704 2014-06-17] (Paragon Software Group)
R3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew00.sys [3346912 2013-10-31] (Intel Corporation)
S3 NETwNs64; C:\Windows\system32\DRIVERS\Netwsw00.sys [11499008 2012-06-03] (Intel Corporation) [File not signed]
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [44784 2013-05-29] (Synaptics Incorporated)
R2 smihlp; C:\Program Files\ThinkVantage Fingerprint Software\smihlp.sys [13128 2011-05-30] (Authentec Inc.)
R3 Tvti2c; C:\Windows\system32\DRIVERS\Tvti2c.sys [40248 2011-05-30] (Lenovo Information Product(ShenZhen China) Inc.)
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2012-12-13] (Apple, Inc.) [File not signed]
S3 vpnva; C:\Windows\system32\DRIVERS\vpnva64-6.sys [52592 2014-03-12] (Cisco Systems, Inc.)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-04] (Microsoft Corporation)
U3 idsvc; No ImagePath
S3 intaud_WaveExtensible; \SystemRoot\system32\drivers\intelaud.sys [X]
S3 iwdbus; \SystemRoot\System32\drivers\iwdbus.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-29 08:53 - 2015-04-29 08:53 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Matthias Meister\Downloads\revosetup95.exe
2015-04-29 08:53 - 2015-04-29 08:53 - 00001280 _____ () C:\Users\Matthias Meister\Desktop\Revo Uninstaller.lnk
2015-04-29 08:53 - 2015-04-29 08:53 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2015-04-28 22:40 - 2015-04-28 22:40 - 00000000 ____D () C:\Users\Matthias Meister\Desktop\FRST-OlderVersion
2015-04-28 11:26 - 2015-01-06 05:01 - 00072192 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndproxy.sys
2015-04-28 11:26 - 2015-01-06 04:59 - 00080896 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wanarp.sys
2015-04-28 11:26 - 2015-01-06 03:12 - 00185856 _____ (Microsoft Corporation) C:\WINDOWS\system32\rascfg.dll
2015-04-28 11:26 - 2015-01-06 03:02 - 00164864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rascfg.dll
2015-04-28 11:25 - 2015-03-17 19:26 - 00467776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBHUB3.SYS
2015-04-28 11:25 - 2015-03-09 04:02 - 00057856 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthhfenum.sys
2015-04-28 11:25 - 2015-03-04 03:32 - 00172544 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Input.Inking.dll
2015-04-28 11:25 - 2015-03-04 03:12 - 00141824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Input.Inking.dll
2015-04-28 11:25 - 2015-01-30 02:53 - 02819584 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers.dll
2015-04-28 11:24 - 2015-04-03 02:35 - 00445440 _____ (Microsoft Corporation) C:\WINDOWS\system32\PhotoMetadataHandler.dll
2015-04-28 11:24 - 2015-04-03 02:14 - 00364544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PhotoMetadataHandler.dll
2015-04-28 11:24 - 2015-03-14 04:03 - 04179968 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2015-04-28 11:24 - 2015-03-13 04:02 - 00316416 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\udfs.sys
2015-04-28 11:24 - 2015-03-13 03:11 - 02162176 _____ (Microsoft Corporation) C:\WINDOWS\system32\SRH.dll
2015-04-28 11:24 - 2015-03-13 02:39 - 01812992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SRH.dll
2015-04-28 11:23 - 2015-03-13 04:59 - 00430080 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll
2015-04-28 11:23 - 2015-03-13 04:38 - 00358912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll
2015-04-28 11:23 - 2015-03-06 04:47 - 01696256 _____ (Microsoft Corporation) C:\WINDOWS\system32\wevtsvc.dll
2015-04-28 11:23 - 2015-02-18 01:19 - 00186368 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpapisrv.dll
2015-04-28 11:23 - 2015-02-13 04:22 - 00445440 _____ (Microsoft Corporation) C:\WINDOWS\system32\certcli.dll
2015-04-28 11:23 - 2015-02-13 03:46 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certcli.dll
2015-04-28 11:23 - 2014-11-15 21:05 - 00801584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfplat.dll
2015-04-28 11:23 - 2014-11-15 08:29 - 00962216 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfplat.dll
2015-04-28 11:23 - 2014-11-14 08:57 - 01027584 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll
2015-04-28 11:23 - 2014-11-14 07:03 - 00885760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll
2015-04-28 11:23 - 2014-11-10 20:06 - 02485056 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys
2015-04-28 11:23 - 2014-11-10 20:06 - 00473408 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\netio.sys
2015-04-28 11:23 - 2014-11-10 20:06 - 00428864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\FWPKCLNT.SYS
2015-04-28 11:23 - 2014-11-10 20:06 - 00136512 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wfplwfs.sys
2015-04-28 11:23 - 2014-11-10 04:57 - 00096768 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\agilevpn.sys
2015-04-28 11:23 - 2014-11-10 03:37 - 00845312 _____ (Microsoft Corporation) C:\WINDOWS\system32\BFE.DLL
2015-04-28 11:23 - 2014-11-10 03:34 - 01084416 _____ (Microsoft Corporation) C:\WINDOWS\system32\IKEEXT.DLL
2015-04-28 11:23 - 2014-11-10 03:26 - 00422400 _____ (Microsoft Corporation) C:\WINDOWS\system32\FWPUCLNT.DLL
2015-04-28 11:23 - 2014-11-10 03:20 - 00420864 _____ (Microsoft Corporation) C:\WINDOWS\system32\vpnike.dll
2015-04-28 11:23 - 2014-11-10 03:09 - 00272384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FWPUCLNT.DLL
2015-04-28 11:23 - 2014-11-10 03:08 - 00702464 _____ (Microsoft Corporation) C:\WINDOWS\system32\rasapi32.dll
2015-04-28 11:23 - 2014-11-10 03:06 - 00713216 _____ (Microsoft Corporation) C:\WINDOWS\system32\nshwfp.dll
2015-04-28 11:23 - 2014-11-10 02:57 - 00624640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rasapi32.dll
2015-04-28 11:23 - 2014-11-10 02:57 - 00561664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nshwfp.dll
2015-04-28 11:23 - 2014-11-08 06:00 - 00024576 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndistapi.sys
2015-04-28 11:23 - 2014-11-08 05:58 - 00112640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rasl2tp.sys
2015-04-28 11:23 - 2014-11-08 05:56 - 00048128 _____ (Microsoft Corporation) C:\WINDOWS\system32\kmddsp.tsp
2015-04-28 11:23 - 2014-11-08 05:56 - 00043008 _____ (Microsoft Corporation) C:\WINDOWS\system32\rasmxs.dll
2015-04-28 11:23 - 2014-11-08 05:56 - 00030208 _____ (Microsoft Corporation) C:\WINDOWS\system32\rasser.dll
2015-04-28 11:23 - 2014-11-08 05:24 - 00077824 _____ (Microsoft Corporation) C:\WINDOWS\system32\rasdiag.dll
2015-04-28 11:23 - 2014-11-08 05:13 - 00039424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kmddsp.tsp
2015-04-28 11:23 - 2014-11-08 05:13 - 00033280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rasmxs.dll
2015-04-28 11:23 - 2014-11-08 05:13 - 00022528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rasser.dll
2015-04-28 11:23 - 2014-11-08 04:48 - 00061440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rasdiag.dll
2015-04-28 11:23 - 2014-11-08 04:38 - 00166912 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppxAllUserStore.dll
2015-04-28 11:23 - 2014-11-08 04:17 - 00143360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppxAllUserStore.dll
2015-04-28 11:23 - 2014-11-08 04:03 - 00733696 _____ (Microsoft Corporation) C:\WINDOWS\system32\SkyDriveTelemetry.dll
2015-04-28 11:23 - 2014-11-08 03:58 - 04837376 _____ (Microsoft Corporation) C:\WINDOWS\system32\SyncEngine.dll
2015-04-28 11:23 - 2014-11-08 03:49 - 01154048 _____ (Microsoft Corporation) C:\WINDOWS\system32\SkyDrive.exe
2015-04-28 11:23 - 2014-11-07 05:58 - 00952896 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmp4srcsnk.dll
2015-04-28 11:23 - 2014-11-07 05:20 - 00786120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll
2015-04-28 11:23 - 2014-11-05 04:12 - 00211968 _____ (Microsoft Corporation) C:\WINDOWS\system32\QSHVHOST.DLL
2015-04-28 11:23 - 2014-11-05 04:12 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\system32\QSVRMGMT.DLL
2015-04-28 11:23 - 2014-11-05 04:06 - 00514048 _____ (Microsoft Corporation) C:\WINDOWS\system32\DevicePairing.dll
2015-04-28 11:23 - 2014-11-05 03:44 - 00657920 _____ (Microsoft Corporation) C:\WINDOWS\system32\dnsapi.dll
2015-04-28 11:23 - 2014-11-05 03:43 - 00252416 _____ (Microsoft Corporation) C:\WINDOWS\system32\dnsrslvr.dll
2015-04-28 11:23 - 2014-11-05 03:41 - 00558080 _____ (Microsoft Corporation) C:\WINDOWS\system32\untfs.dll
2015-04-28 11:23 - 2014-11-05 03:39 - 00155648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\QSHVHOST.DLL
2015-04-28 11:23 - 2014-11-05 03:39 - 00094208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\QSVRMGMT.DLL
2015-04-28 11:23 - 2014-11-05 03:33 - 00465408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DevicePairing.dll
2015-04-28 11:23 - 2014-11-05 03:21 - 00658432 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSDApi.dll
2015-04-28 11:23 - 2014-11-05 03:20 - 00498688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dnsapi.dll
2015-04-28 11:23 - 2014-11-05 03:18 - 00507392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\untfs.dll
2015-04-28 11:23 - 2014-11-05 03:14 - 00309760 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSDMon.dll
2015-04-28 11:23 - 2014-11-05 03:06 - 00555520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSDApi.dll
2015-04-28 11:23 - 2014-11-04 21:33 - 00058176 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dam.sys
2015-04-28 11:23 - 2014-11-04 21:25 - 00059712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\kbdclass.sys
2015-04-28 11:23 - 2014-11-04 21:25 - 00051008 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mouclass.sys
2015-04-28 11:23 - 2014-11-04 08:55 - 00026112 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sermouse.sys
2015-04-28 11:23 - 2014-11-04 08:54 - 00108544 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\i8042prt.sys
2015-04-28 11:23 - 2014-11-04 08:54 - 00032256 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\kbdhid.sys
2015-04-28 11:23 - 2014-11-04 08:54 - 00030208 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mouhid.sys
2015-04-28 11:23 - 2014-11-04 08:27 - 00128512 _____ (Microsoft Corporation) C:\WINDOWS\splwow64.exe
2015-04-28 11:23 - 2014-11-04 07:01 - 00827392 _____ (Microsoft Corporation) C:\WINDOWS\system32\spoolsv.exe
2015-04-28 11:23 - 2014-10-31 02:51 - 18823168 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll
2015-04-28 11:23 - 2014-10-31 02:10 - 15158784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll
2015-04-28 11:23 - 2014-10-29 05:05 - 00551232 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vhdmp.sys
2015-04-28 11:23 - 2014-10-29 03:55 - 00242176 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinSCard.dll
2015-04-28 11:23 - 2014-10-29 03:13 - 00169984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WinSCard.dll
2015-04-28 11:23 - 2014-10-21 03:59 - 00016896 _____ (Microsoft Corporation) C:\WINDOWS\system32\eventcls.dll
2015-04-28 11:23 - 2014-10-21 03:19 - 00015360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eventcls.dll
2015-04-28 11:23 - 2014-10-21 02:50 - 00074752 _____ (Microsoft Corporation) C:\WINDOWS\system32\vsstrace.dll
2015-04-28 11:23 - 2014-10-21 02:31 - 01574400 _____ (Microsoft Corporation) C:\WINDOWS\system32\vssapi.dll
2015-04-28 11:23 - 2014-10-21 02:31 - 00055296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vsstrace.dll
2015-04-28 11:23 - 2014-10-21 02:30 - 01454080 _____ (Microsoft Corporation) C:\WINDOWS\system32\VSSVC.exe
2015-04-28 11:23 - 2014-10-21 02:20 - 01142272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vssapi.dll
2015-04-28 11:23 - 2014-10-17 06:56 - 00039744 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\intelpep.sys
2015-04-28 11:23 - 2014-10-17 05:35 - 00086336 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pdc.sys
2015-04-28 11:22 - 2015-03-13 06:03 - 00239424 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdbus.sys
2015-04-28 11:22 - 2015-03-13 06:03 - 00154432 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dumpsd.sys
2015-04-28 11:22 - 2015-03-06 05:08 - 02067968 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpdshext.dll
2015-04-28 11:22 - 2015-03-06 04:43 - 01969664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wpdshext.dll
2015-04-27 08:55 - 2015-04-28 22:48 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Local\1A8F483F-CFB2-4BEC-BFAE-55393764F250.aplzod
2015-04-24 14:03 - 2015-04-24 14:28 - 00136408 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-04-24 14:03 - 2015-04-24 14:03 - 00001114 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-04-24 14:03 - 2015-04-24 14:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-04-24 14:03 - 2015-04-24 14:03 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-04-24 14:03 - 2015-04-14 09:38 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2015-04-24 14:03 - 2015-04-14 09:37 - 00107736 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2015-04-24 14:03 - 2015-04-14 09:37 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2015-04-24 12:17 - 2015-04-29 08:58 - 00005994 _____ () C:\WINDOWS\PFRO.log
2015-04-24 11:29 - 2015-04-24 11:30 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Roaming\FreeFileSync
2015-04-24 11:29 - 2015-04-24 11:30 - 00000000 ____D () C:\ProgramData\TuneUp Software
2015-04-24 11:29 - 2015-04-24 11:29 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2015-04-24 11:29 - 2015-04-24 11:29 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Local\TuneUp Software
2015-04-24 11:28 - 2015-04-24 11:28 - 00000956 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FreeFileSync.lnk
2015-04-24 11:28 - 2015-04-24 11:28 - 00000946 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RealtimeSync.lnk
2015-04-24 11:28 - 2015-04-24 11:28 - 00000944 _____ () C:\Users\Public\Desktop\FreeFileSync.lnk
2015-04-24 11:28 - 2015-04-24 11:28 - 00000934 _____ () C:\Users\Public\Desktop\RealtimeSync.lnk
2015-04-24 11:28 - 2015-04-24 11:28 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Roaming\RHEng
2015-04-24 11:28 - 2015-04-24 11:28 - 00000000 ____D () C:\Program Files\FreeFileSync
2015-04-24 09:09 - 2015-04-29 08:58 - 00001150 _____ () C:\WINDOWS\setupact.log
2015-04-24 09:09 - 2015-04-24 09:09 - 00000000 _____ () C:\WINDOWS\setuperr.log
2015-04-24 08:43 - 2015-04-29 09:03 - 00003594 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-895578266-524488165-4032655203-1000
2015-04-23 16:28 - 2015-04-23 16:28 - 00001016 _____ () C:\Users\Matthias Meister\Desktop\JRT.txt
2015-04-23 16:22 - 2015-04-23 16:22 - 00000207 _____ () C:\WINDOWS\tweaking.com-regbackup-MATTHIASMEISTER-Windows-8.1-Pro-(64-bit).dat
2015-04-23 16:22 - 2015-04-23 16:22 - 00000000 ____D () C:\RegBackup
2015-04-23 16:10 - 2015-04-23 16:10 - 02685470 _____ (Thisisu) C:\Users\Matthias Meister\Desktop\JRT.exe
2015-04-23 16:09 - 2015-04-23 16:09 - 02217984 _____ () C:\Users\Matthias Meister\Desktop\AdwCleaner_4.201.exe
2015-04-23 15:51 - 2015-04-28 22:49 - 00054599 _____ () C:\Users\Matthias Meister\Desktop\Addition.txt
2015-04-23 15:49 - 2015-04-29 09:03 - 00031073 _____ () C:\Users\Matthias Meister\Desktop\FRST.txt
2015-04-23 15:49 - 2015-04-29 09:03 - 00000000 ____D () C:\FRST
2015-04-23 15:47 - 2015-04-28 22:40 - 02100736 _____ (Farbar) C:\Users\Matthias Meister\Desktop\FRST64.exe
2015-04-23 14:22 - 2015-04-23 14:38 - 00000000 ____D () C:\Users\Matthias Meister\Desktop\Trojaner Board
2015-04-23 11:59 - 2015-04-28 09:46 - 00000000 ____D () C:\Users\Matthias Meister\Documents\Citavi 5
2015-04-23 11:58 - 2015-04-23 11:58 - 00001977 _____ () C:\Users\Public\Desktop\Citavi 5.lnk
2015-04-23 11:58 - 2015-04-23 11:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Citavi 5
2015-04-23 11:57 - 2015-04-23 11:58 - 00000000 ____D () C:\Program Files (x86)\Citavi 5
2015-04-23 10:11 - 2015-04-23 10:11 - 00001917 _____ () C:\Users\Public\Desktop\HitmanPro.lnk
2015-04-23 10:11 - 2015-04-23 10:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro
2015-04-23 10:11 - 2015-04-23 10:11 - 00000000 ____D () C:\Program Files\HitmanPro
2015-04-23 10:10 - 2015-04-23 10:16 - 00000000 ____D () C:\ProgramData\HitmanPro
2015-04-23 10:09 - 2015-04-23 10:09 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-04-23 10:08 - 2015-04-23 16:17 - 00000000 ____D () C:\AdwCleaner
2015-04-23 09:05 - 2015-04-23 09:05 - 00002523 _____ () C:\Users\Public\Desktop\Evernote.lnk
2015-04-23 09:05 - 2015-04-23 09:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Evernote
2015-04-22 11:26 - 2015-04-22 11:26 - 00000398 _____ () C:\Users\Matthias Meister\AppData\Local\Citavi Picker Internet Explorer Protocol.txt
2015-04-22 11:26 - 2015-04-22 11:26 - 00000000 __SHD () C:\Users\Matthias Meister\AppData\Local\EmieBrowserModeList
2015-04-15 09:56 - 2015-04-15 21:23 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Roaming\Skype
2015-04-15 09:56 - 2015-04-15 09:58 - 00000000 ___RD () C:\Program Files (x86)\Skype
2015-04-15 09:56 - 2015-04-15 09:58 - 00000000 ____D () C:\ProgramData\Skype
2015-04-15 09:56 - 2015-04-15 09:56 - 00002715 _____ () C:\Users\Public\Desktop\Skype.lnk
2015-04-15 09:56 - 2015-04-15 09:56 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Local\Skype
2015-04-15 09:56 - 2015-04-15 09:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2015-04-15 09:49 - 2014-11-17 22:17 - 00672984 _____ (Microsoft Corporation) C:\WINDOWS\system32\MDMAgent.exe
2015-04-15 09:49 - 2014-11-17 22:17 - 00273240 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsAdminFlows.exe
2015-04-15 09:49 - 2014-11-14 08:58 - 00116736 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsDatabase.dll
2015-04-15 09:49 - 2014-11-14 08:54 - 00463872 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettings.Handlers.dll
2015-04-15 09:49 - 2014-11-14 08:46 - 02171904 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsAdminFlowUI.dll
2015-04-15 09:45 - 2015-03-23 23:59 - 07476032 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2015-04-15 09:45 - 2015-03-23 23:59 - 01733952 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2015-04-15 09:45 - 2015-03-23 23:59 - 00360480 _____ (Microsoft Corporation) C:\WINDOWS\system32\sechost.dll
2015-04-15 09:45 - 2015-03-23 23:58 - 01498872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2015-04-15 09:45 - 2015-03-23 23:45 - 00257216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sechost.dll
2015-04-15 09:45 - 2015-03-20 06:12 - 00246272 _____ (Microsoft Corporation) C:\WINDOWS\system32\microsoft-windows-system-events.dll
2015-04-15 09:45 - 2015-03-20 06:10 - 00285184 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64.dll
2015-04-15 09:45 - 2015-03-20 06:10 - 00013312 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64cpu.dll
2015-04-15 09:45 - 2015-03-20 05:17 - 00411648 _____ (Microsoft Corporation) C:\WINDOWS\system32\tracerpt.exe
2015-04-15 09:45 - 2015-03-20 04:41 - 00369152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tracerpt.exe
2015-04-15 09:45 - 2015-03-20 04:40 - 00950784 _____ (Microsoft Corporation) C:\WINDOWS\system32\tdh.dll
2015-04-15 09:45 - 2015-03-20 04:16 - 00749568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tdh.dll
2015-04-15 09:45 - 2015-03-14 10:20 - 01385256 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctf.dll
2015-04-15 09:45 - 2015-03-14 10:13 - 01124352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctf.dll
2015-04-15 09:45 - 2015-03-13 04:58 - 00259072 _____ (Microsoft Corporation) C:\WINDOWS\system32\pku2u.dll
2015-04-15 09:45 - 2015-03-13 04:37 - 00208896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\pku2u.dll
2015-04-15 09:45 - 2015-02-24 10:32 - 00991552 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\http.sys
2015-04-15 09:45 - 2015-02-21 01:49 - 00780800 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsm.dll
2015-04-15 09:44 - 2015-03-23 00:45 - 00227328 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepdu.dll
2015-04-15 09:44 - 2015-03-23 00:09 - 01111552 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2015-04-15 09:44 - 2015-03-23 00:09 - 00957440 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2015-04-15 09:44 - 2015-03-23 00:09 - 00769024 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
2015-04-15 09:44 - 2015-03-23 00:09 - 00726528 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2015-04-15 09:44 - 2015-03-23 00:09 - 00419328 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2015-04-15 09:44 - 2015-03-23 00:09 - 00030720 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll
2015-04-15 09:44 - 2015-03-14 10:54 - 00133256 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
2015-04-15 09:44 - 2015-03-14 03:56 - 00066048 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups.dll
2015-04-15 09:44 - 2015-03-14 03:56 - 00052224 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups2.dll
2015-04-15 09:44 - 2015-03-14 03:51 - 00015360 _____ (Microsoft Corporation) C:\WINDOWS\system32\wu.upgrade.ps.dll
2015-04-15 09:44 - 2015-03-14 03:37 - 00267264 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinSetupUI.dll
2015-04-15 09:44 - 2015-03-14 03:14 - 00027136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wups.dll
2015-04-15 09:44 - 2015-03-14 02:22 - 03678720 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2015-04-15 09:44 - 2015-03-14 02:12 - 00140288 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuwebv.dll
2015-04-15 09:44 - 2015-03-14 02:12 - 00035840 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapp.exe
2015-04-15 09:44 - 2015-03-14 02:09 - 00200192 _____ (Microsoft Corporation) C:\WINDOWS\system32\storewuauth.dll
2015-04-15 09:44 - 2015-03-14 02:08 - 00408064 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUSettingsProvider.dll
2015-04-15 09:44 - 2015-03-14 02:08 - 00095744 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll
2015-04-15 09:44 - 2015-03-14 02:06 - 02373632 _____ (Microsoft Corporation) C:\WINDOWS\system32\wucltux.dll
2015-04-15 09:44 - 2015-03-14 02:06 - 00891392 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
2015-04-15 09:44 - 2015-03-14 02:02 - 00124928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuwebv.dll
2015-04-15 09:44 - 2015-03-14 02:02 - 00029696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapp.exe
2015-04-15 09:44 - 2015-03-14 01:59 - 00721920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll
2015-04-15 09:44 - 2015-03-14 01:59 - 00081920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll
2015-04-15 09:44 - 2015-03-13 06:32 - 24980480 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2015-04-15 09:44 - 2015-03-13 06:08 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2015-04-15 09:44 - 2015-03-13 06:07 - 02886144 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2015-04-15 09:44 - 2015-03-13 05:53 - 00816128 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2015-04-15 09:44 - 2015-03-13 05:50 - 06025216 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2015-04-15 09:44 - 2015-03-13 05:42 - 19695616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2015-04-15 09:44 - 2015-03-13 05:28 - 00503296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2015-04-15 09:44 - 2015-03-13 05:26 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2015-04-15 09:44 - 2015-03-13 05:22 - 02278400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2015-04-15 09:44 - 2015-03-13 05:17 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2015-04-15 09:44 - 2015-03-13 05:16 - 00664064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2015-04-15 09:44 - 2015-03-13 05:08 - 00720384 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2015-04-15 09:44 - 2015-03-13 05:07 - 00801280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2015-04-15 09:44 - 2015-03-13 05:00 - 14397440 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2015-04-15 09:44 - 2015-03-13 04:50 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2015-04-15 09:44 - 2015-03-13 04:49 - 04305408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2015-04-15 09:44 - 2015-03-13 04:45 - 02358784 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2015-04-15 09:44 - 2015-03-13 04:44 - 00689152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2015-04-15 09:44 - 2015-03-13 04:34 - 12825600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2015-04-15 09:44 - 2015-03-13 04:33 - 01548288 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2015-04-15 09:44 - 2015-03-13 04:22 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2015-04-15 09:44 - 2015-03-13 04:20 - 01888256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2015-04-15 09:44 - 2015-03-13 04:16 - 01311232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2015-04-15 09:44 - 2015-03-13 04:14 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2015-04-15 09:44 - 2015-03-04 12:25 - 00377152 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\clfs.sys
2015-04-15 09:44 - 2015-03-04 05:04 - 00075264 _____ (Microsoft Corporation) C:\WINDOWS\system32\clfsw32.dll
2015-04-15 09:44 - 2015-03-04 04:19 - 00058880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\clfsw32.dll
2015-04-13 14:32 - 2015-04-13 14:33 - 00000000 ____D () C:\Users\Matthias Meister\Documents\Systeminttools
2015-04-13 11:30 - 2015-04-13 14:35 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2015-04-13 11:16 - 2015-04-13 11:16 - 00000550 _____ () C:\Users\Matthias Meister\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ITA (liebenzell.intBereiche) (Z).lnk
2015-04-13 10:46 - 2015-04-29 08:58 - 00000000 ___RD () C:\Users\Matthias Meister\iCloudDrive
2015-04-13 10:46 - 2015-04-13 10:46 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Local\Apple Inc
2015-04-13 10:36 - 2015-04-13 10:36 - 00001765 _____ () C:\Users\Public\Desktop\iTunes.lnk
2015-04-13 10:36 - 2015-04-13 10:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2015-04-13 10:35 - 2015-04-13 10:36 - 00000000 ____D () C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7
2015-04-13 10:35 - 2015-04-13 10:36 - 00000000 ____D () C:\Program Files\iTunes
2015-04-13 10:35 - 2015-04-13 10:35 - 00000000 ____D () C:\Program Files\iPod
2015-04-13 10:35 - 2015-04-13 10:35 - 00000000 ____D () C:\Program Files (x86)\iTunes
2015-04-13 10:27 - 2015-04-13 10:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud
2015-04-04 13:47 - 2015-04-04 13:47 - 00000000 ___SD () C:\WINDOWS\SysWOW64\GWX
2015-04-04 13:47 - 2015-04-04 13:47 - 00000000 ___SD () C:\WINDOWS\system32\GWX
2015-04-04 10:27 - 2015-04-27 15:09 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Local\Spotify
2015-04-04 10:27 - 2015-04-04 10:27 - 00001913 _____ () C:\Users\Matthias Meister\Desktop\Spotify.lnk
2015-04-04 10:27 - 2015-04-04 10:27 - 00001899 _____ () C:\Users\Matthias Meister\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk
2015-04-04 10:26 - 2015-04-27 15:14 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Roaming\Spotify
2015-03-30 23:30 - 2015-03-30 23:30 - 00000000 ____D () C:\Program Files\IBM
2015-03-30 21:07 - 2015-03-30 21:07 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Roaming\Unity
2015-03-30 21:03 - 2015-03-30 21:03 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Local\Unity

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-29 09:03 - 2013-09-30 06:14 - 01776918 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2015-04-29 09:03 - 2013-09-30 05:56 - 00765582 _____ () C:\WINDOWS\system32\perfh007.dat
2015-04-29 09:03 - 2013-09-30 05:56 - 00159366 _____ () C:\WINDOWS\system32\perfc007.dat
2015-04-29 09:00 - 2014-06-05 19:16 - 01545703 _____ () C:\WINDOWS\WindowsUpdate.log
2015-04-29 09:00 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2015-04-29 08:59 - 2012-11-28 14:12 - 00000000 ___RD () C:\Users\Matthias Meister\Dropbox
2015-04-29 08:59 - 2012-11-28 14:11 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Roaming\Dropbox
2015-04-29 08:58 - 2013-08-22 16:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2015-04-29 08:58 - 2013-08-22 16:44 - 00539528 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2015-04-29 08:58 - 2013-05-14 15:50 - 00005208 _____ () C:\WINDOWS\System32\Tasks\Microsoft Office 15 Sync Maintenance for MATTHIASMEISTER-Matthias Meister MatthiasMeister
2015-04-29 08:58 - 2013-04-02 13:21 - 00001146 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2015-04-29 08:58 - 2012-11-29 17:01 - 00000000 ___DO () C:\Users\Matthias Meister\SkyDrive
2015-04-29 08:57 - 2013-08-22 17:36 - 00000000 ___RD () C:\WINDOWS\ImmersiveControlPanel
2015-04-29 08:57 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\SysWOW64\setup
2015-04-29 08:57 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\setup
2015-04-29 08:57 - 2013-08-22 15:36 - 00000000 ____D () C:\WINDOWS\system32\AdvancedInstallers
2015-04-29 08:57 - 2013-08-22 15:25 - 00786432 ___SH () C:\WINDOWS\system32\config\BBI
2015-04-29 08:56 - 2012-11-28 12:40 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2015-04-29 08:55 - 2013-10-17 16:40 - 00004002 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{79616768-A823-4D1A-A05A-496DB8C5B27C}
2015-04-29 08:55 - 2013-10-07 17:23 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Roaming\DVDVideoSoft
2015-04-28 22:41 - 2015-03-11 21:25 - 03312848 _____ (DVDVideoSoft Ltd. ) C:\Users\Matthias
2015-04-28 16:45 - 2014-07-16 10:54 - 00000000 ____D () C:\ProgramData\AccordanceFinalClean
2015-04-28 11:31 - 2013-04-02 13:21 - 00001150 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2015-04-28 11:27 - 2013-03-12 20:24 - 00001196 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-895578266-524488165-4032655203-1000UA.job
2015-04-28 11:27 - 2012-07-26 09:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
2015-04-27 09:32 - 2013-03-12 20:24 - 00001144 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-895578266-524488165-4032655203-1000Core.job
2015-04-27 09:10 - 2012-11-28 17:49 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Local\Packages
2015-04-27 08:31 - 2012-11-28 14:11 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-04-27 08:21 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2015-04-24 12:16 - 2013-10-17 16:15 - 00000000 ____D () C:\Users\Matthias Meister
2015-04-24 11:29 - 2012-11-28 10:17 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Roaming\TuneUp Software
2015-04-23 17:10 - 2013-08-22 17:31 - 00000834 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2015-04-23 17:10 - 2013-02-20 10:34 - 00000000 ____D () C:\Program Files\CCleaner
2015-04-23 12:43 - 2013-08-10 16:40 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Local\Microsoft Help
2015-04-23 12:03 - 2014-02-03 15:34 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Roaming\Swiss Academic Software
2015-04-23 12:02 - 2014-02-03 15:33 - 00000000 ____D () C:\Program Files (x86)\Citavi 4
2015-04-23 11:58 - 2014-02-03 15:33 - 00000000 ____D () C:\ProgramData\Swiss Academic Software
2015-04-23 11:56 - 2014-02-03 15:32 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Local\Downloaded Installations
2015-04-22 12:24 - 2013-02-26 18:57 - 00000678 _____ () C:\WINDOWS\BRCALIB.INI
2015-04-20 11:17 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\NDF
2015-04-17 11:11 - 2015-01-11 12:07 - 00000942 _____ () C:\Users\Public\Desktop\calibre 64bit - E-book management.lnk
2015-04-17 11:11 - 2015-01-11 12:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\calibre 64bit - E-book Management
2015-04-17 11:11 - 2015-01-11 12:07 - 00000000 ____D () C:\Program Files\Calibre2
2015-04-16 13:23 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\rescache
2015-04-15 22:42 - 2012-12-05 18:07 - 00000000 ____D () C:\Users\Matthias Meister\Documents\Outlook Files
2015-04-15 11:06 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\AppCompat
2015-04-15 10:15 - 2012-11-28 12:30 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-04-15 10:14 - 2014-12-12 00:14 - 00000000 ____D () C:\WINDOWS\system32\appraiser
2015-04-15 10:14 - 2014-07-09 10:28 - 00000000 ___SD () C:\WINDOWS\system32\CompatTel
2015-04-15 10:14 - 2013-07-23 12:38 - 00000000 ____D () C:\WINDOWS\system32\MRT
2015-04-15 10:03 - 2012-11-28 10:27 - 128913832 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2015-04-15 09:42 - 2014-11-14 15:45 - 00017408 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaext.dll
2015-04-15 08:02 - 2013-10-29 15:16 - 00068145 _____ () C:\Users\Public\Documents\AcSvc.dmp
2015-04-15 08:02 - 2013-10-29 15:16 - 00012288 _____ () C:\Users\Public\Documents\AccConnAdvanced.dat
2015-04-14 20:14 - 2012-11-28 12:40 - 00003796 _____ () C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2015-04-14 17:33 - 2015-01-11 12:08 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Local\calibre-cache
2015-04-14 01:24 - 2013-08-22 17:38 - 00792056 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2015-04-14 01:24 - 2013-08-22 17:38 - 00178168 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2015-04-13 11:31 - 2013-10-17 22:25 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Local\Deployment
2015-04-13 11:00 - 2015-03-12 13:00 - 00002270 ____H () C:\Users\Matthias Meister\Documents\Default.rdp
2015-04-13 10:53 - 2012-11-28 14:38 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Roaming\Apple Computer
2015-04-13 10:35 - 2012-11-28 14:38 - 00000000 ____D () C:\Program Files\Common Files\Apple
2015-04-13 10:18 - 2013-07-23 14:19 - 00000000 ____D () C:\ProgramData\Package Cache
2015-04-13 10:18 - 2012-12-18 13:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-04-13 10:18 - 2012-12-18 13:44 - 00000000 ____D () C:\Program Files (x86)\Avira
2015-04-01 08:25 - 2012-12-18 13:49 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Roaming\Avira
2015-04-01 08:25 - 2012-12-18 13:44 - 00000000 ____D () C:\ProgramData\Avira
2015-03-30 23:57 - 2012-11-28 11:37 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-03-30 23:57 - 2012-11-28 11:05 - 00000000 ____D () C:\Program Files\Lenovo
2015-03-30 23:45 - 2014-05-08 21:52 - 00000000 ____D () C:\Users\Matthias Meister\Desktop\Kathrin SPSS

==================== Files in the root of some directories =======

2015-04-22 11:26 - 2015-04-22 11:26 - 0000398 _____ () C:\Users\Matthias Meister\AppData\Local\Citavi Picker Internet Explorer Protocol.txt
2014-06-04 16:40 - 2014-06-04 16:40 - 0000337 _____ () C:\Users\Matthias Meister\AppData\Local\Perfmon.PerfmonCfg
2014-07-29 08:17 - 2014-07-29 08:17 - 0001490 _____ () C:\Users\Matthias Meister\AppData\Local\recently-used.xbel
2012-12-05 13:15 - 2013-07-21 22:41 - 0007594 _____ () C:\Users\Matthias Meister\AppData\Local\resmon.resmoncfg
2013-02-13 12:45 - 2013-02-13 12:45 - 0009646 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130213.114511.txt
2013-02-13 12:47 - 2013-02-13 12:47 - 0009909 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130213.114706.txt
2013-02-13 12:47 - 2013-02-13 12:47 - 0009969 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130213.114726.txt
2013-02-13 13:02 - 2013-02-13 13:02 - 0010292 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130213.120230.txt
2013-02-13 13:02 - 2013-02-13 13:03 - 0010101 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130213.120247.txt
2013-02-13 13:04 - 2013-02-13 13:04 - 0010032 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130213.120402.txt
2013-02-20 10:46 - 2013-02-20 10:46 - 0010291 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130220.094602.txt
2013-02-20 10:46 - 2013-02-20 10:47 - 0010101 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130220.094618.txt
2013-02-20 10:47 - 2013-02-20 10:47 - 0010073 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130220.094737.txt
2013-02-20 10:48 - 2013-02-20 10:48 - 0010107 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130220.094812.txt
2013-03-05 17:55 - 2013-03-05 17:55 - 0010173 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130305.165512.txt
2013-03-12 15:29 - 2013-03-12 15:29 - 0010216 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130312.142910.txt
2013-04-02 09:46 - 2013-04-02 09:46 - 0010097 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130402.094618.txt
2013-04-03 21:03 - 2013-04-03 21:03 - 0010291 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130403.210334.txt
2013-04-17 16:09 - 2013-04-17 16:09 - 0010173 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130417.160933.txt
2013-04-30 14:49 - 2013-04-30 14:49 - 0010167 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130430.144903.txt
2013-05-06 17:32 - 2013-05-06 17:32 - 0010211 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130506.173211.txt
2013-05-06 17:32 - 2013-05-06 17:33 - 0010032 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130506.173226.txt
2013-06-03 18:31 - 2013-06-03 18:31 - 0010289 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130603.183117.txt
2013-06-03 18:31 - 2013-06-03 18:32 - 0010107 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130603.183133.txt
2013-07-23 12:44 - 2013-07-23 12:44 - 0010291 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130723.124408.txt
2013-07-23 14:14 - 2013-07-23 14:15 - 0009989 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130723.141452.txt
2013-07-23 14:23 - 2013-07-23 14:23 - 0009915 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130723.142335.txt
2013-10-17 14:33 - 2013-10-17 14:33 - 0014208 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20131017.143331.wdl
2014-01-11 15:24 - 2014-01-11 15:27 - 0014685 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20140111.142447.wdl
2014-01-13 12:36 - 2014-01-13 12:36 - 0014684 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20140113.113611.wdl
2014-01-13 12:46 - 2014-01-13 12:47 - 0016917 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20140113.114653.txt
2014-01-14 22:06 - 2014-01-14 22:06 - 0016629 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20140114.210628.wdl

Some content of TEMP:
====================
C:\Users\Matthias Meister\AppData\Local\Temp\avgnt.exe
C:\Users\Matthias Meister\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmptqmh33.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-04-27 10:39

==================== End Of Log ============================

--- --- ---

Matmeis · 29.04.2015, 08:10

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 27-04-2015 01
Ran by Matthias Meister at 2015-04-29 09:05:04
Running from C:\Users\Matthias Meister\Desktop
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-895578266-524488165-4032655203-500 - Administrator - Disabled)
Gast (S-1-5-21-895578266-524488165-4032655203-501 - Limited - Disabled) => C:\Users\Gast
HomeGroupUser$ (S-1-5-21-895578266-524488165-4032655203-1004 - Limited - Enabled)
Matthias Meister (S-1-5-21-895578266-524488165-4032655203-1000 - Administrator - Enabled) => C:\Users\Matthias Meister

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Antivirus (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avira Antivirus (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Accordance (HKLM-x32\...\{9B088535-6E1D-480E-A5F1-510E1DE6B572}_is1) (Version: 10.4.5 - Oaktree Software, Inc.)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 14.0.0.110 - Adobe Systems Incorporated)
Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Amazon MP3-Downloader 1.0.17 (HKLM-x32\...\Amazon MP3-Downloader) (Version: 1.0.17 - Amazon Services LLC)
Anzeige am Bildschirm (HKLM\...\OnScreenDisplay) (Version: 7.12.23 - )
Apple Application Support (32-Bit) (HKLM-x32\...\{AFA1153A-F547-409B-B837-3A0D6C5A3FEC}) (Version: 3.1.3 - Apple Inc.)
Apple Application Support (64-Bit) (HKLM\...\{D7B824DE-DA32-4772-9E5E-39C5158136A7}) (Version: 3.1.3 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{C4123106-B685-48E6-B9BD-E4F911841EB4}) (Version: 8.1.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
AutoHotkey 1.1.14.02 (HKLM\...\AutoHotkey) (Version: 1.1.14.02 - Lexikos)
Avira (HKLM-x32\...\{b5675cc4-ab8b-4945-8c1d-4c5479556d6a}) (Version: 1.1.34.19732 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.34.19732 - Avira Operations GmbH & Co. KG) Hidden
Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.9.504 - Avira Operations GmbH & Co. KG)
Bing-Desktop (HKLM-x32\...\{7D095455-D971-4D4C-9EFD-9AF6A6584F3A}) (Version: 1.3.171.0 - Microsoft Corporation)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Bullzip PDF Printer 9.3.0.1516 (HKLM\...\Bullzip PDF Printer_is1) (Version: 9.3.0.1516 - Bullzip)
calibre 64bit (HKLM\...\{C5D7991D-5C4F-475D-BF58-89A068A2FF14}) (Version: 2.25.0 - Kovid Goyal)
CCleaner (HKLM\...\CCleaner) (Version: 5.05 - Piriform)
Cisco AnyConnect Secure Mobility Client  (HKLM-x32\...\Cisco AnyConnect Secure Mobility Client) (Version: 3.1.05160 - Cisco Systems, Inc.)
Cisco AnyConnect Secure Mobility Client (x32 Version: 3.1.05160 - Cisco Systems, Inc.) Hidden
Citavi 5 (HKLM-x32\...\{7EB278FB-0C3C-445E-8665-4A6CDD9B794E}) (Version: 5.0.0.11 - Swiss Academic Software)
Conexant 20672 SmartAudio HD (HKLM\...\CNXT_AUDIO_HDA) (Version: 8.32.43.0 - Conexant)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dropbox (HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Dropbox) (Version: 3.4.4 - Dropbox, Inc.)
ElsterFormular (HKLM-x32\...\ElsterFormular) (Version: 16.0.16151 - Landesfinanzdirektion Thüringen)
Evernote v. 5.8.5 (HKLM-x32\...\{5EDC25EC-D966-11E4-9E5C-00163E98E7D6}) (Version: 5.8.5.7193 - Evernote Corp.)
FormatFactory 3.0.1 (HKLM-x32\...\FormatFactory) (Version: 3.0.1 - Free Time)
Fotogalerie (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
FreeFileSync 6.15 (HKLM-x32\...\FreeFileSync) (Version: 6.15 - www.FreeFileSync.org)
GIMP 2.8.10 (HKLM\...\GIMP-2_is1) (Version: 2.8.10 - The GIMP Team)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 42.0.2311.90 - Google Inc.)
Google Drive (HKLM-x32\...\{6C36881B-0E51-4231-9D02-BF2149664D34}) (Version: 1.20.8672.3137 - Google, Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
HitmanPro 3.7 (HKLM\...\HitmanPro37) (Version: 3.7.9.240 - SurfRight B.V.)
HL-4150CDN (HKLM-x32\...\{123DE6D6-9566-4777-AC81-E6D86FFA95DA}) (Version: 1.1.7.0 - Brother Industries, Ltd.)
iCloud (HKLM\...\{309768A4-A2BB-4930-A5A2-8169678C9B4C}) (Version: 4.0.6.28 - Apple Inc.)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.1.70.1205 - Intel Corporation)
Intel(R) Network Connections Drivers (HKLM\...\PROSet) (Version: 16.8 - Intel)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.3347 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
Intel(R) Wireless Display (HKLM\...\{28EF7372-9087-4AC3-9B9F-D9751FCDF830}) (Version:  - )
Intel® PROSet/Wireless Software (HKLM-x32\...\{440d014b-4444-4533-b96d-2910e1ca2bcf}) (Version: 16.7.0 - Intel Corporation)
Intel® PROSet/Wireless WiMAX Software (HKLM\...\{5F588B19-C575-4750-86FD-6ED2B76E61F1}) (Version: 7.50.0000 - Intel Corporation)
Interlinear Scripture Analyzer 2 basic (HKLM\...\{C8F753CF-C578-4138-A870-33149B689FFD}) (Version: 2.1.5.0 - Scripture4all Foundation)
IRISPen 7 (HKLM-x32\...\{699F407B-A9DE-4261-8C46-2C5C42E3172D}) (Version: 1.5.2.330 - Ihr Firmenname)
iTunes (HKLM\...\{93F2A022-6C37-48B8-B241-FFABD9F60C30}) (Version: 12.1.2.27 - Apple Inc.)
Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)
LAME v3.99.3 (for Windows) (HKLM-x32\...\LAME_is1) (Version:  - )
Lenovo Multimedia and Communications Core Runtime (HKLM\...\{033DC0E0-DA89-4C33-B66C-89B64D312CD1}_is1) (Version: 5.0.13.94 - Lenovo Corporation)
Lenovo Patch Utility (x32 Version: 1.3.2.6 - Lenovo Group Limited) Hidden
Lenovo Patch Utility 64 bit (Version: 1.3.2.6 - Lenovo Group Limited) Hidden
Lenovo Power Management Driver (HKLM\...\Power Management Driver) (Version: 1.67.09.03 - )
Lenovo Settings - Camera Audio (HKLM\...\{88C6A6D9-324C-46E8-BA87-563D14021442}_is1) (Version: 4.3.19.209 - Lenovo Corporation)
Lenovo Settings - Location Awareness (HKLM-x32\...\{C79D4402-E622-4922-9C02-89F9080BF081}_is1) (Version: 1.4.0.5 - Lenovo Group Limited)
Lenovo Settings - Power (HKLM-x32\...\{DAC01CEE-5BAE-42D5-81FC-B687E84E8405}) (Version: 7.49.4 - Lenovo Group Limited)
Lenovo Settings Dependency Package (HKLM\...\{3694BA2E-BE31-4B7E-886B-A0B559E69D4D}_is1) (Version: 2.3.3.6 - Lenovo Group Limited)
Lenovo Settings Mobile Hotspot (HKLM\...\{42603F7D-B08D-436B-B0D8-3E2DEF1AFD41}_is1) (Version: 2.3.0.84 - Lenovo)
Lenovo Settings Service (HKLM\...\{8C6F1EBA-17F1-4481-B688-9777E63E985F}_is1) (Version: 2.3.3.7 - Lenovo Group Limited)
Lenovo Settings UMDF driver (HKLM\...\{2BDC7413-65EA-4B99-8C4B-02F11075BE6D}_is1) (Version: 1.2.0.7 - Lenovo Group Limited)
LibreOffice 4.2.7.2 (HKLM-x32\...\{A313C39F-79A7-408B-97EE-8F958407D694}) (Version: 4.2.7.2 - The Document Foundation)
LyX 2.1.0 (HKLM-x32\...\LyX210) (Version: 2.1.0 - LyX Team)
Malwarebytes Anti-Malware Version 2.1.6.1022 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)
Metric Collection SDK (x32 Version: 1.1.0005.00 - Lenovo Group Limited) Hidden
Metric Collection SDK 35 (x32 Version: 1.2.0001.00 - Lenovo Group Limited) Hidden
Microsoft Office 365 - de-de (HKLM\...\O365HomePremRetail - de-de) (Version: 15.0.4701.1002 - Microsoft Corporation)
Microsoft Office on Demand-Browser-Add-Ons (HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Microsoft Office on Demand-Browser-Add-Ons) (Version:  - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\OneDriveSetup.exe) (Version: 17.3.4726.0226 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP1 English (HKLM-x32\...\{E59113EB-0285-4BFD-A37A-B79EAC6B8F4B}) (Version: 3.5.5692.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{4fcf070a-daac-45e9-a8b0-6850941f7ed8}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
MiKTeX 2.9 (HKLM-x32\...\MiKTeX 2.9) (Version: 2.9 - MiKTeX.org)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 26.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 26.0 (x86 de)) (Version: 26.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 31.5.0 - Mozilla)
Mozilla Thunderbird 31.6.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 31.6.0 (x86 de)) (Version: 31.6.0 - Mozilla)
Music Manager (HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\MusicManager) (Version:  - Google, Inc.)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4701.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4701.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4701.1002 - Microsoft Corporation) Hidden
Pandoc 1.12.3 (HKLM-x32\...\{5DFB319D-1BD3-49AE-991A-95ED9E8BBCE8}) (Version: 1.12.3 - John MacFarlane)
Paragon HFS+ for Windows 8 Free Edition (HKLM-x32\...\{456534C0-51E7-11DF-B336-005056C00008}) (Version: 1.00 - Paragon Software)
PDF24 Creator 6.3.2 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)
QuickTime 7 (HKLM-x32\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)
Renesas Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}) (Version: 2.1.36.0 - Renesas Electronics Corporation)
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.1.36.0 - Renesas Electronics Corporation) Hidden
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
RICOH_Media_Driver_v2.22.18.01 (HKLM-x32\...\{FE041B02-234C-4AAA-9511-80DF6482A458}) (Version: 2.22.18.01 - RICOH)
Samsung Universal Print Driver 2 (HKLM-x32\...\Samsung Universal Print Driver 2) (Version: 2.50.04.00 - Samsung Electronics Co., Ltd.)
Scrivener (HKLM-x32\...\Scrivener 1710) (Version: 1710 - Literature and Latte)
Sentinel RMS License Manager 8.4.1 (HKLM-x32\...\{3213A8E3-81A3-417D-93B2-A116A60666C8}) (Version: 8.4.1 - SafeNet, Inc.)
Skitch (HKLM-x32\...\Skitch 2.3.1.163) (Version: 2.3.1.163 - Evernote Corp.)
Skype™ 7.3 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.3.101 - Skype Technologies S.A.)
Sophos SSL VPN Client 2.1 (HKLM-x32\...\Sophos SSL VPN Client) (Version: 2.1 - )
Spotify (HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Spotify) (Version: 0.9.16.29.g0b5fcb05 - Spotify AB)
Telegram Desktop version 0.8.4 (HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_is1) (Version: 0.8.4 - Telegram Messenger LLP)
ThinkPad UltraNav Driver (HKLM\...\SynTPDeinstKey) (Version: 16.2.19.9 - )
ThinkVantage Access Connections (HKLM-x32\...\{8E537894-A559-4D60-B3CB-F4485E3D24E3}) (Version: 5.97 - Lenovo)
ThinkVantage Fingerprint Software (HKLM\...\{68D50088-CE92-4FF0-A220-D875E2E73151}) (Version: 6.0.0.8102 - Authentec Inc.)
ThinkVantage System für aktiven Festplattenschutz (HKLM\...\{46A84694-59EC-48F0-964C-7E76E9F8A2ED}) (Version: 1.79.00.03 - Lenovo)
Unity Web Player (HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\UnityWebPlayer) (Version: 4.6.4f1 - Unity Technologies ApS)
Visual Studio 2010 x64 Redistributables (HKLM\...\{21B133D6-5979-47F0-BE1C-F6A6B304693F}) (Version: 13.0.0.1 - AVG Technologies)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.0 - VideoLAN)
Windows Driver Package - Silicon Laboratories (silabenm) Ports  (12/10/2012 6.6.1.0) (HKLM\...\F1D0CAF4C0DED9E19E7D560DEA76E9C03A9840DA) (Version: 12/10/2012 6.6.1.0 - Silicon Laboratories)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
Windows Phone app for desktop (HKLM-x32\...\{19773614-FC22-4ACC-AAA3-E6BDA81ACF92}) (Version: 1.1.2726.0 - Microsoft Corporation)
XMind 2013 (v3.4.1) (HKLM-x32\...\XMind_is1) (Version: 3.4.1.201401221918 - XMind Ltd.)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-895578266-524488165-4032655203-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-895578266-524488165-4032655203-1000_Classes\CLSID\{225F8CFE-1B76-48E6-8E75-62CC471AFA28}\InprocServer32 -> C:\Users\Matthias Meister\AppData\Local\Microsoft\Internet Explorer\Downloaded Program Files\Microsoft Office 15\RoamingOfficeActiveX.64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-895578266-524488165-4032655203-1000_Classes\CLSID\{C3BC25C0-FCD3-4F01-AFDD-41373F017C9A}\InprocServer32 -> C:\Users\Matthias Meister\AppData\Local\Google\Update\1.3.26.9\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-895578266-524488165-4032655203-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Matthias Meister\AppData\Local\Google\Update\1.3.26.9\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-895578266-524488165-4032655203-1000_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-895578266-524488165-4032655203-1000_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Matthias Meister\AppData\Local\Microsoft\OneDrive\17.3.4726.0226\amd64\FileSyncApi64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-895578266-524488165-4032655203-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-895578266-524488165-4032655203-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-895578266-524488165-4032655203-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-895578266-524488165-4032655203-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-895578266-524488165-4032655203-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-895578266-524488165-4032655203-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-895578266-524488165-4032655203-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-895578266-524488165-4032655203-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)

==================== Restore Points  =========================

24-04-2015 11:33:16 TuneUp Utilities 2014 wird entfernt
28-04-2015 11:25:33 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {01297DD5-ACC9-45C6-B050-7969EA08F41E} - System32\Tasks\{53107B12-F938-4A02-9F23-8DB6A9939CB9} => pcalua.exe -a "C:\Users\Matthias Meister\Downloads\Setup.exe" -d "C:\Users\Matthias Meister\Downloads"
Task: {05CB891C-C430-44FB-A2E6-BBFD4CBB3BF1} - System32\Tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask => C:\Windows\ehome\mcupdate.exe
Task: {05D33BDF-B8CC-45AA-92D3-D9002AD63BA8} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-04-02] (Google Inc.)
Task: {0CA2C72B-9776-481F-9294-2B023B5C3916} - System32\Tasks\Microsoft\Windows\Media Center\RegisterSearch => C:\Windows\ehome\ehPrivJob.exe
Task: {12E26CAC-355D-413E-8815-1F3D8E3DC4A6} - System32\Tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask => C:\Windows\ehome\mcupdate.exe
Task: {16AC7163-24A3-4CC6-A4C5-B3DFD226F91C} - System32\Tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService => C:\Windows\ehome\ehPrivJob.exe
Task: {2057EB88-B9CB-48EB-AE5E-47B905FD54DD} - System32\Tasks\Microsoft\Windows\Media Center\MediaCenterRecoveryTask => C:\Windows\ehome\mcupdate.exe
Task: {23E3F989-8993-499C-B7E4-0CB50F135014} - System32\Tasks\GenericSettingsHandler\Windows-Credentials\RetrySyncTask_for_S-1-5-21-895578266-524488165-4032655203-1000
Task: {30622C2C-ABD3-42E3-869C-52CB71AAA599} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program 64 35 => C:\Program Files (x86)\Lenovo\Customer Feedback Program 35\Lenovo.TVT.CustomerFeedback.Agent35.exe [2014-05-30] (Lenovo)
Task: {3B54B7EB-6485-41D4-A696-A8BCBCE142D5} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program 64 => C:\Program Files (x86)\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe [2014-02-13] (Lenovo)
Task: {454DB601-A28B-4668-81B4-097FA3E68187} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-04-08] (Piriform Ltd)
Task: {47318851-E293-4F05-B3A8-8A944EE0413A} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-04-02] (Google Inc.)
Task: {5A54D371-C499-41ED-8450-82862B2778BF} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-895578266-524488165-4032655203-1000Core => C:\Users\Matthias Meister\AppData\Local\Google\Update\GoogleUpdate.exe [2013-03-12] (Google Inc.)
Task: {6B3C7E23-AF30-4D60-8654-0D00BF1BBC2B} - System32\Tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks => C:\Windows\ehome\ehPrivJob.exe
Task: {6D236B4F-EB9D-4105-ABC7-107FC05B5652} - System32\Tasks\{577DBEBF-24E0-4DE5-ADCA-0CA1C24DC512} => pcalua.exe -a "C:\Program Files (x86)\InstallShield Installation Information\{DAC01CEE-5BAE-42D5-81FC-B687E84E8405}\Setup.exe" -c -AddRemove
Task: {6DFB74AB-13CA-4EBF-A592-B6547565BB5C} - System32\Tasks\Lenovo\Lenovo Settings Power => Rundll32.exe "C:\Program Files (x86)\ThinkPad\Utilities\PWMTR64V.dll",PwrMgrBkGndMonitor
Task: {6FB9E1DD-2FF2-4C7D-8215-5B0C3D176678} - System32\Tasks\Microsoft\Windows\Media Center\PvrScheduleTask => C:\Windows\ehome\mcupdate.exe
Task: {6FBCF39A-3974-47BD-A7B5-98BD2088E4C6} - System32\Tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch => C:\Windows\ehome\ehPrivJob.exe
Task: {71B27283-ADF6-4D11-A1E2-1C72ADB2FCD7} - System32\Tasks\Microsoft\Windows\Media Center\RecordingRestart => C:\Windows\ehome\ehrec.exe
Task: {7C002A81-25B3-46B5-B50B-5FBF2C5115C7} - System32\Tasks\Microsoft\Windows\Media Center\PeriodicScanRetry => C:\Windows\ehome\MCUpdate.exe
Task: {7EE0D6E1-D550-47F2-9967-40EB282CDB2A} - System32\Tasks\Microsoft\Windows\Media Center\StartRecording => C:\Windows\ehome\ehrec.exe
Task: {85DAE385-6CC4-4773-8D95-E19701EE0B3E} - System32\Tasks\{65D61D50-655A-4E16-AABB-B4DCEEB47EB6} => pcalua.exe -a "C:\Users\Matthias Meister\Desktop\83ts04ww.exe" -d "C:\Users\Matthias Meister\Desktop"
Task: {894F577B-8062-4C7F-ABEE-F5C484DEAADC} - System32\Tasks\{108EF52A-3187-4CAC-9F1F-2BB07316FD66} => pcalua.exe -a D:\GloAppInstaller\GloAppInstaller.exe -d D:\GloAppInstaller
Task: {99EE5FEC-783F-4ED8-9F14-7EB56177FA8C} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\Windows\ehome\mcupdate.exe
Task: {9B34940D-B95A-49D0-AE30-303BDD79C214} - System32\Tasks\Microsoft\Windows\Media Center\OCURActivate => C:\Windows\ehome\ehPrivJob.exe
Task: {9C8D95FA-3DDC-41AF-8610-C79E58EBD09C} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxcontent => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-24] (Microsoft Corporation)
Task: {9FFC158D-DEEF-479E-8510-BE1594D8198C} - System32\Tasks\Microsoft\Windows\Media Center\ReindexSearchRoot => C:\Windows\ehome\ehPrivJob.exe
Task: {A6BC1F86-E80D-4983-B992-0B129A7E92F8} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW1 => C:\Windows\ehome\ehPrivJob.exe
Task: {A9BA052B-F1B6-408F-B284-AD79DD856F7D} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-02-10] (Microsoft Corporation)
Task: {A9E0DC59-4CF1-4003-85E9-E71028102D66} - System32\Tasks\Microsoft\Windows\Media Center\ehDRMInit => C:\Windows\ehome\ehPrivJob.exe
Task: {AA0925B4-5482-45AE-A8C2-A56168A3B7CD} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW2 => C:\Windows\ehome\ehPrivJob.exe
Task: {AB8ECDA1-3927-46FD-965C-E1C01114EE28} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscovery => C:\Windows\ehome\ehPrivJob.exe
Task: {AD897FB0-A59A-4083-9BCE-DDB66D373347} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-03-24] (Microsoft Corporation)
Task: {B02DF302-AF51-4BD8-AE04-5F7E6C7DBB64} - System32\Tasks\{50A03D00-3269-4A49-BDB1-2CFA24F87A31} => pcalua.exe -a C:\PM\Setup.exe -d C:\PM
Task: {B42F2D24-7C93-40EE-823D-75BF8C9C39CC} - System32\Tasks\Microsoft\Windows\Media Center\PvrRecoveryTask => C:\Windows\ehome\mcupdate.exe
Task: {B4825007-B2A8-4703-8CC3-9D6623DEEA09} - System32\Tasks\TVT\LenovoWERMonitor => C:\Program Files (x86)\Common Files\lenovo\SUP\sup_wermonitor.exe [2014-05-27] (Lenovo)
Task: {B8B4304A-7B6E-4898-A75C-10A9DE78ECB0} - System32\Tasks\Microsoft Office 15 Sync Maintenance for MATTHIASMEISTER-Matthias Meister MatthiasMeister => C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [2015-02-10] (Microsoft Corporation)
Task: {CCD3EB94-2E66-48C3-8EDA-CB164AFD3173} - System32\Tasks\Microsoft\Windows\Media Center\UpdateRecordPath => C:\Windows\ehome\ehPrivJob.exe
Task: {CF171EB8-9D40-4F8F-B63F-8CE4350AF4DA} - System32\Tasks\Microsoft\Windows\Media Center\InstallPlayReady => C:\Windows\ehome\ehPrivJob.exe
Task: {D2185F41-0AC0-4459-8E79-E25722541479} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-04-14] (Adobe Systems Incorporated)
Task: {D95CB13D-D946-42BC-90E6-6F6EF921B25E} - System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-895578266-524488165-4032655203-1000 => %localappdata%\Microsoft\OneDrive\OneDrive.exe
Task: {DB1C2689-BDCA-46B6-A55A-35BFD66756BE} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {DFDF3405-737A-493E-AA97-6BAE78F4875F} - System32\Tasks\Microsoft\Windows\Setup\gwx\runappraiser => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-24] (Microsoft Corporation)
Task: {E50237D5-168F-437E-B928-FCDAA6E20D81} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2015-02-10] (Microsoft Corporation)
Task: {E6D695C1-371F-409F-A8EB-4FFAE6B87AD2} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate => C:\Windows\ehome\mcupdate.exe
Task: {E8F72B08-9E73-4F72-ADBA-C83EB155F071} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-24] (Microsoft Corporation)
Task: {EB07A24C-9C02-4FB0-9EFA-13F716A7BE8B} - System32\Tasks\SidebarExecute => C:\Program Files\Windows Sidebar\sidebar.exe
Task: {EB691299-F4B8-4ACB-8ED3-D4C9B2D2C038} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-04-15] (Microsoft Corporation)
Task: {EED8DA22-AC11-47B9-B7DE-6B940B00285F} - System32\Tasks\Microsoft\Windows\Media Center\OCURDiscovery => C:\Windows\ehome\ehPrivJob.exe
Task: {EF95BCC9-40DE-4BFC-9D0B-37256C2F70E6} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program => C:\Program Files\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe
Task: {F196D4B9-21B8-496A-8E56-8EAA2A7D9C85} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-02-10] (Microsoft Corporation)
Task: {FE8BC4C2-EC58-4C1C-8FA9-FDB227D1BE65} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-895578266-524488165-4032655203-1000UA => C:\Users\Matthias Meister\AppData\Local\Google\Update\GoogleUpdate.exe [2013-03-12] (Google Inc.)
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-895578266-524488165-4032655203-1000Core.job => C:\Users\Matthias Meister\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-895578266-524488165-4032655203-1000UA.job => C:\Users\Matthias Meister\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\Synaptics TouchPad Enhancements.job => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

==================== Loaded Modules (whitelisted) ==============

2014-06-16 12:08 - 2015-01-16 08:49 - 00118272 ____N () C:\Program Files (x86)\ThinkPad\Utilities\GR\PWMRT64V.dll
2011-03-10 09:14 - 2012-12-19 11:58 - 00015360 _____ () C:\WINDOWS\System32\KOAZCA_L.DLL
2015-03-12 12:55 - 2011-04-11 07:26 - 00034304 _____ () C:\WINDOWS\System32\spe__l.dll
2011-06-22 11:44 - 2011-06-22 11:44 - 00034304 _____ () C:\WINDOWS\System32\sst2cl6.dll
2015-03-12 12:55 - 2013-09-13 09:29 - 01242112 _____ () C:\WINDOWS\system32\spool\DRIVERS\x64\3\spe__du.dll
2015-01-20 23:35 - 2015-01-20 23:35 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-01-20 23:35 - 2015-01-20 23:35 - 01346344 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2014-03-23 08:54 - 2014-05-20 09:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2014-06-16 12:08 - 2015-01-16 08:49 - 00118272 ____N () C:\Program Files (x86)\ThinkPad\Utilities\GR\PWMRT64V.DLL
2012-11-28 11:39 - 2010-10-26 11:40 - 00049056 _____ () C:\Program Files\CONEXANT\ForteConfig\fmapp.exe
2012-12-14 03:42 - 2012-12-14 03:42 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2015-02-19 00:03 - 2015-01-09 16:40 - 00469720 _____ () C:\Program Files (x86)\Lenovo\LocationAware\loctaskmgr.exe
2014-01-11 16:36 - 2015-01-09 16:40 - 00013528 _____ () C:\Program Files (x86)\Lenovo\LocationAware\lpdagent.exe
2014-03-12 22:53 - 2014-03-12 22:53 - 00063376 _____ () C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\zlib1.dll
2012-09-06 20:18 - 2012-09-06 20:18 - 00086016 _____ () C:\Program Files (x86)\Lenovo\Access Connections\AcWrpc.dll
2014-11-21 11:02 - 2014-11-21 11:02 - 00316576 _____ () C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\AppVIsvStream32.dll
2014-11-21 10:59 - 2014-11-21 10:59 - 00316576 _____ () C:\Program Files\Microsoft Office 15\Root\Office15\AppVIsvStream32.dll
2015-01-20 23:35 - 2015-01-20 23:35 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2015-04-29 08:59 - 2015-04-29 08:59 - 00043008 _____ () c:\Users\Matthias Meister\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmptqmh33.dll
2015-03-04 23:45 - 2015-03-04 23:45 - 00750080 _____ () C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\libGLESv2.dll
2015-03-04 23:45 - 2015-03-04 23:45 - 00047616 _____ () C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\libEGL.dll
2015-03-04 23:45 - 2015-03-04 23:45 - 00865280 _____ () C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll
2015-03-04 23:45 - 2015-03-04 23:45 - 00200704 _____ () C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll
2013-02-26 18:56 - 2009-02-27 17:38 - 00139264 ____R () C:\Program Files (x86)\Brother\BrUtilities\BrLogAPI.dll
2015-04-17 09:33 - 2015-04-13 23:55 - 01252680 _____ () C:\Program Files (x86)\Google\Chrome\Application\42.0.2311.90\libglesv2.dll
2015-04-17 09:33 - 2015-04-13 23:55 - 00080712 _____ () C:\Program Files (x86)\Google\Chrome\Application\42.0.2311.90\libegl.dll
2015-01-26 10:47 - 2015-01-26 10:47 - 00799232 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Windows.Networking\86865ced79f3180ebdfa736d895e5edb\Windows.Networking.ni.dll
2015-01-26 10:46 - 2015-01-26 10:46 - 00228864 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Windows.Foundation\16c3eb7650767d95d002c998d0c73eb5\Windows.Foundation.ni.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\Users\Matthias Meister\SkyDrive:ms-properties

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, the associated entry will be removed from the registry.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-895578266-524488165-4032655203-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Matthias Meister\AppData\Local\Microsoft\Windows\Themes\RoamedThemeFiles\DesktopBackground\2015-03-24.jpg
DNS Servers: 192.168.178.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

HKLM\...\StartupApproved\Run: => "MacDrive 9 application"
HKLM\...\StartupApproved\Run: => "LnvMobHotspotClient"
HKLM\...\StartupApproved\Run: => "SmartAudio"
HKLM\...\StartupApproved\Run: => "LenovoOptMouseUpdate"
HKLM\...\StartupApproved\Run: => "iTunesHelper"
HKLM\...\StartupApproved\Run32: => "Adobe ARM"
HKLM\...\StartupApproved\Run32: => "APSDaemon"
HKLM\...\StartupApproved\Run32: => "ApnUpdater"
HKLM\...\StartupApproved\Run32: => "iTunesHelper"
HKLM\...\StartupApproved\Run32: => "QuickTime Task"
HKLM\...\StartupApproved\Run32: => "SweetIM"
HKLM\...\StartupApproved\Run32: => "Sweetpacks Communicator"
HKLM\...\StartupApproved\Run32: => "BingDesktop"
HKLM\...\StartupApproved\Run32: => "Cisco AnyConnect Secure Mobility Agent for Windows"
HKLM\...\StartupApproved\Run32: => "PDFPrint"
HKLM\...\StartupApproved\Run32: => "openvpn-gui"
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\StartupApproved\StartupFolder: => "OneNote 2013 Screen Clipper and Launcher.lnk"
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\StartupApproved\StartupFolder: => "An OneNote senden.lnk"
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\StartupApproved\Run: => "GoogleChromeAutoLaunch_5382C8EB82E9B70BA085EAF9BDB27BD7"
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\StartupApproved\Run: => "GoogleDriveSync"
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\StartupApproved\Run: => "Google Update"
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\StartupApproved\Run: => "MusicManager"
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\StartupApproved\Run: => "Ubuntu One Icon"
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\StartupApproved\Run: => "Ubuntu One"
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\StartupApproved\Run: => "Skitch"
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\StartupApproved\Run: => "Spotify"
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\StartupApproved\Run: => "Spotify Web Helper"

==================== FirewallRules (whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [Wininit-Shutdown-In-Rule-TCP-RPC] => (Allow) %systemroot%\system32\wininit.exe
FirewallRules: [Wininit-Shutdown-In-Rule-TCP-RPC-EPMapper] => (Allow) %systemroot%\system32\wininit.exe
FirewallRules: [ProximityUxHost-Sharing-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\proximityuxhost.exe
FirewallRules: [ProximityUxHost-Sharing-Out-TCP-NoScope] => (Allow) %SystemRoot%\system32\proximityuxhost.exe
FirewallRules: [NETDIS-DAS-In-UDP-Active] => (Allow) %SystemRoot%\system32\dashost.exe
FirewallRules: [NETDIS-DAS-In-UDP] => (Allow) %SystemRoot%\system32\dashost.exe
FirewallRules: [EventForwarder-In-TCP] => (Allow) %SystemRoot%\system32\NetEvtFwdr.exe
FirewallRules: [TPMVSCMGR-Server-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\RmtTpmVscMgrSvr.exe
FirewallRules: [TPMVSCMGR-Server-Out-TCP-NoScope] => (Allow) %SystemRoot%\system32\RmtTpmVscMgrSvr.exe
FirewallRules: [TPMVSCMGR-Server-In-TCP] => (Allow) %SystemRoot%\system32\RmtTpmVscMgrSvr.exe
FirewallRules: [TPMVSCMGR-Server-Out-TCP] => (Allow) %SystemRoot%\system32\RmtTpmVscMgrSvr.exe
FirewallRules: [PlayTo-In-UDP-NoScope] => (Allow) %SystemRoot%\system32\mdeserver.exe
FirewallRules: [PlayTo-In-UDP-LocalSubnetScope] => (Allow) %SystemRoot%\system32\mdeserver.exe
FirewallRules: [PlayTo-In-UDP-PlayToScope] => (Allow) %SystemRoot%\system32\mdeserver.exe
FirewallRules: [PlayTo-Out-UDP-NoScope] => (Allow) %SystemRoot%\system32\mdeserver.exe
FirewallRules: [PlayTo-Out-UDP-LocalSubnetScope] => (Allow) %SystemRoot%\system32\mdeserver.exe
FirewallRules: [PlayTo-Out-UDP-PlayToScope] => (Allow) %SystemRoot%\system32\mdeserver.exe
FirewallRules: [PlayTo-In-RTSP-NoScope] => (Allow) %SystemRoot%\system32\mdeserver.exe
FirewallRules: [PlayTo-In-RTSP-LocalSubnetScope] => (Allow) %SystemRoot%\system32\mdeserver.exe
FirewallRules: [PlayTo-In-RTSP-PlayToScope] => (Allow) %SystemRoot%\system32\mdeserver.exe
FirewallRules: [WFDPRINT-DAFWSD-In-Active] => (Allow) %SystemRoot%\system32\dashost.exe
FirewallRules: [WFDPRINT-DAFWSD-Out-Active] => (Allow) %SystemRoot%\system32\dashost.exe
FirewallRules: [RemoteDesktop-Shadow-In-TCP] => (Allow) %SystemRoot%\system32\RdpSa.exe
FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppextcomobj.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppextcomobj.exe
FirewallRules: [UDP Query User{81EAD92C-2436-4C92-AEC8-8F359922F3D3}C:\users\matthias meister\appdata\roaming\dropbox\bin\dropbox.exe] => (Allow) C:\users\matthias meister\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [TCP Query User{0AE1C93B-1673-48B4-9FC1-BF8DE2F805DC}C:\users\matthias meister\appdata\roaming\dropbox\bin\dropbox.exe] => (Allow) C:\users\matthias meister\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [{8B68C2C2-6F29-4B0C-AB0C-19400F662098}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{E5EA7E1A-98B9-4A3B-BAFE-FE1D602BF61A}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{1DC1BD93-FCD4-46E1-8744-59573531B4D6}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{4155D9C7-E226-4380-81FE-19027DBA872F}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{B41F9AD3-9A36-4D83-9A55-58736C132C94}] => (Allow) C:\Program Files\Intel\WiMAX\Bin\DMAgent.exe
FirewallRules: [{9E9A8BF3-EB73-41C8-909B-2F1C78EECA78}] => (Allow) C:\Program Files\Intel\WiMAX\Bin\DMAgent.exe
FirewallRules: [{1A5D2C45-9673-444D-87E2-FB405C0C9A24}] => (Allow) C:\Program Files\Intel\WiMAX\Bin\AppSrv.exe
FirewallRules: [{8CEEFDD7-7E98-44BD-92EF-ED4070ABAE12}] => (Allow) C:\Program Files\Intel\WiMAX\Bin\AppSrv.exe
FirewallRules: [{F66F10A5-0FCB-453B-BBFE-7862E25DF510}] => (Allow) C:\Windows\SysWOW64\msiexec.exe
FirewallRules: [{90E7027D-5141-4BE8-83AB-8663AEAE065A}] => (Allow) C:\Windows\SysWOW64\msiexec.exe
FirewallRules: [{73F738A2-9782-4E45-8DA7-E57CBFCA75B5}] => (Allow) C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{CCE3B923-5211-472F-8BF8-8E6BC3A43856}] => (Allow) C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{61F0A51F-2618-46F0-865D-767AA1BBB0D1}] => (Allow) C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel RMS License Manager\WinNT\lservnt.exe
FirewallRules: [{DA420B02-43D9-4824-94DE-6FF68B98091F}] => (Allow) C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel RMS License Manager\WinNT\lservnt.exe
FirewallRules: [{BC214D58-6E84-475B-B16C-3D66603897FB}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\outlook.exe
FirewallRules: [{2F097CBC-B1D8-40BB-8EBA-B141F974BE42}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{BA2E681D-AA7F-48B7-84B5-010D22C7062E}] => (Allow) LPort=2869
FirewallRules: [{9B51227D-B737-49C8-9343-678FE5F8953A}] => (Allow) LPort=1900
FirewallRules: [{D07584FC-1D6C-4F22-925E-136343280F71}] => (Allow) C:\Program Files (x86)\Samsung\Samsung Universal Print Driver 2\PrinterSelector\SUPDApp.exe
FirewallRules: [TCP Query User{1993B725-0F67-4D95-89AD-21118005DB70}C:\users\matthias meister\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\matthias meister\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{F9F4FB2B-2FB6-4CB7-AE26-12F7F9A2CDCC}C:\users\matthias meister\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\matthias meister\appdata\roaming\spotify\spotify.exe
FirewallRules: [{49AC4E5F-8E78-4E97-8CB7-374CAB319156}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [TCP Query User{97A6C33D-9800-41EB-858C-E300DFE8ACC2}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [UDP Query User{5FC1940A-8A91-49EF-BEEC-91865E066B52}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [{99D93192-7472-4BAF-9D58-6584A9314BE6}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Faulty Device Manager Devices =============

Name: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64
Description: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: vpnva
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (04/29/2015 08:51:54 AM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Überspringen: Eap method DLL path Fehler bei der Überprüfung. Fehler: Type-ID=43, Autor-ID=9, Lieferant-ID=0, Lieferant-Typ=0

Error: (04/29/2015 08:51:54 AM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Überspringen: Eap method DLL path Fehler bei der Überprüfung. Fehler: Type-ID=25, Autor-ID=9, Lieferant-ID=0, Lieferant-Typ=0

Error: (04/29/2015 08:51:54 AM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Überspringen: Eap method DLL path Fehler bei der Überprüfung. Fehler: Type-ID=17, Autor-ID=9, Lieferant-ID=0, Lieferant-Typ=0

Error: (04/29/2015 08:51:54 AM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Überspringen: Eap method DLL path Fehler bei der Überprüfung. Fehler: Type-ID=254, Autor-ID=311, Lieferant-ID=14122, Lieferant-Typ=1

Error: (04/28/2015 11:16:51 PM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Überspringen: Eap method DLL path Fehler bei der Überprüfung. Fehler: Type-ID=43, Autor-ID=9, Lieferant-ID=0, Lieferant-Typ=0

Error: (04/28/2015 11:16:51 PM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Überspringen: Eap method DLL path Fehler bei der Überprüfung. Fehler: Type-ID=25, Autor-ID=9, Lieferant-ID=0, Lieferant-Typ=0

Error: (04/28/2015 11:16:51 PM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Überspringen: Eap method DLL path Fehler bei der Überprüfung. Fehler: Type-ID=17, Autor-ID=9, Lieferant-ID=0, Lieferant-Typ=0

Error: (04/28/2015 11:16:51 PM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Überspringen: Eap method DLL path Fehler bei der Überprüfung. Fehler: Type-ID=254, Autor-ID=311, Lieferant-ID=14122, Lieferant-Typ=1

Error: (04/28/2015 10:39:58 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005

Error: (04/28/2015 10:39:57 PM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Überspringen: Eap method DLL path Fehler bei der Überprüfung. Fehler: Type-ID=43, Autor-ID=9, Lieferant-ID=0, Lieferant-Typ=0


System errors:
=============
Error: (04/29/2015 08:58:29 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Heimnetzgruppen-Anbieter" ist vom Dienst "Funktionssuche-Ressourcenveröffentlichung" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%2147942405

Error: (04/29/2015 08:58:29 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Funktionssuche-Ressourcenveröffentlichung" wurde mit folgendem Fehler beendet: 
%%2147942405

Error: (04/29/2015 08:58:18 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Lenovo Doze Mode Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (04/29/2015 08:58:18 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Bing Desktop Update service erreicht.

Error: (04/29/2015 08:58:16 AM) (Source: Microsoft-Windows-Directory-Services-SAM) (EventID: 16953) (User: NT-AUTORITÄT)
Description: Fehler "126" beim Laden der Kennwortbenachrichtigungs-DLL "ACGina". Stellen Sie sicher, dass der in der Registrierung definierte DLL-Pfad "HKLM\System\CurrentControlSet\Control\Lsa\Notification Packages" sich auf einen korrekten und absoluten Pfad (<Laufwerk>:\<Pfad>\<Dateiname>.<Erw.>) bezieht und nicht auf einen relativen oder ungültigen Pfad. Wenn der DLL-Pfad falsch ist, stellen Sie sicher, dass sich alle Hilfsdateien im gleichen Verzeichnis befinden und dass das Systemkonto sowohl auf den DLL-Pfad als auch die Hilfsdateien Lesezugriff hat.  Wenden Sie sich an den Anbieter der Benachrichtigungs-DLL, um weitere Unterstützung zu erhalten. Weitere Informationen finden Sie im Internet unter "hxxp://go.microsoft.com/fwlink/?LinkId=245898".

Error: (04/27/2015 08:33:04 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Lenovo Doze Mode Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (04/27/2015 08:33:04 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Bing Desktop Update service erreicht.

Error: (04/27/2015 08:32:59 AM) (Source: Microsoft-Windows-Directory-Services-SAM) (EventID: 16953) (User: NT-AUTORITÄT)
Description: Fehler "126" beim Laden der Kennwortbenachrichtigungs-DLL "ACGina". Stellen Sie sicher, dass der in der Registrierung definierte DLL-Pfad "HKLM\System\CurrentControlSet\Control\Lsa\Notification Packages" sich auf einen korrekten und absoluten Pfad (<Laufwerk>:\<Pfad>\<Dateiname>.<Erw.>) bezieht und nicht auf einen relativen oder ungültigen Pfad. Wenn der DLL-Pfad falsch ist, stellen Sie sicher, dass sich alle Hilfsdateien im gleichen Verzeichnis befinden und dass das Systemkonto sowohl auf den DLL-Pfad als auch die Hilfsdateien Lesezugriff hat.  Wenden Sie sich an den Anbieter der Benachrichtigungs-DLL, um weitere Unterstützung zu erhalten. Weitere Informationen finden Sie im Internet unter "hxxp://go.microsoft.com/fwlink/?LinkId=245898".

Error: (04/27/2015 08:32:33 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Superfetch" wurde mit folgendem Fehler beendet: 
%%1062

Error: (04/24/2015 00:17:52 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Lenovo Doze Mode Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2


Microsoft Office Sessions:
=========================
Error: (04/29/2015 08:51:54 AM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Eap method DLL path43900

Error: (04/29/2015 08:51:54 AM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Eap method DLL path25900

Error: (04/29/2015 08:51:54 AM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Eap method DLL path17900

Error: (04/29/2015 08:51:54 AM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Eap method DLL path254311141221

Error: (04/28/2015 11:16:51 PM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Eap method DLL path43900

Error: (04/28/2015 11:16:51 PM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Eap method DLL path25900

Error: (04/28/2015 11:16:51 PM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Eap method DLL path17900

Error: (04/28/2015 11:16:51 PM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Eap method DLL path254311141221

Error: (04/28/2015 10:39:58 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005

Error: (04/28/2015 10:39:57 PM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Eap method DLL path43900


CodeIntegrity Errors:
===================================
  Date: 2015-04-15 11:06:07.958
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume2\Windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.stdformat.dll that did not meet the Microsoft signing level requirements.

  Date: 2015-04-15 11:06:07.833
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume2\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\adodb.dll that did not meet the Microsoft signing level requirements.

  Date: 2015-04-15 11:06:07.739
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume2\Windows\assembly\GAC\MSDATASRC\7.0.3300.0__b03f5f7f11d50a3a\msdatasrc.dll that did not meet the Microsoft signing level requirements.

  Date: 2015-04-15 11:06:07.551
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume2\Windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.stdformat.dll that did not meet the Microsoft signing level requirements.

  Date: 2015-04-15 11:06:07.442
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume2\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\adodb.dll that did not meet the Microsoft signing level requirements.

  Date: 2015-04-15 11:06:07.348
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume2\Windows\assembly\GAC\MSDATASRC\7.0.3300.0__b03f5f7f11d50a3a\msdatasrc.dll that did not meet the Microsoft signing level requirements.

  Date: 2015-04-15 11:06:06.458
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume2\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\stdole.dll that did not meet the Microsoft signing level requirements.

  Date: 2015-04-15 11:06:06.114
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume2\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\stdole.dll that did not meet the Microsoft signing level requirements.

  Date: 2015-04-15 11:02:08.759
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume2\Windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.stdformat.dll that did not meet the Microsoft signing level requirements.

  Date: 2015-04-15 11:02:08.556
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume2\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\adodb.dll that did not meet the Microsoft signing level requirements.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i5-2520M CPU @ 2.50GHz
Percentage of memory in use: 51%
Total physical RAM: 3979.21 MB
Available physical RAM: 1932.1 MB
Total Pagefile: 8075.21 MB
Available Pagefile: 5573.22 MB
Total Virtual: 131072 MB
Available Virtual: 131071.84 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:119.14 GB) (Free:24.54 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 119.2 GB) (Disk ID: 0001EDA7)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=119.1 GB) - (Type=07 NTFS)

==================== End Of Log ============================

Grüße Matmeis

cosinus · 29.04.2015, 23:56

Zitat:

Mehrere Regestrycleans mit CCleaner über die letzten Wochen hat keine Abhilfe geschaffen. Vielleicht hängen ja beide Probleme zusammen?

Jup, Registryaufräumaktionen sind immer zweifelhaft und v.a. sehr sehr schlecht wenn man einfach alles löscht ohne zu wissen was das genau ist was das Programm an Löschungen vorschlägt.

Hinweis: Registry Cleaner

Ich sehe, dass du sogenannte Registry Cleaner installiert hast.
In deinem Fall CCleaner.

Wir raten von der Verwendung jeglicher Art von Registry Cleaner ab.

Der Grund ist ganz einfach:
Die Registry ist das Hirn des Systems. Funktioniert das Hirn nicht, funktioniert der Rest nicht mehr wirklich.
Man sollte nicht unnötigerweise an der Registry rumbasteln. Schon ein kleiner Fehler kann gravierende Folgen haben und auch Programme machen manchmal Fehler.
Zerstörst du die Registry, zerstörst du Windows.

Zudem ist der Nutzen zur Performancesteigerung umstritten und meist kaum im wahrnehmbaren Bereich.

Ich würde dir empfehlen, Registry Cleaner nicht weiterhin zu verwenden und über

Start --> Systemsteuerung --> Software (bei Windows XP)
Start --> Systemsteuerung --> Programme und Funktionen (bei Vista / Win 7)

zu deinstallieren.

Matmeis · 30.04.2015, 09:29

Hi Cosinus,

vielen Dank für deinen Hinweis, ich werde CCleaner deinstallieren und nicht mehr an der Registry herumbasteln.
Trotzdem ist der Fehler ja nicht durch das Reinigen der Registry aufgetreten, es war nur mein Versuch, den Fehler zu behen, da ich das in einem Forum gelesen hatte.

Der Fehler, weswegen ich mich an Trojaner-Board gewendet habe, ist aber noch immer nicht behoben. Weißt du noch eine Lösung. Was mich irritiert, ist dass es diese Datei von DVDVideoSoft schafft nach System start wieder und wieder gestartet zu werden und die ganzen Scans sie nicht finden können. Kannst du mir nicht noch weiter helfen?
Ich würde ungern Windows komplett neu aufsetzen. Denkst du ich komme da noch drum herum?

Liebe Grüße
Matmeis

cosinus · 30.04.2015, 14:26

FRST-Fix

Virenscanner jetzt bitte komplett deaktivieren, damit sichergestellt ist, dass der Fix sauber durchläuft!

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

Task: {01297DD5-ACC9-45C6-B050-7969EA08F41E} - System32\Tasks\{53107B12-F938-4A02-9F23-8DB6A9939CB9} => pcalua.exe -a "C:\Users\Matthias Meister\Downloads\Setup.exe" -d "C:\Users\Matthias Meister\Downloads"
C:\Users\Matthias Meister\Downloads\Setup.exe
C:\Users\Matthias Meister\AppData\Roaming\DVDVideoSoft
C:\Users\Matthias
EmptyTemp:

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Matmeis · 30.04.2015, 18:35

Guten Abend lieber cosinus,

hier der Inhalt der Fixlog-Datei:

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 29-04-2015 01
Ran by Matthias Meister at 2015-04-30 19:28:57 Run:3
Running from C:\Users\Matthias Meister\Desktop
Loaded Profiles: Matthias Meister (Available profiles: Matthias Meister & Gast)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
Task: {01297DD5-ACC9-45C6-B050-7969EA08F41E} - System32\Tasks\{53107B12-F938-4A02-9F23-8DB6A9939CB9} => pcalua.exe -a "C:\Users\Matthias Meister\Downloads\Setup.exe" -d "C:\Users\Matthias Meister\Downloads"
C:\Users\Matthias Meister\Downloads\Setup.exe
C:\Users\Matthias Meister\AppData\Roaming\DVDVideoSoft
C:\Users\Matthias
EmptyTemp:
*****************

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{01297DD5-ACC9-45C6-B050-7969EA08F41E}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{01297DD5-ACC9-45C6-B050-7969EA08F41E}" => Key deleted successfully.
C:\Windows\System32\Tasks\{53107B12-F938-4A02-9F23-8DB6A9939CB9} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{53107B12-F938-4A02-9F23-8DB6A9939CB9}" => Key deleted successfully.
"C:\Users\Matthias Meister\Downloads\Setup.exe" => File/Directory not found.

"C:\Users\Matthias Meister\AppData\Roaming\DVDVideoSoft" directory move:

Could not move "C:\Users\Matthias Meister\AppData\Roaming\DVDVideoSoft" directory. => Scheduled to move on reboot.

C:\Users\Matthias => Moved successfully.
EmptyTemp: => Removed 410.9 MB temporary data.

=> Result of Scheduled Files to move (Boot Mode: Normal) (Date&Time: 2015-04-30 19:30:13)<=

C:\Users\Matthias Meister\AppData\Roaming\DVDVideoSoft => Is moved successfully.

==== End of Fixlog 19:30:13 ====

Ich finde es sehr klasse, dass du dich freiwillig so einsetzt und bereit bist mir zu helfen. Dankeschön!

Gruß,
Matmeis

cosinus · 30.04.2015, 18:37

Problem behoben?

Matmeis · 30.04.2015, 18:39

Ich habe gerade den Computer nochmals gestartet und ja, das Fenster ist nicht wieder aufgetaucht. Nochmals vielen Dank!

Gruß,
Matmeis

28.04.2015, 20:08	#20
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Win 8.1: Nach löschen von Virus mit Avira erscheint jedes Mal nach dem starten ein Fenster mit Auswahl, wie Datei geöffnet werden soll. Dann zeig mal frische FRST Logs. Haken setzen bei addition.txt dann auf Scan klicken __________________ Logfiles bitte immer in CODE-Tags posten

30.04.2015, 18:37	#29
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Win 8.1: Nach löschen von Virus mit Avira erscheint jedes Mal nach dem starten ein Fenster mit Auswahl, wie Datei geöffnet werden soll. Problem behoben? __________________ Logfiles bitte immer in CODE-Tags posten

Win 8.1: Nach löschen von Virus mit Avira erscheint jedes Mal nach dem starten ein Fenster mit Auswahl, wie Datei geöffnet werden soll.

Plagegeister aller Art und deren Bekämpfung: Win 8.1: Nach löschen von Virus mit Avira erscheint jedes Mal nach dem starten ein Fenster mit Auswahl, wie Datei geöffnet werden soll.