Windows 7 - Werbeclips im Hintergrund und der Verlauf enthält unbekannte Webseiten

Morphy · 06.05.2015, 16:18

Hallo Trojaner Board Team,

ich bin neu hier im Forum und habe mein Problem in einem anderen Thema gefunden.
http://www.trojaner-board.de/163581-...webseiten.html

Problem: iexplorer startet sich im Hintergrund und spielt Werbungen ab.
Verlauf ist total vollgestopft mit Werbelinks!

iexplorer wird normalerweise nicht benutzt. Da ich den Verlauf des anderen Themas nicht blind folgen möchte habe ich ein Neues erstellt.

Ich möchte auch darauf hinweisen, dass dies ein HomeOffice Rechner ist und ich keinen Support dafür habe.
Habe darum die "Namen" mit *NAME* bzw. "Namen~1" mit *NAM* und den "Rechnernamen" mit RECHNER ausgetauscht!

Mir ist der Ordner "C:\Users\*NAME*\AppData\Roaming\ernden" mit zwei Fragwürdigen DLL-Dateien aufgefallen! (berdis.dll und rewardca.dll)

Logfiles habe ich angehängt da die Zeichenanzahl überschritten wurde!

Ich hoffe Ihr könnt mir weiterhelfen
lg Morphy

deeprybka · 06.05.2015, 16:44

Mein Name ist Jürgen und ich werde Dir bei Deinem Problem behilflich sein. Zusammen schaffen wir das...

Bitte arbeite alle Schritte der Reihe nach ab.
Lese die Anleitungen sorgfältig durch bevor Du beginnst. Wenn es Probleme gibt oder Du etwas nicht verstehst, dann stoppe mit Deiner Ausführung und beschreibe mir das Problem.
Führe bitte nur Scans durch, zu denen Du von mir aufgefordert wurdest.
Bitte kein Crossposting (posten in mehreren Foren).
Installiere oder deinstalliere während der Bereinigung keine Software, außer Du wurdest dazu aufgefordert.
Speichere alle unsere Tools auf dem Desktop ab. Link: So ladet Ihr unsere Tools richtig
Poste die Logfiles direkt in Deinen Thread in Code-Tags.
Bedenke, dass wir hier alle während unserer Freizeit tätig sind, wenn du innerhalb von 24 Stunden nichts von mir liest, dann schreibe mir bitte eine PM.

Hinweis:
Ich kann Dir niemals eine Garantie geben, dass wir alle schädlichen Dateien finden werden.
Eine Formatierung ist meist der schnellere und immer der sicherste Weg, aber auch nur bei wirklicher Malware empfehlenswert.
Adware & Co. können wir sehr gut entfernen.
Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis Du mein clean bekommst.

Los geht's:

Bitte Logs aufteilen und posten.

Lesestoff
Posten in CODE-Tags: So gehts...
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert uns massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu groß für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

Morphy · 07.05.2015, 09:26

Hallo Jürgen,

hier nochmal die Logfiles

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 06-05-2015
Ran by *NAME* (administrator) on RECHNER01 on 06-05-2015 13:40:23
Running from C:\Users\*NAME*\Desktop
Loaded Profiles: *NAME* (Available profiles: *NAME* & *NAME* & Administrator)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
() C:\Windows\System32\nvwmi64.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RTKAUDIOSERVICE64.EXE
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Autodesk Inc.) C:\Program Files (x86)\Common Files\Autodesk Shared\AppManager\R1\AdAppMgrSvc.exe
(Autodesk, Inc.) C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe
(CANON INC) C:\Program Files\Canon\imagePROGRAFStatusMonitor\cnwisam.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe
(CANON INC.) C:\Windows\System32\cnwiols6.exe
(3Dconnexion) C:\Program Files\3Dconnexion\3DxWare\3DxWinCore64\Mgl3DCtlrRPCService.exe
(Autodesk, Inc.) C:\2015\Inventor 2015\Moldflow\bin\mitsijm.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(AMD) C:\Windows\System32\atieclxx.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
() C:\Windows\System32\nvwmi64.exe
() C:\Program Files\Core Temp\Core Temp.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(3Dconnexion, INC) C:\Program Files\3Dconnexion\3DxWare\3DxWinCore64\3DxService.exe
(CANON INC.) C:\Program Files\Canon\imagePROGRAFStatusMonitor\cnwida.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\acrotray.exe
(Autodesk Inc.) C:\Users\*NAME*\AppData\Local\Autodesk\.AdskAppManager\R1\AdAppMgr.exe
(Logitech Inc.) C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe
(3Dconnexion) C:\Program Files\3Dconnexion\3DxWare\3DxWinCore64\3dxpiemenus.exe
() C:\Portable Apps\PortableApps\RocketDock\RocketDock.exe
(3Dconnexion) C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\3DxLCD10SPPRO.exe
(PortableApps.com) C:\Portable Apps\PortableApps\PortableApps.com\PortableAppsPlatform.exe
(PortableApps.com) C:\Portable Apps\PortableApps\FirefoxPortable\FirefoxPortable.exe
(Mozilla Corporation) C:\Portable Apps\PortableApps\FirefoxPortable\App\Firefox\firefox.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe
(PortableApps.com) C:\Portable Apps\PortableApps\AIMPPortable\AIMPPortable.exe
(AIMP DevTeam) C:\Portable Apps\PortableApps\AIMPPortable\App\AIMP\AIMP3.exe
(Microsoft Corporation) C:\Windows\System32\taskmgr.exe
(Dominik Reichl) C:\Portable Apps\PortableApps\KeePass portable\KeePass.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13519432 2013-04-10] (Realtek Semiconductor)
HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1331288 2014-08-22] (Microsoft Corporation)
HKLM\...\Run: [3DxWare Service] => C:\Program Files\3Dconnexion\3DxWare\3DxWinCore64\3DxService.exe [2157440 2014-06-23] (3Dconnexion, INC)
HKLM\...\Run: [CnwiDeviceAgent] => C:\Program Files\Canon\imagePROGRAFStatusMonitor\cnwida.exe [71440 2009-06-10] (CANON INC.)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
HKLM\...\Run: [nwiz] => C:\Program Files\NVIDIA Corporation\nview\nwiz.exe [2498368 2015-03-13] ()
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [134616 2013-07-11] (Intel Corporation)
HKLM-x32\...\Run: [CLMLServer_For_P2G8] => c:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111136 2012-11-21] (CyberLink)
HKLM-x32\...\Run: [CLVirtualDrive] => c:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [493088 2012-11-21] (CyberLink Corp.)
HKLM-x32\...\Run: [Adobe ARM] => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
HKLM-x32\...\Run: [ADSKAppManager] => C:\Program Files (x86)\Common Files\Autodesk Shared\AppManager\R1\AdAppMgr.exe [493960 2014-12-05] (Autodesk Inc.)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [191528 2014-07-04] (Geek Software GmbH)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Acrobat Assistant 8.0] => C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Acrotray.exe [3499920 2014-09-12] (Adobe Systems Inc.)
HKU\S-1-5-21-779854708-3996167121-2897795797-1172\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\ssText3d.scr [333824 2010-11-21] (Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\imagePROGRAF Status Monitor.lnk [2014-09-29]
ShortcutTarget: imagePROGRAF Status Monitor.lnk -> C:\Program Files\Canon\imagePROGRAFStatusMonitor\cnwism.exe (CANON INC.)
Startup: C:\Users\CAD\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Start.exe - Verknüpfung.lnk [2014-09-15]
ShortcutTarget: Start.exe - Verknüpfung.lnk -> C:\Portable Apps\Start.exe (PortableApps.com)
Startup: C:\Users\*NAME*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Programmstarts.cmd [2014-09-23] ()
ShellIconOverlayIdentifiers: [ SkyDrivePro1 (ErrorConflict)] -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-02-10] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ SkyDrivePro2 (SyncInProgress)] -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-02-10] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ SkyDrivePro3 (InSync)] -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-02-10] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [AutoCAD Digital Signatures Icon Overlay Handler] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\Windows\system32\AcSignIcon.dll [2014-02-07] (Autodesk, Inc.)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-779854708-3996167121-2897795797-1172\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPCOM13/34
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPCOM13/34
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll [2015-02-10] (Microsoft Corporation)
BHO: Adobe Acrobat Create PDF Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll [2014-09-12] (Adobe Systems Incorporated)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL [2015-02-10] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-02-10] (Microsoft Corporation)
BHO: Adobe Acrobat Create PDF from Selection -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll [2014-09-12] (Adobe Systems Incorporated)
BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\OCHelper.dll [2015-02-10] (Microsoft Corporation)
BHO-x32: PDFXChange 2012 -> {42DFA04F-0F16-418e-B80C-AB97A5AFAD3A} -> C:\Program Files\Tracker Software\PDF-XChange 5\PXCIEaddin5.dll [2012-11-12] (Tracker Software Products (Canada) Ltd.)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\ssv.dll [2015-04-15] (Oracle Corporation)
BHO-x32: Adobe Acrobat Create PDF Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll [2014-09-12] (Adobe Systems Incorporated)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\URLREDIR.DLL [2015-02-10] (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\GROOVEEX.DLL [2015-02-10] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-04-15] (Oracle Corporation)
BHO-x32: Adobe Acrobat Create PDF from Selection -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll [2014-09-12] (Adobe Systems Incorporated)
Toolbar: HKLM - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll [2014-09-12] (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - PDFXChange 2012 - {42DFA04F-0F16-418e-B80C-AB97A5AFAD3A} - C:\Program Files\Tracker Software\PDF-XChange 5\PXCIEaddin5.dll [2012-11-12] (Tracker Software Products (Canada) Ltd.)
Toolbar: HKLM-x32 - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll [2014-09-12] (Adobe Systems Incorporated)
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2014-07-16] (Microsoft Corporation)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\MSOSB.DLL [2015-02-03] (Microsoft Corporation)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.0.20

FireFox:
========
FF ProfilePath: C:\Portable Apps\PortableApps\FirefoxPortable\Data\profile
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_169.dll [2015-04-15] ()
FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll [2012-11-12] (Tracker Software Products (Canada) Ltd.)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2014-07-16] (Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll No File
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-04-15] ()
FF Plugin-x32: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll [2012-11-12] (Tracker Software Products (Canada) Ltd.)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=3.0.72 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-07-11] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-07-11] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-04-15] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-04-15] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2014-07-16] (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\NPSPWRAP.DLL [2014-07-16] (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2015-03-13] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2015-03-13] (NVIDIA Corporation)
FF Plugin-x32: Adobe Acrobat -> C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Air\nppdf32.dll [2014-09-12] (Adobe Systems Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-09-12] (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll No File
FF Plugin HKU\S-1-5-21-779854708-3996167121-2897795797-1172: @citrixonline.com/appdetectorplugin -> C:\Users\*NAME*\AppData\Local\Citrix\Plugins\104\npappdetector.dll [2014-10-28] (Citrix Online)
FF Plugin HKU\S-1-5-21-779854708-3996167121-2897795797-1172: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll [2012-11-12] (Tracker Software Products (Canada) Ltd.)
FF Extension: Click&Clean - C:\Portable Apps\PortableApps\FirefoxPortable\Data\profile\Extensions\clickclean@hotcleaner.com [2015-03-09]
FF Extension: KeeFox - C:\Portable Apps\PortableApps\FirefoxPortable\Data\profile\Extensions\keefox@chris.tomlinson [2015-03-10]
FF Extension: WOT - C:\Portable Apps\PortableApps\FirefoxPortable\Data\profile\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2015-04-22]
FF Extension: Snip-Me - C:\Portable Apps\PortableApps\FirefoxPortable\Data\profile\Extensions\addon@snip-me.de.xpi [2015-03-09]
FF Extension: Personas Plus - C:\Portable Apps\PortableApps\FirefoxPortable\Data\profile\Extensions\personas@christopher.beard.xpi [2015-04-10]
FF Extension: NoScript - C:\Portable Apps\PortableApps\FirefoxPortable\Data\profile\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2015-03-09]
FF Extension: Adblock Plus - C:\Portable Apps\PortableApps\FirefoxPortable\Data\profile\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-03-09]
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn [2014-10-01]
StartMenuInternet: FIREFOX.EXE - C:\Portable Apps\PortableApps\FirefoxPortable\App\Firefox\firefox.exe

Chrome: 
=======
CHR Profile: C:\Users\*NAME*\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Docs) - C:\Users\*NAME*\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-04-23]
CHR Extension: (Google Drive) - C:\Users\*NAME*\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-04-23]
CHR Extension: (YouTube) - C:\Users\*NAME*\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-04-23]
CHR Extension: (Google Search) - C:\Users\*NAME*\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-04-23]
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCChromeExtn\WCChromeExtn.crx [2014-09-12]
StartMenuInternet: Google Chrome.ODMYRIY4HGCA2FPWYASBY6PMUI - C:\Portable Apps\PortableApps\GoogleChromePortable\App\Chrome-bin\chrome.exe

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AdAppMgrSvc; C:\Program Files (x86)\Common Files\Autodesk Shared\AppManager\R1\AdAppMgrSvc.exe [599944 2014-12-05] (Autodesk Inc.)
R2 Autodesk Content Service; C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [31192 2014-02-07] (Autodesk, Inc.)
R2 Canon imagePROGRAF Status Monitor; C:\Program Files\Canon\imagePROGRAFStatusMonitor\cnwisam.exe [713488 2009-06-10] (CANON INC)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2714800 2015-02-10] (Microsoft Corporation)
R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe [46904 2013-12-17] (Hewlett-Packard Company)
R2 Intel(R) Capability Licensing Service Interface; c:\Program Files\Intel\iCLS Client\HeciServer.exe [732160 2012-12-11] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; c:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [803872 2012-12-11] (Intel(R) Corporation)
R2 iPFDeviceAgentService; C:\Windows\system32\cnwiols6.exe [210944 2008-12-08] (CANON INC.) [File not signed]
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-07-11] (Intel Corporation)
R2 Mgl3DCtlrRPCService; C:\Program Files\3Dconnexion\3DxWare\3DxWinCore64\Mgl3DCtlrRPCService.exe [30208 2014-06-23] (3Dconnexion) [File not signed]
R2 mitsijm2015; C:\2015\Inventor 2015\Moldflow\bin\mitsijm.exe [968480 2013-10-12] (Autodesk, Inc.)
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2014-08-22] (Microsoft Corporation)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [368624 2014-08-22] (Microsoft Corporation)
R2 NVWMI; C:\Windows\system32\nvwmi64.exe [3039376 2015-03-13] ()
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [239176 2013-02-20] (Realtek Semiconductor)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-11-04] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 3dxhid; C:\Windows\System32\DRIVERS\3dxhid.sys [38672 2014-06-12] (3Dconnexion SAM)
R1 CLVirtualDrive; C:\Windows\System32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [279616 2014-09-29] (DT Soft Ltd)
R0 iaStorF; C:\Windows\System32\drivers\iaStorF.sys [27120 2013-07-02] (Intel Corporation)
R0 iaStorS; C:\Windows\System32\drivers\iaStorS.sys [660976 2013-07-02] (Intel Corporation)
R3 KMJHidMini; C:\Windows\System32\DRIVERS\3dxkmj.sys [18944 2014-05-12] (3Dconnextion Inc.)
R3 KMJShim; C:\Windows\System32\DRIVERS\3dxshim.sys [7168 2014-05-12] (3Dconnextion Inc.)
R3 LGPBTDD; C:\Windows\System32\Drivers\LGPBTDD.sys [30728 2009-07-01] (Logitech Inc.)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [269008 2014-07-17] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [125584 2014-07-17] (Microsoft Corporation)
R3 ALSysIO; \??\C:\Users\*NAM*~1\AppData\Local\Temp\ALSysIO64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-05-06 13:40 - 2015-05-06 13:40 - 00022180 _____ () C:\Users\*NAME*\Desktop\FRST.txt
2015-05-06 13:39 - 2015-05-06 13:39 - 02101760 _____ (Farbar) C:\Users\*NAME*\Desktop\FRST64.exe
2015-05-04 14:03 - 2015-05-06 13:11 - 00000546 _____ () C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-779854708-3996167121-2897795797-1172.job
2015-05-04 14:03 - 2015-05-04 14:03 - 00003580 _____ () C:\Windows\System32\Tasks\G2MUpdateTask-S-1-5-21-779854708-3996167121-2897795797-1172
2015-04-29 08:54 - 2015-04-29 08:54 - 00000000 ____D () C:\Users\*NAME*\AppData\Roaming\SkypePM
2015-04-23 10:33 - 2015-04-23 10:33 - 00000076 _____ () C:\ADR_ColdStart.txt
2015-04-23 08:33 - 2015-04-23 08:33 - 00000000 ____D () C:\Users\*NAME*\AppData\Local\Google
2015-04-22 09:18 - 2015-04-22 09:18 - 00002217 _____ () C:\Users\Public\Desktop\JT2Go.lnk
2015-04-22 09:18 - 2015-04-22 09:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Teamcenter 10.1
2015-04-22 09:09 - 2015-04-22 09:09 - 00000000 ____D () C:\Users\*NAME*\Documents\SymbolLibrary
2015-04-21 07:49 - 2015-04-21 07:49 - 00000171 _____ () C:\Users\*NAME*\Desktop\FEHLER-SCHRIFTVERKEHR.txt
2015-04-20 16:50 - 2015-05-06 12:07 - 00003938 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{EEB18E22-28E3-4E68-AE57-15698A41CD27}
2015-04-16 13:50 - 2015-04-16 13:50 - 00000000 _____ () C:\Users\*NAME*\Desktop\Neues Textdokument.txt
2015-04-15 03:02 - 2015-03-25 05:24 - 03298816 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-04-15 03:02 - 2015-03-25 05:24 - 02553856 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-04-15 03:02 - 2015-03-25 05:24 - 00696320 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-04-15 03:02 - 2015-03-25 05:24 - 00191488 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-04-15 03:02 - 2015-03-25 05:24 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-04-15 03:02 - 2015-03-25 05:24 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-04-15 03:02 - 2015-03-25 05:24 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-04-15 03:02 - 2015-03-25 05:24 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-04-15 03:02 - 2015-03-25 05:23 - 00135168 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-04-15 03:02 - 2015-03-25 05:23 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-04-15 03:02 - 2015-03-25 05:23 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2015-04-15 03:02 - 2015-03-25 05:00 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2015-04-15 03:02 - 2015-03-25 05:00 - 00173056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2015-04-15 03:02 - 2015-03-25 05:00 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2015-04-15 03:02 - 2015-03-25 05:00 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2015-04-15 03:02 - 2015-03-25 05:00 - 00029696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2015-04-15 03:02 - 2015-03-10 05:25 - 01882624 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2015-04-15 03:02 - 2015-03-10 05:21 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2015-04-15 03:02 - 2015-03-10 05:08 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2015-04-15 03:02 - 2015-03-10 05:05 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2015-04-15 03:02 - 2015-03-05 07:12 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2015-04-15 03:02 - 2015-03-05 06:05 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2015-04-15 03:01 - 2015-03-17 07:22 - 05557696 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-04-15 03:01 - 2015-03-17 07:22 - 00155576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-04-15 03:01 - 2015-03-17 07:22 - 00095672 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-04-15 03:01 - 2015-03-17 07:19 - 01727904 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-04-15 03:01 - 2015-03-17 07:17 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-04-15 03:01 - 2015-03-17 07:17 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-04-15 03:01 - 2015-03-17 07:17 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-04-15 03:01 - 2015-03-17 07:16 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-04-15 03:01 - 2015-03-17 07:16 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-04-15 03:01 - 2015-03-17 07:16 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-04-15 03:01 - 2015-03-17 07:16 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-04-15 03:01 - 2015-03-17 07:16 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-04-15 03:01 - 2015-03-17 07:16 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-04-15 03:01 - 2015-03-17 07:16 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-04-15 03:01 - 2015-03-17 07:16 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-04-15 03:01 - 2015-03-17 07:16 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-04-15 03:01 - 2015-03-17 07:16 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-04-15 03:01 - 2015-03-17 07:16 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-04-15 03:01 - 2015-03-17 07:16 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-04-15 03:01 - 2015-03-17 07:16 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-04-15 03:01 - 2015-03-17 07:16 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-04-15 03:01 - 2015-03-17 07:16 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-04-15 03:01 - 2015-03-17 07:16 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-04-15 03:01 - 2015-03-17 07:16 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-04-15 03:01 - 2015-03-17 07:16 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-04-15 03:01 - 2015-03-17 07:16 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-04-15 03:01 - 2015-03-17 07:16 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-04-15 03:01 - 2015-03-17 07:15 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-04-15 03:01 - 2015-03-17 07:15 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-04-15 03:01 - 2015-03-17 07:15 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-04-15 03:01 - 2015-03-17 07:13 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-04-15 03:01 - 2015-03-17 07:13 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-04-15 03:01 - 2015-03-17 07:11 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-04-15 03:01 - 2015-03-17 07:11 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-04-15 03:01 - 2015-03-17 07:11 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 07:11 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 07:11 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 07:11 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 07:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 07:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 07:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 07:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 07:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 07:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 07:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 07:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 07:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 07:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 07:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 07:01 - 03976632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-04-15 03:01 - 2015-03-17 07:01 - 03920824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-04-15 03:01 - 2015-03-17 06:59 - 01309696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-04-15 03:01 - 2015-03-17 06:57 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-04-15 03:01 - 2015-03-17 06:57 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-04-15 03:01 - 2015-03-17 06:57 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-04-15 03:01 - 2015-03-17 06:57 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-04-15 03:01 - 2015-03-17 06:57 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-04-15 03:01 - 2015-03-17 06:57 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-04-15 03:01 - 2015-03-17 06:57 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-04-15 03:01 - 2015-03-17 06:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-04-15 03:01 - 2015-03-17 06:57 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-04-15 03:01 - 2015-03-17 06:56 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-04-15 03:01 - 2015-03-17 06:56 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-04-15 03:01 - 2015-03-17 06:56 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-04-15 03:01 - 2015-03-17 06:56 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-04-15 03:01 - 2015-03-17 06:56 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-04-15 03:01 - 2015-03-17 06:56 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-04-15 03:01 - 2015-03-17 06:56 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-04-15 03:01 - 2015-03-17 06:53 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-04-15 03:01 - 2015-03-17 06:53 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-04-15 03:01 - 2015-03-17 06:50 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-04-15 03:01 - 2015-03-17 06:50 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-04-15 03:01 - 2015-03-17 06:50 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 06:50 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 06:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 06:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 06:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 06:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 06:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 06:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 06:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 06:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 06:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 06:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 06:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 05:45 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-04-15 03:01 - 2015-03-17 05:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-04-15 03:01 - 2015-03-17 05:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 05:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 05:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 05:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-04-15 03:00 - 2015-04-02 02:17 - 00389808 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-04-15 03:00 - 2015-04-02 01:49 - 00342704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-04-15 03:00 - 2015-03-13 06:32 - 24980480 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-04-15 03:00 - 2015-03-13 06:25 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-04-15 03:00 - 2015-03-13 06:25 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-04-15 03:00 - 2015-03-13 06:09 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-04-15 03:00 - 2015-03-13 06:08 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-04-15 03:00 - 2015-03-13 06:08 - 00417280 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-04-15 03:00 - 2015-03-13 06:08 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-04-15 03:00 - 2015-03-13 06:07 - 02886144 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-04-15 03:00 - 2015-03-13 06:06 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-04-15 03:00 - 2015-03-13 06:00 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-04-15 03:00 - 2015-03-13 05:59 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-04-15 03:00 - 2015-03-13 05:55 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-04-15 03:00 - 2015-03-13 05:54 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-04-15 03:00 - 2015-03-13 05:54 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-04-15 03:00 - 2015-03-13 05:53 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-04-15 03:00 - 2015-03-13 05:50 - 06025216 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-04-15 03:00 - 2015-03-13 05:44 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-04-15 03:00 - 2015-03-13 05:42 - 19695616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-04-15 03:00 - 2015-03-13 05:42 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-04-15 03:00 - 2015-03-13 05:40 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-04-15 03:00 - 2015-03-13 05:32 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-04-15 03:00 - 2015-03-13 05:28 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-04-15 03:00 - 2015-03-13 05:28 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-04-15 03:00 - 2015-03-13 05:27 - 00340992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-04-15 03:00 - 2015-03-13 05:27 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-04-15 03:00 - 2015-03-13 05:27 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-04-15 03:00 - 2015-03-13 05:26 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-04-15 03:00 - 2015-03-13 05:26 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-04-15 03:00 - 2015-03-13 05:23 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-04-15 03:00 - 2015-03-13 05:22 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-04-15 03:00 - 2015-03-13 05:20 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-04-15 03:00 - 2015-03-13 05:20 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-04-15 03:00 - 2015-03-13 05:17 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-04-15 03:00 - 2015-03-13 05:16 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-04-15 03:00 - 2015-03-13 05:15 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-04-15 03:00 - 2015-03-13 05:08 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-04-15 03:00 - 2015-03-13 05:07 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-04-15 03:00 - 2015-03-13 05:06 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-04-15 03:00 - 2015-03-13 05:05 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-04-15 03:00 - 2015-03-13 05:05 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-04-15 03:00 - 2015-03-13 05:01 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-04-15 03:00 - 2015-03-13 05:00 - 14397440 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-04-15 03:00 - 2015-03-13 04:57 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-04-15 03:00 - 2015-03-13 04:56 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-04-15 03:00 - 2015-03-13 04:54 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-04-15 03:00 - 2015-03-13 04:49 - 04305408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-04-15 03:00 - 2015-03-13 04:45 - 02358784 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-04-15 03:00 - 2015-03-13 04:44 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-04-15 03:00 - 2015-03-13 04:43 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-04-15 03:00 - 2015-03-13 04:42 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-04-15 03:00 - 2015-03-13 04:34 - 12825600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-04-15 03:00 - 2015-03-13 04:33 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-04-15 03:00 - 2015-03-13 04:22 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-04-15 03:00 - 2015-03-13 04:20 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-04-15 03:00 - 2015-03-13 04:16 - 01311232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-04-15 03:00 - 2015-03-13 04:14 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-04-15 03:00 - 2015-03-04 06:55 - 00367552 _____ (Microsoft Corporation) C:\Windows\system32\clfs.sys
2015-04-15 03:00 - 2015-03-04 06:41 - 00079360 _____ (Microsoft Corporation) C:\Windows\system32\clfsw32.dll
2015-04-15 03:00 - 2015-03-04 06:10 - 00058880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\clfsw32.dll
2015-04-15 03:00 - 2015-02-25 05:18 - 00754688 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\http.sys
2015-04-14 16:35 - 2015-04-14 16:35 - 21102200 _____ (SUPERAntiSpyware) C:\Users\*NAME*\Downloads\SUPERAntiSpyware_6.0.1170.exe
2015-04-08 09:51 - 2015-04-08 09:51 - 00000000 ____D () C:\Users\*NAME*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ArchiPHYSIK 12 aut

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-05-06 13:40 - 2015-03-03 16:45 - 00000000 ____D () C:\FRST
2015-05-06 13:31 - 2014-01-20 22:13 - 01702947 _____ () C:\Windows\WindowsUpdate.log
2015-05-06 13:17 - 2014-10-02 08:19 - 00000000 ____D () C:\Users\*NAME*\AppData\Roaming\Mozilla
2015-05-06 13:05 - 2014-09-30 10:18 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-05-06 12:21 - 2014-09-22 20:08 - 00000120 _____ () C:\Windows\system32\config\netlogon.ftl
2015-05-06 08:45 - 2009-07-14 06:45 - 00027568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-05-06 08:45 - 2009-07-14 06:45 - 00027568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-05-06 08:42 - 2013-11-04 20:38 - 04233676 _____ () C:\Windows\system32\perfh007.dat
2015-05-06 08:42 - 2013-11-04 20:38 - 01246584 _____ () C:\Windows\system32\perfc007.dat
2015-05-06 08:42 - 2009-07-14 07:13 - 00006212 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-05-06 08:37 - 2014-01-23 13:43 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-05-06 08:37 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-05-06 08:37 - 2009-07-14 06:51 - 00009164 _____ () C:\Windows\setupact.log
2015-05-05 12:20 - 2009-07-14 04:34 - 00000428 _____ () C:\Windows\win.ini
2015-05-04 14:03 - 2014-10-28 11:12 - 00000000 ____D () C:\Program Files (x86)\Citrix
2015-05-04 09:27 - 2014-10-31 11:33 - 00003243 _____ () C:\Users\*NAME*\Documents\plot.log
2015-05-04 09:25 - 2014-10-01 15:31 - 01424568 _____ () C:\Windows\system32\webservice4.log
2015-04-30 14:30 - 2014-01-21 00:39 - 00000000 ____D () C:\Temp
2015-04-30 11:08 - 2014-09-29 15:12 - 00000000 ____D () C:\Users\*NAME*\AppData\Roaming\DAEMON Tools Lite
2015-04-29 08:54 - 2014-10-01 09:04 - 00000000 ____D () C:\Users\*NAME*\AppData\Local\Skype
2015-04-28 15:51 - 2010-11-21 05:47 - 00225388 _____ () C:\Windows\PFRO.log
2015-04-24 09:58 - 2015-03-12 16:26 - 00000000 ____D () C:\AdwCleaner
2015-04-23 10:33 - 2014-09-23 08:13 - 00000000 ____D () C:\Users\*NAME*\AppData\Roaming\Autodesk
2015-04-23 10:33 - 2014-09-23 08:13 - 00000000 ____D () C:\Users\*NAME*\AppData\Local\Autodesk
2015-04-23 10:33 - 2014-07-15 18:12 - 00000000 ____D () C:\ProgramData\Autodesk
2015-04-22 09:18 - 2014-09-29 11:10 - 00000000 ____D () C:\Program Files (x86)\Siemens
2015-04-22 09:15 - 2014-09-23 15:34 - 00000000 ____D () C:\Windows\Downloaded Installations
2015-04-16 07:58 - 2009-07-14 06:45 - 00561432 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-04-15 17:05 - 2014-09-30 10:18 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-04-15 17:05 - 2014-09-30 10:18 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-04-15 17:05 - 2014-09-30 10:18 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-04-15 15:07 - 2015-03-24 08:57 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2015-04-15 15:07 - 2014-10-16 14:36 - 00000000 ____D () C:\Program Files (x86)\Java
2015-04-15 15:07 - 2014-09-23 09:38 - 00000000 ____D () C:\ProgramData\Oracle
2015-04-15 12:54 - 2014-09-23 08:13 - 00163464 _____ () C:\Users\*NAME*\AppData\Local\GDIPFONTCACHEV1.DAT
2015-04-15 03:34 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2015-04-14 03:32 - 2015-02-11 11:57 - 00000000 ____D () C:\Windows\System32\Tasks\Games
2015-04-13 12:26 - 2014-09-23 08:13 - 00000000 ____D () C:\Users\*NAME*\Documents\Inventor
2015-04-08 09:52 - 2014-10-24 08:50 - 00000000 ____D () C:\Users\*NAME*\AppData\Roaming\4D
2015-04-08 09:51 - 2014-10-24 08:49 - 00000000 ____D () C:\Program Files (x86)\A-NULL

==================== Files in the root of some directories =======

2014-09-24 09:39 - 2014-12-11 12:30 - 0000132 _____ () C:\Users\*NAME*\AppData\Roaming\Adobe PNG Format CS5 Prefs
2014-10-02 08:44 - 2014-10-17 09:32 - 0000626 _____ () C:\Users\*NAME*\AppData\Roaming\All CPU MeterV3_Settings.ini
2014-10-17 09:35 - 2014-10-17 09:35 - 0000017 _____ () C:\Users\*NAME*\AppData\Local\resmon.resmoncfg
2014-07-15 18:25 - 2014-07-15 18:25 - 0000153 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc

Some content of TEMP:
====================
C:\Users\*NAME*\AppData\Local\Temp\FNP_ACT_InstallerCA.dll
C:\Users\*NAME*\AppData\Local\Temp\jre-8u40-windows-au.exe
C:\Users\*NAME*\AppData\Local\Temp\jre-8u45-windows-au.exe
C:\Users\*NAME*\AppData\Local\Temp\nvSCPAPI.dll
C:\Users\*NAME*\AppData\Local\Temp\nvSCPAPI64.dll
C:\Users\*NAME*\AppData\Local\Temp\nvStInst.exe
C:\Users\*NAME*\AppData\Local\Temp\SkypeSetup.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-05-04 11:49

==================== End Of Log ============================

--- --- ---

--- --- ---

Morphy · 07.05.2015, 09:27

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 06-05-2015
Ran by *NAME* at 2015-05-06 13:40:40
Running from C:\Users\*NAME*\Desktop
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-2894447428-521936725-362015667-500 - Administrator - Disabled)
Gast (S-1-5-21-2894447428-521936725-362015667-501 - Limited - Enabled)
*NAME* (S-1-5-21-2894447428-521936725-362015667-1001 - Administrator - Enabled) => C:\Users\CAD

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Enabled - Up to date) {4F35CFC4-45A3-FC37-EF17-759A02E39AB1}
AS: Microsoft Security Essentials (Enabled - Up to date) {F4542E20-6399-F3B9-D5A7-4EE87964D00C}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

3Dconnexion 3DxWare 10 (64-bit) (HKLM-x32\...\{BAFCA6AC-8B37-405B-B57E-C1D45DE70ACC}) (Version: 10.1.2 - 3Dconnexion)
3Dconnexion Add-In for AutoCAD 2007 - 2010 (Version: 4.6.0 - 3Dconnexion) Hidden
3Dconnexion Add-In for Inventor 11 - 2015 (Version: 2.0.5 - 3Dconnexion) Hidden
3Dconnexion Collage (x32 Version: 1.3.0 - 3Dconnexion) Hidden
3Dconnexion LCD Applets for SpacePilot Pro (x64) (Version: 1.3.2 - 3Dconnexion) Hidden
3Dconnexion Plug-in for Acrobat 3D (x32 Version: 1.3.0 - 3Dconnexion) Hidden
3Dconnexion Plug-In for Photoshop CS3 - CS6 and CC (Version: 2.4.0 - 3Dconnexion) Hidden
3Dconnexion Trainer (x32 Version: 3.2.2 - 3Dconnexion) Hidden
3DxWinCore (x64) (Version: 17.1.2.10488 - 3Dconnexion) Hidden
ACDSee 5.0 PowerPack (HKLM-x32\...\{316B6021-BB9B-4200-BD7B-2B4634C2F356}) (Version: 5.0.0 - ACD Systems Ltd)
Adobe Acrobat XI Pro (HKLM-x32\...\{AC76BA86-1033-FFFF-7760-000000000006}) (Version: 11.0.09 - Adobe Systems)
Adobe Flash Player 17 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.09) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.09 - Adobe Systems Incorporated)
ArchiPHYSIK 12 aut (HKLM-x32\...\ArchiPHYSIK 12 aut) (Version: 12..0 - A-NULL Bauphysik GmbH, Wien, Austria)
Astroburn Lite (HKLM-x32\...\Astroburn Lite) (Version: 1.8.0.0182 - Disc Soft Ltd)
AutoCAD 2015 VBA Enabler (Version: 20.0.51.0 - Autodesk) Hidden
AutoCAD Electrical 2015 - Deutsch (German) (Version: 12.0.55.0 - Autodesk) Hidden
AutoCAD Electrical 2015 - Deutsch (German) (Version: 12.2.0.8 - Autodesk) Hidden
AutoCAD Electrical 2015 - Deutsch (German) SP1 (Version: 12.2.0.8 - Autodesk) Hidden
AutoCAD Electrical 2015 - Deutsch (German) SP2 (HKLM\...\AutoCAD Electrical 2015 - Deutsch (German) SP2) (Version: 12.2.0.8 - Autodesk)
AutoCAD Electrical 2015 Language Pack - Deutsch (German) (Version: 12.0.55.0 - Autodesk) Hidden
AutoCAD Mechanical 2015 - Deutsch (German) (Version: 19.0.206.0 - Autodesk) Hidden
AutoCAD Mechanical 2015 - Deutsch (German) (Version: 19.0.48.0 - Autodesk) Hidden
AutoCAD Mechanical 2015 - Deutsch (German) SP2 (HKLM\...\AutoCAD Mechanical 2015 - Deutsch (German) SP2) (Version: 1 - Autodesk)
AutoCAD Mechanical 2015 Language Pack - Deutsch (German) (Version: 19.0.48.0 - Autodesk) Hidden
Autodesk App Manager (HKLM-x32\...\{C8125548-F2D5-4059-823F-1F3C5BBD9F19}) (Version: 1.2.0 - Autodesk)
Autodesk Application Manager (HKLM-x32\...\Autodesk Application Manager) (Version: 4.0.69.0 - Autodesk)
Autodesk AutoCAD 2015 VBA Enabler (HKLM\...\AutoCAD 2015 VBA Enabler) (Version: 20.0.51.0 - Autodesk)
Autodesk AutoCAD Electrical 2015 - Deutsch (German) (HKLM\...\AutoCAD Electrical 2015 - Deutsch (German)) (Version: 12.0.55.0 - Autodesk)
Autodesk AutoCAD Electrical Mobile Data (HKLM-x32\...\{4F4C5027-2FAC-4863-AA12-5754FF226849}) (Version: 1.0.0 - Autodesk)
Autodesk AutoCAD Mechanical 2015 - Deutsch (German) (HKLM\...\AutoCAD Mechanical 2015 - Deutsch (German)) (Version: 19.0.48.0 - Autodesk)
Autodesk AutoCAD Performance Feedback Tool Version 1.2.2 (HKLM-x32\...\{85735431-6CD3-4B16-BEC8-95332034E53B}) (Version: 1.2.2.0 - Autodesk)
Autodesk BIM 360 Glue AutoCAD 2015 Add-in 64 bit (HKLM\...\{78E2A54B-5F13-4286-9148-DAD8B823D485}) (Version: 4.33.6482 - Autodesk)
Autodesk BIM 360 Glue AutoCAD 2015 Add-in 64 bit (HKLM\...\{7B3A3142-5801-48F2-819B-515818EFE696}) (Version: 4.34.2701 - Autodesk)
Autodesk BIM 360 Navisworks Manage 2015 Add-in 64 bit (HKLM\...\{A254B429-1472-4B9C-BC9A-4E2CE74F2190}) (Version: 4.33.6482 - Autodesk)
Autodesk BIM 360 Navisworks Manage 2015 Add-in 64 bit (HKLM\...\{E0D028E7-5468-40AF-8F2D-4881D003F747}) (Version: 4.34.2701 - Autodesk)
Autodesk Content Service (HKLM-x32\...\Autodesk Content Service) (Version: 3.2.0.0 - Autodesk)
Autodesk Content Service (x32 Version: 3.2.0.0 - Autodesk) Hidden
Autodesk Content Service Language Pack (x32 Version: 3.2.0.0 - Autodesk) Hidden
Autodesk Design Review 2013 (HKLM-x32\...\Autodesk Design Review 2013) (Version: 13.0.0.82 - Autodesk, Inc.)
Autodesk Design Review 2013 (x32 Version: 13.0.0.82 - Autodesk, Inc.) Hidden
Autodesk DWG TrueView 2015 - English (HKLM\...\DWG TrueView 2015 - English) (Version: 20.0.51.0 - Autodesk)
Autodesk Inventor 2015 User Tools (HKLM\...\{55C7852C-E326-4227-9590-949843F2E744}) (Version: 7.0.0 - Autodesk)
Autodesk Inventor Content Center Libraries 2015 (Desktop Content) (HKLM\...\{B46DECD1-1964-4EF1-0000-22D71E81877C}) (Version: 19.0.15900.0000 - Autodesk)
Autodesk Inventor Electrical Catalog Browser 2015 (HKLM\...\{CD301C75-E007-0407-8A4F-E62AF995F11C}) (Version: 12.0.55.0 - Autodesk)
Autodesk Inventor Professional 2015 - Deutsch (German) (HKLM\...\Autodesk Inventor Professional 2015) (Version: 19.1.20300.0000 - Autodesk)
Autodesk Inventor Professional 2015 (Version: 19.1.20300.0000 - Autodesk) Hidden
Autodesk Inventor Professional 2015 Language Pack - Deutsch (German) (Version: 19.0.15900.0000 - Autodesk) Hidden
Autodesk Inventor Professional 2015 SP1 (HKLM\...\Autodesk Inventor Professional 2015 SP1RTM) (Version: 19.1.20300.0000 - Autodesk)
Autodesk Material Library 2015 (HKLM-x32\...\{427F733F-4D6C-45BC-9324-EB743104C321}) (Version: 5.2.9.100 - Autodesk)
Autodesk Material Library Base Resolution Image Library 2015 (HKLM-x32\...\{ABE2F70B-8D94-44E9-AA04-F0DB35063D62}) (Version: 5.2.9.100 - Autodesk)
Autodesk Material Library Low Resolution Image Library 2015 (HKLM-x32\...\{4FBC9635-AC56-4378-8FDE-C4D3ED072681}) (Version: 5.2.9.100 - Autodesk)
Autodesk Product Design Suite 2015 (HKLM\...\Autodesk Product Design Suite 2015) (Version: 4.0.102.007 - Autodesk)
Autodesk Product Design Suite 2015 (Version: 4.0.102.007 - Autodesk) Hidden
Autodesk Product Design Suite 2015 Language Pack (Version: 4.0.102.007 - Autodesk) Hidden
Autodesk Revit Interoperability for Inventor 2015 (HKLM\...\Autodesk Revit Interoperability for Inventor 2015) (Version: 15.0.107.0 - Autodesk)
Autodesk Revit Interoperability for Inventor 2015 (Version: 15.0.107.0 - Autodesk) Hidden
Autodesk Vault 2015 Service Pack 1 (Client) (HKLM\...\Autodesk Vault Basic 2015 (Client)_R19SP1) (Version:  - Autodesk, Inc.)
Autodesk Vault Basic 2015 (Client) (HKLM\...\Autodesk Vault Basic 2015 (Client)) (Version: 19.1.13.0 - Autodesk)
Autodesk Vault Basic 2015 (Client) (Version: 19.1.13.0 - Autodesk) Hidden
Autodesk Vault Basic 2015 (Client) German Language Pack (Version: 19.0.49.0 - Autodesk) Hidden
Autodesk Workflows 2015 (HKLM\...\{A90DD6F8-60D2-4803-AFF6-796400E73E1B}) (Version: 5.2.11.100 - Autodesk, Inc.)
Citrix Online Launcher (HKLM-x32\...\{77463C86-BB3A-426E-A6C2-06B4D28C250F}) (Version: 1.0.223 - Citrix)
Configurator 360 addin (HKLM-x32\...\{8FE324B0-B934-4D68-BAB5-DE2136036237}) (Version: 19.0.11300.9000 - Autodesk, Inc.)
Core Temp 1.0 RC6 (HKLM\...\{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1) (Version: 1.0 - Alcpu)
CyberLink Power2Go 8 (HKLM-x32\...\InstallShield_{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}) (Version: 8.0.2.2321 - CyberLink Corp.)
CyberLink PowerDVD 12 (HKLM-x32\...\InstallShield_{B46BEA36-0B71-4A4E-AE41-87241643FA0A}) (Version: 12.0.1.2725 - CyberLink Corp.)
DWG TrueView 2015 - English (Version: 20.0.51.0 - Autodesk) Hidden
Eco Materials Adviser for Autodesk Inventor 2015 (64-bit) (HKLM\...\{2F7441CB-A646-41F1-B1CB-518AB311138B}) (Version: 5.1.2.0 - Granta Design Limited)
FARO LS 1.1.502.0 (64bit) (HKLM-x32\...\{66D83FE0-D798-4B38-86FE-FB48151E5AEF}) (Version: 5.2.0.35213 - FARO Scanner Production)
GoToMeeting 6.4.12.2331 (HKU\S-1-5-21-779854708-3996167121-2897795797-1172\...\GoToMeeting) (Version: 6.4.12.2331 - CitrixOnline)
HP Performance Advisor (HKLM-x32\...\{8E3138D3-686D-4F77-A807-CFF5CAEC98D7}) (Version: 1.7.6530 - Hewlett-Packard Company)
HP Support Information (HKLM-x32\...\{B2B7B1C8-7C8B-476C-BE2C-049731C55992}) (Version: 12.00.0000 - Hewlett-Packard)
HP Support Solutions Framework (HKLM-x32\...\{23CCE784-A812-4647-AEFF-1DCCD4E57478}) (Version: 11.50.0000 - Hewlett-Packard Company)
HP Vision Hardware Diagnostics (HKLM\...\{D79A02E9-6713-4335-9668-AAC7474C0C0E}) (Version: 2.12.2.0 - Hewlett-Packard)
imagePROGRAF Status Monitor (HKLM-x32\...\{66392B7C-C522-450D-97B7-B3E41E170C3B}) (Version: 4.10 - Canon)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1011 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.0.0.1310 - Intel Corporation)
Intel(R) Network Connections 18.1.59.0 (HKLM\...\PROSetDX) (Version: 18.1.59.0 - Intel)
iPF750 Media Configuration Tool (HKLM-x32\...\{DA08E681-106D-42BE-9B43-D4B7F736DBFA}) (Version: 3.64.00 - Canon)
Java 8 Update 45 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218045F0}) (Version: 8.0.450 - Oracle Corporation)
JT2Go (HKLM-x32\...\{EAF3A581-2EE5-46BD-BFB0-2089821608AD}) (Version: 10.1.15028 - Siemens PLM Software)
Mathcad 15 F000 (HKLM-x32\...\{DC8F6C78-7231-44A2-B66E-6C4FCB3A3364}) (Version: 15.0.0.0 - PTC)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Access database engine 2010 (English) (HKLM\...\{90140000-00D1-0409-1000-0000000FF1CE}) (Version: 14.0.6029.1000 - Microsoft Corporation)
Microsoft Office 365 Small Business Premium - de-de (HKLM\...\O365SmallBusPremRetail - de-de) (Version: 15.0.4701.1002 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.6.305.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.5026 (HKLM-x32\...\{761AB0B8-FC68-3AE2-B7D9-A0CC6F0ED045}) (Version: 9.0.30729.5026 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft WSE 3.0 Runtime (HKLM-x32\...\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}) (Version: 3.0.5305.0 - Microsoft Corp.)
Mockup 360 Addin 2015 (HKLM-x32\...\{E4D4242C-FC14-4B4F-B1D9-6760D8C241D5}) (Version: 1.1.0 - Autodesk)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
NVIDIA 3D Vision Controller-Treiber 347.09 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 347.09 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 347.88 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 347.88 - NVIDIA Corporation)
NVIDIA Grafiktreiber 347.88 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 347.88 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.33.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.33.0 - NVIDIA Corporation)
NVIDIA nView 146.33 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NView) (Version: 146.33 - NVIDIA Corporation)
NVIDIA WMI 2.20.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVWMI) (Version: 2.20.0 - NVIDIA Corporation)
Office 15 Click-to-Run Extensibility Component (Version: 15.0.4701.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4701.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (Version: 15.0.4701.1002 - Microsoft Corporation) Hidden
PDF24 Creator 6.7.0 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)
PDF-XChange 2012 (HKLM\...\{504022CD-6A58-42D5-ACC9-966F695AAD93}_is1) (Version: 5.0.267.0 - Tracker Software Products Ltd)
PDF-XChange 2012 Pro (HKLM\...\{F92F0AAB-2EF6-412C-8BF4-0B11EB535280}_is1) (Version: 5.0.266.0 - Tracker Software Products Ltd)
'PTC Places' Namespace Shell Extension (HKLM-x32\...\{C65ABF2A-1B82-4F34-8C74-E4FE373F3BE4}) (Version: 1.1.11 - PTC)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6878 - Realtek Semiconductor Corp.)
Recovery Manager (x32 Version: 5.5.0.5223 - CyberLink Corp.) Hidden
Samsung Magician (HKLM-x32\...\{29AE3F9F-7158-4ca7-B1ED-28A73ECDB215}_is1) (Version: 4.3.0 - Samsung Electronics)
SketchUp-Import (HKLM-x32\...\{C403E867-FCF1-432B-BCC1-8FFD40A10A6E}) (Version: 1.2.0 - Autodesk)
Skype™ 6.22 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.22.107 - Skype Technologies S.A.)
Stahlschlüssel 2007 (HKLM-x32\...\{36002523-EB0B-11DA-8435-009027A6F7F8}) (Version:  - )
Update 1 for Inventor 2015 Service Pack 1 (See readme for detail) (INV19110) (HKLM\...\Autodesk Inventor Professional 2015_19110) (Version: 1 - Autodesk)
Update 2 for Inventor 2015 Service Pack 1 (See readme for detail) (INV19120) (HKLM\...\Autodesk Inventor Professional 2015_19120) (Version: 1 - Autodesk)
Update 3 for Inventor 2015 Service Pack 1 (See readme for detail) (INV19130) (HKLM\...\Autodesk Inventor Professional 2015_19130) (Version: 1 - Autodesk)
VC_CRT_x64 (Version: 1.02.0000 - Intel Corporation) Hidden
Verfügbare Autodesk-Apps (HKLM-x32\...\{EDDEE94B-214D-4B07-9727-A3E46F3E379A}) (Version: 1.2.0 - Autodesk)
Visual C++ 2008 - x64 (KB958357) - v9.0.30729.177 (HKLM-x32\...\{6DA2B636-698A-3294-BF4A-B5E11B238CDD}.KB958357) (Version: 9.0.30729.177 - Microsoft Corporation)
Visual C++ 2008 - x64 (KB958357) - v9.0.30729.177 (HKLM-x32\...\{8CCEA24C-51AE-3B71-9092-7D0C44DDA2DF}.KB958357) (Version: 9.0.30729.177 - Microsoft Corporation)
Visual C++ 2008 - x64 (KB958357) - v9.0.30729.177 (HKLM-x32\...\{C3A57BB3-9AA6-3F6F-9395-6C062BDD5FC4}.KB958357) (Version: 9.0.30729.177 - Microsoft Corporation)
Visual C++ 2008 - x64 (KB958357) - v9.0.30729.177 (HKLM-x32\...\{F6F09DD8-F39B-3A16-ADB9-C9E6B56903F9}.KB958357) (Version: 9.0.30729.177 - Microsoft Corporation)
Visual C++ 2008 - x86 (KB958357) - v9.0.30729.177 (HKLM-x32\...\{04B34E21-5BEE-3D2B-8D3D-E3E80D253F64}.KB958357) (Version: 9.0.30729.177 - Microsoft Corporation)
Visual C++ 2008 - x86 (KB958357) - v9.0.30729.177 (HKLM-x32\...\{14866AAD-1F23-39AC-A62B-7091ED1ADE64}.KB958357) (Version: 9.0.30729.177 - Microsoft Corporation)
Visual C++ 2008 - x86 (KB958357) - v9.0.30729.177 (HKLM-x32\...\{4B90093A-5D9C-3956-8ABB-95848BE6EFAD}.KB958357) (Version: 9.0.30729.177 - Microsoft Corporation)
Visual C++ 2008 - x86 (KB958357) - v9.0.30729.177 (HKLM-x32\...\{B42E259C-E4D4-37F1-A1B2-EB9C4FC5A04D}.KB958357) (Version: 9.0.30729.177 - Microsoft Corporation)
Windchill ProductPoint Client Manager (HKLM-x32\...\{129024FF-A6C9-4696-91BC-570C6C05193A}) (Version: 1.1.187 - PTC)
Windows Small Business Server 2011 Standard ClientAgent (HKLM\...\{5C72F8A3-BF39-4733-B41E-0ED7EF622E37}) (Version: 6.1.7900.1 - Microsoft Corporation)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{00F064D8-FEC3-48ac-B07D-39C314D1727B}\InprocServer32 -> C:\2015\Inventor 2015\Bin\ServiceModule.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{0215A4C0-5431-4FD0-9B06-46589B5C4939}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{048ED0E0-12CF-4C0F-9FFA-947C2FBE8C8E}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{071339A1-1946-44B2-B63E-50459B15DB86}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{073CB204-6B29-46FC-AB98-451F1D068741}\InprocServer32 -> C:\2015\Inventor 2015\Bin\TestServer.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{083f5ae0-2b0a-11dd-bd0b-0800200c9a66}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{08A60FF7-BB37-44F4-9759-0ADA6C7B9CC9}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{0B38CACA-3D3C-48EA-BEB5-7D95F4F6EE15}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{0B628DE4-07AD-4284-81CA-5B439F67C5E6}\localserver32 -> C:\2015\AutoCAD 2015\acad.exe (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{0C3393F8-94F5-4B79-8C01-49A2D0CC0FE9}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{0D555CE0-304A-47A6-858B-B145209A3982}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{1029ABC3-2457-11D5-8E9D-0010B541CD80}\localserver32 -> C:\2015\Inventor 2015\Compatibility\Bin\DbxBridge.exe (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{12545889-6D32-4424-9967-1E1D7BD1F809}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{13009989-EFB5-48C9-8BD2-943E0392BD71}\InprocServer32 -> C:\2015\Inventor 2015\Bin\RxAppCtrl.Ocx (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{14679E3B-C952-4998-8E13-4B1286E6DD99}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{1481B385-759A-4B00-9257-E96357563999}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{149DD748-EA85-45A6-93C5-AC50D0260C98}\localserver32 -> C:\2015\AutoCAD 2015\acad.exe (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{162EF0A1-5A33-46F2-ACCF-CA388B084A09}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{18A21864-E37B-42b9-9612-2C1E8C450A29}\InprocServer32 -> C:\2015\Inventor 2015\Bin\ServiceModule.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{1D625598-C876-4C51-8EF5-F9D8F96F62AA}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{1D6DFD6A-9E16-435A-9327-6FFEC6BA372F}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{1E5724EA-3423-4BD3-ABD6-46E650D2DC66}\InprocServer32 -> AcETransmit.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{1E8A29BA-827D-4031-A4A3-AE7999B402F6}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{1EA072EE-57FD-495E-889C-8243C3BDBDBC}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{1FD7F53F-7ED5-439C-9A77-A3821CD09E98}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{20E47D5B-529A-45BD-8E77-BF1A3064A008}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{21DB88B0-BFBF-11D4-8DE6-0010B541CAA8}\InprocServer32 -> C:\2015\Inventor 2015\Bin\iDrop.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{244298EC-E661-11d4-BC13-0010B5891E89}\InprocServer32 -> C:\2015\Inventor 2015\Bin\TI.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{2709544A-5B24-4F9F-A5DA-CEC7297D3A4E}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{2BCA857B-A18B-4AFA-B183-CC0E49C12058}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{2C74F89E-7421-46B4-BA54-F86F1BD9F237}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{2C7D1157-7D50-4A88-9777-5EBBA3189AB8}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{2F8377FC-50C1-44EF-AB7A-8FF1BB8EA277}\InprocServer32 -> C:\2015\Inventor 2015\Bin\ServiceModule.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{3497C2EC-5684-4B21-AF74-F6760E0221DC}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{3897B445-D5B8-410d-899A-9789B8ADB643}\localserver32 -> C:\2015\Inventor 2015\Compatibility\Bin\DbxBridge.exe (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{38C8B14E-7879-4DA9-8C3F-8CAAC359293A}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{3C3F63EA-C7BA-11d4-8E60-0010B541CD80}\localserver32 -> C:\2015\Inventor 2015\Compatibility\Bin\DbxBridge.exe (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{3FC94EB5-AEBD-4f3f-A2A4-B6CE57113C01}\InprocServer32 -> C:\2015\Inventor 2015\Bin\RxAppDocView.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{3FCEB42C-9B98-486A-BED7-FD7F3ADB7291}\InprocServer32 -> AcETransmit.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{40770568-0D5E-49D4-BE47-BC47A4F0B0A4}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{44A52280-AE56-490D-890C-89FB7279ED6B}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{45122C53-8483-4b62-B15A-EAA9FE5FC3D5}\InprocServer32 -> C:\2015\Inventor 2015\Bin\ServiceModule.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{46C56738-39C6-4240-8B9B-008CCD769A84}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{47179DDE-10AC-4737-97C9-8CE5379343EA}\InprocServer32 -> AcETransmit.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{475C7B4A-6964-4F9E-9708-05A16EAC31D0}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{48270F9E-CCF6-4C79-B6FF-267C960E6425}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{48A74AAC-E196-4AF0-9EC2-28C7C5150645}\InprocServer32 -> c:\Users\Public\Documents\Autodesk\Inventor 2015\SDK\UserTools\DrawingTools\Bin\DrawingTools.dll ()
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{48FEFCD7-5D7C-4E4A-9F11-60E69A31D4B1}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{49998808-648A-4A9C-A7A5-B1672775D9AB}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{4A756F5F-CBA4-428B-B17F-AF80C0C8502D}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{4B40437B-8972-4444-BBE3-1588FF55F203}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{4BD03680-3C0F-4501-AFF7-3D008586917F}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{4C80573A-9150-11d2-B772-0060B0F159EF}\InprocServer32 -> C:\2015\Inventor 2015\Bin\RxAppDocView.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{4D29B490-49B2-11D0-93C3-7E0706000000}\localserver32 -> C:\2015\Inventor 2015\Bin\Inventor.exe (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{4E6F2E83-E7F0-4333-9772-875EB733C820}\InprocServer32 -> C:\2015\Inventor 2015\Bin\RxTest.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{5544903C-2CCC-487C-91BB-F310B72A8E9B}\InprocServer32 -> AcETransmit.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}\InprocServer32 -> C:\Users\*NAME*\AppData\Roaming\ernden\berdis.dll () <==== ATTENTION
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{59A224A2-BEF8-4C89-96E0-83A5411ABB6C}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{622F6193-E4DD-46E6-BC66-2ED88E9FD28D}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{62FBB030-24C7-11D3-B78D-0060B0F159EF}\localserver32 -> C:\2015\Inventor 2015\Bin\Inventor.exe (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{644190AE-BD8F-493F-B63D-C79404AC5E07}\InprocServer32 -> C:\2015\Inventor 2015\Bin\ServiceModule.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{6451051B-AD22-4C6A-ACCE-013A0E1DDBC3}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{64B99FDB-1D85-447F-98C7-569DBDA723DB}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{6BCE6F6E-C050-4F39-BD98-E2743949F724}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{6F56D7C9-18DD-4C15-9FA8-C54E3610EC40}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{6FDE7A70-351B-11d6-988B-0010B57A8BB7}\InprocServer32 -> C:\2015\Inventor 2015\Bin\DtBridge.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{6FDE7A71-351B-11d6-988B-0010B57A8BB7}\InprocServer32 -> C:\2015\Inventor 2015\Bin\DtBridge.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{6FDE7A72-351B-11d6-988B-0010B57A8BB7}\InprocServer32 -> C:\2015\Inventor 2015\Bin\DtBridge.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{6FDE7A73-351B-11d6-988B-0010B57A8BB7}\InprocServer32 -> C:\2015\Inventor 2015\Bin\DtBridge.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{6FDE7A74-351B-11d6-988B-0010B57A8BB7}\InprocServer32 -> C:\2015\Inventor 2015\Bin\DtBridge.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{6FDE7A77-351B-11d6-988B-0010B57A8BB7}\InprocServer32 -> C:\2015\Inventor 2015\Bin\DtCp.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{70DBCAE8-8C2B-450C-9E1D-43E4686C6512}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{713C0E8A-5AE8-4695-B442-5ED6C4FE5C42}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{714D325C-E9CE-44ab-A72A-36BB410BA19B}\localserver32 -> C:\2015\Inventor 2015\Bin\FEAFilesHandler.exe (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{7293E009-3015-4AD3-96EC-D42C36B5FCE3}\InprocServer32 -> AcETransmit.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{72EC5CC5-88F3-45B1-A865-0A327DF58CC8}\InprocServer32 -> C:\2015\Inventor 2015\Bin\ServiceModule.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{72EFC580-D085-4B81-8C55-26A79E445338}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{750AEC19-2E4C-4ED9-9B9F-F9CAFCD060F3}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{76283A80-50DD-11D3-A7E3-00C04F79D7BC}\localserver32 -> C:\2015\Inventor 2015\Bin\Inventor.exe (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{794199C5-827C-41C8-8CB2-3A1EA056AF5E}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{798391FE-4AF2-4851-9DDA-1F0D70C02A9E}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{7BA16B3F-1AB3-4BD7-B959-52C4B8504EE9}\InprocServer32 -> AcInetUI.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{7C239DAB-BC87-45F3-B7B1-FCC1541A235B}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{81D07C3D-0350-11D3-B7C2-0060B0EC020B}\InprocServer32 -> C:\2015\Inventor 2015\Bin\RxAppCtrl.Ocx (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{834CE679-2E47-49DE-9E41-FEC87E9192EB}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{8421A29C-54B8-11D1-9837-0060B03C43C8}\InprocServer32 -> C:\2015\Inventor 2015\Bin\SolidObject.Dll ()
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{846217D0-8954-11D2-8DCD-0060B0C32531}\InprocServer32 -> C:\2015\Inventor 2015\Bin\UCxTextBtn.Ocx (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{846217D1-8954-11D2-8DCD-0060B0C32531}\InprocServer32 -> C:\2015\Inventor 2015\Bin\UCxTextBtn.Ocx (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{849AFB5B-D6C9-4924-A712-F7118FF9611F}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{84B5A313-CD5D-4904-8BA2-AFDC81C1B309}\InprocServer32 -> C:\Program Files (x86)\Citrix\GoToMeeting\2331\G2MOutlookAddin64.dll (Citrix Online, a division of Citrix Systems, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{85452F88-5071-492E-B850-2E3C586DCBD8}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{87F5CF8F-A06D-498F-A05F-E520E6B570DB}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{89F0FC31-3B1D-494B-A75B-6BD4FA527B8A}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{8AA16DFC-DFC6-4B51-8FA2-A5D812BE33BF}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{8B0E6BD9-610C-11D1-9842-0060B03C43C8}\InprocServer32 -> C:\2015\Inventor 2015\Bin\SolidObject.Dll ()
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{8C23B656-4E6E-4B45-9920-9617168D39A3}\InprocServer32 -> C:\2015\Inventor 2015\Bin\TestServer.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{8ED07FEF-E1B0-4CC3-B2BA-D354828AB952}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{97E17F04-17DF-11d5-BC38-0010B5891E89}\InprocServer32 -> C:\2015\Inventor 2015\Bin\BodyReceiver.dll ()
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{988F4102-E6E3-4282-ACAC-55270827F2A8}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{9906CDFC-DB2C-4126-9422-13139B148495}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{9A21C6C5-27FC-4442-8590-575E7AFD73BB}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{9ECF83FB-23C5-43B6-83DE-93CFBDD74D4A}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{A58F47CC-FF65-4152-B0B1-666C643A5BFC}\InprocServer32 -> AcETransmit.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{A6A3D586-44CF-44C2-A92C-620BB713B4F2}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{ABBE3F83-D585-4A50-9B69-198B0F566F2E}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{AC5CECFA-F03A-41D2-A89C-704C44935941}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{B1560245-190E-4BBD-81DF-9B642D0E5325}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{B2A579E0-A797-40B1-8AEE-A8F6404719F8}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{B47196BC-D4AB-41BB-A771-543D67CFC9F5}\InprocServer32 -> AcETransmit.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{B53CEF4B-1A13-49DE-BBC5-A7100FB2F38C}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{B5EE2B68-9A23-4BCD-BB77-FEA6DFB24DD6}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{B6B5DC40-96E3-11d2-B774-0060B0F159EF}\localserver32 -> C:\2015\Inventor 2015\Bin\Inventor.exe (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{B80687F9-FA4C-4735-9DC4-E5715F2BC698}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{B8E7214B-25CA-4116-84CB-E86FB9625B36}\InprocServer32 -> C:\2015\Inventor 2015\Bin\ServiceModule.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{BAE5802A-CF21-4F9C-AE04-D98F4036AC31}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{BBF6A206-CB04-479D-96AE-349E1E83319A}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{BBF9FDF1-52DC-11D0-8C04-0800090BE8EC}\localserver32 -> C:\2015\Inventor 2015\Bin\Inventor.exe (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{BC71DEA1-D6FB-48B8-AB06-D151C81BBCDD}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{BE54741D-E02B-4572-93D6-105AF4EDE777}\InprocServer32 -> C:\2015\Inventor 2015\Bin\ServiceModule.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{BF224DC3-B602-4EEE-BFE9-9E4E0AED6837}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{BF4CC07E-E9BB-40D6-873F-855B211033B9}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{C061C82C-D041-4214-BB07-B608107CEFCB}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{C2D4ACCC-A3D1-4A0A-AD59-0DD8BA3D5EE1}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{C343ED84-A129-11d3-B799-0060B0F159EF}\InprocServer32 -> C:\2015\Inventor 2015\Bin\RxApprenticeServer.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{C8C18F89-794D-466B-8B97-95634D9890EF}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{C8EC7647-1E79-4F13-81D7-2EED803D0D22}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{C92F8F8C-8B2C-11d4-B872-0060B0EC020B}\InprocServer32 -> C:\2015\Inventor 2015\Bin\DtBridge.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{CC23CA32-9892-4FBA-A108-FE31CA0F35A6}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{CD865713-70D6-4E15-BB7B-9B99AD9DEB85}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{CFEE2BAF-14F9-4D23-853D-B6E2BCC14263}\InprocServer32 -> C:\2015\Inventor 2015\Bin\ServiceModule.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{D56F5AB3-9C4D-4F1A-A851-A671D9FE8C22}\InprocServer32 -> AcETransmit.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{D66873EA-AAE5-41CC-8DD2-8CE3228E9F89}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{D7A1987D-4A73-11D1-9A4B-080009DCE505}\InprocServer32 -> C:\2015\Inventor 2015\Bin\ColorButton.Ocx (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{D7A1987E-4A73-11D1-9A4B-080009DCE505}\InprocServer32 -> C:\2015\Inventor 2015\Bin\ColorButton.Ocx (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{D86B6C47-11F2-4D95-B635-EA575F0892FC}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{DA1F437C-9BD9-11d4-B87C-0060B0EC020B}\InprocServer32 -> C:\2015\Inventor 2015\Bin\DtBridge.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{DB207560-8449-4FAF-BDC2-61676EB012D4}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{DB5D476B-3FF4-4E9D-A606-1E2B473BE571}\InprocServer32 -> C:\2015\Inventor 2015\Bin\AcInetUI.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{DCA7356C-FF94-4b20-AE04-7AA6A8E14117}\InprocServer32 -> C:\2015\Inventor 2015\Bin\ServiceModule.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{DDA9A20F-5B56-49F5-9465-CE82FC199352}\InprocServer32 -> C:\2015\Inventor 2015\Bin\ServiceModule.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{DE6B563C-B074-4BF1-A8A0-B3FED8703E99}\InprocServer32 -> C:\2015\Inventor 2015\Bin\ServiceModule.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{DE74F5AD-DA2F-429F-BAF9-850A2808D585}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{DF6525C2-6358-4B07-813D-708120C5FE1A}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{E177A457-9EAA-43C3-A3CE-84874A28F6CA}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{E1C85E9F-60B2-4007-80C3-2C5E09474C3B}\InprocServer32 -> C:\2015\Inventor 2015\Bin\RxInventorUtilities.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{E29F6C45-6927-4508-8F3F-34105FD3FC5F}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{E2C40589-DE61-11ce-BAE0-0020AF6D7005}\InprocServer32 -> C:\2015\AutoCAD 2015\de-DE\acadficn.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{E4222C78-3670-4BB1-9AD4-7D8F3E581F2D}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{E5B0515D-48D2-4F04-906D-0192ED65A2DD}\InprocServer32 -> C:\2015\Inventor 2015\Bin\TestServer.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{E60F81E1-49B3-11D0-93C3-7E0706000000}\localserver32 -> C:\2015\Inventor 2015\Bin\Inventor.exe (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{E70DE962-842A-4488-9481-1D0FD72A020F}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{E9C07CEC-7B82-49E4-BBA2-7533B88E9D64}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{EA34A0C0-5CE7-4701-A6FA-117D25CD5EBB}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{EF01D98A-747B-4522-AD70-991B90855DBF}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{F13E75B9-6AF6-49CB-80B3-6D2FF6E09932}\InprocServer32 -> C:\2015\Inventor 2015\Bin\ServiceModule.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{F196F03F-651A-43AF-BE34-D11942F24445}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{F2D4F4E5-EEA1-46FF-A83B-A270C92DAE4B}\InprocServer32 -> C:\2015\Inventor 2015\Bin\DTInterop.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{F2DB0EE3-7137-4CB0-8349-483C4FF2143A}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{F40E2FF0-4D77-40B2-9A44-A3AEECCE8EFF}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{F5522F0C-962A-48AC-9992-E81B07628F1F}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{F61064CC-DBFB-47ee-9BC8-CA5A1CBDF0DA}\InprocServer32 -> C:\2015\Inventor 2015\Bin\InvResc.dll (Autodesk)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{F78DCF7C-043D-45FC-9D21-676FC307BA3F}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{F868EAEC-1B73-4F5E-BA73-90EBA94E75BE}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{FA62F626-EBD5-4dc5-B970-D9E81E0E20E0}\InprocServer32 -> C:\2015\Inventor 2015\Bin\ServiceModule.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{FA97F7A7-FD19-4D55-ABF2-CFEFFF777426}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{FB469644-3F14-4403-ACCA-6B13486FF7BD}\localserver32 -> C:\2015\Inventor 2015\Bin\InvTXTStack.exe (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{FD51ED8A-D518-4554-B236-B6E9D234FD03}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{FD703B01-4362-423E-9BDB-91BDCB16C1C9}\InprocServer32 -> C:\2015\Inventor 2015\Bin\DTInterop.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{FE054BB2-AF94-40AC-88AA-2F59F7018B1D}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{FE317223-8EDE-4684-B424-E48B9EA90220}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{FE718E8F-C3AA-4F30-9103-432450CF1DA1}\InprocServer32 -> axdb.dll No File

==================== Restore Points  =========================

24-03-2015 08:56:07 Removed Java 8 Update 40
08-04-2015 08:11:27 Windows Update
08-04-2015 09:50:19 Revo Uninstaller's restore point - ArchiPHYSIK 11 aut
11-04-2015 12:30:23 Windows Update
15-04-2015 01:49:48 Windows Update
15-04-2015 03:00:11 Windows Update
18-04-2015 13:55:51 Windows Update
22-04-2015 00:11:37 Windows Update
22-04-2015 09:16:17 Revo Uninstaller's restore point - JT2Go
22-04-2015 09:18:05 Installed JT2Go.
25-04-2015 00:19:42 Windows Update
28-04-2015 01:02:56 Windows Update
04-05-2015 08:52:29 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2014-10-01 14:39 - 00000892 ____A C:\Windows\system32\Drivers\etc\hosts


==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0047D990-32A3-4743-9C16-F2CDE90559B6} - System32\Tasks\{2A486EC4-1A89-4107-A1D9-79242CB7DF4B} => pcalua.exe -a C:\Users\*NAME*\AppData\Roaming\Oracle\Java\Uninstall\UninstallJavaVersions.exe -d "C:\Portable Apps\PortableApps\FirefoxPortable\App\firefox" -c -remove 1.7.0_67:32
Task: {05607697-2CAF-42F0-9465-70E812791512} - System32\Tasks\3DconnexionCreateProcess_3DxService.exe => C:\Program Files\3Dconnexion\3DxWare\3DxWinCore64\3DxService.exe [2014-06-23] (3Dconnexion, INC)
Task: {21EC8B28-7C81-44AF-820D-99EA0E245E16} - System32\Tasks\{A48601B8-0C32-4EA4-BDC3-BAD2E3B5164E} => pcalua.exe -a "C:\2015\Inventor 2015\Inventor2015ConnectSetup.exe" -d "C:\2015\Inventor 2015"
Task: {3956AAB4-91A3-402B-B37A-C81717B349A2} - System32\Tasks\{6156481B-CCE6-4A22-985F-5AD6E5CAAD1B} => pcalua.exe -a C:\Users\*NAME*\Downloads\Inventor2015ConnectSetup.exe -d C:\Users\*NAME*\Downloads
Task: {3C907C8B-B54C-4533-951E-FAF8868EA343} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx64\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2015-02-10] (Microsoft Corporation)
Task: {6EE83BD2-9293-4A71-9CE4-DB794159A882} - System32\Tasks\Core Temp Autostart CAD => C:\Program Files\Core Temp\Core Temp.exe [2013-10-08] ()
Task: {7B168B2B-DC0D-4216-AF69-1B80CD27A309} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-02-10] (Microsoft Corporation)
Task: {81E4189D-21D5-42A4-809B-1E6D6FEF3DBB} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-02-10] (Microsoft Corporation)
Task: {822B4ABE-3C32-4615-87D6-27A679BE9B34} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-04-15] (Adobe Systems Incorporated)
Task: {ADC172C1-BB03-4351-9B79-404EEA80FC05} - System32\Tasks\G2MUpdateTask-S-1-5-21-779854708-3996167121-2897795797-1172 => C:\Program Files (x86)\Citrix\GoToMeeting\2331\g2mupdate.exe [2015-05-04] (Citrix Online, a division of Citrix Systems, Inc.)
Task: {B0DE8FB4-578D-4D70-AE19-015D45CE4154} - System32\Tasks\Microsoft Office 15 Sync Maintenance for {07d4931b-8424-4072-8a2b-533ef1d23aa6} RECHNER01.office.local => C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [2015-02-10] (Microsoft Corporation)
Task: {B11F0678-3EBA-488B-9504-96453D59E39E} - System32\Tasks\{6E9EB1A9-C6AF-4DDF-A150-7515B5CA2E77} => pcalua.exe -a C:\Users\*NAM*~1\AppData\Local\Temp\jre-8u40-windows-au.exe -d "C:\Program Files (x86)\Java\jre1.8.0_31\bin" -c /installmethod=jau-m FAMILYUPGRADE=1
Task: {C19D6E93-00DD-477B-ACAA-C7376EB17A19} - System32\Tasks\Core Temp Autostart *NAME* => C:\Program Files\Core Temp\Core Temp.exe [2013-10-08] ()
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-779854708-3996167121-2897795797-1172.job => C:\Program Files (x86)\Citrix\GoToMeeting\2331\g2mupdate.exe

==================== Loaded Modules (whitelisted) ==============

2015-03-24 11:59 - 2015-03-13 21:41 - 03039376 _____ () C:\Windows\system32\nvwmi64.exe
2014-07-16 19:07 - 2014-05-20 09:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2014-01-23 13:43 - 2015-03-13 18:16 - 00118472 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2014-11-17 22:32 - 2014-11-17 22:32 - 00145920 _____ () C:\Users\*NAME*\AppData\Roaming\ernden\berdis.dll
2014-09-15 16:46 - 2013-10-08 13:23 - 00890016 _____ () C:\Program Files\Core Temp\Core Temp.exe
2014-06-23 20:37 - 2014-06-23 20:37 - 00044544 _____ () C:\Windows\system32\SPWINI.dll
2014-10-02 08:43 - 2014-10-02 08:43 - 00012520 _____ () C:\Users\*NAME*\AppData\Local\Microsoft\Windows Sidebar\Gadgets\All_CPU_Meter_V4.7.3.gadget\CoreTempReader.dll
2014-10-02 08:43 - 2014-10-02 08:43 - 00015080 _____ () C:\Users\*NAME*\AppData\Local\Microsoft\Windows Sidebar\Gadgets\All_CPU_Meter_V4.7.3.gadget\GetCoreTempInfoNET.dll
2014-10-02 08:43 - 2014-10-02 08:43 - 00014056 _____ () C:\Users\*NAME*\AppData\Local\Microsoft\Windows Sidebar\Gadgets\All_CPU_Meter_V4.7.3.gadget\SystemInfo.dll
2014-09-23 12:58 - 2007-09-02 13:58 - 00495616 _____ () C:\Portable Apps\PortableApps\RocketDock\RocketDock.exe
2015-04-13 08:54 - 2015-04-13 08:54 - 00046080 _____ () C:\Users\*NAME*\AppData\Local\KeePass\PluginCache\Rdz49q3UFxP1Oq9fT5Hh\Fleck2.dll
2014-09-15 15:25 - 2015-04-10 10:56 - 00385968 _____ () C:\Portable Apps\PortableApps\KeePass portable\KeePass.XmlSerializers.dll
2014-07-15 18:35 - 2014-12-05 04:27 - 00055688 _____ () C:\Program Files (x86)\Common Files\Autodesk Shared\AppManager\R1\QtSolutions_Service-head.dll
2014-07-15 18:35 - 2014-12-05 04:27 - 00104328 _____ () C:\Program Files (x86)\Common Files\Autodesk Shared\AppManager\R1\qjson0.dll
2013-11-04 21:29 - 2012-06-08 05:34 - 00627216 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMediaLibrary.dll
2012-06-08 21:34 - 2012-06-08 21:34 - 00016400 _____ () c:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvcPS.dll
2014-09-23 12:58 - 2007-09-02 13:57 - 00069632 _____ () C:\Portable Apps\PortableApps\RocketDock\RocketDock.dll
2012-09-23 20:43 - 2012-09-23 20:43 - 00010240 _____ () C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\locale\de_de\acrotray.deu
2015-05-06 08:38 - 2014-12-05 04:27 - 00104328 _____ () C:\Users\*NAME*\AppData\Local\Autodesk\.AdskAppManager\R1\qjson0.dll
2014-11-17 22:32 - 2014-11-17 22:32 - 00122880 _____ () C:\Users\*NAME*\AppData\Roaming\ernden\rewardca.dll
2015-05-06 08:38 - 2015-05-06 08:38 - 00029696 _____ () C:\Users\*NAME*\AppData\Local\Temp\nsa1C96.tmp\registry.dll
2015-05-06 08:38 - 2015-05-06 08:38 - 00008704 _____ () C:\Users\*NAME*\AppData\Local\Temp\nsa1C96.tmp\newadvsplash.dll
2015-05-06 08:38 - 2015-05-06 08:38 - 00011264 _____ () C:\Users\*NAME*\AppData\Local\Temp\nsa1C96.tmp\System.dll
2013-11-04 21:26 - 2013-07-11 01:16 - 01199576 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
2015-05-06 09:35 - 2015-05-06 09:35 - 00011264 _____ () C:\Users\*NAME*\AppData\Local\Temp\nslE5AF.tmp\System.dll
2015-04-25 20:52 - 2015-04-25 20:52 - 00218112 _____ () C:\Portable Apps\PortableApps\AIMPPortable\App\AIMP\System\libsoxr.dll
2015-04-25 20:52 - 2015-04-25 20:52 - 00467968 _____ () C:\Portable Apps\PortableApps\AIMPPortable\App\AIMP\System\Encoders\libFLAC.dll
2015-04-25 20:52 - 2015-04-25 20:52 - 01733120 _____ () C:\Portable Apps\PortableApps\AIMPPortable\App\AIMP\System\Encoders\aimp_libvorbis.dll
2015-04-25 20:52 - 2015-04-25 20:52 - 00059976 _____ () C:\Portable Apps\PortableApps\AIMPPortable\App\AIMP\Plugins\aimp_AnalogMeter\aimp_AnalogMeter.dll
2015-04-25 20:52 - 2015-04-25 20:52 - 00160840 _____ () C:\Portable Apps\PortableApps\AIMPPortable\App\AIMP\Plugins\aimp_cdda\aimp_cdda.dll
2015-04-25 20:52 - 2015-04-25 20:52 - 00159232 _____ () C:\Portable Apps\PortableApps\AIMPPortable\App\AIMP\Plugins\aimp_sacd\libsacd.dll
2015-04-25 20:52 - 2015-04-25 20:52 - 00026624 _____ () C:\Portable Apps\PortableApps\AIMPPortable\App\AIMP\Plugins\Aorta\Aorta.dll
2015-04-25 20:52 - 2015-04-25 20:52 - 00237568 _____ () C:\Portable Apps\PortableApps\AIMPPortable\App\AIMP\Plugins\OptimFROG\OptimFROG.dll
2015-04-25 20:52 - 2015-04-25 20:52 - 00152648 _____ () C:\Portable Apps\PortableApps\AIMPPortable\App\AIMP\Plugins\PandemicAnalogMeter\PandemicAnalogMeter.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, the associated entry will be removed from the registry.)

IE trusted site: HKU\S-1-5-21-779854708-3996167121-2897795797-1172\...\chip.de -> hxxp://www.chip.de


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-779854708-3996167121-2897795797-1172\Control Panel\Desktop\\Wallpaper -> C:\Users\*NAME*\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.0.20

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== FirewallRules (whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [{EF056D0E-6578-4E4B-BE08-34A78B41AC05}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12.exe
FirewallRules: [{65123027-D71D-4532-87DF-F93CF81087AF}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe
FirewallRules: [{0AC6D902-7655-4E13-979A-0B57E561517E}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe
FirewallRules: [{A3C3E7EC-B41E-45C3-9E33-64B176A7FF25}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12Agent.exe
FirewallRules: [{F47C1FE8-91DE-42AA-8758-07CE6139119B}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12ML.exe
FirewallRules: [{61AE2FF3-E900-4CA5-B795-9CEDCFCCCCC2}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDVD12\Movie\PowerDVD.exe
FirewallRules: [{62C82F3C-76F8-4F12-B0CC-6F44DD22A57E}] => (Allow) LPort=50248
FirewallRules: [{0B5152E8-1853-4034-BCD4-2857C64DA898}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\outlook.exe
FirewallRules: [{30CFF3CC-6359-448A-A2F1-C975EAD37BED}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\Lync.exe
FirewallRules: [{B0AA2CAD-927C-44D2-B0A2-C6FC54EA8FB6}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\UcMapi.exe
FirewallRules: [TCP Query User{8EA55079-6C16-4CB6-B7DD-5DF774F185D9}C:\2015\showcase 2015\bin\showcase.exe] => (Allow) C:\2015\showcase 2015\bin\showcase.exe
FirewallRules: [UDP Query User{B94B046D-FCE4-4C43-A093-57B17167D999}C:\2015\showcase 2015\bin\showcase.exe] => (Allow) C:\2015\showcase 2015\bin\showcase.exe
FirewallRules: [{32C2EC71-50AA-4D32-9204-CEB0B4509714}] => (Allow) \\SERVER\Software\Druckertreiber\CANON IPF 750\64bit\iPFSetup.exe
FirewallRules: [{2B619C45-9546-4E9E-83F7-3664DBC5E6B8}] => (Allow) \\SERVER\Software\Druckertreiber\CANON IPF 750\64bit\iPFSetup.exe
FirewallRules: [{E3E8B88B-AE26-4DFF-8808-FDD02A035497}] => (Allow) \\SERVER\Software\Druckertreiber\CANON IPF 750\64bit\iPFSetup.exe
FirewallRules: [{E649BC1C-7468-45BC-8C29-5D98C27743B7}] => (Allow) \\SERVER\Software\Druckertreiber\CANON IPF 750\64bit\iPFSetup.exe
FirewallRules: [{C0E71D27-E8F7-4975-AE57-574CD0303A13}] => (Allow) C:\Program Files\Canon\imagePROGRAFStatusMonitor\cnwism.exe
FirewallRules: [{10308854-CE14-4011-96DC-E0040D14F61A}] => (Allow) C:\Program Files\Canon\imagePROGRAFStatusMonitor\cnwism.exe
FirewallRules: [{AD652DDD-245F-4ECC-A39C-26D103F180EB}] => (Allow) C:\Program Files\Canon\imagePROGRAFStatusMonitor\cnwida.exe
FirewallRules: [{F30676D6-93B7-4169-AC3A-BB7D73023165}] => (Allow) C:\Program Files\Canon\imagePROGRAFStatusMonitor\cnwida.exe
FirewallRules: [TCP Query User{A4405184-8485-4073-8A9D-A7E251E81E7E}C:\portable apps\portableapps\skypeportable\app\skype\phone\skype.exe] => (Allow) C:\portable apps\portableapps\skypeportable\app\skype\phone\skype.exe
FirewallRules: [UDP Query User{5FE15974-4907-4DF4-8F84-11D1E5CE87B1}C:\portable apps\portableapps\skypeportable\app\skype\phone\skype.exe] => (Allow) C:\portable apps\portableapps\skypeportable\app\skype\phone\skype.exe
FirewallRules: [TCP Query User{4272C48E-BFA1-4743-B670-FBF3DA4C3C2E}C:\portable apps\portableapps\skypeportable\app\skype\phone\skype.exe] => (Allow) C:\portable apps\portableapps\skypeportable\app\skype\phone\skype.exe
FirewallRules: [UDP Query User{C5F7D05A-965D-45DE-970F-4D77A67782BA}C:\portable apps\portableapps\skypeportable\app\skype\phone\skype.exe] => (Allow) C:\portable apps\portableapps\skypeportable\app\skype\phone\skype.exe
FirewallRules: [{6D57713E-36D0-4F7F-9FA8-BEFA96A6EEEA}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\Lync.exe
FirewallRules: [{525F7463-DD75-4CDE-BD68-BD1114C4D4B0}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\UcMapi.exe
FirewallRules: [TCP Query User{8356A772-C900-4F29-A5C1-866398CEAC8A}C:\portable apps\portableapps\counter-strike source\hl2.exe] => (Allow) C:\portable apps\portableapps\counter-strike source\hl2.exe
FirewallRules: [UDP Query User{1B755C2B-C79C-4381-A92C-377F2AA29129}C:\portable apps\portableapps\counter-strike source\hl2.exe] => (Allow) C:\portable apps\portableapps\counter-strike source\hl2.exe
FirewallRules: [TCP Query User{3FB4B3A0-85DB-4959-AEC7-E84057DDC518}E:\voss-cad-katalog\software\lic\x86\cnslocal.exe] => (Allow) E:\voss-cad-katalog\software\lic\x86\cnslocal.exe
FirewallRules: [UDP Query User{B32986F1-3068-474B-AD8B-03A9D064EAA0}E:\voss-cad-katalog\software\lic\x86\cnslocal.exe] => (Allow) E:\voss-cad-katalog\software\lic\x86\cnslocal.exe
FirewallRules: [{B73EAEC8-02AF-4466-B78C-D8D1F85387B9}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [TCP Query User{04C019B9-E904-4302-9743-0B05FCF85329}C:\portable apps\portableapps\cod4\iw3mp.exe] => (Allow) C:\portable apps\portableapps\cod4\iw3mp.exe
FirewallRules: [UDP Query User{E5AE3635-0F10-4CE9-AB5E-B4002014223C}C:\portable apps\portableapps\cod4\iw3mp.exe] => (Allow) C:\portable apps\portableapps\cod4\iw3mp.exe
FirewallRules: [TCP Query User{3CF64B4E-E756-4499-90ED-B2B0CB4FC36E}E:\privat\cod4 - patched\iw3mp.exe] => (Allow) E:\privat\cod4 - patched\iw3mp.exe
FirewallRules: [UDP Query User{6C595B7E-D47B-4045-BB79-806DA9233EC7}E:\privat\cod4 - patched\iw3mp.exe] => (Allow) E:\privat\cod4 - patched\iw3mp.exe
FirewallRules: [TCP Query User{74BAAFA3-DE21-48C4-B324-345B791570BF}E:\privat\cod4 - portable patched - de\iw3mp.exe] => (Allow) E:\privat\cod4 - portable patched - de\iw3mp.exe
FirewallRules: [UDP Query User{B669D25C-A8CD-4394-966B-304C17D3CE4F}E:\privat\cod4 - portable patched - de\iw3mp.exe] => (Allow) E:\privat\cod4 - portable patched - de\iw3mp.exe
FirewallRules: [TCP Query User{D5AE5F75-AEF9-4C29-BCCC-0F3B530866CD}E:\privat\cod4 - portable patched - en\iw3mp.exe] => (Allow) E:\privat\cod4 - portable patched - en\iw3mp.exe
FirewallRules: [UDP Query User{26F255A3-6918-46B8-8A59-690A950A8B94}E:\privat\cod4 - portable patched - en\iw3mp.exe] => (Allow) E:\privat\cod4 - portable patched - en\iw3mp.exe
FirewallRules: [TCP Query User{2533592D-75DF-415D-997D-ABD1A932C46E}E:\privat\cod 4 - modern warfare (portable) - unpatched\iw3mp.exe] => (Allow) E:\privat\cod 4 - modern warfare (portable) - unpatched\iw3mp.exe
FirewallRules: [UDP Query User{15410DF2-6842-4D64-83F9-C10323C4267C}E:\privat\cod 4 - modern warfare (portable) - unpatched\iw3mp.exe] => (Allow) E:\privat\cod 4 - modern warfare (portable) - unpatched\iw3mp.exe
FirewallRules: [TCP Query User{475B4788-6936-4768-9276-A86A102D115F}E:\privat\cod 4 - modern warfare (portable) - de- patched\iw3mp.exe] => (Allow) E:\privat\cod 4 - modern warfare (portable) - de- patched\iw3mp.exe
FirewallRules: [UDP Query User{F10BA5B5-9972-454C-9E1D-0953307F8392}E:\privat\cod 4 - modern warfare (portable) - de- patched\iw3mp.exe] => (Allow) E:\privat\cod 4 - modern warfare (portable) - de- patched\iw3mp.exe
FirewallRules: [TCP Query User{98B04019-8631-4923-AD55-C06CF183BE7B}C:\portable apps\portableapps\aimpportable\app\aimp\aimp3.exe] => (Allow) C:\portable apps\portableapps\aimpportable\app\aimp\aimp3.exe
FirewallRules: [UDP Query User{7A8CCF9B-B45E-4D47-B9AF-D7ECFAE59375}C:\portable apps\portableapps\aimpportable\app\aimp\aimp3.exe] => (Allow) C:\portable apps\portableapps\aimpportable\app\aimp\aimp3.exe
FirewallRules: [TCP Query User{8A03E15E-C718-462F-B063-E1227DDB89E5}C:\portable apps\portableapps\firefoxportable\app\firefox\firefox.exe] => (Allow) C:\portable apps\portableapps\firefoxportable\app\firefox\firefox.exe
FirewallRules: [UDP Query User{85BE244D-C575-46A7-98AB-7BB8E4026661}C:\portable apps\portableapps\firefoxportable\app\firefox\firefox.exe] => (Allow) C:\portable apps\portableapps\firefoxportable\app\firefox\firefox.exe
FirewallRules: [{C11A66F7-9127-47E6-8C78-8BACD3F7E2A8}] => (Block) %ProgramFiles%\Internet Explorer\iexplore.exe
FirewallRules: [{9591FBED-6BA9-4C34-A492-02F2BF00528B}] => (Block) %ProgramFiles%\Internet Explorer\iexplore.exe
FirewallRules: [TCP Query User{5DA063AF-5256-47A4-BDC3-081DD5D517C6}E:\privat\firefoxportable\app\firefox\firefox.exe] => (Block) E:\privat\firefoxportable\app\firefox\firefox.exe
FirewallRules: [UDP Query User{65E46646-AC6A-4394-BB9E-399BF98F0039}E:\privat\firefoxportable\app\firefox\firefox.exe] => (Block) E:\privat\firefoxportable\app\firefox\firefox.exe
FirewallRules: [TCP Query User{A8C208C1-3421-4691-A735-6913C65C30CD}C:\portable apps\portableapps\firefoxportable\app\firefox\firefox.exe] => (Allow) C:\portable apps\portableapps\firefoxportable\app\firefox\firefox.exe
FirewallRules: [UDP Query User{EFD2AEBC-A867-45FD-B8D9-90B306E0F96D}C:\portable apps\portableapps\firefoxportable\app\firefox\firefox.exe] => (Allow) C:\portable apps\portableapps\firefoxportable\app\firefox\firefox.exe
FirewallRules: [TCP Query User{C8C4590C-418F-4A8A-9F03-B9D8E4F600CF}C:\portable apps\portableapps\keepass portable\keepass.exe] => (Allow) C:\portable apps\portableapps\keepass portable\keepass.exe
FirewallRules: [UDP Query User{90F2764C-09CB-43EC-8586-0DB58DED2BC6}C:\portable apps\portableapps\keepass portable\keepass.exe] => (Allow) C:\portable apps\portableapps\keepass portable\keepass.exe

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (05/06/2015 08:42:10 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.

Error: (05/06/2015 08:42:10 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (05/06/2015 08:42:10 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (05/06/2015 08:38:34 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: netlogon.exe, Version: 2.0.0.0, Zeitstempel: 0x41e45945
Name des fehlerhaften Moduls: WBDEF44I.DLL, Version: 5.6.2.0, Zeitstempel: 0x41f16c57
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00049ee5
ID des fehlerhaften Prozesses: 0xe14
Startzeit der fehlerhaften Anwendung: 0xnetlogon.exe0
Pfad der fehlerhaften Anwendung: netlogon.exe1
Pfad des fehlerhaften Moduls: netlogon.exe2
Berichtskennung: netlogon.exe3

Error: (05/04/2015 09:29:31 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.

Error: (05/04/2015 09:29:31 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (05/04/2015 09:29:31 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (05/04/2015 09:25:01 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: netlogon.exe, Version: 2.0.0.0, Zeitstempel: 0x41e45945
Name des fehlerhaften Moduls: WBDEF44I.DLL, Version: 5.6.2.0, Zeitstempel: 0x41f16c57
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00049ec9
ID des fehlerhaften Prozesses: 0xda4
Startzeit der fehlerhaften Anwendung: 0xnetlogon.exe0
Pfad der fehlerhaften Anwendung: netlogon.exe1
Pfad des fehlerhaften Moduls: netlogon.exe2
Berichtskennung: netlogon.exe3

Error: (05/04/2015 08:46:18 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.

Error: (05/04/2015 08:46:18 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.


System errors:
=============
Error: (05/06/2015 08:37:58 AM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎06.‎05.‎2015 um 08:36:13 unerwartet heruntergefahren.

Error: (05/05/2015 05:32:41 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {F9717507-6651-4EDB-BFF7-AE615179BCCF}

Error: (05/05/2015 11:21:49 AM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.

Error: (05/05/2015 11:21:49 AM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.

Error: (05/05/2015 11:21:33 AM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.

Error: (05/05/2015 11:21:33 AM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.

Error: (05/05/2015 11:21:33 AM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.

Error: (05/05/2015 08:28:33 AM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.

Error: (05/05/2015 08:28:33 AM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.

Error: (05/05/2015 08:28:32 AM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.


Microsoft Office Sessions:
=========================
Error: (05/06/2015 08:42:10 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000

Error: (05/06/2015 08:42:10 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (05/06/2015 08:42:10 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (05/06/2015 08:38:34 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: netlogon.exe2.0.0.041e45945WBDEF44I.DLL5.6.2.041f16c57c000000500049ee5e1401d087c7447de55c\\Server\netlogon\netlogon.exe\\Server\netlogon\WBDEF44I.DLL842c025f-f3ba-11e4-994c-a0d3c121c60b

Error: (05/04/2015 09:29:31 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000

Error: (05/04/2015 09:29:31 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (05/04/2015 09:29:31 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (05/04/2015 09:25:01 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: netlogon.exe2.0.0.041e45945WBDEF44I.DLL5.6.2.041f16c57c000000500049ec9da401d0863b6d930d0c\\Server\netlogon\netlogon.exe\\Server\netlogon\WBDEF44I.DLLac80a6b2-f22e-11e4-8505-a0d3c121c60b

Error: (05/04/2015 08:46:18 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000

Error: (05/04/2015 08:46:18 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000


CodeIntegrity Errors:
===================================
  Date: 2015-01-12 10:37:43.091
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\l3codeca.acm" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-10-07 13:14:30.598
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\l3codeca.acm" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-10-07 09:50:19.116
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\l3codeca.acm" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-10-07 08:07:54.623
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\l3codeca.acm" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-10-07 07:58:47.164
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\l3codeca.acm" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-10-06 09:14:20.681
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\l3codeca.acm" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-10-06 09:07:05.463
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\l3codeca.acm" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-10-06 08:27:02.899
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\l3codeca.acm" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-10-06 07:42:17.387
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\l3codeca.acm" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-10-06 07:05:10.868
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\l3codeca.acm" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Processor: Intel(R) Xeon(R) CPU E5-1620 v2 @ 3.70GHz
Percentage of memory in use: 12%
Total physical RAM: 32696.11 MB
Available physical RAM: 28699.71 MB
Total Pagefile: 65390.42 MB
Available Pagefile: 61076.7 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:164.75 GB) (Free:22.09 GB) NTFS
Drive d: (DATEN) (Fixed) (Total:58.59 GB) (Free:26.95 GB) NTFS
Drive e: (HDD) (Fixed) (Total:465.76 GB) (Free:81.75 GB) NTFS
Drive n: (System) (Network) (Total:1115.5 GB) (Free:414.73 GB) NTFS
Drive o: (System) (Network) (Total:1115.5 GB) (Free:414.73 GB) NTFS
Drive q: (System) (Network) (Total:1115.5 GB) (Free:414.73 GB) NTFS
Drive s: (System) (Network) (Total:1115.5 GB) (Free:414.73 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 223.6 GB) (Disk ID: 8434AE9E)

Partition: GPT Partition Type.

========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 465.8 GB) (Disk ID: 46F349D8)
Partition 1: (Not Active) - (Size=465.8 GB) - (Type=07 NTFS)

==================== End Of Log ============================

Code:

ATTFilter

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-05-06 15:32:26
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\0000006a ATA_____ rev.B710 223,57GB
Running: Gmer-19357.exe; Driver: C:\Users\*NAM*~1\AppData\Local\Temp\pwlcafow.sys


---- Kernel code sections - GMER 2.1 ----

.text    C:\Windows\System32\win32k.sys!W32pServiceTable                                                                                                                                    fffff96000104c00 7 bytes [00, 93, F3, FF, 41, A4, F0]
.text    C:\Windows\System32\win32k.sys!W32pServiceTable + 8                                                                                                                                fffff96000104c08 3 bytes [00, 07, 02]

---- User code sections - GMER 2.1 ----

.text    C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe[1872] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExW + 17                                   0000000076951401 2 bytes JMP 752fb1ef C:\Windows\syswow64\KERNEL32.dll
.text    C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe[1872] C:\Windows\syswow64\psapi.dll!EnumProcessModules + 17                                     0000000076951419 2 bytes JMP 752fb31a C:\Windows\syswow64\KERNEL32.dll
.text    C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe[1872] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 17                                   0000000076951431 2 bytes JMP 75378f09 C:\Windows\syswow64\KERNEL32.dll
.text    C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe[1872] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 42                                   000000007695144a 2 bytes CALL 752d4885 C:\Windows\syswow64\KERNEL32.dll
.text    ...                                                                                                                                                                                * 9
.text    C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe[1872] C:\Windows\syswow64\psapi.dll!EnumDeviceDrivers + 17                                      00000000769514dd 2 bytes JMP 75378802 C:\Windows\syswow64\KERNEL32.dll
.text    C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe[1872] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 17                               00000000769514f5 2 bytes JMP 753789d8 C:\Windows\syswow64\KERNEL32.dll
.text    C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe[1872] C:\Windows\syswow64\psapi.dll!QueryWorkingSetEx + 17                                      000000007695150d 2 bytes JMP 753786f8 C:\Windows\syswow64\KERNEL32.dll
.text    C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe[1872] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 17                               0000000076951525 2 bytes JMP 75378ac2 C:\Windows\syswow64\KERNEL32.dll
.text    C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe[1872] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameW + 17                                     000000007695153d 2 bytes JMP 752efc78 C:\Windows\syswow64\KERNEL32.dll
.text    C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe[1872] C:\Windows\syswow64\psapi.dll!EnumProcesses + 17                                          0000000076951555 2 bytes JMP 752f68bf C:\Windows\syswow64\KERNEL32.dll
.text    C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe[1872] C:\Windows\syswow64\psapi.dll!GetProcessMemoryInfo + 17                                   000000007695156d 2 bytes JMP 75378fc1 C:\Windows\syswow64\KERNEL32.dll
.text    C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe[1872] C:\Windows\syswow64\psapi.dll!GetPerformanceInfo + 17                                     0000000076951585 2 bytes JMP 75378b22 C:\Windows\syswow64\KERNEL32.dll
.text    C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe[1872] C:\Windows\syswow64\psapi.dll!QueryWorkingSet + 17                                        000000007695159d 2 bytes JMP 753786bc C:\Windows\syswow64\KERNEL32.dll
.text    C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe[1872] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameA + 17                                     00000000769515b5 2 bytes JMP 752efd11 C:\Windows\syswow64\KERNEL32.dll
.text    C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe[1872] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExA + 17                                   00000000769515cd 2 bytes JMP 752fb2b0 C:\Windows\syswow64\KERNEL32.dll
.text    C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe[1872] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 20                               00000000769516b2 2 bytes JMP 75378e84 C:\Windows\syswow64\KERNEL32.dll
.text    C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe[1872] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 31                               00000000769516bd 2 bytes JMP 75378651 C:\Windows\syswow64\KERNEL32.dll
.text    C:\Portable Apps\PortableApps\RocketDock\RocketDock.exe[4256] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                              0000000076951401 2 bytes JMP 752fb1ef C:\Windows\syswow64\kernel32.dll
.text    C:\Portable Apps\PortableApps\RocketDock\RocketDock.exe[4256] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                                0000000076951419 2 bytes JMP 752fb31a C:\Windows\syswow64\kernel32.dll
.text    C:\Portable Apps\PortableApps\RocketDock\RocketDock.exe[4256] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                              0000000076951431 2 bytes JMP 75378f09 C:\Windows\syswow64\kernel32.dll
.text    C:\Portable Apps\PortableApps\RocketDock\RocketDock.exe[4256] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                              000000007695144a 2 bytes CALL 752d4885 C:\Windows\syswow64\kernel32.dll
.text    ...                                                                                                                                                                                * 9
.text    C:\Portable Apps\PortableApps\RocketDock\RocketDock.exe[4256] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                                 00000000769514dd 2 bytes JMP 75378802 C:\Windows\syswow64\kernel32.dll
.text    C:\Portable Apps\PortableApps\RocketDock\RocketDock.exe[4256] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                          00000000769514f5 2 bytes JMP 753789d8 C:\Windows\syswow64\kernel32.dll
.text    C:\Portable Apps\PortableApps\RocketDock\RocketDock.exe[4256] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                                 000000007695150d 2 bytes JMP 753786f8 C:\Windows\syswow64\kernel32.dll
.text    C:\Portable Apps\PortableApps\RocketDock\RocketDock.exe[4256] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                          0000000076951525 2 bytes JMP 75378ac2 C:\Windows\syswow64\kernel32.dll
.text    C:\Portable Apps\PortableApps\RocketDock\RocketDock.exe[4256] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                                000000007695153d 2 bytes JMP 752efc78 C:\Windows\syswow64\kernel32.dll
.text    C:\Portable Apps\PortableApps\RocketDock\RocketDock.exe[4256] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                     0000000076951555 2 bytes JMP 752f68bf C:\Windows\syswow64\kernel32.dll
.text    C:\Portable Apps\PortableApps\RocketDock\RocketDock.exe[4256] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                              000000007695156d 2 bytes JMP 75378fc1 C:\Windows\syswow64\kernel32.dll
.text    C:\Portable Apps\PortableApps\RocketDock\RocketDock.exe[4256] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                                0000000076951585 2 bytes JMP 75378b22 C:\Windows\syswow64\kernel32.dll
.text    C:\Portable Apps\PortableApps\RocketDock\RocketDock.exe[4256] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                                   000000007695159d 2 bytes JMP 753786bc C:\Windows\syswow64\kernel32.dll
.text    C:\Portable Apps\PortableApps\RocketDock\RocketDock.exe[4256] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                                00000000769515b5 2 bytes JMP 752efd11 C:\Windows\syswow64\kernel32.dll
.text    C:\Portable Apps\PortableApps\RocketDock\RocketDock.exe[4256] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                              00000000769515cd 2 bytes JMP 752fb2b0 C:\Windows\syswow64\kernel32.dll
.text    C:\Portable Apps\PortableApps\RocketDock\RocketDock.exe[4256] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                          00000000769516b2 2 bytes JMP 75378e84 C:\Windows\syswow64\kernel32.dll
.text    C:\Portable Apps\PortableApps\RocketDock\RocketDock.exe[4256] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                          00000000769516bd 2 bytes JMP 75378651 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Internet Explorer\iexplore.exe[4288] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                                0000000076951401 2 bytes JMP 752fb1ef C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Internet Explorer\iexplore.exe[4288] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                                  0000000076951419 2 bytes JMP 752fb31a C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Internet Explorer\iexplore.exe[4288] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                                0000000076951431 2 bytes JMP 75378f09 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Internet Explorer\iexplore.exe[4288] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                                000000007695144a 2 bytes CALL 752d4885 C:\Windows\syswow64\kernel32.dll
.text    ...                                                                                                                                                                                * 9
.text    C:\Program Files (x86)\Internet Explorer\iexplore.exe[4288] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                                   00000000769514dd 2 bytes JMP 75378802 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Internet Explorer\iexplore.exe[4288] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                            00000000769514f5 2 bytes JMP 753789d8 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Internet Explorer\iexplore.exe[4288] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                                   000000007695150d 2 bytes JMP 753786f8 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Internet Explorer\iexplore.exe[4288] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                            0000000076951525 2 bytes JMP 75378ac2 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Internet Explorer\iexplore.exe[4288] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                                  000000007695153d 2 bytes JMP 752efc78 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Internet Explorer\iexplore.exe[4288] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                       0000000076951555 2 bytes JMP 752f68bf C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Internet Explorer\iexplore.exe[4288] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                                000000007695156d 2 bytes JMP 75378fc1 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Internet Explorer\iexplore.exe[4288] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                                  0000000076951585 2 bytes JMP 75378b22 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Internet Explorer\iexplore.exe[4288] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                                     000000007695159d 2 bytes JMP 753786bc C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Internet Explorer\iexplore.exe[4288] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                                  00000000769515b5 2 bytes JMP 752efd11 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Internet Explorer\iexplore.exe[4288] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                                00000000769515cd 2 bytes JMP 752fb2b0 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Internet Explorer\iexplore.exe[4288] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                            00000000769516b2 2 bytes JMP 75378e84 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Internet Explorer\iexplore.exe[4288] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                            00000000769516bd 2 bytes JMP 75378651 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[6476] C:\Windows\syswow64\kernel32.dll!CreateProcessW                                                                        00000000752d103d 5 bytes JMP 00000001035c92b2
.text    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[6476] C:\Windows\syswow64\advapi32.DLL!RegQueryValueExW                                                                      00000000761a462d 5 bytes JMP 00000001035ca963
.text    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[6476] C:\Windows\syswow64\user32.DLL!SetWindowPos                                                                            00000000753e8e4e 5 bytes JMP 00000001035c92eb
.text    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[6476] C:\Windows\syswow64\user32.DLL!ShowWindow                                                                              00000000753f0dfb 5 bytes JMP 00000001035c9330
.text    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[6476] C:\Windows\syswow64\user32.DLL!MessageBeep                                                                             00000000753fc036 5 bytes JMP 00000001035cac9d
.text    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[6476] C:\Windows\syswow64\user32.DLL!SetForegroundWindow                                                                     000000007540f170 5 bytes JMP 00000001035c92e6
.text    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[6476] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                                0000000076951401 2 bytes JMP 752fb1ef C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[6476] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                                  0000000076951419 2 bytes JMP 752fb31a C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[6476] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                                0000000076951431 2 bytes JMP 75378f09 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[6476] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                                000000007695144a 2 bytes CALL 752d4885 C:\Windows\syswow64\kernel32.dll
.text    ...                                                                                                                                                                                * 9
.text    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[6476] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                                   00000000769514dd 2 bytes JMP 75378802 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[6476] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                            00000000769514f5 2 bytes JMP 753789d8 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[6476] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                                   000000007695150d 2 bytes JMP 753786f8 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[6476] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                            0000000076951525 2 bytes JMP 75378ac2 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[6476] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                                  000000007695153d 2 bytes JMP 752efc78 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[6476] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                       0000000076951555 2 bytes JMP 752f68bf C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[6476] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                                000000007695156d 2 bytes JMP 75378fc1 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[6476] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                                  0000000076951585 2 bytes JMP 75378b22 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[6476] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                                     000000007695159d 2 bytes JMP 753786bc C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[6476] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                                  00000000769515b5 2 bytes JMP 752efd11 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[6476] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                                00000000769515cd 2 bytes JMP 752fb2b0 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[6476] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                            00000000769516b2 2 bytes JMP 75378e84 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[6476] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                            00000000769516bd 2 bytes JMP 75378651 C:\Windows\syswow64\kernel32.dll
.text    C:\Portable Apps\PortableApps\PortableApps.com\PortableAppsPlatform.exe[5636] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                              0000000076951401 2 bytes JMP 752fb1ef C:\Windows\syswow64\kernel32.dll
.text    C:\Portable Apps\PortableApps\PortableApps.com\PortableAppsPlatform.exe[5636] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                0000000076951419 2 bytes JMP 752fb31a C:\Windows\syswow64\kernel32.dll
.text    C:\Portable Apps\PortableApps\PortableApps.com\PortableAppsPlatform.exe[5636] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                              0000000076951431 2 bytes JMP 75378f09 C:\Windows\syswow64\kernel32.dll
.text    C:\Portable Apps\PortableApps\PortableApps.com\PortableAppsPlatform.exe[5636] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                              000000007695144a 2 bytes CALL 752d4885 C:\Windows\syswow64\kernel32.dll
.text    ...                                                                                                                                                                                * 9
.text    C:\Portable Apps\PortableApps\PortableApps.com\PortableAppsPlatform.exe[5636] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                 00000000769514dd 2 bytes JMP 75378802 C:\Windows\syswow64\kernel32.dll
.text    C:\Portable Apps\PortableApps\PortableApps.com\PortableAppsPlatform.exe[5636] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                          00000000769514f5 2 bytes JMP 753789d8 C:\Windows\syswow64\kernel32.dll
.text    C:\Portable Apps\PortableApps\PortableApps.com\PortableAppsPlatform.exe[5636] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                 000000007695150d 2 bytes JMP 753786f8 C:\Windows\syswow64\kernel32.dll
.text    C:\Portable Apps\PortableApps\PortableApps.com\PortableAppsPlatform.exe[5636] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                          0000000076951525 2 bytes JMP 75378ac2 C:\Windows\syswow64\kernel32.dll
.text    C:\Portable Apps\PortableApps\PortableApps.com\PortableAppsPlatform.exe[5636] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                000000007695153d 2 bytes JMP 752efc78 C:\Windows\syswow64\kernel32.dll
.text    C:\Portable Apps\PortableApps\PortableApps.com\PortableAppsPlatform.exe[5636] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                     0000000076951555 2 bytes JMP 752f68bf C:\Windows\syswow64\kernel32.dll
.text    C:\Portable Apps\PortableApps\PortableApps.com\PortableAppsPlatform.exe[5636] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                              000000007695156d 2 bytes JMP 75378fc1 C:\Windows\syswow64\kernel32.dll
.text    C:\Portable Apps\PortableApps\PortableApps.com\PortableAppsPlatform.exe[5636] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                0000000076951585 2 bytes JMP 75378b22 C:\Windows\syswow64\kernel32.dll
.text    C:\Portable Apps\PortableApps\PortableApps.com\PortableAppsPlatform.exe[5636] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                   000000007695159d 2 bytes JMP 753786bc C:\Windows\syswow64\kernel32.dll
.text    C:\Portable Apps\PortableApps\PortableApps.com\PortableAppsPlatform.exe[5636] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                00000000769515b5 2 bytes JMP 752efd11 C:\Windows\syswow64\kernel32.dll
.text    C:\Portable Apps\PortableApps\PortableApps.com\PortableAppsPlatform.exe[5636] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                              00000000769515cd 2 bytes JMP 752fb2b0 C:\Windows\syswow64\kernel32.dll
.text    C:\Portable Apps\PortableApps\PortableApps.com\PortableAppsPlatform.exe[5636] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                          00000000769516b2 2 bytes JMP 75378e84 C:\Windows\syswow64\kernel32.dll
.text    C:\Portable Apps\PortableApps\PortableApps.com\PortableAppsPlatform.exe[5636] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                          00000000769516bd 2 bytes JMP 75378651 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\*NAME*\Desktop\Gmer-19357.exe[6560] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                                            0000000076951401 2 bytes JMP 752fb1ef C:\Windows\syswow64\kernel32.dll
.text    C:\Users\*NAME*\Desktop\Gmer-19357.exe[6560] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                                              0000000076951419 2 bytes JMP 752fb31a C:\Windows\syswow64\kernel32.dll
.text    C:\Users\*NAME*\Desktop\Gmer-19357.exe[6560] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                                            0000000076951431 2 bytes JMP 75378f09 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\*NAME*\Desktop\Gmer-19357.exe[6560] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                                            000000007695144a 2 bytes CALL 752d4885 C:\Windows\syswow64\kernel32.dll
.text    ...                                                                                                                                                                                * 9
.text    C:\Users\*NAME*\Desktop\Gmer-19357.exe[6560] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                                               00000000769514dd 2 bytes JMP 75378802 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\*NAME*\Desktop\Gmer-19357.exe[6560] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                                        00000000769514f5 2 bytes JMP 753789d8 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\*NAME*\Desktop\Gmer-19357.exe[6560] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                                               000000007695150d 2 bytes JMP 753786f8 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\*NAME*\Desktop\Gmer-19357.exe[6560] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                                        0000000076951525 2 bytes JMP 75378ac2 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\*NAME*\Desktop\Gmer-19357.exe[6560] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                                              000000007695153d 2 bytes JMP 752efc78 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\*NAME*\Desktop\Gmer-19357.exe[6560] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                                   0000000076951555 2 bytes JMP 752f68bf C:\Windows\syswow64\kernel32.dll
.text    C:\Users\*NAME*\Desktop\Gmer-19357.exe[6560] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                                            000000007695156d 2 bytes JMP 75378fc1 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\*NAME*\Desktop\Gmer-19357.exe[6560] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                                              0000000076951585 2 bytes JMP 75378b22 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\*NAME*\Desktop\Gmer-19357.exe[6560] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                                                 000000007695159d 2 bytes JMP 753786bc C:\Windows\syswow64\kernel32.dll
.text    C:\Users\*NAME*\Desktop\Gmer-19357.exe[6560] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                                              00000000769515b5 2 bytes JMP 752efd11 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\*NAME*\Desktop\Gmer-19357.exe[6560] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                                            00000000769515cd 2 bytes JMP 752fb2b0 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\*NAME*\Desktop\Gmer-19357.exe[6560] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                                        00000000769516b2 2 bytes JMP 75378e84 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\*NAME*\Desktop\Gmer-19357.exe[6560] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                                        00000000769516bd 2 bytes JMP 75378651 C:\Windows\syswow64\kernel32.dll

---- Threads - GMER 2.1 ----

Thread   C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE [6476:3916]                                                                                                                  00000000035cae96
---- Processes - GMER 2.1 ----

Library  C:\Users\*NAME*\AppData\Roaming\ernden\berdis.dll (*** suspicious ***) @ C:\Program Files\Internet Explorer\IEXPLORE.EXE [4668]                                                 000007feef970000
Library  C:\Users\*NAME*\AppData\Roaming\ernden\rewardca.dll (*** suspicious ***) @ C:\Portable Apps\PortableApps\PortableApps.com\PortableAppsPlatform.exe [5636](2014-11-17 20:32:20)  000000006c140000

---- Disk sectors - GMER 2.1 ----

Disk     \Device\Harddisk0\DR0                                                                                                                                                              unknown MBR code

---- EOF - GMER 2.1 ----

deeprybka · 07.05.2015, 09:51

Hi,

Schritt 1

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Morphy · 07.05.2015, 11:50

Hallo Jürgen,

ComboFix lief durch. Dumm war nur, dass ich noch Programmstarts im Autostart hatte, darum musste ich anschließend den Rechner nochmals neustarten.

Hier der ComboFix-log

Code:

ATTFilter

ComboFix 15-05-07.01 - *NAME* 07.05.2015  11:16:47.1.8 - x64
Microsoft Windows 7 Professional   6.1.7601.1.1252.43.1031.18.32696.28416 [GMT 2:00]
ausgeführt von:: c:\users\*NAME*\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {4F35CFC4-45A3-FC37-EF17-759A02E39AB1}
SP: Microsoft Security Essentials *Disabled/Updated* {F4542E20-6399-F3B9-D5A7-4EE87964D00C}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\ntuser.pol
c:\users\CAD\AppData\Local\Microsoft\Windows\Temporary Internet Files\{C5E5FF67-B87F-4435-8643-74EF0FA37218}.xps
c:\users\CAD\AppData\Local\Microsoft\Windows\Temporary Internet Files\Advisor.msi
c:\users\*NAM*~1\AppData\Local\Temp\nsh13EF.tmp\System.dll
c:\users\*NAM*~1\AppData\Local\Temp\nskF97C.tmp\newadvsplash.dll
c:\users\*NAM*~1\AppData\Local\Temp\nskF97C.tmp\registry.dll
c:\users\*NAM*~1\AppData\Local\Temp\nskF97C.tmp\System.dll
c:\users\*NAME*\AppData\Local\Microsoft\Windows\Temporary Internet Files\fmAAF1
c:\users\*NAME*\AppData\Local\Microsoft\Windows\Temporary Internet Files\scrollbar.css
c:\users\*NAME*\AppData\Local\Microsoft\Windows\Temporary Internet Files\unknown(10-24-10-43-34)(1).gif
c:\users\*NAME*\AppData\Local\Microsoft\Windows\Temporary Internet Files\unknown(10-24-10-43-34)(2).gif
c:\users\*NAME*\AppData\Local\Microsoft\Windows\Temporary Internet Files\unknown(10-24-10-43-34)(4).gif
c:\users\*NAME*\AppData\Local\Microsoft\Windows\Temporary Internet Files\unknown(10-24-10-43-34)(5).gif
c:\users\*NAME*\AppData\Local\Microsoft\Windows\Temporary Internet Files\unknown(10-24-10-43-34)(6).gif
c:\users\*NAME*\AppData\Local\Temp\nsh13EF.tmp\System.dll
c:\users\*NAME*\AppData\Local\Temp\nskF97C.tmp\newadvsplash.dll
c:\users\*NAME*\AppData\Local\Temp\nskF97C.tmp\registry.dll
c:\users\*NAME*\AppData\Local\Temp\nskF97C.tmp\System.dll
c:\windows\Downloaded Program Files\IDropPTB.dll
c:\windows\wininit.ini
C:\WindowsServer2008r2.mdx
.
.
(((((((((((((((((((((((   Dateien erstellt von 2015-04-07 bis 2015-05-07  ))))))))))))))))))))))))))))))
.
.
2015-05-06 22:14 . 2015-04-04 06:25	12032440	----a-w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{B718046E-F266-4E59-B968-F9416F13753F}\mpengine.dll
2015-05-06 13:40 . 2015-04-04 06:25	12032440	----a-w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2015-04-29 06:54 . 2015-04-29 06:54	--------	d-----w-	c:\users\*NAME*\AppData\Roaming\SkypePM
2015-04-23 06:33 . 2015-04-23 06:33	--------	d-----w-	c:\users\*NAME*\AppData\Local\Google
2015-04-15 13:07 . 2015-04-15 13:07	--------	d-----w-	c:\program files (x86)\Common Files\Java
2015-04-15 01:01 . 2015-03-17 05:16	86528	----a-w-	c:\windows\system32\TSpkg.dll
2015-04-15 01:00 . 2015-02-25 03:18	754688	----a-w-	c:\windows\system32\drivers\http.sys
2015-04-08 06:11 . 2015-04-08 06:11	1187344	----a-w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{13F8B824-C432-4333-8119-7CEFB59775AE}\gapaengine.dll
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-04-15 15:05 . 2014-09-30 08:18	778416	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2015-04-15 15:05 . 2014-09-30 08:18	142512	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2015-04-15 13:07 . 2015-03-24 06:57	98216	----a-w-	c:\windows\SysWow64\WindowsAccessBridge-32.dll
2015-03-17 04:56 . 2015-04-15 01:01	44032	----a-w-	c:\windows\apppatch\acwow64.dll
2015-03-16 21:32 . 2015-03-24 09:58	30536	----a-w-	c:\windows\system32\nvhdap64.dll
2015-03-16 21:32 . 2015-03-24 09:58	195728	----a-w-	c:\windows\system32\drivers\nvhda64v.sys
2015-03-16 21:32 . 2015-03-24 09:58	1540240	----a-w-	c:\windows\system32\nvhdagenco6420103.dll
2015-03-13 19:41 . 2015-03-24 09:59	3039376	----a-w-	c:\windows\system32\nvwmi64.exe
2015-03-13 19:41 . 2015-03-24 09:58	997856	----a-w-	c:\windows\system32\nvumdshimx.dll
2015-03-13 19:41 . 2015-03-24 09:58	970384	----a-w-	c:\windows\system32\NvIFR64.dll
2015-03-13 19:41 . 2015-03-24 09:58	944784	----a-w-	c:\windows\system32\NvFBC64.dll
2015-03-13 19:41 . 2015-03-24 09:58	930448	----a-w-	c:\windows\SysWow64\NvIFR.dll
2015-03-13 19:41 . 2015-03-24 09:58	909512	----a-w-	c:\windows\SysWow64\NvFBC.dll
2015-03-13 19:41 . 2015-03-24 09:58	878328	----a-w-	c:\windows\SysWow64\nvumdshim.dll
2015-03-13 19:41 . 2015-03-24 09:58	496272	----a-w-	c:\windows\system32\nvEncodeAPI64.dll
2015-03-13 19:41 . 2015-03-24 09:58	400584	----a-w-	c:\windows\SysWow64\nvEncodeAPI.dll
2015-03-13 19:41 . 2015-03-24 09:58	390288	----a-w-	c:\windows\system32\NvIFROpenGL.dll
2015-03-13 19:41 . 2015-03-24 09:58	3611792	----a-w-	c:\windows\system32\nvcuvid.dll
2015-03-13 19:41 . 2015-03-24 09:58	354112	----a-w-	c:\windows\system32\nvoglshim64.dll
2015-03-13 19:41 . 2015-03-24 09:58	346824	----a-w-	c:\windows\SysWow64\NvIFROpenGL.dll
2015-03-13 19:41 . 2015-03-24 09:58	3249352	----a-w-	c:\windows\SysWow64\nvcuvid.dll
2015-03-13 19:41 . 2015-03-24 09:58	32114888	----a-w-	c:\windows\system32\nvoglv64.dll
2015-03-13 19:41 . 2015-03-24 09:58	306208	----a-w-	c:\windows\SysWow64\nvoglshim32.dll
2015-03-13 19:41 . 2015-03-24 09:58	25460880	----a-w-	c:\windows\system32\nvcompiler.dll
2015-03-13 19:41 . 2015-03-24 09:58	24775368	----a-w-	c:\windows\SysWow64\nvoglv32.dll
2015-03-13 19:41 . 2015-03-24 09:58	20466376	----a-w-	c:\windows\SysWow64\nvcompiler.dll
2015-03-13 19:41 . 2015-03-24 09:58	1896136	----a-w-	c:\windows\system32\nvdispco6434788.dll
2015-03-13 19:41 . 2015-03-24 09:58	178512	----a-w-	c:\windows\system32\nvinitx.dll
2015-03-13 19:41 . 2015-03-24 09:58	164568	----a-w-	c:\windows\SysWow64\nvinit.dll
2015-03-13 19:41 . 2015-03-24 09:58	1557648	----a-w-	c:\windows\system32\nvdispgenco6434788.dll
2015-03-13 19:41 . 2015-03-24 09:58	14121624	----a-w-	c:\windows\SysWow64\nvd3dum.dll
2015-03-13 19:41 . 2015-03-24 09:58	13297144	----a-w-	c:\windows\system32\nvopencl.dll
2015-03-13 19:41 . 2015-03-24 09:58	13210080	----a-w-	c:\windows\system32\nvcuda.dll
2015-03-13 19:41 . 2015-03-24 09:58	10775080	----a-w-	c:\windows\SysWow64\nvopencl.dll
2015-03-13 19:41 . 2015-03-24 09:58	10715864	----a-w-	c:\windows\SysWow64\nvcuda.dll
2015-03-13 19:41 . 2015-03-24 09:58	10262160	----a-w-	c:\windows\system32\drivers\nvlddmkm.sys
2015-03-13 19:41 . 2013-06-05 14:52	17258024	----a-w-	c:\windows\system32\nvd3dumx.dll
2015-03-13 19:41 . 2013-06-05 14:52	16022016	----a-w-	c:\windows\SysWow64\nvwgf2um.dll
2015-03-13 19:41 . 2013-06-05 14:52	18580512	----a-w-	c:\windows\system32\nvwgf2umx.dll
2015-03-13 19:41 . 2013-06-05 14:52	2906928	----a-w-	c:\windows\SysWow64\nvapi.dll
2015-03-13 19:41 . 2013-06-05 14:52	3303448	----a-w-	c:\windows\system32\nvapi64.dll
2015-03-13 16:16 . 2014-01-23 11:43	3526856	----a-w-	c:\windows\system32\nvsvc64.dll
2015-03-13 16:16 . 2014-01-23 11:43	6861968	----a-w-	c:\windows\system32\nvcpl.dll
2015-03-13 16:16 . 2014-01-23 11:43	75976	----a-w-	c:\windows\system32\nv3dappshextr.dll
2015-03-13 16:16 . 2014-01-23 11:43	62608	----a-w-	c:\windows\system32\nvshext.dll
2015-03-13 16:16 . 2014-01-23 11:43	1099408	----a-w-	c:\windows\system32\nv3dappshext.dll
2015-03-13 16:16 . 2014-01-23 11:43	935056	----a-w-	c:\windows\system32\nvvsvc.exe
2015-03-13 16:16 . 2014-01-23 11:43	386248	----a-w-	c:\windows\system32\nvmctray.dll
2015-03-13 16:16 . 2014-01-23 11:43	2559808	----a-w-	c:\windows\system32\nvsvcr.dll
2015-03-13 15:38 . 2015-03-24 09:58	622224	----a-w-	c:\windows\SysWow64\nvStreaming.exe
2015-03-11 13:10 . 2014-01-23 11:43	4246327	----a-w-	c:\windows\system32\nvcoproc.bin
2015-03-10 08:45 . 2014-07-16 17:19	907976	----a-w-	c:\programdata\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe
2015-03-03 13:17 . 2010-11-21 03:27	295552	------w-	c:\windows\system32\MpSigStub.exe
2015-02-26 03:25 . 2015-03-11 07:52	3204096	----a-w-	c:\windows\system32\win32k.sys
2015-02-20 04:41 . 2015-03-11 07:55	41984	----a-w-	c:\windows\system32\lpk.dll
2015-02-20 04:40 . 2015-03-11 07:55	100864	----a-w-	c:\windows\system32\fontsub.dll
2015-02-20 04:40 . 2015-03-11 07:55	14336	----a-w-	c:\windows\system32\dciman32.dll
2015-02-20 04:40 . 2015-03-11 07:55	46080	----a-w-	c:\windows\system32\atmlib.dll
2015-02-20 04:13 . 2015-03-11 07:55	70656	----a-w-	c:\windows\SysWow64\fontsub.dll
2015-02-20 04:13 . 2015-03-11 07:55	10240	----a-w-	c:\windows\SysWow64\dciman32.dll
2015-02-20 04:13 . 2015-03-11 07:55	34304	----a-w-	c:\windows\SysWow64\atmlib.dll
2015-02-20 04:12 . 2015-03-11 07:55	25600	----a-w-	c:\windows\SysWow64\lpk.dll
2015-02-20 03:29 . 2015-03-11 07:55	372224	----a-w-	c:\windows\system32\atmfd.dll
2015-02-20 03:09 . 2015-03-11 07:55	299008	----a-w-	c:\windows\SysWow64\atmfd.dll
2015-02-13 05:22 . 2015-03-11 07:53	14177280	----a-w-	c:\windows\system32\shell32.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro1 (ErrorConflict)]
@="{8BA85C75-763B-4103-94EB-9470F12FE0F7}"
[HKEY_CLASSES_ROOT\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7}]
2015-03-10 07:22	1729752	----a-w-	c:\program files\Microsoft Office 15\root\vfs\ProgramFilesX86\Microsoft Office\Office15\grooveex.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro2 (SyncInProgress)]
@="{CD55129A-B1A1-438E-A425-CEBC7DC684EE}"
[HKEY_CLASSES_ROOT\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE}]
2015-03-10 07:22	1729752	----a-w-	c:\program files\Microsoft Office 15\root\vfs\ProgramFilesX86\Microsoft Office\Office15\grooveex.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro3 (InSync)]
@="{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}"
[HKEY_CLASSES_ROOT\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}]
2015-03-10 07:22	1729752	----a-w-	c:\program files\Microsoft Office 15\root\vfs\ProgramFilesX86\Microsoft Office\Office15\grooveex.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IMSS"="c:\program files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe" [2013-07-10 134616]
"CLMLServer_For_P2G8"="c:\program files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe" [2012-11-21 111136]
"CLVirtualDrive"="c:\program files (x86)\CyberLink\Power2Go8\VirtualDrive.exe" [2012-11-21 493088]
"ADSKAppManager"="c:\program files (x86)\Common Files\Autodesk Shared\AppManager\R1\AdAppMgr.exe" [2014-12-05 493960]
"PDFPrint"="c:\program files (x86)\PDF24\pdf24.exe" [2014-07-04 191528]
"Acrobat Assistant 8.0"="c:\program files (x86)\Adobe\Acrobat 11.0\Acrobat\Acrotray.exe" [2014-09-12 3499920]
.
c:\users\CAD\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Start.exe - Verknüpfung.lnk - c:\portable apps\Start.exe [2015-5-7 523264]
.
c:\users\*NAME*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Programmstarts.cmd [2015-3-24 670]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
imagePROGRAF Status Monitor.lnk - c:\program files\Canon\imagePROGRAFStatusMonitor\cnwism.exe /w [2014-9-29 608016]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute	REG_MULTI_SZ   	autocheck autochk *\0\0sdnclean64.exe
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 FlexNet Licensing Service 64;FlexNet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FlexNet Publisher\FNPLicensingService64.exe;c:\program files\Common Files\Macrovision Shared\FlexNet Publisher\FNPLicensingService64.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 Intel(R) Capability Licensing Service TCP IP Interface;Intel(R) Capability Licensing Service TCP IP Interface;c:\program files\Intel\iCLS Client\SocketHeciServer.exe;c:\program files\Intel\iCLS Client\SocketHeciServer.exe [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Microsoft-Netzwerkinspektion;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x]
R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
S0 iaStorA;iaStorA;c:\windows\system32\drivers\iaStorA.sys;c:\windows\SYSNATIVE\drivers\iaStorA.sys [x]
S0 iaStorF;iaStorF;c:\windows\system32\drivers\iaStorF.sys;c:\windows\SYSNATIVE\drivers\iaStorF.sys [x]
S0 iaStorS;iaStorS;c:\windows\system32\drivers\iaStorS.sys;c:\windows\SYSNATIVE\drivers\iaStorS.sys [x]
S1 CLVirtualDrive;CLVirtualDrive;c:\windows\system32\DRIVERS\CLVirtualDrive.sys;c:\windows\SYSNATIVE\DRIVERS\CLVirtualDrive.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]
S2 AdAppMgrSvc;Autodesk Application Manager Service;c:\program files (x86)\Common Files\Autodesk Shared\AppManager\R1\AdAppMgrSvc.exe ;c:\program files (x86)\Common Files\Autodesk Shared\AppManager\R1\AdAppMgrSvc.exe  [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 Autodesk Content Service;Autodesk Content Service;c:\program files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe;c:\program files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [x]
S2 Canon imagePROGRAF Status Monitor;Canon imagePROGRAF Status Monitor;c:\program files\Canon\imagePROGRAFStatusMonitor\cnwisam.exe;c:\program files\Canon\imagePROGRAFStatusMonitor\cnwisam.exe [x]
S2 ClickToRunSvc;Microsoft Office-Klick-und-Los-Dienst;c:\program files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe;c:\program files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [x]
S2 HPSupportSolutionsFrameworkService;HP Support Solutions Framework Service;c:\program files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe;c:\program files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe [x]
S2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe;c:\program files\Intel\iCLS Client\HeciServer.exe [x]
S2 Intel(R) PROSet Monitoring Service;Intel(R) PROSet Monitoring Service;c:\windows\system32\IProsetMonitor.exe;c:\windows\SYSNATIVE\IProsetMonitor.exe [x]
S2 iPFDeviceAgentService;iPF Device Agent Service;c:\windows\system32\cnwiols6.exe;c:\windows\SYSNATIVE\cnwiols6.exe [x]
S2 Mgl3DCtlrRPCService;3Dconnexion Broker Service;c:\program files\3Dconnexion\3DxWare\3DxWinCore64\Mgl3DCtlrRPCService.exe;c:\program files\3Dconnexion\3DxWare\3DxWinCore64\Mgl3DCtlrRPCService.exe [x]
S2 mitsijm2015;Autodesk Simulation Moldflow MITSI 2015 Job-Manager;c:\2015\Inventor 2015\Moldflow\bin\mitsijm.exe;c:\2015\Inventor 2015\Moldflow\bin\mitsijm.exe [x]
S2 NVWMI;NVIDIA WMI Provider;c:\windows\system32\nvwmi64.exe;c:\windows\SYSNATIVE\nvwmi64.exe [x]
S2 RtkAudioService;Realtek Audio Service;c:\program files\Realtek\Audio\HDA\RtkAudioService64.exe;c:\program files\Realtek\Audio\HDA\RtkAudioService64.exe [x]
S2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S3 3dxhid;3Dconnexion HID filter;c:\windows\system32\DRIVERS\3dxhid.sys;c:\windows\SYSNATIVE\DRIVERS\3dxhid.sys [x]
S3 ALSysIO;ALSysIO;c:\users\*NAM*~1\AppData\Local\Temp\ALSysIO64.sys;c:\users\*NAM*~1\AppData\Local\Temp\ALSysIO64.sys [x]
S3 KMJHidMini;3Dconnexion KMJ Emulator;c:\windows\system32\DRIVERS\3dxkmj.sys;c:\windows\SYSNATIVE\DRIVERS\3dxkmj.sys [x]
S3 KMJShim;3Dconnexion KMJ Emulator Shim;c:\windows\system32\DRIVERS\3dxshim.sys;c:\windows\SYSNATIVE\DRIVERS\3dxshim.sys [x]
S3 LGPBTDD;LGPBTDD.sys Display Driver;c:\windows\system32\Drivers\LGPBTDD.sys;c:\windows\SYSNATIVE\Drivers\LGPBTDD.sys [x]
S3 tihub3;TI USB3 Hub Service;c:\windows\system32\DRIVERS\tihub3.sys;c:\windows\SYSNATIVE\DRIVERS\tihub3.sys [x]
S3 tixhci;TI XHCI Service;c:\windows\system32\drivers\tixhci.sys;c:\windows\SYSNATIVE\drivers\tixhci.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
Inhalt des "geplante Tasks" Ordners
.
2015-05-07 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-30 15:05]
.
2015-05-07 c:\windows\Tasks\G2MUpdateTask-S-1-5-21-779854708-3996167121-2897795797-1172.job
- c:\program files (x86)\Citrix\GoToMeeting\2331\g2mupdate.exe [2015-05-04 12:03]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro1 (ErrorConflict)]
@="{8BA85C75-763B-4103-94EB-9470F12FE0F7}"
[HKEY_CLASSES_ROOT\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7}]
2015-03-10 08:43	2334928	----a-w-	c:\program files\Microsoft Office 15\root\office15\grooveex.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro2 (SyncInProgress)]
@="{CD55129A-B1A1-438E-A425-CEBC7DC684EE}"
[HKEY_CLASSES_ROOT\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE}]
2015-03-10 08:43	2334928	----a-w-	c:\program files\Microsoft Office 15\root\office15\grooveex.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro3 (InSync)]
@="{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}"
[HKEY_CLASSES_ROOT\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}]
2015-03-10 08:43	2334928	----a-w-	c:\program files\Microsoft Office 15\root\office15\grooveex.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2013-04-10 13519432]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2014-08-22 1331288]
"3DxWare Service"="c:\program files\3Dconnexion\3DxWare\3DxWinCore64\3DxService.exe" [2014-06-23 2157440]
"CnwiDeviceAgent"="c:\program files\Canon\imagePROGRAFStatusMonitor\cnwida.exe" [2009-06-10 71440]
"nwiz"="c:\program files\NVIDIA Corporation\nview\nwiz.exe" [2015-03-13 2498368]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
Trusted Zone: chip.de\www
TCP: DhcpNameServer = 192.168.0.20
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
Wow6432Node-HKLM-Run-Adobe ARM - c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
Toolbar-Locked - (no file)
HKLM-Run-AdobeAAMUpdater-1.0 - c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_17_0_0_169_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_17_0_0_169_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_17_0_0_169_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_17_0_0_169_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_17_0_0_169.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.17"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_17_0_0_169.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_17_0_0_169.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_17_0_0_169.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\users\*NAME*\AppData\Local\Autodesk\.AdskAppManager\R1\AdAppMgr.exe
c:\portable apps\PortableApps\RocketDock\RocketDock.exe
c:\portable apps\PortableApps\PortableApps.com\PortableAppsPlatform.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2015-05-07  11:22:44 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2015-05-07 09:22
.
Vor Suchlauf: 15 Verzeichnis(se), 42.748.743.680 Bytes frei
Nach Suchlauf: 23 Verzeichnis(se), 42.887.618.560 Bytes frei
.
- - End Of File - - BF7D47CFE5C763C8197EAD991F96BE95
6D042FF56077F780079CC58B90CE66C0

deeprybka · 07.05.2015, 16:13

Hi,

Schritt 1

Schließe alle offenen Programme und Browser.
Starte bitte Adwcleaner.
Klicke auf Suchen und warte, bis der Suchlauf abgeschlossen ist.
Klicke nun auf Löschen.
Bestätige jeweils mit Ok.
Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
Poste mir den Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Sx].txt. (x = fortlaufende Nummer).

Schritt 2

Download und Anleitung
Starte Malwarebytes' Anti-Malware (MBAM).
Sollte die Benutzeroberfläche noch in Englisch sein, klicke auf Settings und wähle bei Language Deutsch aus.
Unter Einstellungen/ Erkennung und Schutz setze bitte einen Haken bei "Suche nach Rootkits".
Gehe zurück zum Armaturenbrett und klicke auf "Jetzt scannen".
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben und poste mir das Log.

Schritt 3

Bitte starte FRST erneut, markiere auch die checkbox

und drücke auf Scan.
Bitte poste mir den Inhalt der beiden Logs die erstellt werden.

Morphy · 11.05.2015, 08:44

Hallo Jürgen,

tut mir leit, dass ich mich erst jetzt wieder melde.

Hier haben wir glaub ich, haben wir das Übel erwischt

Code:

ATTFilter

# AdwCleaner v4.203 - Bericht erstellt 11/05/2015 um 08:46:27
# Aktualisiert 30/04/2015 von Xplode
# Datenbank : 2015-05-09.1 [Server]
# Betriebssystem : Windows 7 Professional Service Pack 1 (x64)
# Benutzername : *NAME* - RECHNER01
# Gestarted von : C:\Users\*NAME*\Desktop\AdwCleaner_4.203.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\Users\*NAME*\AppData\Roaming\ernden

***** [ Geplante Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{91EE0830-B539-45AB-83F2-741FED0B0E2F}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{89ADB46E-3E8C-4250-BEBF-14F3FDA0829B}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{91EE0830-B539-45AB-83F2-741FED0B0E2F}

***** [ Internetbrowser ] *****

-\\ Internet Explorer v11.0.9600.17728


-\\ Mozilla Firefox v


-\\ Google Chrome v


*************************

AdwCleaner[R0].txt - [1051 Bytes] - [12/03/2015 16:27:35]
AdwCleaner[R1].txt - [1513 Bytes] - [24/04/2015 09:58:04]
AdwCleaner[R2].txt - [1418 Bytes] - [11/05/2015 08:45:45]
AdwCleaner[S0].txt - [1113 Bytes] - [12/03/2015 16:28:45]
AdwCleaner[S1].txt - [1330 Bytes] - [11/05/2015 08:46:27]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [1389  Bytes] ##########

MBAM-log

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 11.05.2015
Suchlauf-Zeit: 09:27:44
Logdatei: mbam-log.txt
Administrator: Ja

Version: 2.01.6.1022
Malware Datenbank: v2015.05.11.01
Rootkit Datenbank: v2015.04.21.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: *NAME*

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 471787
Verstrichene Zeit: 5 Min, 30 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Aktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(Keine schädliche Elemente gefunden)

Module: 0
(Keine schädliche Elemente gefunden)

Registrierungsschlüssel: 0
(Keine schädliche Elemente gefunden)

Registrierungswerte: 0
(Keine schädliche Elemente gefunden)

Registrierungsdaten: 0
(Keine schädliche Elemente gefunden)

Ordner: 0
(Keine schädliche Elemente gefunden)

Dateien: 0
(Keine schädliche Elemente gefunden)

Physische Sektoren: 0
(Keine schädliche Elemente gefunden)


(end)

Frst-log

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 09-05-2015
Ran by *NAME* (administrator) on RECHNER01 on 11-05-2015 09:35:07
Running from C:\Users\*NAME*\Desktop
Loaded Profiles: *NAME* (Available profiles: *NAME* & *NAME* & Administrator)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
() C:\Windows\System32\nvwmi64.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RTKAUDIOSERVICE64.EXE
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
() C:\Windows\System32\nvwmi64.exe
(Autodesk Inc.) C:\Program Files (x86)\Common Files\Autodesk Shared\AppManager\R1\AdAppMgrSvc.exe
(Autodesk, Inc.) C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe
(CANON INC) C:\Program Files\Canon\imagePROGRAFStatusMonitor\cnwisam.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe
(CANON INC.) C:\Windows\System32\cnwiols6.exe
(3Dconnexion) C:\Program Files\3Dconnexion\3DxWare\3DxWinCore64\Mgl3DCtlrRPCService.exe
(Autodesk, Inc.) C:\2015\Inventor 2015\Moldflow\bin\mitsijm.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
() C:\Program Files\Core Temp\Core Temp.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(3Dconnexion, INC) C:\Program Files\3Dconnexion\3DxWare\3DxWinCore64\3DxService.exe
(CANON INC.) C:\Program Files\Canon\imagePROGRAFStatusMonitor\cnwida.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\acrotray.exe
(Autodesk Inc.) C:\Users\*NAME*\AppData\Local\Autodesk\.AdskAppManager\R1\AdAppMgr.exe
(Logitech Inc.) C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe
(3Dconnexion) C:\Program Files\3Dconnexion\3DxWare\3DxWinCore64\3dxpiemenus.exe
() C:\Portable Apps\PortableApps\RocketDock\RocketDock.exe
(3Dconnexion) C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\3DxLCD10SPPRO.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe
(Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
(Autodesk, Inc.) C:\2015\Inventor 2015\Bin\Inventor.exe
(Flexera Software LLC) C:\Program Files\Common Files\Macrovision Shared\FlexNet Publisher\FNPLicensingService64.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13519432 2013-04-10] (Realtek Semiconductor)
HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1331288 2014-08-22] (Microsoft Corporation)
HKLM\...\Run: [3DxWare Service] => C:\Program Files\3Dconnexion\3DxWare\3DxWinCore64\3DxService.exe [2157440 2014-06-23] (3Dconnexion, INC)
HKLM\...\Run: [CnwiDeviceAgent] => C:\Program Files\Canon\imagePROGRAFStatusMonitor\cnwida.exe [71440 2009-06-10] (CANON INC.)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
HKLM\...\Run: [nwiz] => C:\Program Files\NVIDIA Corporation\nview\nwiz.exe [2498368 2015-03-13] ()
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [134616 2013-07-11] (Intel Corporation)
HKLM-x32\...\Run: [CLMLServer_For_P2G8] => c:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111136 2012-11-21] (CyberLink)
HKLM-x32\...\Run: [CLVirtualDrive] => c:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [493088 2012-11-21] (CyberLink Corp.)
HKLM-x32\...\Run: [ADSKAppManager] => C:\Program Files (x86)\Common Files\Autodesk Shared\AppManager\R1\AdAppMgr.exe [493960 2014-12-05] (Autodesk Inc.)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [191528 2014-07-04] (Geek Software GmbH)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Acrobat Assistant 8.0] => C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Acrotray.exe [3499920 2014-09-12] (Adobe Systems Inc.)
HKU\S-1-5-21-779854708-3996167121-2897795797-1172\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\ssText3d.scr [333824 2010-11-21] (Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\imagePROGRAF Status Monitor.lnk [2014-09-29]
ShortcutTarget: imagePROGRAF Status Monitor.lnk -> C:\Program Files\Canon\imagePROGRAFStatusMonitor\cnwism.exe (CANON INC.)
Startup: C:\Users\CAD\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Start.exe - Verknüpfung.lnk [2014-09-15]
ShortcutTarget: Start.exe - Verknüpfung.lnk -> C:\Portable Apps\Start.exe (PortableApps.com)
Startup: C:\Users\*NAME*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Programmstarts.cmd [2014-09-23] ()
ShellIconOverlayIdentifiers: [ SkyDrivePro1 (ErrorConflict)] -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-03-10] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ SkyDrivePro2 (SyncInProgress)] -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-03-10] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ SkyDrivePro3 (InSync)] -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-03-10] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [AutoCAD Digital Signatures Icon Overlay Handler] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\Windows\system32\AcSignIcon.dll [2014-02-07] (Autodesk, Inc.)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-779854708-3996167121-2897795797-1172\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPCOM13/34
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPCOM13/34
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-779854708-3996167121-2897795797-1172\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-779854708-3996167121-2897795797-1172\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-at/?ocid=iehp
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll [2015-03-10] (Microsoft Corporation)
BHO: Adobe Acrobat Create PDF Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll [2014-09-12] (Adobe Systems Incorporated)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL [2015-03-10] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-03-10] (Microsoft Corporation)
BHO: Adobe Acrobat Create PDF from Selection -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll [2014-09-12] (Adobe Systems Incorporated)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\OCHelper.dll [2015-03-04] (Microsoft Corporation)
BHO-x32: PDFXChange 2012 -> {42DFA04F-0F16-418e-B80C-AB97A5AFAD3A} -> C:\Program Files\Tracker Software\PDF-XChange 5\PXCIEaddin5.dll [2012-11-12] (Tracker Software Products (Canada) Ltd.)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\ssv.dll [2015-04-15] (Oracle Corporation)
BHO-x32: Adobe Acrobat Create PDF Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll [2014-09-12] (Adobe Systems Incorporated)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\URLREDIR.DLL [2015-03-10] (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\GROOVEEX.DLL [2015-03-10] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-04-15] (Oracle Corporation)
BHO-x32: Adobe Acrobat Create PDF from Selection -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll [2014-09-12] (Adobe Systems Incorporated)
Toolbar: HKLM - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll [2014-09-12] (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - PDFXChange 2012 - {42DFA04F-0F16-418e-B80C-AB97A5AFAD3A} - C:\Program Files\Tracker Software\PDF-XChange 5\PXCIEaddin5.dll [2012-11-12] (Tracker Software Products (Canada) Ltd.)
Toolbar: HKLM-x32 - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll [2014-09-12] (Adobe Systems Incorporated)
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2014-07-16] (Microsoft Corporation)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\MSOSB.DLL [2015-02-03] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.20

FireFox:
========
FF ProfilePath: C:\Portable Apps\PortableApps\FirefoxPortable\Data\profile
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_169.dll [2015-04-15] ()
FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll [2012-11-12] (Tracker Software Products (Canada) Ltd.)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2014-07-16] (Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll No File
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-04-15] ()
FF Plugin-x32: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll [2012-11-12] (Tracker Software Products (Canada) Ltd.)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=3.0.72 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-07-11] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-07-11] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-04-15] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-04-15] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2015-02-17] (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\NPSPWRAP.DLL [2014-07-16] (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2015-03-13] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2015-03-13] (NVIDIA Corporation)
FF Plugin-x32: Adobe Acrobat -> C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Air\nppdf32.dll [2014-09-12] (Adobe Systems Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-09-12] (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll No File
FF Plugin HKU\S-1-5-21-779854708-3996167121-2897795797-1172: @citrixonline.com/appdetectorplugin -> C:\Users\*NAME*\AppData\Local\Citrix\Plugins\104\npappdetector.dll [2014-10-28] (Citrix Online)
FF Plugin HKU\S-1-5-21-779854708-3996167121-2897795797-1172: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll [2012-11-12] (Tracker Software Products (Canada) Ltd.)
FF Extension: Click&Clean - C:\Portable Apps\PortableApps\FirefoxPortable\Data\profile\Extensions\clickclean@hotcleaner.com [2015-05-07]
FF Extension: KeeFox - C:\Portable Apps\PortableApps\FirefoxPortable\Data\profile\Extensions\keefox@chris.tomlinson [2015-05-07]
FF Extension: WOT - C:\Portable Apps\PortableApps\FirefoxPortable\Data\profile\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2015-05-07]
FF Extension: Snip-Me - C:\Portable Apps\PortableApps\FirefoxPortable\Data\profile\Extensions\addon@snip-me.de.xpi [2015-05-07]
FF Extension: Personas Plus - C:\Portable Apps\PortableApps\FirefoxPortable\Data\profile\Extensions\personas@christopher.beard.xpi [2015-05-07]
FF Extension: NoScript - C:\Portable Apps\PortableApps\FirefoxPortable\Data\profile\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2015-05-07]
FF Extension: Adblock Plus - C:\Portable Apps\PortableApps\FirefoxPortable\Data\profile\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-05-07]
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn [2014-10-01]
StartMenuInternet: FIREFOX.EXE - C:\Portable Apps\PortableApps\FirefoxPortable\App\Firefox\firefox.exe

Chrome: 
=======
CHR Profile: C:\Users\*NAME*\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Docs) - C:\Users\*NAME*\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-04-23]
CHR Extension: (Google Drive) - C:\Users\*NAME*\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-04-23]
CHR Extension: (YouTube) - C:\Users\*NAME*\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-04-23]
CHR Extension: (Google Search) - C:\Users\*NAME*\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-04-23]
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCChromeExtn\WCChromeExtn.crx [2014-09-12]
StartMenuInternet: Google Chrome.ODMYRIY4HGCA2FPWYASBY6PMUI - C:\Portable Apps\PortableApps\GoogleChromePortable\App\Chrome-bin\chrome.exe

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AdAppMgrSvc; C:\Program Files (x86)\Common Files\Autodesk Shared\AppManager\R1\AdAppMgrSvc.exe [599944 2014-12-05] (Autodesk Inc.)
R2 Autodesk Content Service; C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [31192 2014-02-07] (Autodesk, Inc.)
R2 Canon imagePROGRAF Status Monitor; C:\Program Files\Canon\imagePROGRAFStatusMonitor\cnwisam.exe [713488 2009-06-10] (CANON INC)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2719928 2015-04-22] (Microsoft Corporation)
R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe [46904 2013-12-17] (Hewlett-Packard Company)
R2 Intel(R) Capability Licensing Service Interface; c:\Program Files\Intel\iCLS Client\HeciServer.exe [732160 2012-12-11] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; c:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [803872 2012-12-11] (Intel(R) Corporation)
R2 iPFDeviceAgentService; C:\Windows\system32\cnwiols6.exe [210944 2008-12-08] (CANON INC.) [File not signed]
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-07-11] (Intel Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
R2 Mgl3DCtlrRPCService; C:\Program Files\3Dconnexion\3DxWare\3DxWinCore64\Mgl3DCtlrRPCService.exe [30208 2014-06-23] (3Dconnexion) [File not signed]
R2 mitsijm2015; C:\2015\Inventor 2015\Moldflow\bin\mitsijm.exe [968480 2013-10-12] (Autodesk, Inc.)
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2014-08-22] (Microsoft Corporation)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [368624 2014-08-22] (Microsoft Corporation)
R2 NVWMI; C:\Windows\system32\nvwmi64.exe [3039376 2015-03-13] ()
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [239176 2013-02-20] (Realtek Semiconductor)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-11-04] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 3dxhid; C:\Windows\System32\DRIVERS\3dxhid.sys [38672 2014-06-12] (3Dconnexion SAM)
R1 CLVirtualDrive; C:\Windows\System32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [279616 2014-09-29] (DT Soft Ltd)
R0 iaStorF; C:\Windows\System32\drivers\iaStorF.sys [27120 2013-07-02] (Intel Corporation)
R0 iaStorS; C:\Windows\System32\drivers\iaStorS.sys [660976 2013-07-02] (Intel Corporation)
R3 KMJHidMini; C:\Windows\System32\DRIVERS\3dxkmj.sys [18944 2014-05-12] (3Dconnextion Inc.)
R3 KMJShim; C:\Windows\System32\DRIVERS\3dxshim.sys [7168 2014-05-12] (3Dconnextion Inc.)
R3 LGPBTDD; C:\Windows\System32\Drivers\LGPBTDD.sys [30728 2009-07-01] (Logitech Inc.)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-04-14] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [269008 2014-07-17] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [125584 2014-07-17] (Microsoft Corporation)
R3 ALSysIO; \??\C:\Users\*NAM*~1\AppData\Local\Temp\ALSysIO64.sys [X]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-05-11 09:34 - 2015-05-11 09:34 - 00000000 ____D () C:\Users\*NAME*\Desktop\FRST-OlderVersion
2015-05-11 09:26 - 2015-05-11 09:26 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-05-11 09:26 - 2015-05-11 09:26 - 00001104 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-05-11 09:26 - 2015-05-11 09:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-05-11 09:26 - 2015-05-11 09:26 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-05-11 09:26 - 2015-04-14 09:37 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-05-11 09:26 - 2015-04-14 09:37 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-05-11 09:26 - 2015-04-14 09:37 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-05-11 09:03 - 2015-05-11 08:49 - 00001477 _____ () C:\Users\*NAME*\Desktop\AdwCleaner[S1].txt
2015-05-11 08:42 - 2015-05-11 08:42 - 02204160 _____ () C:\Users\*NAME*\Desktop\AdwCleaner_4.203.exe
2015-05-11 08:41 - 2015-05-11 08:41 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\*NAME*\Desktop\mbam-setup-2.1.6.1022.exe
2015-05-07 11:22 - 2015-05-07 11:22 - 00026716 _____ () C:\ComboFix.txt
2015-05-07 11:15 - 2015-05-07 11:22 - 00000000 ____D () C:\Qoobox
2015-05-07 11:15 - 2015-05-07 11:21 - 00000000 ____D () C:\Windows\erdnt
2015-05-07 11:15 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2015-05-07 11:15 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2015-05-07 11:15 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-05-07 11:15 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-05-07 11:15 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-05-07 11:15 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2015-05-07 11:15 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2015-05-07 11:15 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2015-05-07 11:13 - 2015-05-07 11:13 - 05621999 ____R (Swearware) C:\Users\*NAME*\Desktop\ComboFix.exe
2015-05-06 16:30 - 2015-05-06 16:31 - 00000066 _____ () C:\Users\*NAME*\Desktop\Textänderungen.txt
2015-05-06 15:46 - 2015-05-06 15:46 - 00344528 _____ () C:\Windows\Minidump\050615-20638-01.dmp
2015-05-06 15:32 - 2015-05-06 16:29 - 00030821 _____ () C:\Users\*NAME*\Desktop\gmer.log
2015-05-06 14:04 - 2015-05-06 14:04 - 00380416 _____ () C:\Users\*NAME*\Desktop\Gmer-19357.exe
2015-05-06 13:40 - 2015-05-11 09:35 - 00022633 _____ () C:\Users\*NAME*\Desktop\FRST.txt
2015-05-06 13:40 - 2015-05-06 16:29 - 00080236 _____ () C:\Users\*NAME*\Desktop\Addition.txt
2015-05-06 13:39 - 2015-05-11 09:34 - 02102784 _____ (Farbar) C:\Users\*NAME*\Desktop\FRST64.exe
2015-05-04 14:03 - 2015-05-11 09:23 - 00000546 _____ () C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-779854708-3996167121-2897795797-1172.job
2015-05-04 14:03 - 2015-05-07 13:58 - 00003580 _____ () C:\Windows\System32\Tasks\G2MUpdateTask-S-1-5-21-779854708-3996167121-2897795797-1172
2015-04-29 08:54 - 2015-04-29 08:54 - 00000000 ____D () C:\Users\*NAME*\AppData\Roaming\SkypePM
2015-04-23 10:33 - 2015-04-23 10:33 - 00000076 _____ () C:\ADR_ColdStart.txt
2015-04-23 08:33 - 2015-04-23 08:33 - 00000000 ____D () C:\Users\*NAME*\AppData\Local\Google
2015-04-22 09:18 - 2015-04-22 09:18 - 00002217 _____ () C:\Users\Public\Desktop\JT2Go.lnk
2015-04-22 09:18 - 2015-04-22 09:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Teamcenter 10.1
2015-04-22 09:09 - 2015-04-22 09:09 - 00000000 ____D () C:\Users\*NAME*\Documents\SymbolLibrary
2015-04-21 07:49 - 2015-04-21 07:49 - 00000171 _____ () C:\Users\*NAME*\Desktop\FEHLER-SCHRIFTVERKEHR.txt
2015-04-20 16:50 - 2015-05-11 08:31 - 00003938 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{EEB18E22-28E3-4E68-AE57-15698A41CD27}
2015-04-16 13:50 - 2015-04-16 13:50 - 00000000 _____ () C:\Users\*NAME*\Desktop\Neues Textdokument.txt
2015-04-15 03:02 - 2015-03-25 05:24 - 03298816 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-04-15 03:02 - 2015-03-25 05:24 - 02553856 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-04-15 03:02 - 2015-03-25 05:24 - 00696320 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-04-15 03:02 - 2015-03-25 05:24 - 00191488 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-04-15 03:02 - 2015-03-25 05:24 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-04-15 03:02 - 2015-03-25 05:24 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-04-15 03:02 - 2015-03-25 05:24 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-04-15 03:02 - 2015-03-25 05:24 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-04-15 03:02 - 2015-03-25 05:23 - 00135168 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-04-15 03:02 - 2015-03-25 05:23 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-04-15 03:02 - 2015-03-25 05:23 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2015-04-15 03:02 - 2015-03-25 05:00 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2015-04-15 03:02 - 2015-03-25 05:00 - 00173056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2015-04-15 03:02 - 2015-03-25 05:00 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2015-04-15 03:02 - 2015-03-25 05:00 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2015-04-15 03:02 - 2015-03-25 05:00 - 00029696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2015-04-15 03:02 - 2015-03-10 05:25 - 01882624 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2015-04-15 03:02 - 2015-03-10 05:21 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2015-04-15 03:02 - 2015-03-10 05:08 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2015-04-15 03:02 - 2015-03-10 05:05 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2015-04-15 03:02 - 2015-03-05 07:12 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2015-04-15 03:02 - 2015-03-05 06:05 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2015-04-15 03:01 - 2015-03-17 07:22 - 05557696 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-04-15 03:01 - 2015-03-17 07:22 - 00155576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-04-15 03:01 - 2015-03-17 07:22 - 00095672 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-04-15 03:01 - 2015-03-17 07:19 - 01727904 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-04-15 03:01 - 2015-03-17 07:17 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-04-15 03:01 - 2015-03-17 07:17 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-04-15 03:01 - 2015-03-17 07:17 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-04-15 03:01 - 2015-03-17 07:16 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-04-15 03:01 - 2015-03-17 07:16 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-04-15 03:01 - 2015-03-17 07:16 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-04-15 03:01 - 2015-03-17 07:16 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-04-15 03:01 - 2015-03-17 07:16 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-04-15 03:01 - 2015-03-17 07:16 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-04-15 03:01 - 2015-03-17 07:16 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-04-15 03:01 - 2015-03-17 07:16 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-04-15 03:01 - 2015-03-17 07:16 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-04-15 03:01 - 2015-03-17 07:16 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-04-15 03:01 - 2015-03-17 07:16 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-04-15 03:01 - 2015-03-17 07:16 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-04-15 03:01 - 2015-03-17 07:16 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-04-15 03:01 - 2015-03-17 07:16 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-04-15 03:01 - 2015-03-17 07:16 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-04-15 03:01 - 2015-03-17 07:16 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-04-15 03:01 - 2015-03-17 07:16 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-04-15 03:01 - 2015-03-17 07:16 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-04-15 03:01 - 2015-03-17 07:16 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-04-15 03:01 - 2015-03-17 07:16 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-04-15 03:01 - 2015-03-17 07:15 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-04-15 03:01 - 2015-03-17 07:15 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-04-15 03:01 - 2015-03-17 07:15 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-04-15 03:01 - 2015-03-17 07:13 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-04-15 03:01 - 2015-03-17 07:13 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-04-15 03:01 - 2015-03-17 07:11 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-04-15 03:01 - 2015-03-17 07:11 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-04-15 03:01 - 2015-03-17 07:11 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 07:11 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 07:11 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 07:11 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 07:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 07:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 07:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 07:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 07:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 07:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 07:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 07:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 07:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 07:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 07:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 07:01 - 03976632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-04-15 03:01 - 2015-03-17 07:01 - 03920824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-04-15 03:01 - 2015-03-17 06:59 - 01309696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-04-15 03:01 - 2015-03-17 06:57 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-04-15 03:01 - 2015-03-17 06:57 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-04-15 03:01 - 2015-03-17 06:57 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-04-15 03:01 - 2015-03-17 06:57 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-04-15 03:01 - 2015-03-17 06:57 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-04-15 03:01 - 2015-03-17 06:57 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-04-15 03:01 - 2015-03-17 06:57 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-04-15 03:01 - 2015-03-17 06:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-04-15 03:01 - 2015-03-17 06:57 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-04-15 03:01 - 2015-03-17 06:56 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-04-15 03:01 - 2015-03-17 06:56 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-04-15 03:01 - 2015-03-17 06:56 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-04-15 03:01 - 2015-03-17 06:56 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-04-15 03:01 - 2015-03-17 06:56 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-04-15 03:01 - 2015-03-17 06:56 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-04-15 03:01 - 2015-03-17 06:56 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-04-15 03:01 - 2015-03-17 06:53 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-04-15 03:01 - 2015-03-17 06:53 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-04-15 03:01 - 2015-03-17 06:50 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-04-15 03:01 - 2015-03-17 06:50 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-04-15 03:01 - 2015-03-17 06:50 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 06:50 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 06:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 06:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 06:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 06:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 06:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 06:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 06:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 06:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 06:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 06:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 06:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 05:45 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-04-15 03:01 - 2015-03-17 05:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-04-15 03:01 - 2015-03-17 05:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 05:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 05:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-04-15 03:01 - 2015-03-17 05:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-04-15 03:00 - 2015-04-02 02:17 - 00389808 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-04-15 03:00 - 2015-04-02 01:49 - 00342704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-04-15 03:00 - 2015-03-13 06:32 - 24980480 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-04-15 03:00 - 2015-03-13 06:25 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-04-15 03:00 - 2015-03-13 06:25 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-04-15 03:00 - 2015-03-13 06:09 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-04-15 03:00 - 2015-03-13 06:08 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-04-15 03:00 - 2015-03-13 06:08 - 00417280 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-04-15 03:00 - 2015-03-13 06:08 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-04-15 03:00 - 2015-03-13 06:07 - 02886144 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-04-15 03:00 - 2015-03-13 06:06 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-04-15 03:00 - 2015-03-13 06:00 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-04-15 03:00 - 2015-03-13 05:59 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-04-15 03:00 - 2015-03-13 05:55 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-04-15 03:00 - 2015-03-13 05:54 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-04-15 03:00 - 2015-03-13 05:54 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-04-15 03:00 - 2015-03-13 05:53 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-04-15 03:00 - 2015-03-13 05:50 - 06025216 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-04-15 03:00 - 2015-03-13 05:44 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-04-15 03:00 - 2015-03-13 05:42 - 19695616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-04-15 03:00 - 2015-03-13 05:42 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-04-15 03:00 - 2015-03-13 05:40 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-04-15 03:00 - 2015-03-13 05:32 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-04-15 03:00 - 2015-03-13 05:28 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-04-15 03:00 - 2015-03-13 05:28 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-04-15 03:00 - 2015-03-13 05:27 - 00340992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-04-15 03:00 - 2015-03-13 05:27 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-04-15 03:00 - 2015-03-13 05:27 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-04-15 03:00 - 2015-03-13 05:26 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-04-15 03:00 - 2015-03-13 05:26 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-04-15 03:00 - 2015-03-13 05:23 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-04-15 03:00 - 2015-03-13 05:22 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-04-15 03:00 - 2015-03-13 05:20 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-04-15 03:00 - 2015-03-13 05:20 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-04-15 03:00 - 2015-03-13 05:17 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-04-15 03:00 - 2015-03-13 05:16 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-04-15 03:00 - 2015-03-13 05:15 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-04-15 03:00 - 2015-03-13 05:08 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-04-15 03:00 - 2015-03-13 05:07 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-04-15 03:00 - 2015-03-13 05:06 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-04-15 03:00 - 2015-03-13 05:05 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-04-15 03:00 - 2015-03-13 05:05 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-04-15 03:00 - 2015-03-13 05:01 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-04-15 03:00 - 2015-03-13 05:00 - 14397440 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-04-15 03:00 - 2015-03-13 04:57 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-04-15 03:00 - 2015-03-13 04:56 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-04-15 03:00 - 2015-03-13 04:54 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-04-15 03:00 - 2015-03-13 04:49 - 04305408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-04-15 03:00 - 2015-03-13 04:45 - 02358784 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-04-15 03:00 - 2015-03-13 04:44 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-04-15 03:00 - 2015-03-13 04:43 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-04-15 03:00 - 2015-03-13 04:42 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-04-15 03:00 - 2015-03-13 04:34 - 12825600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-04-15 03:00 - 2015-03-13 04:33 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-04-15 03:00 - 2015-03-13 04:22 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-04-15 03:00 - 2015-03-13 04:20 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-04-15 03:00 - 2015-03-13 04:16 - 01311232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-04-15 03:00 - 2015-03-13 04:14 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-04-15 03:00 - 2015-03-04 06:55 - 00367552 _____ (Microsoft Corporation) C:\Windows\system32\clfs.sys
2015-04-15 03:00 - 2015-03-04 06:41 - 00079360 _____ (Microsoft Corporation) C:\Windows\system32\clfsw32.dll
2015-04-15 03:00 - 2015-03-04 06:10 - 00058880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\clfsw32.dll
2015-04-15 03:00 - 2015-02-25 05:18 - 00754688 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\http.sys
2015-04-14 16:35 - 2015-04-14 16:35 - 21102200 _____ (SUPERAntiSpyware) C:\Users\*NAME*\Downloads\SUPERAntiSpyware_6.0.1170.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-05-11 09:35 - 2015-03-03 16:45 - 00000000 ____D () C:\FRST
2015-05-11 09:26 - 2014-01-20 22:13 - 01938227 _____ () C:\Windows\WindowsUpdate.log
2015-05-11 09:25 - 2014-10-02 08:19 - 00000000 ____D () C:\Users\*NAME*\AppData\Roaming\Mozilla
2015-05-11 09:05 - 2014-09-30 10:18 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-05-11 08:55 - 2009-07-14 06:45 - 00027568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-05-11 08:55 - 2009-07-14 06:45 - 00027568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-05-11 08:53 - 2013-11-04 20:38 - 04393638 _____ () C:\Windows\system32\perfh007.dat
2015-05-11 08:53 - 2013-11-04 20:38 - 01296282 _____ () C:\Windows\system32\perfc007.dat
2015-05-11 08:53 - 2009-07-14 07:13 - 00006212 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-05-11 08:47 - 2014-09-22 20:08 - 00000120 _____ () C:\Windows\system32\config\netlogon.ftl
2015-05-11 08:47 - 2014-01-23 13:43 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-05-11 08:47 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-05-11 08:47 - 2009-07-14 06:51 - 00009556 _____ () C:\Windows\setupact.log
2015-05-11 08:46 - 2015-03-12 16:26 - 00000000 ____D () C:\AdwCleaner
2015-05-07 16:26 - 2014-01-21 00:39 - 00000000 ____D () C:\Temp
2015-05-07 15:57 - 2014-10-01 15:31 - 01503980 _____ () C:\Windows\system32\webservice4.log
2015-05-07 13:06 - 2014-10-14 11:25 - 00000000 ____D () C:\Users\*NAME*\AppData\Roaming\Adobe
2015-05-07 11:21 - 2010-11-21 05:47 - 00231714 _____ () C:\Windows\PFRO.log
2015-05-07 11:21 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2015-05-07 11:18 - 2013-11-04 21:24 - 00000000 ____D () C:\ProgramData\Temp
2015-05-07 10:12 - 2014-10-31 11:33 - 00004263 _____ () C:\Users\*NAME*\Documents\plot.log
2015-05-06 15:46 - 2015-03-09 18:46 - 1682547986 _____ () C:\Windows\MEMORY.DMP
2015-05-06 15:46 - 2015-03-09 18:46 - 00000000 ____D () C:\Windows\Minidump
2015-05-06 15:46 - 2014-07-16 19:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2015-05-06 15:46 - 2014-07-16 19:07 - 00000000 ____D () C:\Program Files\Microsoft Office 15
2015-05-05 12:20 - 2009-07-14 04:34 - 00000428 _____ () C:\Windows\win.ini
2015-05-04 14:03 - 2014-10-28 11:12 - 00000000 ____D () C:\Program Files (x86)\Citrix
2015-04-30 11:08 - 2014-09-29 15:12 - 00000000 ____D () C:\Users\*NAME*\AppData\Roaming\DAEMON Tools Lite
2015-04-29 08:54 - 2014-10-01 09:04 - 00000000 ____D () C:\Users\*NAME*\AppData\Local\Skype
2015-04-23 10:33 - 2014-09-23 08:13 - 00000000 ____D () C:\Users\*NAME*\AppData\Roaming\Autodesk
2015-04-23 10:33 - 2014-09-23 08:13 - 00000000 ____D () C:\Users\*NAME*\AppData\Local\Autodesk
2015-04-23 10:33 - 2014-07-15 18:12 - 00000000 ____D () C:\ProgramData\Autodesk
2015-04-22 09:18 - 2014-09-29 11:10 - 00000000 ____D () C:\Program Files (x86)\Siemens
2015-04-22 09:15 - 2014-09-23 15:34 - 00000000 ____D () C:\Windows\Downloaded Installations
2015-04-16 07:58 - 2009-07-14 06:45 - 00561432 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-04-15 17:05 - 2014-09-30 10:18 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-04-15 17:05 - 2014-09-30 10:18 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-04-15 17:05 - 2014-09-30 10:18 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-04-15 15:07 - 2015-03-24 08:57 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2015-04-15 15:07 - 2014-10-16 14:36 - 00000000 ____D () C:\Program Files (x86)\Java
2015-04-15 15:07 - 2014-09-23 09:38 - 00000000 ____D () C:\ProgramData\Oracle
2015-04-15 12:54 - 2014-09-23 08:13 - 00163464 _____ () C:\Users\*NAME*\AppData\Local\GDIPFONTCACHEV1.DAT
2015-04-15 03:34 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2015-04-14 03:32 - 2015-02-11 11:57 - 00000000 ____D () C:\Windows\System32\Tasks\Games
2015-04-13 12:26 - 2014-09-23 08:13 - 00000000 ____D () C:\Users\*NAME*\Documents\Inventor

==================== Files in the root of some directories =======

2014-09-24 09:39 - 2014-12-11 12:30 - 0000132 _____ () C:\Users\*NAME*\AppData\Roaming\Adobe PNG Format CS5 Prefs
2014-10-02 08:44 - 2014-10-17 09:32 - 0000626 _____ () C:\Users\*NAME*\AppData\Roaming\All CPU MeterV3_Settings.ini
2014-10-17 09:35 - 2014-10-17 09:35 - 0000017 _____ () C:\Users\*NAME*\AppData\Local\resmon.resmoncfg
2014-07-15 18:25 - 2014-07-15 18:25 - 0000153 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc

Some content of TEMP:
====================
C:\Users\*NAME*\AppData\Local\Temp\Quarantine.exe
C:\Users\*NAME*\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-05-04 11:49

==================== End Of Log ============================

--- --- ---

--- --- ---

Morphy · 11.05.2015, 08:45

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 09-05-2015
Ran by *NAME* at 2015-05-11 09:35:22
Running from C:\Users\*NAME*\Desktop
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-2894447428-521936725-362015667-500 - Administrator - Disabled)
Gast (S-1-5-21-2894447428-521936725-362015667-501 - Limited - Enabled)
*NAME* (S-1-5-21-2894447428-521936725-362015667-1001 - Administrator - Enabled) => C:\Users\CAD

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Enabled - Up to date) {4F35CFC4-45A3-FC37-EF17-759A02E39AB1}
AS: Microsoft Security Essentials (Enabled - Up to date) {F4542E20-6399-F3B9-D5A7-4EE87964D00C}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

3Dconnexion 3DxWare 10 (64-bit) (HKLM-x32\...\{BAFCA6AC-8B37-405B-B57E-C1D45DE70ACC}) (Version: 10.1.2 - 3Dconnexion)
3Dconnexion Add-In for AutoCAD 2007 - 2010 (Version: 4.6.0 - 3Dconnexion) Hidden
3Dconnexion Add-In for Inventor 11 - 2015 (Version: 2.0.5 - 3Dconnexion) Hidden
3Dconnexion Collage (x32 Version: 1.3.0 - 3Dconnexion) Hidden
3Dconnexion LCD Applets for SpacePilot Pro (x64) (Version: 1.3.2 - 3Dconnexion) Hidden
3Dconnexion Plug-in for Acrobat 3D (x32 Version: 1.3.0 - 3Dconnexion) Hidden
3Dconnexion Plug-In for Photoshop CS3 - CS6 and CC (Version: 2.4.0 - 3Dconnexion) Hidden
3Dconnexion Trainer (x32 Version: 3.2.2 - 3Dconnexion) Hidden
3DxWinCore (x64) (Version: 17.1.2.10488 - 3Dconnexion) Hidden
ACDSee 5.0 PowerPack (HKLM-x32\...\{316B6021-BB9B-4200-BD7B-2B4634C2F356}) (Version: 5.0.0 - ACD Systems Ltd)
Adobe Acrobat XI Pro (HKLM-x32\...\{AC76BA86-1033-FFFF-7760-000000000006}) (Version: 11.0.09 - Adobe Systems)
Adobe Flash Player 17 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.09) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.09 - Adobe Systems Incorporated)
ArchiPHYSIK 12 aut (HKLM-x32\...\ArchiPHYSIK 12 aut) (Version: 12..0 - A-NULL Bauphysik GmbH, Wien, Austria)
Astroburn Lite (HKLM-x32\...\Astroburn Lite) (Version: 1.8.0.0182 - Disc Soft Ltd)
AutoCAD 2015 VBA Enabler (Version: 20.0.51.0 - Autodesk) Hidden
AutoCAD Electrical 2015 - Deutsch (German) (Version: 12.0.55.0 - Autodesk) Hidden
AutoCAD Electrical 2015 - Deutsch (German) (Version: 12.2.0.8 - Autodesk) Hidden
AutoCAD Electrical 2015 - Deutsch (German) SP1 (Version: 12.2.0.8 - Autodesk) Hidden
AutoCAD Electrical 2015 - Deutsch (German) SP2 (HKLM\...\AutoCAD Electrical 2015 - Deutsch (German) SP2) (Version: 12.2.0.8 - Autodesk)
AutoCAD Electrical 2015 Language Pack - Deutsch (German) (Version: 12.0.55.0 - Autodesk) Hidden
AutoCAD Mechanical 2015 - Deutsch (German) (Version: 19.0.206.0 - Autodesk) Hidden
AutoCAD Mechanical 2015 - Deutsch (German) (Version: 19.0.48.0 - Autodesk) Hidden
AutoCAD Mechanical 2015 - Deutsch (German) SP2 (HKLM\...\AutoCAD Mechanical 2015 - Deutsch (German) SP2) (Version: 1 - Autodesk)
AutoCAD Mechanical 2015 Language Pack - Deutsch (German) (Version: 19.0.48.0 - Autodesk) Hidden
Autodesk App Manager (HKLM-x32\...\{C8125548-F2D5-4059-823F-1F3C5BBD9F19}) (Version: 1.2.0 - Autodesk)
Autodesk Application Manager (HKLM-x32\...\Autodesk Application Manager) (Version: 4.0.69.0 - Autodesk)
Autodesk AutoCAD 2015 VBA Enabler (HKLM\...\AutoCAD 2015 VBA Enabler) (Version: 20.0.51.0 - Autodesk)
Autodesk AutoCAD Electrical 2015 - Deutsch (German) (HKLM\...\AutoCAD Electrical 2015 - Deutsch (German)) (Version: 12.0.55.0 - Autodesk)
Autodesk AutoCAD Electrical Mobile Data (HKLM-x32\...\{4F4C5027-2FAC-4863-AA12-5754FF226849}) (Version: 1.0.0 - Autodesk)
Autodesk AutoCAD Mechanical 2015 - Deutsch (German) (HKLM\...\AutoCAD Mechanical 2015 - Deutsch (German)) (Version: 19.0.48.0 - Autodesk)
Autodesk AutoCAD Performance Feedback Tool Version 1.2.2 (HKLM-x32\...\{85735431-6CD3-4B16-BEC8-95332034E53B}) (Version: 1.2.2.0 - Autodesk)
Autodesk BIM 360 Glue AutoCAD 2015 Add-in 64 bit (HKLM\...\{78E2A54B-5F13-4286-9148-DAD8B823D485}) (Version: 4.33.6482 - Autodesk)
Autodesk BIM 360 Glue AutoCAD 2015 Add-in 64 bit (HKLM\...\{7B3A3142-5801-48F2-819B-515818EFE696}) (Version: 4.34.2701 - Autodesk)
Autodesk BIM 360 Navisworks Manage 2015 Add-in 64 bit (HKLM\...\{A254B429-1472-4B9C-BC9A-4E2CE74F2190}) (Version: 4.33.6482 - Autodesk)
Autodesk BIM 360 Navisworks Manage 2015 Add-in 64 bit (HKLM\...\{E0D028E7-5468-40AF-8F2D-4881D003F747}) (Version: 4.34.2701 - Autodesk)
Autodesk Content Service (HKLM-x32\...\Autodesk Content Service) (Version: 3.2.0.0 - Autodesk)
Autodesk Content Service (x32 Version: 3.2.0.0 - Autodesk) Hidden
Autodesk Content Service Language Pack (x32 Version: 3.2.0.0 - Autodesk) Hidden
Autodesk Design Review 2013 (HKLM-x32\...\Autodesk Design Review 2013) (Version: 13.0.0.82 - Autodesk, Inc.)
Autodesk Design Review 2013 (x32 Version: 13.0.0.82 - Autodesk, Inc.) Hidden
Autodesk DWG TrueView 2015 - English (HKLM\...\DWG TrueView 2015 - English) (Version: 20.0.51.0 - Autodesk)
Autodesk Inventor 2015 User Tools (HKLM\...\{55C7852C-E326-4227-9590-949843F2E744}) (Version: 7.0.0 - Autodesk)
Autodesk Inventor Content Center Libraries 2015 (Desktop Content) (HKLM\...\{B46DECD1-1964-4EF1-0000-22D71E81877C}) (Version: 19.0.15900.0000 - Autodesk)
Autodesk Inventor Electrical Catalog Browser 2015 (HKLM\...\{CD301C75-E007-0407-8A4F-E62AF995F11C}) (Version: 12.0.55.0 - Autodesk)
Autodesk Inventor Professional 2015 - Deutsch (German) (HKLM\...\Autodesk Inventor Professional 2015) (Version: 19.1.20300.0000 - Autodesk)
Autodesk Inventor Professional 2015 (Version: 19.1.20300.0000 - Autodesk) Hidden
Autodesk Inventor Professional 2015 Language Pack - Deutsch (German) (Version: 19.0.15900.0000 - Autodesk) Hidden
Autodesk Inventor Professional 2015 SP1 (HKLM\...\Autodesk Inventor Professional 2015 SP1RTM) (Version: 19.1.20300.0000 - Autodesk)
Autodesk Material Library 2015 (HKLM-x32\...\{427F733F-4D6C-45BC-9324-EB743104C321}) (Version: 5.2.9.100 - Autodesk)
Autodesk Material Library Base Resolution Image Library 2015 (HKLM-x32\...\{ABE2F70B-8D94-44E9-AA04-F0DB35063D62}) (Version: 5.2.9.100 - Autodesk)
Autodesk Material Library Low Resolution Image Library 2015 (HKLM-x32\...\{4FBC9635-AC56-4378-8FDE-C4D3ED072681}) (Version: 5.2.9.100 - Autodesk)
Autodesk Product Design Suite 2015 (HKLM\...\Autodesk Product Design Suite 2015) (Version: 4.0.102.007 - Autodesk)
Autodesk Product Design Suite 2015 (Version: 4.0.102.007 - Autodesk) Hidden
Autodesk Product Design Suite 2015 Language Pack (Version: 4.0.102.007 - Autodesk) Hidden
Autodesk Revit Interoperability for Inventor 2015 (HKLM\...\Autodesk Revit Interoperability for Inventor 2015) (Version: 15.0.107.0 - Autodesk)
Autodesk Revit Interoperability for Inventor 2015 (Version: 15.0.107.0 - Autodesk) Hidden
Autodesk Vault 2015 Service Pack 1 (Client) (HKLM\...\Autodesk Vault Basic 2015 (Client)_R19SP1) (Version:  - Autodesk, Inc.)
Autodesk Vault Basic 2015 (Client) (HKLM\...\Autodesk Vault Basic 2015 (Client)) (Version: 19.1.13.0 - Autodesk)
Autodesk Vault Basic 2015 (Client) (Version: 19.1.13.0 - Autodesk) Hidden
Autodesk Vault Basic 2015 (Client) German Language Pack (Version: 19.0.49.0 - Autodesk) Hidden
Autodesk Workflows 2015 (HKLM\...\{A90DD6F8-60D2-4803-AFF6-796400E73E1B}) (Version: 5.2.11.100 - Autodesk, Inc.)
Citrix Online Launcher (HKLM-x32\...\{77463C86-BB3A-426E-A6C2-06B4D28C250F}) (Version: 1.0.223 - Citrix)
Configurator 360 addin (HKLM-x32\...\{8FE324B0-B934-4D68-BAB5-DE2136036237}) (Version: 19.0.11300.9000 - Autodesk, Inc.)
Core Temp 1.0 RC6 (HKLM\...\{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1) (Version: 1.0 - Alcpu)
CyberLink Power2Go 8 (HKLM-x32\...\InstallShield_{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}) (Version: 8.0.2.2321 - CyberLink Corp.)
CyberLink PowerDVD 12 (HKLM-x32\...\InstallShield_{B46BEA36-0B71-4A4E-AE41-87241643FA0A}) (Version: 12.0.1.2725 - CyberLink Corp.)
DWG TrueView 2015 - English (Version: 20.0.51.0 - Autodesk) Hidden
Eco Materials Adviser for Autodesk Inventor 2015 (64-bit) (HKLM\...\{2F7441CB-A646-41F1-B1CB-518AB311138B}) (Version: 5.1.2.0 - Granta Design Limited)
FARO LS 1.1.502.0 (64bit) (HKLM-x32\...\{66D83FE0-D798-4B38-86FE-FB48151E5AEF}) (Version: 5.2.0.35213 - FARO Scanner Production)
GoToMeeting 7.1.8.2553 (HKU\S-1-5-21-779854708-3996167121-2897795797-1172\...\GoToMeeting) (Version: 7.1.8.2553 - CitrixOnline)
HP Performance Advisor (HKLM-x32\...\{8E3138D3-686D-4F77-A807-CFF5CAEC98D7}) (Version: 1.7.6530 - Hewlett-Packard Company)
HP Support Information (HKLM-x32\...\{B2B7B1C8-7C8B-476C-BE2C-049731C55992}) (Version: 12.00.0000 - Hewlett-Packard)
HP Support Solutions Framework (HKLM-x32\...\{23CCE784-A812-4647-AEFF-1DCCD4E57478}) (Version: 11.50.0000 - Hewlett-Packard Company)
HP Vision Hardware Diagnostics (HKLM\...\{D79A02E9-6713-4335-9668-AAC7474C0C0E}) (Version: 2.12.2.0 - Hewlett-Packard)
imagePROGRAF Status Monitor (HKLM-x32\...\{66392B7C-C522-450D-97B7-B3E41E170C3B}) (Version: 4.10 - Canon)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1011 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.0.0.1310 - Intel Corporation)
Intel(R) Network Connections 18.1.59.0 (HKLM\...\PROSetDX) (Version: 18.1.59.0 - Intel)
iPF750 Media Configuration Tool (HKLM-x32\...\{DA08E681-106D-42BE-9B43-D4B7F736DBFA}) (Version: 3.64.00 - Canon)
Java 8 Update 45 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218045F0}) (Version: 8.0.450 - Oracle Corporation)
JT2Go (HKLM-x32\...\{EAF3A581-2EE5-46BD-BFB0-2089821608AD}) (Version: 10.1.15028 - Siemens PLM Software)
Malwarebytes Anti-Malware Version 2.1.6.1022 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)
Mathcad 15 F000 (HKLM-x32\...\{DC8F6C78-7231-44A2-B66E-6C4FCB3A3364}) (Version: 15.0.0.0 - PTC)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Access database engine 2010 (English) (HKLM\...\{90140000-00D1-0409-1000-0000000FF1CE}) (Version: 14.0.6029.1000 - Microsoft Corporation)
Microsoft Office 365 Small Business Premium - de-de (HKLM\...\O365SmallBusPremRetail - de-de) (Version: 15.0.4711.1003 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.6.305.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.5026 (HKLM-x32\...\{761AB0B8-FC68-3AE2-B7D9-A0CC6F0ED045}) (Version: 9.0.30729.5026 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft WSE 3.0 Runtime (HKLM-x32\...\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}) (Version: 3.0.5305.0 - Microsoft Corp.)
Mockup 360 Addin 2015 (HKLM-x32\...\{E4D4242C-FC14-4B4F-B1D9-6760D8C241D5}) (Version: 1.1.0 - Autodesk)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
NVIDIA 3D Vision Controller-Treiber 347.09 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 347.09 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 347.88 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 347.88 - NVIDIA Corporation)
NVIDIA Grafiktreiber 347.88 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 347.88 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.33.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.33.0 - NVIDIA Corporation)
NVIDIA nView 146.33 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NView) (Version: 146.33 - NVIDIA Corporation)
NVIDIA WMI 2.20.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVWMI) (Version: 2.20.0 - NVIDIA Corporation)
Office 15 Click-to-Run Extensibility Component (Version: 15.0.4711.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4711.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (Version: 15.0.4711.1003 - Microsoft Corporation) Hidden
PDF24 Creator 6.7.0 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)
PDF-XChange 2012 (HKLM\...\{504022CD-6A58-42D5-ACC9-966F695AAD93}_is1) (Version: 5.0.267.0 - Tracker Software Products Ltd)
PDF-XChange 2012 Pro (HKLM\...\{F92F0AAB-2EF6-412C-8BF4-0B11EB535280}_is1) (Version: 5.0.266.0 - Tracker Software Products Ltd)
'PTC Places' Namespace Shell Extension (HKLM-x32\...\{C65ABF2A-1B82-4F34-8C74-E4FE373F3BE4}) (Version: 1.1.11 - PTC)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6878 - Realtek Semiconductor Corp.)
Recovery Manager (x32 Version: 5.5.0.5223 - CyberLink Corp.) Hidden
Samsung Magician (HKLM-x32\...\{29AE3F9F-7158-4ca7-B1ED-28A73ECDB215}_is1) (Version: 4.3.0 - Samsung Electronics)
SketchUp-Import (HKLM-x32\...\{C403E867-FCF1-432B-BCC1-8FFD40A10A6E}) (Version: 1.2.0 - Autodesk)
Skype™ 6.22 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.22.107 - Skype Technologies S.A.)
Stahlschlüssel 2007 (HKLM-x32\...\{36002523-EB0B-11DA-8435-009027A6F7F8}) (Version:  - )
Update 1 for Inventor 2015 Service Pack 1 (See readme for detail) (INV19110) (HKLM\...\Autodesk Inventor Professional 2015_19110) (Version: 1 - Autodesk)
Update 2 for Inventor 2015 Service Pack 1 (See readme for detail) (INV19120) (HKLM\...\Autodesk Inventor Professional 2015_19120) (Version: 1 - Autodesk)
Update 3 for Inventor 2015 Service Pack 1 (See readme for detail) (INV19130) (HKLM\...\Autodesk Inventor Professional 2015_19130) (Version: 1 - Autodesk)
VC_CRT_x64 (Version: 1.02.0000 - Intel Corporation) Hidden
Verfügbare Autodesk-Apps (HKLM-x32\...\{EDDEE94B-214D-4B07-9727-A3E46F3E379A}) (Version: 1.2.0 - Autodesk)
Visual C++ 2008 - x64 (KB958357) - v9.0.30729.177 (HKLM-x32\...\{6DA2B636-698A-3294-BF4A-B5E11B238CDD}.KB958357) (Version: 9.0.30729.177 - Microsoft Corporation)
Visual C++ 2008 - x64 (KB958357) - v9.0.30729.177 (HKLM-x32\...\{8CCEA24C-51AE-3B71-9092-7D0C44DDA2DF}.KB958357) (Version: 9.0.30729.177 - Microsoft Corporation)
Visual C++ 2008 - x64 (KB958357) - v9.0.30729.177 (HKLM-x32\...\{C3A57BB3-9AA6-3F6F-9395-6C062BDD5FC4}.KB958357) (Version: 9.0.30729.177 - Microsoft Corporation)
Visual C++ 2008 - x64 (KB958357) - v9.0.30729.177 (HKLM-x32\...\{F6F09DD8-F39B-3A16-ADB9-C9E6B56903F9}.KB958357) (Version: 9.0.30729.177 - Microsoft Corporation)
Visual C++ 2008 - x86 (KB958357) - v9.0.30729.177 (HKLM-x32\...\{04B34E21-5BEE-3D2B-8D3D-E3E80D253F64}.KB958357) (Version: 9.0.30729.177 - Microsoft Corporation)
Visual C++ 2008 - x86 (KB958357) - v9.0.30729.177 (HKLM-x32\...\{14866AAD-1F23-39AC-A62B-7091ED1ADE64}.KB958357) (Version: 9.0.30729.177 - Microsoft Corporation)
Visual C++ 2008 - x86 (KB958357) - v9.0.30729.177 (HKLM-x32\...\{4B90093A-5D9C-3956-8ABB-95848BE6EFAD}.KB958357) (Version: 9.0.30729.177 - Microsoft Corporation)
Visual C++ 2008 - x86 (KB958357) - v9.0.30729.177 (HKLM-x32\...\{B42E259C-E4D4-37F1-A1B2-EB9C4FC5A04D}.KB958357) (Version: 9.0.30729.177 - Microsoft Corporation)
Windchill ProductPoint Client Manager (HKLM-x32\...\{129024FF-A6C9-4696-91BC-570C6C05193A}) (Version: 1.1.187 - PTC)
Windows Small Business Server 2011 Standard ClientAgent (HKLM\...\{5C72F8A3-BF39-4733-B41E-0ED7EF622E37}) (Version: 6.1.7900.1 - Microsoft Corporation)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{00F064D8-FEC3-48ac-B07D-39C314D1727B}\InprocServer32 -> C:\2015\Inventor 2015\Bin\ServiceModule.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{0215A4C0-5431-4FD0-9B06-46589B5C4939}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{048ED0E0-12CF-4C0F-9FFA-947C2FBE8C8E}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{071339A1-1946-44B2-B63E-50459B15DB86}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{073CB204-6B29-46FC-AB98-451F1D068741}\InprocServer32 -> C:\2015\Inventor 2015\Bin\TestServer.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{083f5ae0-2b0a-11dd-bd0b-0800200c9a66}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{08A60FF7-BB37-44F4-9759-0ADA6C7B9CC9}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{0B38CACA-3D3C-48EA-BEB5-7D95F4F6EE15}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{0B628DE4-07AD-4284-81CA-5B439F67C5E6}\localserver32 -> C:\2015\AutoCAD 2015\acad.exe (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{0C3393F8-94F5-4B79-8C01-49A2D0CC0FE9}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{0D555CE0-304A-47A6-858B-B145209A3982}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{1029ABC3-2457-11D5-8E9D-0010B541CD80}\localserver32 -> C:\2015\Inventor 2015\Compatibility\Bin\DbxBridge.exe (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{12545889-6D32-4424-9967-1E1D7BD1F809}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{13009989-EFB5-48C9-8BD2-943E0392BD71}\InprocServer32 -> C:\2015\Inventor 2015\Bin\RxAppCtrl.Ocx (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{14679E3B-C952-4998-8E13-4B1286E6DD99}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{1481B385-759A-4B00-9257-E96357563999}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{149DD748-EA85-45A6-93C5-AC50D0260C98}\localserver32 -> C:\2015\AutoCAD 2015\acad.exe (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{162EF0A1-5A33-46F2-ACCF-CA388B084A09}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{18A21864-E37B-42b9-9612-2C1E8C450A29}\InprocServer32 -> C:\2015\Inventor 2015\Bin\ServiceModule.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{1D625598-C876-4C51-8EF5-F9D8F96F62AA}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{1D6DFD6A-9E16-435A-9327-6FFEC6BA372F}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{1E5724EA-3423-4BD3-ABD6-46E650D2DC66}\InprocServer32 -> AcETransmit.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{1E8A29BA-827D-4031-A4A3-AE7999B402F6}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{1EA072EE-57FD-495E-889C-8243C3BDBDBC}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{1FD7F53F-7ED5-439C-9A77-A3821CD09E98}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{20E47D5B-529A-45BD-8E77-BF1A3064A008}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{21DB88B0-BFBF-11D4-8DE6-0010B541CAA8}\InprocServer32 -> C:\2015\Inventor 2015\Bin\iDrop.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{244298EC-E661-11d4-BC13-0010B5891E89}\InprocServer32 -> C:\2015\Inventor 2015\Bin\TI.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{2709544A-5B24-4F9F-A5DA-CEC7297D3A4E}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{2BCA857B-A18B-4AFA-B183-CC0E49C12058}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{2C74F89E-7421-46B4-BA54-F86F1BD9F237}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{2C7D1157-7D50-4A88-9777-5EBBA3189AB8}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{2F8377FC-50C1-44EF-AB7A-8FF1BB8EA277}\InprocServer32 -> C:\2015\Inventor 2015\Bin\ServiceModule.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{3497C2EC-5684-4B21-AF74-F6760E0221DC}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{3897B445-D5B8-410d-899A-9789B8ADB643}\localserver32 -> C:\2015\Inventor 2015\Compatibility\Bin\DbxBridge.exe (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{38C8B14E-7879-4DA9-8C3F-8CAAC359293A}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{3C3F63EA-C7BA-11d4-8E60-0010B541CD80}\localserver32 -> C:\2015\Inventor 2015\Compatibility\Bin\DbxBridge.exe (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{3FC94EB5-AEBD-4f3f-A2A4-B6CE57113C01}\InprocServer32 -> C:\2015\Inventor 2015\Bin\RxAppDocView.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{3FCEB42C-9B98-486A-BED7-FD7F3ADB7291}\InprocServer32 -> AcETransmit.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{40770568-0D5E-49D4-BE47-BC47A4F0B0A4}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{44A52280-AE56-490D-890C-89FB7279ED6B}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{45122C53-8483-4b62-B15A-EAA9FE5FC3D5}\InprocServer32 -> C:\2015\Inventor 2015\Bin\ServiceModule.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{46C56738-39C6-4240-8B9B-008CCD769A84}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{47179DDE-10AC-4737-97C9-8CE5379343EA}\InprocServer32 -> AcETransmit.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{475C7B4A-6964-4F9E-9708-05A16EAC31D0}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{48270F9E-CCF6-4C79-B6FF-267C960E6425}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{48A74AAC-E196-4AF0-9EC2-28C7C5150645}\InprocServer32 -> c:\Users\Public\Documents\Autodesk\Inventor 2015\SDK\UserTools\DrawingTools\Bin\DrawingTools.dll ()
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{48FEFCD7-5D7C-4E4A-9F11-60E69A31D4B1}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{49998808-648A-4A9C-A7A5-B1672775D9AB}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{4A756F5F-CBA4-428B-B17F-AF80C0C8502D}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{4B40437B-8972-4444-BBE3-1588FF55F203}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{4BD03680-3C0F-4501-AFF7-3D008586917F}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{4C80573A-9150-11d2-B772-0060B0F159EF}\InprocServer32 -> C:\2015\Inventor 2015\Bin\RxAppDocView.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{4D29B490-49B2-11D0-93C3-7E0706000000}\localserver32 -> C:\2015\Inventor 2015\Bin\Inventor.exe (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{4E6F2E83-E7F0-4333-9772-875EB733C820}\InprocServer32 -> C:\2015\Inventor 2015\Bin\RxTest.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{5544903C-2CCC-487C-91BB-F310B72A8E9B}\InprocServer32 -> AcETransmit.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}\InprocServer32 -> C:\Users\*NAME*\AppData\Roaming\ernden\berdis.dll No File <==== ATTENTION
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{59A224A2-BEF8-4C89-96E0-83A5411ABB6C}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{622F6193-E4DD-46E6-BC66-2ED88E9FD28D}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{62FBB030-24C7-11D3-B78D-0060B0F159EF}\localserver32 -> C:\2015\Inventor 2015\Bin\Inventor.exe (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{644190AE-BD8F-493F-B63D-C79404AC5E07}\InprocServer32 -> C:\2015\Inventor 2015\Bin\ServiceModule.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{6451051B-AD22-4C6A-ACCE-013A0E1DDBC3}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{64B99FDB-1D85-447F-98C7-569DBDA723DB}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{6BCE6F6E-C050-4F39-BD98-E2743949F724}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{6F56D7C9-18DD-4C15-9FA8-C54E3610EC40}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{6FDE7A70-351B-11d6-988B-0010B57A8BB7}\InprocServer32 -> C:\2015\Inventor 2015\Bin\DtBridge.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{6FDE7A71-351B-11d6-988B-0010B57A8BB7}\InprocServer32 -> C:\2015\Inventor 2015\Bin\DtBridge.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{6FDE7A72-351B-11d6-988B-0010B57A8BB7}\InprocServer32 -> C:\2015\Inventor 2015\Bin\DtBridge.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{6FDE7A73-351B-11d6-988B-0010B57A8BB7}\InprocServer32 -> C:\2015\Inventor 2015\Bin\DtBridge.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{6FDE7A74-351B-11d6-988B-0010B57A8BB7}\InprocServer32 -> C:\2015\Inventor 2015\Bin\DtBridge.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{6FDE7A77-351B-11d6-988B-0010B57A8BB7}\InprocServer32 -> C:\2015\Inventor 2015\Bin\DtCp.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{70DBCAE8-8C2B-450C-9E1D-43E4686C6512}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{713C0E8A-5AE8-4695-B442-5ED6C4FE5C42}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{714D325C-E9CE-44ab-A72A-36BB410BA19B}\localserver32 -> C:\2015\Inventor 2015\Bin\FEAFilesHandler.exe (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{7293E009-3015-4AD3-96EC-D42C36B5FCE3}\InprocServer32 -> AcETransmit.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{72EC5CC5-88F3-45B1-A865-0A327DF58CC8}\InprocServer32 -> C:\2015\Inventor 2015\Bin\ServiceModule.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{72EFC580-D085-4B81-8C55-26A79E445338}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{750AEC19-2E4C-4ED9-9B9F-F9CAFCD060F3}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{76283A80-50DD-11D3-A7E3-00C04F79D7BC}\localserver32 -> C:\2015\Inventor 2015\Bin\Inventor.exe (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{794199C5-827C-41C8-8CB2-3A1EA056AF5E}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{798391FE-4AF2-4851-9DDA-1F0D70C02A9E}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{7BA16B3F-1AB3-4BD7-B959-52C4B8504EE9}\InprocServer32 -> AcInetUI.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{7C239DAB-BC87-45F3-B7B1-FCC1541A235B}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{81D07C3D-0350-11D3-B7C2-0060B0EC020B}\InprocServer32 -> C:\2015\Inventor 2015\Bin\RxAppCtrl.Ocx (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{834CE679-2E47-49DE-9E41-FEC87E9192EB}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{8421A29C-54B8-11D1-9837-0060B03C43C8}\InprocServer32 -> C:\2015\Inventor 2015\Bin\SolidObject.Dll ()
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{846217D0-8954-11D2-8DCD-0060B0C32531}\InprocServer32 -> C:\2015\Inventor 2015\Bin\UCxTextBtn.Ocx (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{846217D1-8954-11D2-8DCD-0060B0C32531}\InprocServer32 -> C:\2015\Inventor 2015\Bin\UCxTextBtn.Ocx (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{849AFB5B-D6C9-4924-A712-F7118FF9611F}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{84B5A313-CD5D-4904-8BA2-AFDC81C1B309}\InprocServer32 -> C:\Program Files (x86)\Citrix\GoToMeeting\2553\G2MOutlookAddin64.dll (Citrix Online, a division of Citrix Systems, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{85452F88-5071-492E-B850-2E3C586DCBD8}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{87F5CF8F-A06D-498F-A05F-E520E6B570DB}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{89F0FC31-3B1D-494B-A75B-6BD4FA527B8A}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{8AA16DFC-DFC6-4B51-8FA2-A5D812BE33BF}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{8B0E6BD9-610C-11D1-9842-0060B03C43C8}\InprocServer32 -> C:\2015\Inventor 2015\Bin\SolidObject.Dll ()
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{8C23B656-4E6E-4B45-9920-9617168D39A3}\InprocServer32 -> C:\2015\Inventor 2015\Bin\TestServer.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{8ED07FEF-E1B0-4CC3-B2BA-D354828AB952}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{97E17F04-17DF-11d5-BC38-0010B5891E89}\InprocServer32 -> C:\2015\Inventor 2015\Bin\BodyReceiver.dll ()
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{988F4102-E6E3-4282-ACAC-55270827F2A8}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{9906CDFC-DB2C-4126-9422-13139B148495}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{9A21C6C5-27FC-4442-8590-575E7AFD73BB}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{9ECF83FB-23C5-43B6-83DE-93CFBDD74D4A}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{A58F47CC-FF65-4152-B0B1-666C643A5BFC}\InprocServer32 -> AcETransmit.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{A6A3D586-44CF-44C2-A92C-620BB713B4F2}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{ABBE3F83-D585-4A50-9B69-198B0F566F2E}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{AC5CECFA-F03A-41D2-A89C-704C44935941}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{B1560245-190E-4BBD-81DF-9B642D0E5325}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{B2A579E0-A797-40B1-8AEE-A8F6404719F8}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{B47196BC-D4AB-41BB-A771-543D67CFC9F5}\InprocServer32 -> AcETransmit.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{B53CEF4B-1A13-49DE-BBC5-A7100FB2F38C}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{B5EE2B68-9A23-4BCD-BB77-FEA6DFB24DD6}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{B6B5DC40-96E3-11d2-B774-0060B0F159EF}\localserver32 -> C:\2015\Inventor 2015\Bin\Inventor.exe (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{B80687F9-FA4C-4735-9DC4-E5715F2BC698}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{B8E7214B-25CA-4116-84CB-E86FB9625B36}\InprocServer32 -> C:\2015\Inventor 2015\Bin\ServiceModule.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{BAE5802A-CF21-4F9C-AE04-D98F4036AC31}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{BBF6A206-CB04-479D-96AE-349E1E83319A}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{BBF9FDF1-52DC-11D0-8C04-0800090BE8EC}\localserver32 -> C:\2015\Inventor 2015\Bin\Inventor.exe (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{BC71DEA1-D6FB-48B8-AB06-D151C81BBCDD}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{BE54741D-E02B-4572-93D6-105AF4EDE777}\InprocServer32 -> C:\2015\Inventor 2015\Bin\ServiceModule.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{BF224DC3-B602-4EEE-BFE9-9E4E0AED6837}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{BF4CC07E-E9BB-40D6-873F-855B211033B9}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{C061C82C-D041-4214-BB07-B608107CEFCB}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{C2D4ACCC-A3D1-4A0A-AD59-0DD8BA3D5EE1}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{C343ED84-A129-11d3-B799-0060B0F159EF}\InprocServer32 -> C:\2015\Inventor 2015\Bin\RxApprenticeServer.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{C8C18F89-794D-466B-8B97-95634D9890EF}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{C8EC7647-1E79-4F13-81D7-2EED803D0D22}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{C92F8F8C-8B2C-11d4-B872-0060B0EC020B}\InprocServer32 -> C:\2015\Inventor 2015\Bin\DtBridge.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{CC23CA32-9892-4FBA-A108-FE31CA0F35A6}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{CD865713-70D6-4E15-BB7B-9B99AD9DEB85}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{CFEE2BAF-14F9-4D23-853D-B6E2BCC14263}\InprocServer32 -> C:\2015\Inventor 2015\Bin\ServiceModule.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{D56F5AB3-9C4D-4F1A-A851-A671D9FE8C22}\InprocServer32 -> AcETransmit.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{D66873EA-AAE5-41CC-8DD2-8CE3228E9F89}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{D7A1987D-4A73-11D1-9A4B-080009DCE505}\InprocServer32 -> C:\2015\Inventor 2015\Bin\ColorButton.Ocx (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{D7A1987E-4A73-11D1-9A4B-080009DCE505}\InprocServer32 -> C:\2015\Inventor 2015\Bin\ColorButton.Ocx (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{D86B6C47-11F2-4D95-B635-EA575F0892FC}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{DA1F437C-9BD9-11d4-B87C-0060B0EC020B}\InprocServer32 -> C:\2015\Inventor 2015\Bin\DtBridge.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{DB207560-8449-4FAF-BDC2-61676EB012D4}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{DB5D476B-3FF4-4E9D-A606-1E2B473BE571}\InprocServer32 -> C:\2015\Inventor 2015\Bin\AcInetUI.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{DCA7356C-FF94-4b20-AE04-7AA6A8E14117}\InprocServer32 -> C:\2015\Inventor 2015\Bin\ServiceModule.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{DDA9A20F-5B56-49F5-9465-CE82FC199352}\InprocServer32 -> C:\2015\Inventor 2015\Bin\ServiceModule.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{DE6B563C-B074-4BF1-A8A0-B3FED8703E99}\InprocServer32 -> C:\2015\Inventor 2015\Bin\ServiceModule.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{DE74F5AD-DA2F-429F-BAF9-850A2808D585}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{DF6525C2-6358-4B07-813D-708120C5FE1A}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{E177A457-9EAA-43C3-A3CE-84874A28F6CA}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{E1C85E9F-60B2-4007-80C3-2C5E09474C3B}\InprocServer32 -> C:\2015\Inventor 2015\Bin\RxInventorUtilities.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{E29F6C45-6927-4508-8F3F-34105FD3FC5F}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{E2C40589-DE61-11ce-BAE0-0020AF6D7005}\InprocServer32 -> C:\2015\AutoCAD 2015\de-DE\acadficn.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{E4222C78-3670-4BB1-9AD4-7D8F3E581F2D}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{E5B0515D-48D2-4F04-906D-0192ED65A2DD}\InprocServer32 -> C:\2015\Inventor 2015\Bin\TestServer.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{E60F81E1-49B3-11D0-93C3-7E0706000000}\localserver32 -> C:\2015\Inventor 2015\Bin\Inventor.exe (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{E70DE962-842A-4488-9481-1D0FD72A020F}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{E9C07CEC-7B82-49E4-BBA2-7533B88E9D64}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{EA34A0C0-5CE7-4701-A6FA-117D25CD5EBB}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{EF01D98A-747B-4522-AD70-991B90855DBF}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{F13E75B9-6AF6-49CB-80B3-6D2FF6E09932}\InprocServer32 -> C:\2015\Inventor 2015\Bin\ServiceModule.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{F196F03F-651A-43AF-BE34-D11942F24445}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{F2D4F4E5-EEA1-46FF-A83B-A270C92DAE4B}\InprocServer32 -> C:\2015\Inventor 2015\Bin\DTInterop.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{F2DB0EE3-7137-4CB0-8349-483C4FF2143A}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{F40E2FF0-4D77-40B2-9A44-A3AEECCE8EFF}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{F5522F0C-962A-48AC-9992-E81B07628F1F}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{F61064CC-DBFB-47ee-9BC8-CA5A1CBDF0DA}\InprocServer32 -> C:\2015\Inventor 2015\Bin\InvResc.dll (Autodesk)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{F78DCF7C-043D-45FC-9D21-676FC307BA3F}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{F868EAEC-1B73-4F5E-BA73-90EBA94E75BE}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{FA62F626-EBD5-4dc5-B970-D9E81E0E20E0}\InprocServer32 -> C:\2015\Inventor 2015\Bin\ServiceModule.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{FA97F7A7-FD19-4D55-ABF2-CFEFFF777426}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{FB469644-3F14-4403-ACCA-6B13486FF7BD}\localserver32 -> C:\2015\Inventor 2015\Bin\InvTXTStack.exe (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{FD51ED8A-D518-4554-B236-B6E9D234FD03}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{FD703B01-4362-423E-9BDB-91BDCB16C1C9}\InprocServer32 -> C:\2015\Inventor 2015\Bin\DTInterop.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{FE054BB2-AF94-40AC-88AA-2F59F7018B1D}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{FE317223-8EDE-4684-B424-E48B9EA90220}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-779854708-3996167121-2897795797-1172_Classes\CLSID\{FE718E8F-C3AA-4F30-9103-432450CF1DA1}\InprocServer32 -> axdb.dll No File

==================== Restore Points  =========================

06-05-2015 18:02:01 Geplanter Prüfpunkt
11-05-2015 08:38:42 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2015-05-07 11:21 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0047D990-32A3-4743-9C16-F2CDE90559B6} - System32\Tasks\{2A486EC4-1A89-4107-A1D9-79242CB7DF4B} => pcalua.exe -a C:\Users\*NAME*\AppData\Roaming\Oracle\Java\Uninstall\UninstallJavaVersions.exe -d "C:\Portable Apps\PortableApps\FirefoxPortable\App\firefox" -c -remove 1.7.0_67:32
Task: {05607697-2CAF-42F0-9465-70E812791512} - System32\Tasks\3DconnexionCreateProcess_3DxService.exe => C:\Program Files\3Dconnexion\3DxWare\3DxWinCore64\3DxService.exe [2014-06-23] (3Dconnexion, INC)
Task: {21EC8B28-7C81-44AF-820D-99EA0E245E16} - System32\Tasks\{A48601B8-0C32-4EA4-BDC3-BAD2E3B5164E} => pcalua.exe -a "C:\2015\Inventor 2015\Inventor2015ConnectSetup.exe" -d "C:\2015\Inventor 2015"
Task: {3956AAB4-91A3-402B-B37A-C81717B349A2} - System32\Tasks\{6156481B-CCE6-4A22-985F-5AD6E5CAAD1B} => pcalua.exe -a C:\Users\*NAME*\Downloads\Inventor2015ConnectSetup.exe -d C:\Users\*NAME*\Downloads
Task: {3A249FBB-13BB-41FE-9FA8-DF01FF48138B} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-04-22] (Microsoft Corporation)
Task: {3C907C8B-B54C-4533-951E-FAF8868EA343} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx64\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2015-04-22] (Microsoft Corporation)
Task: {6EE83BD2-9293-4A71-9CE4-DB794159A882} - System32\Tasks\Core Temp Autostart CAD => C:\Program Files\Core Temp\Core Temp.exe [2013-10-08] ()
Task: {822B4ABE-3C32-4615-87D6-27A679BE9B34} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-04-15] (Adobe Systems Incorporated)
Task: {A9CAA55A-95CB-4170-B6B1-32EA0E33C24D} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-04-22] (Microsoft Corporation)
Task: {ADC172C1-BB03-4351-9B79-404EEA80FC05} - System32\Tasks\G2MUpdateTask-S-1-5-21-779854708-3996167121-2897795797-1172 => C:\Program Files (x86)\Citrix\GoToMeeting\2553\g2mupdate.exe [2015-05-07] (Citrix Online, a division of Citrix Systems, Inc.)
Task: {B0DE8FB4-578D-4D70-AE19-015D45CE4154} - System32\Tasks\Microsoft Office 15 Sync Maintenance for {07d4931b-8424-4072-8a2b-533ef1d23aa6} RECHNER01.office.local => C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [2015-03-10] (Microsoft Corporation)
Task: {B11F0678-3EBA-488B-9504-96453D59E39E} - System32\Tasks\{6E9EB1A9-C6AF-4DDF-A150-7515B5CA2E77} => pcalua.exe -a C:\Users\*NAM*~1\AppData\Local\Temp\jre-8u40-windows-au.exe -d "C:\Program Files (x86)\Java\jre1.8.0_31\bin" -c /installmethod=jau-m FAMILYUPGRADE=1
Task: {C19D6E93-00DD-477B-ACAA-C7376EB17A19} - System32\Tasks\Core Temp Autostart *NAME* => C:\Program Files\Core Temp\Core Temp.exe [2013-10-08] ()
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-779854708-3996167121-2897795797-1172.job => C:\Program Files (x86)\Citrix\GoToMeeting\2553\g2mupdate.exe

==================== Loaded Modules (whitelisted) ==============

2015-03-24 11:59 - 2015-03-13 21:41 - 03039376 _____ () C:\Windows\system32\nvwmi64.exe
2014-01-23 13:43 - 2015-03-13 18:16 - 00118472 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2014-07-16 19:07 - 2014-05-20 09:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2014-01-23 13:44 - 2015-03-13 21:41 - 00714048 _____ () C:\Program Files\NVIDIA Corporation\nview\nvshell.dll
2014-09-15 16:46 - 2013-10-08 13:23 - 00890016 _____ () C:\Program Files\Core Temp\Core Temp.exe
2014-06-23 20:37 - 2014-06-23 20:37 - 00044544 _____ () C:\Windows\system32\SPWINI.dll
2015-05-07 10:38 - 2007-09-02 13:58 - 00495616 _____ () C:\Portable Apps\PortableApps\RocketDock\RocketDock.exe
2015-01-12 10:15 - 2013-09-23 19:52 - 00048520 _____ () C:\2015\Inventor 2015\Bin\QtSolutions_MFCMigrationFramework_Ad_2.dll
2015-01-12 10:15 - 2013-12-12 13:38 - 05617480 _____ () C:\2015\Inventor 2015\Bin\synHub.dll
2013-04-23 18:28 - 2013-04-23 18:28 - 00549888 _____ () c:\Users\Public\Documents\Autodesk\Inventor 2015\SDK\UserTools\DrawingTools\Bin\DrawingTools.dll
2015-01-12 10:15 - 2014-10-24 12:00 - 04459848 _____ () C:\2015\Inventor 2015\Bin\DWFMergerUtil.dll
2015-01-12 10:15 - 2014-10-24 11:59 - 00325448 _____ () C:\2015\Inventor 2015\Bin\Connectivity.Common.Windows.dll
2015-01-12 10:15 - 2013-09-23 19:52 - 00059784 _____ () C:\2015\Inventor 2015\Bin\qoauth_Ad_1.dll
2015-01-12 10:15 - 2013-09-23 19:51 - 00922504 _____ () C:\2015\Inventor 2015\Bin\qca_Ad_2.dll
2015-01-12 10:15 - 2013-09-23 19:52 - 00232328 _____ () C:\2015\Inventor 2015\Bin\qjson_Ad_0.dll
2015-01-12 10:15 - 2014-09-03 03:24 - 00402304 _____ () C:\2015\Inventor 2015\Bin\AgSrv.dll
2015-01-12 10:15 - 2014-09-03 03:24 - 00604032 _____ () C:\2015\Inventor 2015\Bin\Ag.dll
2015-01-12 10:15 - 2014-03-05 14:02 - 00049480 _____ () C:\2015\Inventor 2015\Bin\de-DE\AgRes.dll
2014-07-15 18:35 - 2014-12-05 04:27 - 00055688 _____ () C:\Program Files (x86)\Common Files\Autodesk Shared\AppManager\R1\QtSolutions_Service-head.dll
2014-07-15 18:35 - 2014-12-05 04:27 - 00104328 _____ () C:\Program Files (x86)\Common Files\Autodesk Shared\AppManager\R1\qjson0.dll
2013-11-04 21:29 - 2012-06-08 05:34 - 00627216 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMediaLibrary.dll
2012-06-08 21:34 - 2012-06-08 21:34 - 00016400 _____ () c:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvcPS.dll
2012-09-23 20:43 - 2012-09-23 20:43 - 00010240 _____ () C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\locale\de_de\acrotray.deu
2015-05-11 08:48 - 2014-12-05 04:27 - 00104328 _____ () C:\Users\*NAME*\AppData\Local\Autodesk\.AdskAppManager\R1\qjson0.dll
2015-05-07 10:38 - 2007-09-02 13:57 - 00069632 _____ () C:\Portable Apps\PortableApps\RocketDock\RocketDock.dll
2013-11-04 21:26 - 2013-07-11 01:16 - 01199576 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, the associated entry will be removed from the registry.)

IE trusted site: HKU\S-1-5-21-779854708-3996167121-2897795797-1172\...\chip.de -> hxxp://www.chip.de


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-779854708-3996167121-2897795797-1172\Control Panel\Desktop\\Wallpaper -> C:\Users\*NAME*\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.0.20

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== FirewallRules (whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [{EF056D0E-6578-4E4B-BE08-34A78B41AC05}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12.exe
FirewallRules: [{65123027-D71D-4532-87DF-F93CF81087AF}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe
FirewallRules: [{0AC6D902-7655-4E13-979A-0B57E561517E}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe
FirewallRules: [{A3C3E7EC-B41E-45C3-9E33-64B176A7FF25}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12Agent.exe
FirewallRules: [{F47C1FE8-91DE-42AA-8758-07CE6139119B}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12ML.exe
FirewallRules: [{61AE2FF3-E900-4CA5-B795-9CEDCFCCCCC2}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDVD12\Movie\PowerDVD.exe
FirewallRules: [{62C82F3C-76F8-4F12-B0CC-6F44DD22A57E}] => (Allow) LPort=50248
FirewallRules: [{0B5152E8-1853-4034-BCD4-2857C64DA898}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\outlook.exe
FirewallRules: [{30CFF3CC-6359-448A-A2F1-C975EAD37BED}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\Lync.exe
FirewallRules: [{B0AA2CAD-927C-44D2-B0A2-C6FC54EA8FB6}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\UcMapi.exe
FirewallRules: [TCP Query User{8EA55079-6C16-4CB6-B7DD-5DF774F185D9}C:\2015\showcase 2015\bin\showcase.exe] => (Allow) C:\2015\showcase 2015\bin\showcase.exe
FirewallRules: [UDP Query User{B94B046D-FCE4-4C43-A093-57B17167D999}C:\2015\showcase 2015\bin\showcase.exe] => (Allow) C:\2015\showcase 2015\bin\showcase.exe
FirewallRules: [{32C2EC71-50AA-4D32-9204-CEB0B4509714}] => (Allow) \\SERVER\Software\Druckertreiber\CANON IPF 750\64bit\iPFSetup.exe
FirewallRules: [{2B619C45-9546-4E9E-83F7-3664DBC5E6B8}] => (Allow) \\SERVER\Software\Druckertreiber\CANON IPF 750\64bit\iPFSetup.exe
FirewallRules: [{E3E8B88B-AE26-4DFF-8808-FDD02A035497}] => (Allow) \\SERVER\Software\Druckertreiber\CANON IPF 750\64bit\iPFSetup.exe
FirewallRules: [{E649BC1C-7468-45BC-8C29-5D98C27743B7}] => (Allow) \\SERVER\Software\Druckertreiber\CANON IPF 750\64bit\iPFSetup.exe
FirewallRules: [{C0E71D27-E8F7-4975-AE57-574CD0303A13}] => (Allow) C:\Program Files\Canon\imagePROGRAFStatusMonitor\cnwism.exe
FirewallRules: [{10308854-CE14-4011-96DC-E0040D14F61A}] => (Allow) C:\Program Files\Canon\imagePROGRAFStatusMonitor\cnwism.exe
FirewallRules: [{AD652DDD-245F-4ECC-A39C-26D103F180EB}] => (Allow) C:\Program Files\Canon\imagePROGRAFStatusMonitor\cnwida.exe
FirewallRules: [{F30676D6-93B7-4169-AC3A-BB7D73023165}] => (Allow) C:\Program Files\Canon\imagePROGRAFStatusMonitor\cnwida.exe
FirewallRules: [TCP Query User{A4405184-8485-4073-8A9D-A7E251E81E7E}C:\portable apps\portableapps\skypeportable\app\skype\phone\skype.exe] => (Allow) C:\portable apps\portableapps\skypeportable\app\skype\phone\skype.exe
FirewallRules: [UDP Query User{5FE15974-4907-4DF4-8F84-11D1E5CE87B1}C:\portable apps\portableapps\skypeportable\app\skype\phone\skype.exe] => (Allow) C:\portable apps\portableapps\skypeportable\app\skype\phone\skype.exe
FirewallRules: [TCP Query User{4272C48E-BFA1-4743-B670-FBF3DA4C3C2E}C:\portable apps\portableapps\skypeportable\app\skype\phone\skype.exe] => (Allow) C:\portable apps\portableapps\skypeportable\app\skype\phone\skype.exe
FirewallRules: [UDP Query User{C5F7D05A-965D-45DE-970F-4D77A67782BA}C:\portable apps\portableapps\skypeportable\app\skype\phone\skype.exe] => (Allow) C:\portable apps\portableapps\skypeportable\app\skype\phone\skype.exe
FirewallRules: [TCP Query User{8356A772-C900-4F29-A5C1-866398CEAC8A}C:\portable apps\portableapps\counter-strike source\hl2.exe] => (Allow) C:\portable apps\portableapps\counter-strike source\hl2.exe
FirewallRules: [UDP Query User{1B755C2B-C79C-4381-A92C-377F2AA29129}C:\portable apps\portableapps\counter-strike source\hl2.exe] => (Allow) C:\portable apps\portableapps\counter-strike source\hl2.exe
FirewallRules: [TCP Query User{3FB4B3A0-85DB-4959-AEC7-E84057DDC518}E:\voss-cad-katalog\software\lic\x86\cnslocal.exe] => (Allow) E:\voss-cad-katalog\software\lic\x86\cnslocal.exe
FirewallRules: [UDP Query User{B32986F1-3068-474B-AD8B-03A9D064EAA0}E:\voss-cad-katalog\software\lic\x86\cnslocal.exe] => (Allow) E:\voss-cad-katalog\software\lic\x86\cnslocal.exe
FirewallRules: [{B73EAEC8-02AF-4466-B78C-D8D1F85387B9}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [TCP Query User{04C019B9-E904-4302-9743-0B05FCF85329}C:\portable apps\portableapps\cod4\iw3mp.exe] => (Allow) C:\portable apps\portableapps\cod4\iw3mp.exe
FirewallRules: [UDP Query User{E5AE3635-0F10-4CE9-AB5E-B4002014223C}C:\portable apps\portableapps\cod4\iw3mp.exe] => (Allow) C:\portable apps\portableapps\cod4\iw3mp.exe
FirewallRules: [TCP Query User{3CF64B4E-E756-4499-90ED-B2B0CB4FC36E}E:\privat\cod4 - patched\iw3mp.exe] => (Allow) E:\privat\cod4 - patched\iw3mp.exe
FirewallRules: [UDP Query User{6C595B7E-D47B-4045-BB79-806DA9233EC7}E:\privat\cod4 - patched\iw3mp.exe] => (Allow) E:\privat\cod4 - patched\iw3mp.exe
FirewallRules: [TCP Query User{74BAAFA3-DE21-48C4-B324-345B791570BF}E:\privat\cod4 - portable patched - de\iw3mp.exe] => (Allow) E:\privat\cod4 - portable patched - de\iw3mp.exe
FirewallRules: [UDP Query User{B669D25C-A8CD-4394-966B-304C17D3CE4F}E:\privat\cod4 - portable patched - de\iw3mp.exe] => (Allow) E:\privat\cod4 - portable patched - de\iw3mp.exe
FirewallRules: [TCP Query User{D5AE5F75-AEF9-4C29-BCCC-0F3B530866CD}E:\privat\cod4 - portable patched - en\iw3mp.exe] => (Allow) E:\privat\cod4 - portable patched - en\iw3mp.exe
FirewallRules: [UDP Query User{26F255A3-6918-46B8-8A59-690A950A8B94}E:\privat\cod4 - portable patched - en\iw3mp.exe] => (Allow) E:\privat\cod4 - portable patched - en\iw3mp.exe
FirewallRules: [TCP Query User{2533592D-75DF-415D-997D-ABD1A932C46E}E:\privat\cod 4 - modern warfare (portable) - unpatched\iw3mp.exe] => (Allow) E:\privat\cod 4 - modern warfare (portable) - unpatched\iw3mp.exe
FirewallRules: [UDP Query User{15410DF2-6842-4D64-83F9-C10323C4267C}E:\privat\cod 4 - modern warfare (portable) - unpatched\iw3mp.exe] => (Allow) E:\privat\cod 4 - modern warfare (portable) - unpatched\iw3mp.exe
FirewallRules: [TCP Query User{475B4788-6936-4768-9276-A86A102D115F}E:\privat\cod 4 - modern warfare (portable) - de- patched\iw3mp.exe] => (Allow) E:\privat\cod 4 - modern warfare (portable) - de- patched\iw3mp.exe
FirewallRules: [UDP Query User{F10BA5B5-9972-454C-9E1D-0953307F8392}E:\privat\cod 4 - modern warfare (portable) - de- patched\iw3mp.exe] => (Allow) E:\privat\cod 4 - modern warfare (portable) - de- patched\iw3mp.exe
FirewallRules: [TCP Query User{98B04019-8631-4923-AD55-C06CF183BE7B}C:\portable apps\portableapps\aimpportable\app\aimp\aimp3.exe] => (Allow) C:\portable apps\portableapps\aimpportable\app\aimp\aimp3.exe
FirewallRules: [UDP Query User{7A8CCF9B-B45E-4D47-B9AF-D7ECFAE59375}C:\portable apps\portableapps\aimpportable\app\aimp\aimp3.exe] => (Allow) C:\portable apps\portableapps\aimpportable\app\aimp\aimp3.exe
FirewallRules: [TCP Query User{8A03E15E-C718-462F-B063-E1227DDB89E5}C:\portable apps\portableapps\firefoxportable\app\firefox\firefox.exe] => (Allow) C:\portable apps\portableapps\firefoxportable\app\firefox\firefox.exe
FirewallRules: [UDP Query User{85BE244D-C575-46A7-98AB-7BB8E4026661}C:\portable apps\portableapps\firefoxportable\app\firefox\firefox.exe] => (Allow) C:\portable apps\portableapps\firefoxportable\app\firefox\firefox.exe
FirewallRules: [{C11A66F7-9127-47E6-8C78-8BACD3F7E2A8}] => (Block) %ProgramFiles%\Internet Explorer\iexplore.exe
FirewallRules: [{9591FBED-6BA9-4C34-A492-02F2BF00528B}] => (Block) %ProgramFiles%\Internet Explorer\iexplore.exe
FirewallRules: [TCP Query User{5DA063AF-5256-47A4-BDC3-081DD5D517C6}E:\privat\firefoxportable\app\firefox\firefox.exe] => (Block) E:\privat\firefoxportable\app\firefox\firefox.exe
FirewallRules: [UDP Query User{65E46646-AC6A-4394-BB9E-399BF98F0039}E:\privat\firefoxportable\app\firefox\firefox.exe] => (Block) E:\privat\firefoxportable\app\firefox\firefox.exe
FirewallRules: [TCP Query User{A8C208C1-3421-4691-A735-6913C65C30CD}C:\portable apps\portableapps\firefoxportable\app\firefox\firefox.exe] => (Allow) C:\portable apps\portableapps\firefoxportable\app\firefox\firefox.exe
FirewallRules: [UDP Query User{EFD2AEBC-A867-45FD-B8D9-90B306E0F96D}C:\portable apps\portableapps\firefoxportable\app\firefox\firefox.exe] => (Allow) C:\portable apps\portableapps\firefoxportable\app\firefox\firefox.exe
FirewallRules: [TCP Query User{C8C4590C-418F-4A8A-9F03-B9D8E4F600CF}C:\portable apps\portableapps\keepass portable\keepass.exe] => (Allow) C:\portable apps\portableapps\keepass portable\keepass.exe
FirewallRules: [UDP Query User{90F2764C-09CB-43EC-8586-0DB58DED2BC6}C:\portable apps\portableapps\keepass portable\keepass.exe] => (Allow) C:\portable apps\portableapps\keepass portable\keepass.exe
FirewallRules: [{93F45C4C-DB5B-4DEA-BBE8-03ECB54943EE}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\Lync.exe
FirewallRules: [{035507AB-6C61-4FB8-82D0-B5CF89301D5B}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\UcMapi.exe

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (05/11/2015 08:53:49 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.

Error: (05/11/2015 08:53:49 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (05/11/2015 08:53:49 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (05/11/2015 08:48:04 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: netlogon.exe, Version: 2.0.0.0, Zeitstempel: 0x41e45945
Name des fehlerhaften Moduls: WBDEF44I.DLL, Version: 5.6.2.0, Zeitstempel: 0x41f16c57
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00049ec9
ID des fehlerhaften Prozesses: 0xf34
Startzeit der fehlerhaften Anwendung: 0xnetlogon.exe0
Pfad der fehlerhaften Anwendung: netlogon.exe1
Pfad des fehlerhaften Moduls: netlogon.exe2
Berichtskennung: netlogon.exe3

Error: (05/11/2015 08:33:01 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.

Error: (05/11/2015 08:33:01 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (05/11/2015 08:33:01 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (05/11/2015 08:28:06 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: netlogon.exe, Version: 2.0.0.0, Zeitstempel: 0x41e45945
Name des fehlerhaften Moduls: WBDEF44I.DLL, Version: 5.6.2.0, Zeitstempel: 0x41f16c57
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00049ee5
ID des fehlerhaften Prozesses: 0x784
Startzeit der fehlerhaften Anwendung: 0xnetlogon.exe0
Pfad der fehlerhaften Anwendung: netlogon.exe1
Pfad des fehlerhaften Moduls: netlogon.exe2
Berichtskennung: netlogon.exe3

Error: (05/07/2015 04:45:21 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.

Error: (05/07/2015 04:45:21 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.


System errors:
=============
Error: (05/11/2015 08:46:28 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits 2 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (05/11/2015 08:46:28 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Intel(R) Capability Licensing Service Interface" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 0 Millisekunden durchgeführt: Neustart des Diensts.

Error: (05/11/2015 08:46:28 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Microsoft Office-Klick-und-Los-Dienst" wurde unerwartet beendet. Dies ist bereits 2 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 0 Millisekunden durchgeführt: Neustart des Diensts.

Error: (05/11/2015 08:46:27 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Intel(R) Dynamic Application Loader Host Interface Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (05/11/2015 08:46:27 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (05/11/2015 08:46:27 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Modules Installer" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (05/11/2015 08:46:27 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Autodesk Simulation Moldflow MITSI 2015 Job-Manager" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (05/11/2015 08:46:27 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "3Dconnexion Broker Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (05/11/2015 08:46:27 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "iPF Device Agent Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (05/11/2015 08:46:27 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Intel(R) PROSet Monitoring Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.


Microsoft Office Sessions:
=========================
Error: (05/11/2015 08:53:49 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000

Error: (05/11/2015 08:53:49 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (05/11/2015 08:53:49 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (05/11/2015 08:48:04 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: netlogon.exe2.0.0.041e45945WBDEF44I.DLL5.6.2.041f16c57c000000500049ec9f3401d08bb66d2c5aaa\\Server\netlogon\netlogon.exe\\Server\netlogon\WBDEF44I.DLLabf72703-f7a9-11e4-979f-a0d3c121c60b

Error: (05/11/2015 08:33:01 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000

Error: (05/11/2015 08:33:01 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (05/11/2015 08:33:01 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (05/11/2015 08:28:06 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: netlogon.exe2.0.0.041e45945WBDEF44I.DLL5.6.2.041f16c57c000000500049ee578401d08bb3a2c65e20\\Server\netlogon\netlogon.exe\\Server\netlogon\WBDEF44I.DLLe1f67bef-f7a6-11e4-ae55-a0d3c121c60b

Error: (05/07/2015 04:45:21 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000

Error: (05/07/2015 04:45:21 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000


CodeIntegrity Errors:
===================================
  Date: 2015-05-07 11:19:55.773
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-05-07 11:19:55.749
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-01-12 10:37:43.091
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\l3codeca.acm" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-10-07 13:14:30.598
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\l3codeca.acm" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-10-07 09:50:19.116
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\l3codeca.acm" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-10-07 08:07:54.623
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\l3codeca.acm" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-10-07 07:58:47.164
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\l3codeca.acm" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-10-06 09:14:20.681
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\l3codeca.acm" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-10-06 09:07:05.463
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\l3codeca.acm" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-10-06 08:27:02.899
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\l3codeca.acm" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Processor: Intel(R) Xeon(R) CPU E5-1620 v2 @ 3.70GHz
Percentage of memory in use: 13%
Total physical RAM: 32696.11 MB
Available physical RAM: 28390.46 MB
Total Pagefile: 65390.42 MB
Available Pagefile: 61045.67 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:164.75 GB) (Free:39.52 GB) NTFS
Drive d: (DATEN) (Fixed) (Total:58.59 GB) (Free:26.75 GB) NTFS
Drive e: (HDD) (Fixed) (Total:465.76 GB) (Free:104.97 GB) NTFS
Drive n: (System) (Network) (Total:1115.5 GB) (Free:411.96 GB) NTFS
Drive o: (System) (Network) (Total:1115.5 GB) (Free:411.96 GB) NTFS
Drive q: (System) (Network) (Total:1115.5 GB) (Free:411.96 GB) NTFS
Drive s: (System) (Network) (Total:1115.5 GB) (Free:411.96 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 223.6 GB) (Disk ID: 8434AE9E)

Partition: GPT Partition Type.

========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 465.8 GB) (Disk ID: 46F349D8)
Partition 1: (Not Active) - (Size=465.8 GB) - (Type=07 NTFS)

==================== End Of Log ============================

deeprybka · 11.05.2015, 09:59

Hi,
bitte Suchscan mit ESET durchführen:

Schritt 1

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Morphy · 11.05.2015, 13:59

Hier der ESET scan

die ersten beiden Einträge gefallen mir nicht.
Mit denen in der Mitte kann ich nichts anfangen und die Letzten beiden sind Programme für mein altes Handy.

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=92ffb0ba0c498943be3feb13ef704849
# engine=23789
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-05-11 12:46:47
# local_time=2015-05-11 02:46:47 (+0100, Mitteleuropäische Sommerzeit)
# country="Austria"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Microsoft Security Essentials'
# compatibility_mode=5895 16777213 100 100 20580527 54328801 0 0
# scanned=636276
# found=12
# cleaned=0
# scan_time=7753
sh=0EB36BBCD3450BE53B70B71976E65C15C86625EE ft=1 fh=c0155251c5310973 vn="Variante von Win64/Adware.Hicosmea.B Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\*NAME*\AppData\Roaming\ernden\berdis.dll.vir"
sh=6C47B67BD5B8BAC42CA3861F76C9284840EBF349 ft=1 fh=53c3b650eb1e10c5 vn="Win32/Adware.Hicosmea.A Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\*NAME*\AppData\Roaming\ernden\rewardca.dll.vir"
sh=F07ED45E8A5791E139C4D3CBE94173C30870B077 ft=1 fh=56dfef5718829748 vn="Variante von Win32/SlowPCfighter.A evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\Installer\{D1A4762A-11DF-4E7D-ADE7-C6D149BD8B37}\faq_8A71AEBB623B46A0B934103F1A762800.exe"
sh=1210EE62877708AE4B0F2DA8C62C97946D997F4E ft=1 fh=bf0133e904aa6e0b vn="Variante von Win32/SlowPCfighter.A evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\Installer\{D1A4762A-11DF-4E7D-ADE7-C6D149BD8B37}\FTsc_94F4507362A24B9B9BA6A29A1AFF037E.exe"
sh=CEBD8B7AEDC29326F9D459623248F4FD137F0416 ft=1 fh=9fb3034728021849 vn="Variante von Win32/SlowPCfighter.A evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\Installer\{D1A4762A-11DF-4E7D-ADE7-C6D149BD8B37}\LicenseShortcut_303A72A482D54D67B5D168C047EE3E11.exe"
sh=35291737F209F3BE080724FC3A8E07C9A78088B4 ft=1 fh=fac1131ab4ce5768 vn="Variante von Win32/SlowPCfighter.A evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\Installer\{D1A4762A-11DF-4E7D-ADE7-C6D149BD8B37}\LogFilesCollectorS_95204E1E4B3B4767821B1FAD987C2D2D.exe"
sh=64E934BB78AF9A8EA801A926A875692C1BBBB0D1 ft=1 fh=e615db32157230dd vn="Variante von Win32/SlowPCfighter.A evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\Installer\{D1A4762A-11DF-4E7D-ADE7-C6D149BD8B37}\MainExe64Shortcut1_A47BC27445824FCF8A8FDFE7347B3885.exe"
sh=61D284C6986F2262B00DEA5955ED373E4FAFE7BD ft=1 fh=cd86692b398d5468 vn="Variante von Win32/SlowPCfighter.A evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\Installer\{D1A4762A-11DF-4E7D-ADE7-C6D149BD8B37}\MainExe64Shortcut_B53671B5D9A445549437680533116875.exe"
sh=004A8681F016C0F908C3AB7EF5A24BC5242B41FB ft=1 fh=c8217f620a843d9b vn="Variante von Win32/SlowPCfighter.A evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\Installer\{D1A4762A-11DF-4E7D-ADE7-C6D149BD8B37}\NewShortcut10_87735DA8B8974C24BDFBDDE8F2D2DF1A.exe"
sh=EEC4A9DB721AA96667D060D3C1BD7307279A0EAF ft=1 fh=b3f785f073b12e83 vn="Variante von Win32/SlowPCfighter.A evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\Installer\{D1A4762A-11DF-4E7D-ADE7-C6D149BD8B37}\UninstallIcon.exe"
sh=A1B5A23581B76A661E9B9309DC7AF97DDF833E2E ft=1 fh=06b59967e0912fbd vn="Win32/InstallMonetizer.AN evtl. unerwünschte Anwendung" ac=I fn="E:\HANDYs\SGS\MyPhoneExplorer_Setup_1.8.2.exe"
sh=5543317AB6CC3C84B018F7262CD7F6048CA22C4B ft=1 fh=1b57474b1411cddc vn="Win32/InstallMonetizer.AH evtl. unerwünschte Anwendung" ac=I fn="E:\HANDYs\SGS\MyPhoneExplorer_Setup_1.8.4.exe"

deeprybka · 11.05.2015, 21:17

Zitat:

Zitat von Morphy

die ersten beiden Einträge gefallen mir nicht.

Warum denn?

Schritt 1

Drücke bitte die

+ R Taste und schreibe notepad in das Ausführen Fenster.
Klicke auf OK und kopiere nun den Text aus der Codebox in das leere Textdokument:

Code:

ATTFilter

CloseProcesses:
C:\Windows\Installer\{D1A4762A-11DF-4E7D-ADE7-C6D149BD8B37}
HKLM-x32\...\Run: [] => [X]
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction 
HKU\S-1-5-21-779854708-3996167121-2897795797-1172\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction 
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
EmptyTemp:

Speichere dieses bitte als Fixlist.txt in das Verzeichnis ab, in dem sich auch die FRST-Anwendung befindet.

Starte FRST und drücke auf den Fix-Button.
Das Tool erstellt eine "Fixlog.txt" -Datei.
Poste mir bitte deren Inhalt.

Gibt es jetzt noch Probleme mit dem PC? Wenn ja, welche?

Morphy · 12.05.2015, 07:18

Sieht zur Zeit gut aus Danke.
Werde das Ganze noch einige Tage beobachten (vor allem den Verlauf beim iexplorer).

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 09-05-2015
Ran by *NAME* at 2015-05-12 08:10:28 Run:1
Running from C:\Users\*NAME*\Desktop
Loaded Profiles: *NAME* (Available profiles: *NAME* & *NAME* & Administrator)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
CloseProcesses:
C:\Windows\Installer\{D1A4762A-11DF-4E7D-ADE7-C6D149BD8B37}
HKLM-x32\...\Run: [] => [X]
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction 
HKU\S-1-5-21-779854708-3996167121-2897795797-1172\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction 
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
EmptyTemp:
*****************

Processes closed successfully.
C:\Windows\Installer\{D1A4762A-11DF-4E7D-ADE7-C6D149BD8B37} => Moved successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => value deleted successfully.
"HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully.
"HKU\S-1-5-21-779854708-3996167121-2897795797-1172\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully.
HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
EmptyTemp: => Removed 556.4 MB temporary data.


The system needed a reboot. 

==== End of Fixlog 08:10:35 ====

deeprybka · 12.05.2015, 15:53

Zitat:

Zitat von Morphy

Sieht zur Zeit gut aus Danke.
Werde das Ganze noch einige Tage beobachten (vor allem den Verlauf beim iexplorer).

Alles klar. Gib bitte Rückmeldung.

Morphy · 20.05.2015, 12:33

Hallo Jürgen,

Der Rechner ist jetzt eine Woche durchgelaufen und es gab keine Probleme mehr.
Verlauf im Explore ist leer (Ausnahme die Startseite).

Nochmals herzlichen Dank für die Hilfe!!

Windows 7 - Werbeclips im Hintergrund und der Verlauf enthält unbekannte Webseiten

Log-Analyse und Auswertung: Windows 7 - Werbeclips im Hintergrund und der Verlauf enthält unbekannte Webseiten