Windows 8: Datenträger 0 (C:) ständig auf 100% Leistung und Laptop sehr langsam.

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 05.05.2015
Suchlauf-Zeit: 12:13:32 AM
Logdatei: hjhj.txt
Administrator: Ja

Version: 2.01.4.1018
Malware Datenbank: v2015.05.04.06
Rootkit Datenbank: v2015.04.21.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 8
CPU: x64
Dateisystem: NTFS
Benutzer: dd

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 426046
Verstrichene Zeit: 26 Min, 47 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(Keine schädliche Elemente gefunden)

Module: 0
(Keine schädliche Elemente gefunden)

Registrierungsschlüssel: 1
PUP.Optional.SearchProtect.A, HKU\S-1-5-21-1182488276-301210562-3317401335-1004\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\SearchProtect, In Quarantäne, [d3d3bad5d6b4c17582d5065cba4be11f], 

Registrierungswerte: 0
(Keine schädliche Elemente gefunden)

Registrierungsdaten: 0
(Keine schädliche Elemente gefunden)

Ordner: 0
(Keine schädliche Elemente gefunden)

Dateien: 1
PUP.Optional.EZDownloader.A, C:\Users\dd\AppData\Local\Temp\9A60\temp\BIT3470.tmp, In Quarantäne, [5c4a8a05d9b1c37307d8170aa55b0df3], 

Physische Sektoren: 0
(Keine schädliche Elemente gefunden)


(end)
         

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 02:44 on 05/05/2015 (dd)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
         

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-05-2015
Ran by dd (administrator) on DOROTHEA on 05-05-2015 02:48:08
Running from C:\Users\dd\Desktop
Loaded Profiles: dd (Available profiles: Dorothea Röger & dd & Administrator)
Platform: Windows 8 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 10 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Qualcomm Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(Sony Corporation) C:\Program Files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\VESMgr.exe
(Atheros) C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe
(McAfee, Inc.) C:\Program Files\mcafee\msc\McAPExe.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\AMCore\mcshield.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\systemcore\mfefire.exe
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(IvoSoft) C:\Program Files\Classic Shell\ClassicStartMenu.exe
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\NetworkSetting\NetworkClient.exe
(Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
() C:\Program Files (x86)\Bluetooth Suite\ActivateDesktop.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(McAfee, Inc.) C:\Program Files\McAfeeEx\MOCP\core\OcpTray.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\Platform\McUICnt.exe
(Sony Corporation) C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
(Sony Corporation) C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe
(Intel Corporation) C:\Program Files\Sony\VAIO Care\ESRV\esrv_svc.exe
(Qualcomm Atheros) C:\Program Files (x86)\Bluetooth Suite\BtTray.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VUAgent.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\vim.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\vim.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCSystemTray.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCService.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCAgent.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1214608 2012-10-10] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2930488 2012-10-23] (Synaptics Incorporated)
HKLM\...\Run: [Classic Start Menu] => C:\Program Files\Classic Shell\ClassicStartMenu.exe [161984 2014-04-20] (IvoSoft)
HKLM-x32\...\Run: [mcui_exe] => C:\Program Files\McAfee.com\Agent\mcagent.exe [537992 2014-04-25] (McAfee, Inc.)
HKLM-x32\...\Run: [ISBMgr.exe] => C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe [68776 2012-08-18] (Sony Corporation)
HKLM-x32\...\Run: [PMBVolumeWatcher] => C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe [724576 2012-07-27] (Sony Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Intel AppUp(R) center] => C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [156000 2012-10-04] (Intel Corporation)
HKLM-x32\...\Run: [mcpltui_exe] => C:\Program Files\McAfee.com\Agent\mcagent.exe [537992 2014-04-25] (McAfee, Inc.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer\Run: [BtvStack] => C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [129664 2012-12-28] (Atheros Communications)
HKU\S-1-5-21-1182488276-301210562-3317401335-1004\...\Run: [Facebook Update] => C:\Users\dd\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2014-12-20] (Facebook Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Parental Controls.lnk [2013-05-09]
ShortcutTarget: McAfee Parental Controls.lnk -> C:\Program Files\McAfeeEx\MOCP\core\OcpTray.exe (McAfee, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk [2015-04-18]
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk [2015-04-10]
ShortcutTarget: Microsoft Office.lnk -> C:\Program Files (x86)\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation)
Startup: C:\Users\dd\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Audials One 12.lnk [2015-04-08]
ShortcutTarget: Audials One 12.lnk -> C:\ProgramData\{18cb70ed-fbb3-231a-18cb-b70edfbbc3b7}\Audials One 12.exe (No File)
ShellIconOverlayIdentifiers: [ShareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer64.dll [2014-04-20] (IvoSoft)
ShellIconOverlayIdentifiers-x32: [ShareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer32.dll [2014-04-20] (IvoSoft)
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = 
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page = 
HKU\S-1-5-21-1182488276-301210562-3317401335-1004\Software\Microsoft\Internet Explorer\Main,Start Page = about:Tabs
HKU\S-1-5-21-1182488276-301210562-3317401335-1004\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp
SearchScopes: HKLM -> DefaultScope value is missing.
SearchScopes: HKLM-x32 -> DefaultScope value is missing.
BHO: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer64.dll [2014-04-20] (IvoSoft)
BHO: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_64.dll [2014-04-20] (IvoSoft)
BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll [2014-04-09] (McAfee, Inc.)
BHO-x32: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer32.dll [2014-04-20] (IvoSoft)
BHO-x32: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_32.dll [2014-04-20] (IvoSoft)
Toolbar: HKLM - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll [2014-04-20] (IvoSoft)
Toolbar: HKLM-x32 - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll [2014-04-20] (IvoSoft)
Handler-x32: http - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL [1999-02-03] (Microsoft Corporation)
Handler-x32: http - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL [1999-02-03] (Microsoft Corporation)
Handler-x32: https - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL [1999-02-03] (Microsoft Corporation)
Handler-x32: https - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL [1999-02-03] (Microsoft Corporation)
Handler-x32: ipp - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL [1999-02-03] (Microsoft Corporation)
Handler-x32: msdaipp - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL [1999-02-03] (Microsoft Corporation)
Handler-x32: msdaipp - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL [1999-02-03] (Microsoft Corporation)
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\mcafee\msc\McSnIePl64.dll [2014-04-25] (McAfee, Inc.)
Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files (x86)\McAfee\msc\McSnIePl.dll [2014-04-25] (McAfee, Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\dd\AppData\Roaming\Mozilla\Firefox\Profiles\tg2jj20g.default
FF Homepage: www.google.de
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_169.dll [2015-04-18] ()
FF Plugin: @java.com/DTPlugin,version=10.9.2 -> C:\Windows\system32\npDeployJava1.dll [2013-05-09] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.9.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll [2013-05-09] (Oracle Corporation)
FF Plugin: @mcafee.com/MSC,version=10 -> c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL [2014-04-25] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.2.0 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-02-27] (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-04-18] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-06-06] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-06-06] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.9.2 -> C:\Windows\SysWOW64\npDeployJava1.dll [2013-05-09] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.9.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2013-05-09] (Oracle Corporation)
FF Plugin-x32: @mcafee.com/McAfeeMssPlugin -> C:\Program Files (x86)\Sony\MSS\3.8.130\npMcAfeeMss.dll No File
FF Plugin-x32: @mcafee.com/MSC,version=10 -> c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL [2014-04-25] ()
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-04-07] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-04-07] (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll [2012-10-12] ()
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1182488276-301210562-3317401335-1004: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\dd\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll [2014-07-24] (Skype Limited)
FF Extension: Adblock Plus - C:\Users\dd\AppData\Roaming\Mozilla\Firefox\Profiles\tg2jj20g.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-04-10]
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
FF Extension: McAfee Anti-Spam Thunderbird Extension - C:\Program Files\McAfee\MSK [2013-05-09]
FF HKU\S-1-5-21-1182488276-301210562-3317401335-1004\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: No Name - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]

Chrome: 
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR HomePage: Default -> hxxp://www.google.de/
CHR StartupUrls: Default -> "hxxp://www.google.de/"
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}
CHR Profile: C:\Users\dd\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Translate) - C:\Users\dd\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb [2015-05-02]
CHR Extension: (Google Slides) - C:\Users\dd\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-04-07]
CHR Extension: (Google Docs) - C:\Users\dd\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-04-07]
CHR Extension: (Google Drive) - C:\Users\dd\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-04-07]
CHR Extension: (YouTube) - C:\Users\dd\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-04-07]
CHR Extension: (Adblock Plus) - C:\Users\dd\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2015-04-07]
CHR Extension: (Google Search) - C:\Users\dd\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-04-07]
CHR Extension: (Grooveshark Germany unlocker) - C:\Users\dd\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejcnhmeicafddjdaeecddemnhnomiaai [2015-04-07]
CHR Extension: (Disable Youtube™ HTML5 Player) - C:\Users\dd\AppData\Local\Google\Chrome\User Data\Default\Extensions\enmofgaijnbjpblfljopnpdogpldapoc [2015-04-18]
CHR Extension: (Google Sheets) - C:\Users\dd\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-04-07]
CHR Extension: (Hola Better Internet) - C:\Users\dd\AppData\Local\Google\Chrome\User Data\Default\Extensions\gkojfkhlekighikafcpjkiklfbnlmeio [2015-04-25]
CHR Extension: (Bookmark Manager) - C:\Users\dd\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik [2015-04-17]
CHR Extension: (New Tab Redirect) - C:\Users\dd\AppData\Local\Google\Chrome\User Data\Default\Extensions\icpgjfneehieebagbmdbhnlpiopdcmna [2015-04-07]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\dd\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-04-17]
CHR Extension: (Google Wallet) - C:\Users\dd\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-04-07]
CHR Extension: (Gmail) - C:\Users\dd\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-04-07]
CHR HKLM-x32\...\Chrome\Extension: [bopakagnckmlgajfccecajhnimjiiedh] - hxxp://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [226944 2012-12-28] (Qualcomm Atheros Commnucations) [File not signed]
S2 ESRV_SVC; C:\Program Files\Sony\VAIO Care\ESRV\esrv_svc.exe [377768 2013-11-19] (Intel Corporation)
R2 HomeNetSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-03-17] (Malwarebytes Corporation)
R2 McAPExe; C:\Program Files\McAfee\MSC\McAPExe.exe [178528 2014-04-25] (McAfee, Inc.)
S3 McAWFwk; c:\Program Files\mcafee\msc\McAWFwk.exe [332080 2012-01-26] (McAfee, Inc.)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)
S3 McComponentHostServiceSony; C:\Program Files (x86)\Sony\MSS\3.8.130\McCHSvc.exe [235216 2013-10-16] (McAfee, Inc.)
R2 McMPFSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
R2 McNaiAnn; C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
S3 McODS; C:\Program Files\mcafee\VirusScan\mcods.exe [603424 2014-06-12] (McAfee, Inc.)
S2 McOobeSv; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [200728 2012-05-11] (McAfee, Inc.)
R2 McOobeSv2; C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
R2 mcpltsvc; C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
R2 McProxy; C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
R2 McSchedulerSvc; C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
R2 mfecore; C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe [1041192 2014-07-24] (McAfee, Inc.)
R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [219752 2014-06-20] (McAfee, Inc.)
S3 mfeicfcoreocp; C:\Program Files\McAfeeEx\MOCP\core\mfeicfcore.exe [2782392 2013-12-31] (McAfee, Inc.)
R2 mfevtp; C:\Windows\system32\mfevtps.exe [189912 2014-06-20] (McAfee, Inc.)
R2 MSK80Service; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
S3 NetworkSupport; C:\Program Files (x86)\Sony\VAIO Control Center\NetworkSetting\NetworkSupport.exe [639576 2013-05-10] (Sony Corporation)
R2 PMBDeviceInfoProvider; C:\Program Files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe [474208 2012-07-27] (Sony Corporation)
R3 USER_ESRV_SVC; C:\Program Files\Sony\VAIO Care\ESRV\esrv_svc.exe [377768 2013-11-19] (Intel Corporation)
S3 VCFw; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [964608 2012-09-28] (Sony Corporation) [File not signed]
R3 VUAgent; C:\Program Files\Sony\VAIO Update\vuagent.exe [1642544 2014-02-28] (Sony Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16024 2015-01-31] (Microsoft Corporation)
R2 ZAtheros Bt and Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [323584 2012-12-28] (Atheros) [File not signed]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [77464 2012-12-28] (Qualcomm Atheros)
R3 BTATH_VDP; C:\Windows\system32\drivers\btath_vdp.sys [428008 2012-12-28] (Qualcomm Atheros)
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)
R3 cfwids; C:\Windows\System32\drivers\cfwids.sys [72128 2014-06-20] (McAfee, Inc.)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)
S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [197704 2013-09-23] (McAfee, Inc.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-03-17] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2015-03-17] (Malwarebytes Corporation)
R3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [181704 2014-06-20] (McAfee, Inc.)
R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [313544 2014-06-20] (McAfee, Inc.)
S0 mfeelamk; C:\Windows\System32\drivers\mfeelamk.sys [70600 2014-06-20] (McAfee, Inc.)
R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [523792 2014-06-20] (McAfee, Inc.)
R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [786296 2014-06-20] (McAfee, Inc.)
R3 mfencbdc; C:\Windows\system32\DRIVERS\mfencbdc.sys [444720 2014-07-24] (McAfee, Inc.)
S3 mfencrk; C:\Windows\system32\DRIVERS\mfencrk.sys [96592 2014-07-24] (McAfee, Inc.)
R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [348552 2014-06-20] (McAfee, Inc.)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [44344 2012-10-23] (Synaptics Incorporated)
R3 SOWS; C:\Windows\System32\drivers\sows.sys [24280 2012-06-11] (Sony Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-05-05 02:48 - 2015-05-05 02:48 - 00024172 _____ () C:\Users\dd\Desktop\FRST.txt
2015-05-05 02:47 - 2015-05-05 02:48 - 00000000 ____D () C:\FRST
2015-05-05 02:46 - 2015-05-05 02:46 - 02101248 _____ (Farbar) C:\Users\dd\Desktop\FRST64.exe
2015-05-05 02:43 - 2015-05-05 02:44 - 00000466 _____ () C:\Users\dd\Desktop\defogger_disable.log
2015-05-05 02:43 - 2015-05-05 02:43 - 00000000 _____ () C:\Users\dd\defogger_reenable
2015-05-05 02:41 - 2015-05-05 02:41 - 00050477 _____ () C:\Users\dd\Desktop\Defogger.exe
2015-05-05 00:54 - 2015-05-05 00:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
2015-05-05 00:47 - 2015-05-05 00:47 - 00001456 _____ () C:\Users\dd\Desktop\hjhj.txt
2015-05-02 14:46 - 2015-05-02 14:46 - 00037000 _____ () C:\Users\dd\Desktop\stop-looking-at-my-ass-pervert_o_243487.webp
2015-04-30 06:00 - 2015-04-30 06:00 - 00002401 _____ () C:\Users\dd\Desktop\Market Leader Upper-Intermediate 3rd Edition.lnk
2015-04-30 06:00 - 2015-04-30 06:00 - 00000000 __SHD () C:\Windows\ftpcache
2015-04-30 06:00 - 2015-04-30 06:00 - 00000000 ___HD () C:\Program Files (x86)\InstallJammer Registry
2015-04-30 05:58 - 2015-04-30 05:58 - 00000000 ____D () C:\Users\dd\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pearson
2015-04-30 05:47 - 2015-04-30 05:47 - 00000000 ____D () C:\Program Files (x86)\Pearson
2015-04-27 20:30 - 2015-04-27 20:30 - 00000252 _____ () C:\Users\dd\Downloads\150424_kraftklub_kw18.mp3.pls
2015-04-24 20:20 - 2015-04-24 20:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
2015-04-24 20:20 - 2015-04-24 20:20 - 00000000 ____D () C:\Program Files\McAfee Security Scan
2015-04-24 17:09 - 2015-04-24 17:09 - 00264705 _____ () C:\Users\dd\Desktop\photo (2).htm
2015-04-24 17:08 - 2015-04-24 17:08 - 00299318 _____ () C:\Users\dd\Desktop\photo (1).htm
2015-04-24 17:07 - 2015-04-24 17:07 - 00290525 _____ () C:\Users\dd\Desktop\photo.htm
2015-04-23 20:19 - 2015-04-23 20:19 - 00000000 ____D () C:\Program Files\Sony Corporation
2015-04-23 20:15 - 2015-04-23 20:15 - 00003124 _____ () C:\Windows\System32\Tasks\USER_ESRV_SVC
2015-04-23 20:15 - 2015-04-23 20:15 - 00000000 ____D () C:\Users\dd\AppData\Roaming\iolo
2015-04-23 20:15 - 2015-04-23 20:11 - 00013792 _____ () C:\Windows\system32\Drivers\semav6thermal64ro.sys
2015-04-23 20:14 - 2015-04-23 20:14 - 00002044 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VAIO Care (Desktop).lnk
2015-04-23 20:14 - 2015-04-23 20:14 - 00000000 __RHD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VAIO Care
2015-04-23 19:54 - 2015-04-23 19:54 - 00000982 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VAIO Update.lnk
2015-04-21 20:05 - 2015-04-21 20:05 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-04-18 13:07 - 2015-04-18 13:07 - 00000000 ____D () C:\Users\dd\AppData\Local\Macromedia
2015-04-18 13:05 - 2015-05-05 01:03 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-04-18 13:05 - 2015-04-24 20:20 - 00000000 ____D () C:\ProgramData\McAfee Security Scan
2015-04-18 13:05 - 2015-04-18 13:05 - 00003772 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-04-16 18:51 - 2015-03-23 07:19 - 00726528 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-04-16 18:51 - 2015-03-23 07:17 - 00957440 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-04-16 18:51 - 2015-03-23 07:17 - 00769024 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-04-16 18:51 - 2015-03-23 07:17 - 00419328 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-04-16 18:51 - 2015-03-23 07:17 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-04-16 18:51 - 2015-03-23 07:17 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-04-16 18:51 - 2015-03-23 00:04 - 01111552 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-04-16 18:51 - 2015-03-14 10:07 - 01120256 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll
2015-04-16 18:51 - 2015-03-14 08:33 - 00891904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msctf.dll
2015-04-16 17:03 - 2015-02-24 09:58 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\http.sys
2015-04-16 17:02 - 2015-03-17 09:00 - 06971712 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-04-16 17:02 - 2015-03-17 08:52 - 01822696 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-04-16 17:02 - 2015-03-17 06:45 - 01409496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-04-16 17:02 - 2015-03-10 07:28 - 02237952 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-04-16 17:02 - 2015-03-10 07:28 - 01409024 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-04-16 17:02 - 2015-03-10 07:28 - 00600576 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-04-16 17:02 - 2015-03-10 07:27 - 19292672 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-04-16 17:02 - 2015-03-10 07:27 - 15409152 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-04-16 17:02 - 2015-03-10 07:27 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-04-16 17:02 - 2015-03-10 07:27 - 00949760 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2015-04-16 17:02 - 2015-03-10 07:27 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-04-16 17:02 - 2015-03-10 07:27 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-04-16 17:02 - 2015-03-10 05:49 - 14373376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-04-16 17:02 - 2015-03-10 05:49 - 02864640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-04-16 17:02 - 2015-03-10 05:49 - 01763328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-04-16 17:02 - 2015-03-10 05:49 - 01181696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-04-16 17:02 - 2015-03-10 05:49 - 00737280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2015-04-16 17:02 - 2015-03-10 05:49 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-04-16 17:02 - 2015-03-10 05:49 - 00523776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-04-16 17:02 - 2015-03-10 05:49 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-04-16 17:02 - 2015-03-10 05:48 - 13767680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-04-16 17:02 - 2015-03-04 09:29 - 00361280 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\clfs.sys
2015-04-16 17:02 - 2015-03-04 08:39 - 00074752 _____ (Microsoft Corporation) C:\Windows\system32\clfsw32.dll
2015-04-16 17:02 - 2015-03-04 06:52 - 00057856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\clfsw32.dll
2015-04-16 12:02 - 2015-04-16 12:04 - 00000000 ____D () C:\Users\dd\Desktop\Buchführung
2015-04-14 11:14 - 2015-04-14 11:14 - 00410945 _____ () C:\Users\dd\Downloads\Tut_UMV_SS10.zip
2015-04-13 08:29 - 2015-04-13 08:29 - 00046759 _____ () C:\Users\dd\Downloads\data.xml
2015-04-13 08:29 - 2015-04-13 08:29 - 00015492 _____ () C:\Users\dd\Downloads\form
2015-04-10 09:12 - 2015-04-10 09:12 - 00561677 _____ () C:\Users\dd\Desktop\bookmark.htm
2015-04-10 09:01 - 2015-04-10 09:01 - 00000403 _____ () C:\Windows\ODBC.INI
2015-04-10 09:01 - 2015-04-10 09:01 - 00000035 _____ () C:\Windows\vbaddin.ini
2015-04-10 09:01 - 2015-04-10 09:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Verwaltung
2015-04-10 09:00 - 2015-04-10 09:00 - 00002715 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Excel.lnk
2015-04-10 09:00 - 2015-04-10 09:00 - 00002703 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft PowerPoint.lnk
2015-04-10 09:00 - 2015-04-10 09:00 - 00002687 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft FrontPage.lnk
2015-04-10 09:00 - 2015-04-10 09:00 - 00002675 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Word.lnk
2015-04-10 09:00 - 2015-04-10 09:00 - 00002635 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Access.lnk
2015-04-10 09:00 - 2015-04-10 09:00 - 00002619 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Office-Dokument öffnen.lnk
2015-04-10 09:00 - 2015-04-10 09:00 - 00002615 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Neues Office-Dokument.lnk
2015-04-10 09:00 - 2015-04-10 09:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Tools
2015-04-10 08:59 - 2015-04-10 08:59 - 00000000 ____D () C:\Windows\Msagent
2015-04-10 08:59 - 2015-04-10 08:59 - 00000000 ____D () C:\Program Files (x86)\Microsoft FrontPage
2015-04-09 23:57 - 2015-04-24 23:34 - 00000000 ____D () C:\Users\dd\Desktop\Neuer Ordner (2)
2015-04-09 23:31 - 2015-04-09 23:31 - 00000000 ____D () C:\Users\dd\AppData\Roaming\Mozilla
2015-04-09 23:31 - 2015-04-09 23:31 - 00000000 ____D () C:\Users\dd\AppData\Local\Mozilla
2015-04-09 23:28 - 2015-04-23 19:42 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-04-09 23:28 - 2015-04-09 23:28 - 00001159 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-04-09 23:28 - 2015-04-09 23:28 - 00000000 ____D () C:\ProgramData\Mozilla
2015-04-09 21:03 - 2015-04-09 21:03 - 00000000 ____D () C:\Users\dd\Neuer Ordner
2015-04-09 21:02 - 2015-04-09 21:02 - 00000000 ____D () C:\Users\dd\Documents\Scripts
2015-04-09 21:02 - 2015-04-09 21:02 - 00000000 ____D () C:\Users\dd\Documents\images
2015-04-09 21:02 - 2015-04-09 21:02 - 00000000 ____D () C:\Users\dd\Documents\css
2015-04-09 21:02 - 2015-04-09 21:02 - 00000000 ____D () C:\Users\dd\Documents\_locales
2015-04-09 21:02 - 2015-03-16 20:30 - 00001293 _____ () C:\Users\dd\Documents\manifest.json
2015-04-09 21:01 - 2015-04-09 21:01 - 01376768 _____ () C:\Users\dd\Downloads\7z920-x64.msi
2015-04-09 21:01 - 2015-04-09 21:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
2015-04-09 21:00 - 2015-04-09 21:00 - 00180982 _____ () C:\Users\dd\Downloads\GroovesharkDownloader.zip
2015-04-09 20:38 - 2015-04-09 20:38 - 01203488 _____ () C:\Users\dd\Downloads\Firefox - CHIP-Installer.exe
2015-04-09 20:19 - 2015-04-09 20:20 - 16567520 _____ (Philipp Schmieder Medien ) C:\Users\dd\Downloads\clipgrab-3.4.9.exe
2015-04-09 20:06 - 2015-04-09 20:07 - 01203488 _____ () C:\Users\dd\Downloads\Classic Shell - CHIP-Installer.exe
2015-04-09 19:53 - 2015-04-09 19:53 - 00278488 _____ () C:\Windows\Minidump\040915-32500-01.dmp
2015-04-09 19:40 - 2015-04-09 19:40 - 00000000 ____H () C:\ProgramData\DP45977C.lfl
2015-04-09 19:05 - 2015-04-09 19:46 - 00000000 _____ () C:\Windows\Model.log
2015-04-09 18:46 - 2015-04-09 18:46 - 00000000 ____D () C:\Users\dd\AppData\Roaming\Spotify
2015-04-09 18:29 - 2015-04-09 20:11 - 00000000 ____D () C:\ProgramData\ClassicShell
2015-04-09 18:29 - 2015-04-09 20:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Classic Shell
2015-04-09 17:58 - 2015-04-09 20:51 - 00000000 ____D () C:\AudacityPortable
2015-04-09 16:04 - 2015-04-09 16:04 - 00000000 ____D () C:\Users\dd\Documents\Neuer Ordner
2015-04-09 15:53 - 2015-04-09 21:01 - 00000000 ____D () C:\Program Files\7-Zip
2015-04-09 14:58 - 2015-05-05 00:48 - 00000000 ____D () C:\Users\dd\AppData\Roaming\ClassicShell
2015-04-09 14:57 - 2015-04-09 20:08 - 00000000 ____D () C:\Program Files\Classic Shell
2015-04-09 12:53 - 2015-04-09 19:19 - 00000000 ____D () C:\Program Files (x86)\bestadblocker
2015-04-09 12:52 - 2015-04-09 19:19 - 00000000 ____D () C:\ProgramData\dpjmahebnogcclmemjfpppkoebfbnjnp
2015-04-09 12:52 - 2015-04-09 19:19 - 00000000 ____D () C:\Program Files (x86)\SaulePlus
2015-04-09 12:43 - 2015-04-09 19:19 - 00000000 ____D () C:\ProgramData\{4d1e6255-623a-349b-4d1e-e62556238955}
2015-04-09 12:40 - 2015-04-09 20:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ClipGrab
2015-04-09 12:40 - 2015-04-09 20:21 - 00000000 ____D () C:\Program Files (x86)\ClipGrab
2015-04-09 12:36 - 2015-04-09 12:36 - 00000000 ____D () C:\Program Files (x86)\Microsoft Visual Studio
2015-04-09 12:33 - 2015-04-09 12:33 - 00000000 ____D () C:\Users\dd\AppData\Roaming\Microsoft Web Folders
2015-04-08 15:54 - 2015-04-24 01:18 - 00000000 ____D () C:\Users\dd\AppData\Roaming\vlc
2015-04-08 15:53 - 2015-04-09 20:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2015-04-08 15:53 - 2015-04-08 15:53 - 00000000 ____D () C:\Program Files\VideoLAN
2015-04-08 14:25 - 2015-05-05 00:13 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-04-08 14:25 - 2015-04-09 20:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-04-08 14:25 - 2015-04-08 14:25 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-04-08 14:25 - 2015-04-08 14:25 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-04-08 14:25 - 2015-03-17 06:15 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-04-08 14:25 - 2015-03-17 06:15 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-04-08 14:25 - 2015-03-17 06:15 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-04-08 14:05 - 2015-04-09 20:52 - 00000000 ____D () C:\ProgramData\18061483429812477594
2015-04-08 14:05 - 2015-04-08 15:07 - 00000000 ____D () C:\Program Files (x86)\SalePelus
2015-04-08 14:04 - 2015-04-08 15:07 - 00000000 ____D () C:\ProgramData\{18cb70ed-fbb3-231a-18cb-b70edfbbc3b7}
2015-04-08 13:40 - 2015-04-08 13:40 - 00000000 ____D () C:\Users\dd\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\No23 Recorder
2015-04-08 13:40 - 2015-04-08 13:40 - 00000000 ____D () C:\Users\dd\AppData\Local\No23 Recorder
2015-04-08 02:34 - 2015-04-08 02:34 - 00000000 ____D () C:\Users\dd\AppData\Roaming\Apowersoft
2015-04-08 02:24 - 2015-04-08 02:24 - 00000000 ____D () C:\Users\dd\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AudioSuite
2015-04-08 02:24 - 2015-04-08 02:24 - 00000000 ____D () C:\AudioSuite
2015-04-08 02:13 - 2015-04-08 02:13 - 00000000 ____D () C:\Users\dd\Documents\Streaming Audio Recorder
2015-04-08 01:05 - 2015-04-09 20:17 - 00001489 _____ () C:\Users\dd\AppData\Local\RecConfig.xml
2015-04-08 00:11 - 2015-04-08 00:11 - 00000000 ____D () C:\Users\dd\.cache
2015-04-08 00:06 - 2015-04-08 00:06 - 00002989 _____ () C:\Users\dd\Desktop\MP3 - Verknüpfung.lnk
2015-04-07 23:43 - 2015-04-07 23:43 - 00000000 ____D () C:\Users\dd\Documents\Any Video Converter
2015-04-07 23:43 - 2015-04-07 23:43 - 00000000 ____D () C:\Users\dd\AppData\Roaming\Anvsoft
2015-04-07 23:42 - 2015-04-07 23:42 - 00000000 ____D () C:\Program Files (x86)\Anvsoft
2015-04-07 23:02 - 2015-04-09 20:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-04-07 23:02 - 2015-04-07 23:02 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2015-04-07 23:02 - 2015-04-07 23:02 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2015-04-07 22:44 - 2015-04-09 20:51 - 00000000 ____D () C:\Program Files\Adblock Plus for IE
2015-04-07 18:39 - 2015-04-09 20:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-04-07 18:34 - 2015-05-05 02:39 - 00000908 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-04-07 18:34 - 2015-05-05 00:49 - 00000904 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-04-07 18:34 - 2015-04-07 18:39 - 00000000 ____D () C:\Program Files (x86)\Google
2015-04-07 18:34 - 2015-04-07 18:34 - 00003880 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-04-07 18:34 - 2015-04-07 18:34 - 00003644 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-04-07 17:44 - 2015-04-09 20:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GrabIt
2015-04-07 17:44 - 2015-04-07 17:44 - 00000979 _____ () C:\Users\dd\Desktop\GrabIt.lnk
2015-04-07 17:44 - 2015-04-07 17:44 - 00000000 ____D () C:\Program Files (x86)\GrabIt
2015-04-07 17:33 - 2015-04-07 17:43 - 01387407 _____ () C:\Users\dd\Desktop\NEUQ1-2015 MN78.nzb
2015-04-07 16:19 - 2015-04-07 19:04 - 00000000 ____D () C:\ProgramData\boost_interprocess
2015-04-07 16:18 - 2015-04-09 20:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NAVIGON
2015-04-07 16:18 - 2015-04-07 16:18 - 00001333 _____ () C:\Users\Public\Desktop\NAVIGON Fresh.lnk
2015-04-07 16:17 - 2015-04-07 16:17 - 00000000 ____D () C:\Program Files (x86)\NAVIGON

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-05-05 02:48 - 2013-05-09 00:38 - 00000000 ____D () C:\ProgramData\MOCP
2015-05-05 02:43 - 2014-09-05 00:47 - 00000000 ____D () C:\Users\dd
2015-05-05 02:34 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\system32\sru
2015-05-05 02:32 - 2013-05-08 23:24 - 01811926 _____ () C:\Windows\WindowsUpdate.log
2015-05-05 01:30 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\rescache
2015-05-05 01:00 - 2014-09-05 13:18 - 00003598 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1182488276-301210562-3317401335-1004
2015-05-05 00:49 - 2012-08-03 04:22 - 00025214 _____ () C:\Windows\PFRO.log
2015-05-05 00:49 - 2012-07-26 09:22 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-05-05 00:04 - 2012-07-26 07:26 - 00524288 ___SH () C:\Windows\system32\config\BBI
2015-05-04 23:33 - 2013-09-16 22:59 - 00000000 ____D () C:\Update
2015-05-04 23:32 - 2012-07-26 07:26 - 00262144 ___SH () C:\Windows\system32\config\ELAM
2015-05-04 23:22 - 2014-12-20 00:17 - 00000934 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1182488276-301210562-3317401335-1004UA.job
2015-05-04 23:22 - 2014-12-20 00:17 - 00000912 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1182488276-301210562-3317401335-1004Core.job
2015-05-03 07:26 - 2015-03-22 21:38 - 00000000 ____D () C:\Users\dd\Desktop\Neuer Ordner
2015-05-01 13:14 - 2013-05-09 00:14 - 00753134 _____ () C:\Windows\system32\perfh007.dat
2015-05-01 13:14 - 2013-05-09 00:14 - 00155826 _____ () C:\Windows\system32\perfc007.dat
2015-05-01 13:14 - 2012-07-26 09:28 - 01745416 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-05-01 09:32 - 2014-09-08 09:49 - 00000000 ____D () C:\Users\dd\AppData\Local\CrashDumps
2015-04-24 00:00 - 2013-05-09 01:31 - 00000000 ____D () C:\ProgramData\iolo
2015-04-23 20:24 - 2013-05-09 00:26 - 00000000 ____D () C:\Documentation
2015-04-23 20:19 - 2013-05-08 23:58 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-04-23 20:14 - 2013-05-09 00:15 - 00000000 ____D () C:\Program Files (x86)\Sony
2015-04-23 19:54 - 2013-05-09 00:15 - 00000000 ____D () C:\Windows\System32\Tasks\Sony Corporation
2015-04-23 19:54 - 2013-05-09 00:15 - 00000000 ____D () C:\Program Files\Sony
2015-04-23 19:54 - 2013-05-09 00:12 - 00000000 ____D () C:\ProgramData\Sony Corporation
2015-04-19 14:26 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\AppCompat
2015-04-18 13:06 - 2014-09-08 08:04 - 00000000 ____D () C:\Users\dd\AppData\Local\Adobe
2015-04-17 22:05 - 2015-03-18 09:29 - 00319720 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-04-17 12:28 - 2014-12-11 17:08 - 00000000 ____D () C:\Windows\system32\appraiser
2015-04-17 12:28 - 2014-09-09 11:17 - 00000000 ___SD () C:\Windows\system32\CompatTel
2015-04-17 12:28 - 2014-09-05 23:05 - 00000000 ____D () C:\Windows\system32\MRT
2015-04-17 12:13 - 2012-07-26 09:59 - 00000000 ____D () C:\Windows\CbsTemp
2015-04-17 12:01 - 2014-09-05 23:05 - 128913832 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-04-14 00:07 - 2015-02-06 16:20 - 00791520 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-04-14 00:07 - 2015-02-06 16:20 - 00177632 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-04-10 09:01 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\Help
2015-04-10 09:00 - 2012-07-26 10:12 - 00000000 __RSD () C:\Windows\Media
2015-04-10 08:59 - 2012-07-26 09:52 - 00000000 ____D () C:\Windows\ShellNew
2015-04-10 08:57 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\System
2015-04-09 20:52 - 2014-09-05 00:47 - 00000000 ____D () C:\Users\Dorothea Röger
2015-04-09 20:52 - 2013-05-09 00:49 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2015-04-09 20:52 - 2013-05-09 00:42 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CyberLink Power2Go 8
2015-04-09 20:52 - 2013-05-09 00:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Parental Controls
2015-04-09 20:52 - 2013-05-09 00:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel AppUp(R) center
2015-04-09 20:52 - 2013-05-09 00:35 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD
2015-04-09 20:52 - 2013-05-09 00:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PlayMemories Home
2015-04-09 20:52 - 2013-05-09 00:04 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel
2015-04-09 20:52 - 2013-05-08 23:58 - 00000000 ____D () C:\Windows\SysWOW64\RTCOM
2015-04-09 20:52 - 2012-08-03 04:24 - 00000000 ____D () C:\Users\Administrator
2015-04-09 20:52 - 2012-07-26 10:12 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools
2015-04-09 20:52 - 2012-07-26 10:12 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2015-04-09 20:52 - 2012-07-26 10:12 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility
2015-04-09 20:52 - 2012-07-26 10:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance
2015-04-09 20:51 - 2013-05-08 23:58 - 00000000 ___HD () C:\Program Files (x86)\Temp
2015-04-09 20:51 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\registration
2015-04-09 20:50 - 2012-07-26 07:38 - 00000000 ____D () C:\Windows\system32\Sysprep
2015-04-09 19:53 - 2015-02-23 19:30 - 00000000 ____D () C:\Windows\Minidump
2015-04-09 19:53 - 2015-02-23 19:29 - 313708124 _____ () C:\Windows\MEMORY.DMP
2015-04-08 02:13 - 2014-09-05 00:49 - 00000000 ____D () C:\Users\dd\AppData\Local\VirtualStore
2015-04-07 18:39 - 2014-12-13 09:58 - 00000000 ____D () C:\Users\dd\AppData\Local\Google
2015-04-07 18:34 - 2014-12-13 09:58 - 00000000 ____D () C:\Users\dd\AppData\Local\Deployment
2015-04-07 16:21 - 2012-07-26 09:21 - 00356228 _____ () C:\Windows\setupact.log
2015-04-07 15:51 - 2013-05-09 00:34 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-04-07 10:06 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\system32\NDF

==================== Files in the root of some directories =======

2006-12-11 19:13 - 2006-12-11 19:13 - 0097336 _____ (Un4seen Developments) C:\Users\dd\AppData\Local\bass.dll
2006-12-11 19:13 - 2006-12-11 19:13 - 0013872 _____ (Un4seen Developments) C:\Users\dd\AppData\Local\basscd.dll
2007-08-13 17:46 - 2007-08-13 17:46 - 0102912 _____ (Albert L Faber) C:\Users\dd\AppData\Local\CDRip.dll
2007-08-13 17:46 - 2007-08-13 17:46 - 0155136 _____ () C:\Users\dd\AppData\Local\lame_enc.dll
2007-01-18 21:09 - 2007-01-18 21:09 - 0623616 _____ (Ivan Bischof ©2003 - 2005) C:\Users\dd\AppData\Local\No23 Recorder.exe
2005-08-23 22:34 - 2005-08-23 22:34 - 0029184 _____ () C:\Users\dd\AppData\Local\no23xwrapper.dll
2006-10-26 01:06 - 2006-10-26 01:06 - 0015872 _____ () C:\Users\dd\AppData\Local\ogg.dll
2015-04-08 01:05 - 2015-04-09 20:17 - 0001489 _____ () C:\Users\dd\AppData\Local\RecConfig.xml
2015-04-08 14:14 - 2015-04-08 14:14 - 0011772 _____ () C:\Users\dd\AppData\Local\Temp-log.txt
2006-10-26 01:06 - 2006-10-26 01:06 - 0143872 _____ () C:\Users\dd\AppData\Local\vorbis.dll
2006-10-26 01:06 - 2006-10-26 01:06 - 0064000 _____ () C:\Users\dd\AppData\Local\vorbisenc.dll
2006-10-26 01:06 - 2006-10-26 01:06 - 0019456 _____ () C:\Users\dd\AppData\Local\vorbisfile.dll
2015-04-09 19:40 - 2015-04-09 19:40 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

Some content of TEMP:
====================
C:\Users\dd\AppData\Local\Temp\tmpA2FB.tmp.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-04-28 11:27

==================== End Of Log ============================
         

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 02-05-2015
Ran by dd at 2015-05-05 02:49:07
Running from C:\Users\dd\Desktop
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-1182488276-301210562-3317401335-500 - Administrator - Disabled) => C:\Users\Administrator
dd (S-1-5-21-1182488276-301210562-3317401335-1004 - Administrator - Enabled) => C:\Users\dd
Dorothea Röger (S-1-5-21-1182488276-301210562-3317401335-1001 - Administrator - Enabled) => C:\Users\Dorothea Röger
Gast (S-1-5-21-1182488276-301210562-3317401335-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1182488276-301210562-3317401335-1003 - Limited - Enabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: McAfee Anti-Virus und Anti-Spyware (Disabled - Up to date) {ADA629C7-7F48-5689-624A-3B76997E0892}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: McAfee Firewall (Disabled) {959DA8E2-3527-57D1-4915-924367AD4FE9}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adblock Plus für IE (32-Bit- und 64-Bit) (HKLM\...\{C27EF409-FB69-451F-B996-DC853C25FCA2}) (Version: 1.4 - Eyeo GmbH)
Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10)  MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Agatha Christie - Death on the Nile (x32 Version: 2.2.0.98 - WildTangent) Hidden
Aloha TriPeaks (x32 Version: 2.2.0.98 - WildTangent) Hidden
Any Audio Converter 5.7.9 (HKLM-x32\...\Any Audio Converter) (Version: 5.7.9 - Anvsoft)
Bejeweled 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Build-a-lot: On Vacation (x32 Version: 2.2.0.110 - WildTangent) Hidden
Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Classic Shell (HKLM\...\{840C85B7-D3D6-4143-9AF9-DAE80FD54CFC}) (Version: 4.1.0 - IvoSoft)
ClipGrab 3.4.9 (HKLM-x32\...\{8A1033B0-EF33-4FB5-97A1-C47A7DCDD7E6}_is1) (Version:  - Philipp Schmieder Medien)
Cradle Of Egypt Collector's Edition (x32 Version: 2.2.0.110 - WildTangent) Hidden
CyberLink Power2Go 8 (HKLM-x32\...\InstallShield_{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}) (Version: 8.0.0.2126 - CyberLink Corp.)
CyberLink PowerDVD (HKLM-x32\...\InstallShield_{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}) (Version: 9.0.5728.52 - CyberLink Corp.)
Facebook Video Calling 3.1.0.521 (HKLM-x32\...\{2091F234-EB58-4B80-8C96-8EB78C808CF7}) (Version: 3.1.521 - Skype Limited)
FATE (x32 Version: 2.2.0.97 - WildTangent) Hidden
FDUx86 (x32 Version: 1.0.0 - Sony Corporation) Hidden
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 42.0.2311.135 - Google Inc.)
Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
GrabIt 1.7.2 Beta 6 (build 1008) (HKLM-x32\...\GrabIt_is1) (Version:  - Ilan Shemes)
Heroes of Hellas 3: Athens (x32 Version: 3.0.2.32 - WildTangent) Hidden
Intel AppUp(R) center (HKLM-x32\...\Intel AppUp(R) center 41505) (Version: 3.8.0.41505.25 - Intel)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.2849 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.6.0.1030 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
Java 7 Update 9 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417009FF}) (Version: 7.0.90 - Oracle)
Java 7 Update 9 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217009FF}) (Version: 7.0.90 - Oracle)
KUx86 (x32 Version: 1.0.0 - Sony Corporation) Hidden
Luxor HD (x32 Version: 2.2.0.110 - WildTangent) Hidden
Mahjongg Artifacts (x32 Version: 2.2.0.110 - WildTangent) Hidden
Malwarebytes Anti-Malware Version 2.1.4.1018 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.4.1018 - Malwarebytes Corporation)
Market Leader Upper-Intermediate 3rd Edition (HKLM-x32\...\xxxxxxxxxxxxx-Pearson) (Version:  - Pearson Education)
McAfee Internet Security (HKLM-x32\...\MSC) (Version: 12.8.988 - McAfee, Inc.)
McAfee Parental Controls (HKLM-x32\...\MOCP) (Version: 3.2.226.1 - McAfee, Inc.)
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.150.1 - McAfee, Inc.)
Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4454.1510 - Microsoft Corporation)
Microsoft Office 2000 Premium (HKLM-x32\...\{00000407-78E1-11D2-B60F-006097C998E7}) (Version: 9.00.2816 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 37.0.2 (x86 de) (HKLM-x32\...\Mozilla Firefox 37.0.2 (x86 de)) (Version: 37.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 37.0.1 - Mozilla)
Mystery of Mortlake Mansion (x32 Version: 2.2.0.98 - WildTangent) Hidden
NAVIGON Fresh 3.5.1 (HKLM-x32\...\NAVIGON Fresh) (Version: 3.5.1 - NAVIGON)
Networkx64 (Version: 1.0.0 - Sony Corporation) Hidden
No23 Recorder (HKLM-x32\...\{22B0E143-2B0B-435B-9F56-136A3D16065F}) (Version: 2.1.0.3 - No23)
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.98 - WildTangent) Hidden
PlayMemories Home (HKLM-x32\...\{10DD6128-A810-4A90-9523-475D573FBB37}) (Version: 6.3.02.07270 - Sony Corporation)
Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden
Qualcomm Atheros Bluetooth Suite (64) (HKLM\...\{A84A4FB1-D703-48DB-89E0-68B6499D2801}) (Version: 8.0.0.218 - Qualcomm Atheros Communications)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6695 - Realtek Semiconductor Corp.)
Realtek PCIE Card Reader (HKLM-x32\...\{C1594429-8296-4652-BF54-9DBE4932A44C}) (Version: 6.1.8400.28121 - Realtek Semiconductor Corp.)
Restore (x32 Version: 1.0.0 - Sony Corporation) Hidden
Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)
SSLx64 (Version: 1.0.0 - Sony Corporation ) Hidden
SSLx86 (x32 Version: 1.0.0 - Sony Corporation ) Hidden
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 16.2.16.2 - Synaptics Incorporated)
Update Installer for WildTangent Games App (x32 Version:  - WildTangent) Hidden
Vacation Quest™ - Australia (x32 Version: 3.0.2.32 - WildTangent) Hidden
VAIO - Xperia Link (HKLM-x32\...\{D91558BF-D1F3-411F-AEFE-8774CB406512}) (Version: 1.3.2.07020 - Sony Corporation)
VAIO Care (HKLM\...\{EF649526-0134-46A8-8DF3-D7F9309E48DB}) (Version: 8.4.2.12046 - Sony Corporation)
VAIO Control Center (HKLM-x32\...\{8E797841-A110-41FD-B17A-3ABC0641187A}) (Version: 6.1.0.10300 - Sony Corporation)
VAIO Data Restore Tool (HKLM-x32\...\{57B955CE-B5D3-495D-AF1B-FAEE0540BFEF}) (Version: 1.10.0.07270 - Sony Corporation)
VAIO Easy Connect (x32 Version: 8.2.0.14170 - Sony Corporation) Hidden
VAIO Gate (HKLM-x32\...\{14AC95A2-7675-4988-A5BD-3F5B943AED08}) (Version: 3.0.0.08140 - Sony Corporation)
VAIO Gate Default (HKLM-x32\...\{B7546697-2A80-4256-A24B-1C33163F535B}) (Version: 3.1.0.10240 - Sony Corporation)
VAIO Gesture Control (HKLM-x32\...\{692955F2-DE9F-4078-8FAA-858D6F3A1776}) (Version: 2.1.0.10220 - Sony Corporation)
VAIO Gesture Control (x32 Version: 2.1.0.10220 - Sony Corporation) Hidden
VAIO Image Optimizer (HKLM-x32\...\InstallShield_{5597C927-029A-46A7-A0C0-8DABD9891A50}) (Version: 3.0.00.08170 - Sony Corporation)
VAIO Image Optimizer (x32 Version: 3.0.00.08170 - Sony Corporation) Hidden
VAIO Improvement (HKLM-x32\...\{3A26D9BD-0F73-432D-B522-2BA18138F7EF}) (Version: 2.1.0.10220 - Sony Corporation)
VAIO Media Server Settings (HKLM\...\{62A172B2-550E-499D-9A82-5190D18390AA}) (Version: 1.0.1.10170 - Sony Corporation)
VAIO Movie Creator (HKLM-x32\...\InstallShield_{C2CC5822-32E6-4D21-88EA-DE8CED09EE2F}) (Version: 4.0.00.10170 - Sony Corporation)
VAIO Movie Creator (x32 Version: 4.0.00.10170 - Sony Corporation) Hidden
VAIO Movie Creator Template Data (x32 Version: 4.0.00.08170 - Sony Corporation) Hidden
VAIO Update (HKLM-x32\...\{9FF95DA2-7DA1-4228-93B7-DED7EC02B6B2}) (Version: 7.0.1.02280 - Sony Corporation)
VAIO*CPU-Lüfterdiagnose (HKLM-x32\...\{BCE6E3D7-B565-4E1B-AC77-F780666A35FB}) (Version: 1.1.0.09200 - Sony Corporation)
VAIO-Handbuch (HKLM-x32\...\{C6E893E7-E5EA-4CD5-917C-5443E753FCBD}) (Version: 3.0.0.08100 - Sony Corporation)
VAIO-Hardwarediagnose-Plugin für VAIO Care (HKLM-x32\...\{EC153498-00E1-4C9C-89BE-81527C6750BE}) (Version: 4.7.0.11070 - Sony Corporation)
VAIO-Support für Übertragungen (HKLM-x32\...\{5DDAFB4B-C52E-468A-9E23-3B0CEEB671BF}) (Version: 1.9.0.11060 - Sony Corporation)
VCCx64 (Version: 1.0.0 - Sony Corporation) Hidden
VCCx86 (x32 Version: 1.0.0 - Sony Corporation) Hidden
VGClientX64 (Version: 1.0.0 - Sony Corporation) Hidden
VHD (x32 Version: 1.0.0 - Sony Corporation) Hidden
Virtual Villagers 5 - New Believers (x32 Version: 3.0.2.32 - WildTangent) Hidden
VIx64 (Version: 1.0.0 - Sony Corporation) Hidden
VIx86 (x32 Version: 1.0.0 - Sony Corporation) Hidden
VLC media player (HKLM\...\VLC media player) (Version: 2.2.0 - VideoLAN)
VMLx86 (x32 Version: 1.0.0 - Sony Corporation) Hidden
VPMx64 (Version: 1.0.0 - Sony Corporation ) Hidden
VSSTx64 (Version: 1.0.0 - Sony Corporation ) Hidden
VSSTx86 (x32 Version: 1.0.0 - Sony Corporation) Hidden
VU5x64 (Version: 1.1.0 - Sony Corporation ) Hidden
VU5x86 (x32 Version: 1.1.0 - Sony Corporation ) Hidden
VWSTx86 (x32 Version: 1.0.0 - Sony Corporation) Hidden
WildTangent Games App (x32 Version: 4.0.9.7 - WildTangent) Hidden
WildTangent-Spiele (HKLM-x32\...\WildTangent wildgames Master Uninstall) (Version: 1.0.4.0 - WildTangent)
XperiaLinkx86 (x32 Version: 1.0.0 - Sony Corporation) Hidden
Youda Jewel Shop (x32 Version: 3.0.2.32 - WildTangent) Hidden

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

16-04-2015 17:06:34 Windows Update
23-04-2015 19:52:47 Entfernt VAIO Update
30-04-2015 20:06:20 Geplanter Prüfpunkt

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2012-07-26 07:26 - 2012-07-26 07:26 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0BB788AC-D3A5-4E76-B412-7E0819DEE94B} - System32\Tasks\Sony Corporation\VAIO Control Center\NetworkSetting\NetworkSetting Logon Start => C:\Program Files (x86)\Sony\VAIO Control Center\NetworkSetting\NetworkClient
Task: {138F2CBB-E030-47B9-B2A0-0C891FC46792} - System32\Tasks\Sony Corporation\VAIO Care\UpdateSolution => C:\Program Files\Sony\VAIO Care\Solution.Updater.exe [2014-12-03] (Sony Corporation)
Task: {1E985E5E-BA1B-4038-99B5-C5090F270456} - System32\Tasks\Sony Corporation\VAIO Gate\VAIO Gate => C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe [2012-08-14] (Sony Corporation)
Task: {321DD8C0-6BB4-48D4-8071-E99E1EBF8B33} - System32\Tasks\Sony Corporation\VAIO Care\VCOneClick => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2014-12-03] (Sony Corporation)
Task: {4B6223EB-1433-4CB8-892B-AB2F1E1BB6BF} - System32\Tasks\Sony Corporation\VAIO Update\VAIO Update => C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe [2014-02-28] (Sony Corporation)
Task: {603AB8FB-6E1F-40E4-9F53-965CB2D58F81} - System32\Tasks\Sony Corporation\VAIO Care\ActiveStatusCollect => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2014-12-03] (Sony Corporation)
Task: {649184AE-51A2-4DAE-93B4-73378001A66F} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2015-04-17] (Microsoft Corporation)
Task: {6FB47000-90F3-417F-9F20-80D9B0C1BF9F} - System32\Tasks\Sony Corporation\VAIO Update\VAIO Update Self Repair => C:\Program Files\Sony\VAIO Update\VUSR.exe [2014-03-01] (Sony Corporation)
Task: {733EE997-C7AF-4F8A-A1D0-7F982D019CB8} - System32\Tasks\Sony Corporation\VAIO Gesture Control\VCGULogonTask => C:\Program Files (x86)\Sony\VAIO Camera Gesture Utility\VCGU.exe [2012-10-23] (Sony Corporation)
Task: {8725BC36-F4B1-41D2-8932-E4C8DAC33414} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-04-18] (Adobe Systems Incorporated)
Task: {8CE449DE-5EDA-462E-A028-DC9E20DA0CFE} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-1182488276-301210562-3317401335-1004Core => C:\Users\dd\AppData\Local\Facebook\Update\FacebookUpdate.exe [2014-12-20] (Facebook Inc.)
Task: {8F0DDD33-02DC-4F82-B464-04CE72B3970B} - System32\Tasks\Sony Corporation\VHDInformationCheck => C:\Program Files (x86)\Sony\VAIO Recovery\plugins\InformationCheck.exe [2012-11-08] (Sony Corporation)
Task: {8F125CCA-6E56-4EBC-8D00-B3988A729492} - System32\Tasks\USER_ESRV_SVC => Wscript.exe //B //NoLogo "C:\Program Files\Sony\VAIO Care\ESRV\task.vbs"
Task: {91818DDC-7F9E-4C23-B1A8-8FB8AA77251A} - System32\Tasks\Sony Corporation\VAIO Care\CheckSystemInfo => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2014-12-03] (Sony Corporation)
Task: {98D6D5C2-B393-4220-948E-BCE9E6BCC838} - System32\Tasks\Sony Corporation\VAIO Care\UploadPOT => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2014-12-03] (Sony Corporation)
Task: {A13DA76B-B827-4E92-B9F6-39ACA7461B05} - System32\Tasks\Sony Corporation\VAIO Care\VAIO Care => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2014-12-03] (Sony Corporation)
Task: {A54437AD-F854-4A53-B265-BA23F4DF21DF} - System32\Tasks\Sony Corporation\VAIO Care\VCMetrics => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2014-12-03] (Sony Corporation)
Task: {AC8E4074-0F71-4988-9D99-EA229CA1DD7E} - System32\Tasks\Sony Corporation\VAIO Care\VCRLog => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2014-12-03] (Sony Corporation)
Task: {B0F4697F-C8D8-4EDB-8B9E-D76319B3F6A2} - System32\Tasks\Sony Corporation\VAIO Control Center\Level4Month => C:\Program Files (x86)\Sony\VAIO Control Center\WBCBatteryCare.exe [2012-09-06] (Sony Corporation)
Task: {B40E403B-E9F9-42D6-9075-7C4D7AAB0C1D} - System32\Tasks\Sony Corporation\VAIO Control Center\VAIOControlCenterSystem => C:\Program Files (x86)\Sony\VAIO Control Center\vim.exe [2013-03-08] (Sony Corporation)
Task: {B7128737-0CA8-4385-AA28-3036080BF0D6} - System32\Tasks\Sony Corporation\VAIO Improvement\VAIOImprovementUploader => C:\Program Files\Sony\VAIO Improvement\viuploader.exe [2012-10-22] (Sony Corporation)
Task: {C2CE4BC8-09AF-4EA3-ABC8-2636381C371E} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-04-07] (Google Inc.)
Task: {C595EB22-C169-4C93-817A-0D73F458D221} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-1182488276-301210562-3317401335-1004UA => C:\Users\dd\AppData\Local\Facebook\Update\FacebookUpdate.exe [2014-12-20] (Facebook Inc.)
Task: {E21C7FCF-89BF-4753-85A2-C886DE339679} - System32\Tasks\Sony Corporation\VAIO Control Center\VAIOControlCenterUser => C:\Program Files (x86)\Sony\VAIO Control Center\vim.exe [2013-03-08] (Sony Corporation)
Task: {E77DBC89-4C04-4DD2-BB2B-06037C4820C1} - System32\Tasks\Sony Corporation\VAIO Care\VCCheckIolo => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2014-12-03] (Sony Corporation)
Task: {ED3E00F1-4CD3-470F-BCC9-355973738A94} - System32\Tasks\Sony Corporation\VAIO Care\GetPOTInfo => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2014-12-03] (Sony Corporation)
Task: {EDCD271D-85D1-4DD5-8921-88872717C978} - System32\Tasks\Sony Corporation\Xperia Link\Xperia Link Logon Start => C:\Program Files (x86)\Sony\Xperia Link\Xperia Link.exe [2014-07-03] (Sony Corporation)
Task: {F85EFC36-4BEE-4C85-AB2D-1BEA0C5DF7B4} - System32\Tasks\Sony Corporation\VAIO Care\DeployCRMflag => C:\Program Files\Sony\VAIO Care\DeployCRMflag.exe [2014-01-16] (Sony Corporation)
Task: {F9EFF2BD-FB34-4D4E-BB11-5CDF4150AAB2} - System32\Tasks\Sony Corporation\VAIO Control Center\Level4Daily => C:\Program Files (x86)\Sony\VAIO Control Center\WBCBatteryCare.exe [2012-09-06] (Sony Corporation)
Task: {FBD7A980-182E-4A3D-9DFE-6588D31C7127} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-04-07] (Google Inc.)
Task: {FBD971D9-B957-4D11-884F-3E52F916528F} - System32\Tasks\CLVDLauncher => C:\Program Files (x86)\CyberLink\Power2Go8\CLVDLauncher.exe [2012-07-24] (CyberLink Corp.)
Task: {FF4CEAFF-5F7F-4041-9DDB-2718066BCD42} - System32\Tasks\Sony Corporation\VAIO Care\VCSelfHeal => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2014-12-03] (Sony Corporation)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1182488276-301210562-3317401335-1004Core.job => C:\Users\dd\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1182488276-301210562-3317401335-1004UA.job => C:\Users\dd\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) ==============

2012-12-28 12:07 - 2012-12-28 12:07 - 00011264 _____ () C:\Program Files (x86)\Bluetooth Suite\Modules\ActivateDesktopDebugger\ActivateDesktopDebugger.dll
2012-12-28 12:04 - 2012-12-28 12:04 - 00084480 _____ () C:\Program Files (x86)\Bluetooth Suite\Modules\Map\MAP.dll
2012-12-28 12:09 - 2012-12-28 12:09 - 00012928 _____ () C:\Program Files (x86)\Bluetooth Suite\ActivateDesktop.exe
2012-11-13 02:55 - 2012-11-12 10:46 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2012-12-28 12:10 - 2012-12-28 12:10 - 00384128 _____ () C:\Program Files (x86)\Bluetooth Suite\ContactsApi.dll
2012-12-28 12:04 - 2012-12-28 12:04 - 00020992 _____ () C:\Program Files (x86)\Bluetooth Suite\L10n\de-DE\BtTray.de-DE.dll
2013-05-09 00:05 - 2012-06-25 10:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2015-04-29 00:43 - 2015-04-28 04:07 - 01252680 _____ () C:\Program Files (x86)\Google\Chrome\Application\42.0.2311.135\libglesv2.dll
2015-04-29 00:43 - 2015-04-28 04:07 - 00080712 _____ () C:\Program Files (x86)\Google\Chrome\Application\42.0.2311.135\libegl.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefire => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfevtp => ""="Driver"

==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, the associated entry will be removed from the registry.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1182488276-301210562-3317401335-1004\Control Panel\Desktop\\Wallpaper -> C:\Users\dd\Desktop\Unbenannt.png
DNS Servers: 192.168.178.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== FirewallRules (whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{A99E06ED-6765-4F4D-8992-F6139D60F771}] => (Allow) C:\Program Files\Common Files\mcafee\mcsvchost\McSvHost.exe
FirewallRules: [{4FF8D650-7C90-4C07-8908-C3DEE8432E12}] => (Allow) C:\Program Files\Common Files\mcafee\mcsvchost\McSvHost.exe
FirewallRules: [{B75614BF-E1FA-40CE-AF2C-5886AE365F57}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDVD9\PowerDVD9.EXE
FirewallRules: [{1C30363B-E890-4857-9A45-DB8EC283957D}] => (Allow) C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe
FirewallRules: [{217E1B42-FBED-4D5B-8D11-0B6449CE0408}] => (Allow) C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe
FirewallRules: [{287B3175-3665-4350-B33E-7583A1FF6511}] => (Allow) C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe
FirewallRules: [{558F3A75-EA16-4DD8-99F1-3D4225C8D6F4}] => (Allow) C:\Program Files (x86)\Apowersoft\Streaming Audio Recorder\Streaming Audio Recorder.exe
FirewallRules: [{5ED7891F-9069-4BCB-855E-085312C44DFD}] => (Allow) C:\Program Files (x86)\Apowersoft\Streaming Audio Recorder\Streaming Audio Recorder.exe
FirewallRules: [{7CE0F2D1-B252-49FE-A7AC-CF987B693278}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{C75AC206-50FA-4B70-A5E7-264E0913BD56}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{FB004A5A-DF2C-42FC-AF1D-DDFA127B4DF6}] => (Allow) C:\Program Files\Sony\VAIO Care\VCAgent.exe
FirewallRules: [{67D89AF0-3DBB-436C-80C8-E296EF161089}] => (Allow) C:\Program Files\Sony\VAIO Care\VCAdmin.exe
FirewallRules: [{40152455-5C43-4941-B1B6-1BAB22C0056E}] => (Allow) C:\Program Files\Sony\VAIO Care\VCSystemTray.exe
FirewallRules: [{71ED2A8B-716A-40AB-817B-C01860646DAE}] => (Allow) C:\Program Files\Sony\VAIO Care\VAIOShell.exe
FirewallRules: [{46F02DE5-D069-4D78-8A75-145F0F4EA744}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (05/05/2015 02:44:28 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Dorothea)
Description: Bei der Aktivierung der App „microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail“ ist folgender Fehler aufgetreten: -2147009284. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (05/05/2015 02:32:35 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Dorothea)
Description: Bei der Aktivierung der App „microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail“ ist folgender Fehler aufgetreten: -2147009284. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (05/05/2015 02:32:29 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Dorothea)
Description: Bei der Aktivierung der App „microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail“ ist folgender Fehler aufgetreten: -2147009284. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (05/05/2015 02:32:29 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Dorothea)
Description: Bei der Aktivierung der App „microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail“ ist folgender Fehler aufgetreten: -2147009284. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (05/05/2015 02:32:29 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Dorothea)
Description: Bei der Aktivierung der App „BD9B8345.VAIOMessageCenter_05bme2bjq6sag!SonyCorporation.VAIOMessageCenter“ ist folgender Fehler aufgetreten: -2147009284. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (05/05/2015 02:32:29 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Dorothea)
Description: Bei der Aktivierung der App „microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail“ ist folgender Fehler aufgetreten: -2147009284. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (05/05/2015 01:34:20 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Dorothea)
Description: Bei der Aktivierung der App „BD9B8345.VAIOMessageCenter_05bme2bjq6sag!SonyCorporation.VAIOMessageCenter“ ist folgender Fehler aufgetreten: -2147009284. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (05/05/2015 01:19:20 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Dorothea)
Description: Bei der Aktivierung der App „microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail“ ist folgender Fehler aufgetreten: -2147009284. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (05/05/2015 01:19:20 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Dorothea)
Description: Bei der Aktivierung der App „BD9B8345.VAIOMessageCenter_05bme2bjq6sag!SonyCorporation.VAIOMessageCenter“ ist folgender Fehler aufgetreten: -2147009284. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (05/05/2015 01:10:57 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Dorothea)
Description: Bei der Aktivierung der App „microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail“ ist folgender Fehler aufgetreten: -2147009284. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.


System errors:
=============
Error: (05/05/2015 00:51:54 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Energy Server Service" wurde mit folgendem Fehler beendet: 
%%268439612

Error: (05/05/2015 00:08:32 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Energy Server Service" wurde mit folgendem Fehler beendet: 
%%268439612

Error: (05/04/2015 11:34:27 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Energy Server Service" wurde mit folgendem Fehler beendet: 
%%268439612

Error: (04/30/2015 07:50:00 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst WSearch erreicht.

Error: (04/26/2015 01:50:24 AM) (Source: DCOM) (EventID: 10010) (User: NT-AUTORITÄT)
Description: {9F070738-F6EA-408A-A6BD-AED405E67A13}

Error: (04/24/2015 04:56:21 PM) (Source: Schannel) (EventID: 4119) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung vom Remoteendpunkt empfangen. Die schwerwiegende Warnung hat folgenden für das TLS-Protokoll definierten Code: 40.

Error: (04/24/2015 01:29:18 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst McNaiAnn erreicht.

Error: (04/23/2015 08:15:14 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Energy Server Service" wurde mit folgendem Fehler beendet: 
%%268439612

Error: (04/23/2015 08:11:51 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "VCService" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (04/23/2015 08:11:51 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "VAIO Care Performance Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.


Microsoft Office Sessions:
=========================
Error: (05/05/2015 02:44:28 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Dorothea)
Description: microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail-2147009284

Error: (05/05/2015 02:32:35 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Dorothea)
Description: microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail-2147009284

Error: (05/05/2015 02:32:29 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Dorothea)
Description: microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail-2147009284

Error: (05/05/2015 02:32:29 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Dorothea)
Description: microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail-2147009284

Error: (05/05/2015 02:32:29 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Dorothea)
Description: BD9B8345.VAIOMessageCenter_05bme2bjq6sag!SonyCorporation.VAIOMessageCenter-2147009284

Error: (05/05/2015 02:32:29 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Dorothea)
Description: microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail-2147009284

Error: (05/05/2015 01:34:20 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Dorothea)
Description: BD9B8345.VAIOMessageCenter_05bme2bjq6sag!SonyCorporation.VAIOMessageCenter-2147009284

Error: (05/05/2015 01:19:20 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Dorothea)
Description: microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail-2147009284

Error: (05/05/2015 01:19:20 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Dorothea)
Description: BD9B8345.VAIOMessageCenter_05bme2bjq6sag!SonyCorporation.VAIOMessageCenter-2147009284

Error: (05/05/2015 01:10:57 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Dorothea)
Description: microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail-2147009284


==================== Memory info =========================== 

Processor: Intel(R) Pentium(R) CPU 2020M @ 2.40GHz
Percentage of memory in use: 43%
Total physical RAM: 3975.27 MB
Available physical RAM: 2248.92 MB
Total Pagefile: 8071.27 MB
Available Pagefile: 5773.46 MB
Total Virtual: 8192 MB
Available Virtual: 8191.78 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:437.41 GB) (Free:346.06 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: FB5BDC2F)

Partition: GPT Partition Type.

==================== End Of Log ============================
         

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-05-05 03:05:21
Windows 6.2.9200  x64 \Device\Harddisk0\DR0 -> \Device\00000037 HGST_HTS545050A7E380 rev.GG2OAC90 465,76GB
Running: Gmer-19357.exe; Driver: C:\Users\dd\AppData\Local\Temp\fwdcapog.sys


---- User code sections - GMER 2.1 ----

.text   C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe[1948] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306  000007ff0071177a 4 bytes [71, 00, FF, 07]
.text   C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe[1948] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314  000007ff00711782 4 bytes [71, 00, FF, 07]
.text   C:\Windows\Explorer.EXE[1820] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                             000007fefb251532 4 bytes [25, FB, FE, 07]
.text   C:\Windows\Explorer.EXE[1820] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                             000007fefb25153a 4 bytes [25, FB, FE, 07]
.text   C:\Windows\Explorer.EXE[1820] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                           000007fefb25165a 4 bytes [25, FB, FE, 07]
.text   C:\Windows\Explorer.EXE[1820] C:\Windows\system32\psapi.dll!GetProcessImageFileNameA + 306                                   000007ff0071177a 4 bytes [71, 00, FF, 07]
.text   C:\Windows\Explorer.EXE[1820] C:\Windows\system32\psapi.dll!GetProcessImageFileNameA + 314                                   000007ff00711782 4 bytes [71, 00, FF, 07]
.text   C:\Program Files\Sony\VAIO Care\VCAgent.exe[1992] C:\Windows\system32\psapi.dll!GetProcessImageFileNameA + 306               000007ff0071177a 4 bytes [71, 00, FF, 07]
.text   C:\Program Files\Sony\VAIO Care\VCAgent.exe[1992] C:\Windows\system32\psapi.dll!GetProcessImageFileNameA + 314               000007ff00711782 4 bytes [71, 00, FF, 07]

---- Threads - GMER 2.1 ----

Thread  C:\Windows\system32\csrss.exe [716:740]                                                                                      fffff9600096f5e8

---- Disk sectors - GMER 2.1 ----

Disk    \Device\Harddisk0\DR0                                                                                                        unknown MBR code

---- EOF - GMER 2.1 ----