Hallo Leude. Ich hab gerade zufällig beim deinstallieren eines Progs dieses Snap.do entdeckt.
Deinstallieren brachte unter der Systemsteuerung nix.
Ich habe aber sonst keine probleme mit dem Rechner. Auch die Startseite unter Firefox hatte sich nicht geändert. Nur um sicher zu gehen, poste ich ma die Ergebnisse der Scans.

defogger_disable

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 09:59 on 23/05/2015 (Silverserver)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...
SPTD -> Disabled (Service running -> reboot required)


-=E.O.F=-
         

FRST.txt

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 22-05-2015 01
Ran by Silverserver (administrator) on MARVEL4 on 23-05-2015 10:03:58
Running from C:\Users\Silverserver\Desktop
Loaded Profiles: Silverserver (Available Profiles: Silverserver & UpdatusUser & Administrator)
Platform: Windows Vista (TM) Home Premium Service Pack 2 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
() C:\Program Files (x86)\ASUS\AASP\1.00.77\aaCenter.exe
(ABBYY) C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
(Andrea Electronics Corporation) C:\Windows\System32\AEADISRV.EXE
(Acronis) C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Nero AG) C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect\HelperService.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect\ConversionService.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(Safer Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Analog Devices, Inc.) C:\Program Files (x86)\Analog Devices\SoundMAX\SoundMAX.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Microsoft Corporation) C:\Windows\ehome\ehsched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Samsung Electronics Co., Ltd.) E:\Kies\KiesTrayAgent.exe
(Analog Devices, Inc.) C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\WPFFontCache_v0400.exe
(Microsoft Corporation) C:\Windows\ehome\ehrecvr.exe
(Mozilla Corporation) E:\FireFox\firefox.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM-x32\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1584184 2008-01-21] (Microsoft Corporation)
HKLM-x32\...\Run: [IAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-04] (Intel Corporation)
HKLM-x32\...\Run: [SoundMAX] => C:\Program Files (x86)\Analog Devices\SoundMAX\SoundMAX.exe [3858432 2008-09-02] (Analog Devices, Inc.)
HKLM-x32\...\Run: [Nvtmru] => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028384 2013-11-14] (NVIDIA Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [728312 2015-05-07] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [KiesTrayAgent] => E:\Kies\KiesTrayAgent.exe [311152 2013-12-11] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [SoundMAXPnP] => C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe [1310720 2009-05-19] (Analog Devices, Inc.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-12-06] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [129272 2015-03-16] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
HKU\S-1-5-21-3728770155-2195705790-4138058334-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [138240 2008-01-21] (Microsoft Corporation)
HKU\S-1-5-21-3728770155-2195705790-4138058334-1000\...\Run: [swg] => C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [68856 2009-08-06] (Google Inc.)
HKU\S-1-5-21-3728770155-2195705790-4138058334-1000\...\Run: [PnPUI Registrator] => C:\Program Files (x86)\Common Files\Sitecom Shared\PnP Universal Installer\PnPUIReg.exe [163840 2004-11-22] ()
HKU\S-1-5-21-3728770155-2195705790-4138058334-1000\...\Run: [] => E:\Kies\External\FirmwareUpdate\KiesPDLR.exe [845168 2013-12-11] (Samsung)
HKU\S-1-5-21-3728770155-2195705790-4138058334-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> 

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-3728770155-2195705790-4138058334-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.startseite24.net
HKU\S-1-5-21-3728770155-2195705790-4138058334-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKU\S-1-5-21-3728770155-2195705790-4138058334-1000\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.giga.de/
SearchScopes: HKLM -> {1C704259-9702-47AB-83C3-097AD8E55269} URL = hxxp://www.startseite24.net/?q={searchTerms}
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-3728770155-2195705790-4138058334-1000 -> {1C704259-9702-47AB-83C3-097AD8E55269} URL = hxxp://www.startseite24.net/?q={searchTerms}
SearchScopes: HKU\S-1-5-21-3728770155-2195705790-4138058334-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.de/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7GGLJ_deDE328
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll [2014-06-20] (Oracle Corporation)
BHO: Easy Photo Print -> {9421DD08-935F-4701-A9CA-22DF90AC4EA6} -> C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll [2009-08-24] (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-03-03] (Google Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll [2014-06-20] (Oracle Corporation)
BHO-x32: DivX Plus Web Player HTML5 <video> -> {326E768D-4182-46FD-9C16-1449A49795F4} -> C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll [2011-02-08] (DivX, LLC)
BHO-x32: PDF Architect Helper -> {3A2D5EBA-F86D-4BD3-A177-019765996711} -> C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll [2013-04-08] (pdfforge GmbH)
BHO-x32: Spybot-S&D IE Protection -> {53707962-6F74-2D53-2644-206D7942484F} -> C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll [2009-01-26] (Safer Networking Limited)
BHO-x32: DivX HiQ -> {593DDEC6-7468-4cdd-90E1-42DADAA222E9} -> C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll [2011-02-08] (DivX, LLC)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2014-06-20] (Oracle Corporation)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-03-03] (Google Inc.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2014-06-20] (Oracle Corporation)
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll [2009-08-24] (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-03-03] (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-03-03] (Google Inc.)
Toolbar: HKU\S-1-5-21-3728770155-2195705790-4138058334-1000 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-03-03] (Google Inc.)
DPF: HKLM-x32 {0D41B8C5-2599-4893-8183-00195EC8D5F9} hxxp://support.asus.com/common/asusTek_sys_ctrl.cab
DPF: HKLM-x32 {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: HKLM-x32 {34DC6011-88B5-4EA9-BA7A-DC7B4F4437FE} hxxp://ips.poi.de/ips-opdata/operator/69189345/objects/jordan.cab
DPF: HKLM-x32 {CAC677B6-4963-4305-9066-0BD135CD9233} https://as.photoprintit.de/ips-opdata/layout/default_cms01/activex/IPSUploader4.cab
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler-x32: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files (x86)\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL [2001-01-22] (Microsoft Corporation)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 217.0.43.17 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\Silverserver\AppData\Roaming\Mozilla\Firefox\Profiles\sf4b9g60.default-1402064898508
FF NewTab: www.google.de
FF SearchEngineOrder.1: Websuche
FF SelectedSearchEngine: eBay
FF Homepage: https://www.google.de/
FF Keyword.URL: hxxp://www.startseite24.net/?q=
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_18_0_0_144.dll [2015-05-21] ()
FF Plugin: @java.com/DTPlugin,version=10.55.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll [2014-06-20] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.55.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll [2014-06-20] (Oracle Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_18_0_0_144.dll [2015-05-21] ()
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll [2011-02-08] (DivX, LLC)
FF Plugin-x32: @divx.com/DivX Player Plugin,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll No File
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll [2011-01-24] (DivX, LLC.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll [2014-06-20] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2014-06-20] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-15] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-15] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2013-12-09] (VideoLAN)
FF Plugin-x32: Adobe Reader -> E:\Adobe Reader\Reader\AIR\nppdf32.dll [2015-04-30] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll [2007-04-10] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll [2011-02-02] (Sun Microsystems, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npDivxPlayerPlugin.dll [2009-11-14] (DivX, Inc)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2015-04-30] (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Silverserver\AppData\Roaming\Mozilla\Firefox\Profiles\sf4b9g60.default-1402064898508\searchplugins\avira-safesearch.xml [2015-05-18]
FF SearchPlugin: C:\Users\Silverserver\AppData\Roaming\Mozilla\Firefox\Profiles\sf4b9g60.default-1402064898508\searchplugins\englische-ergebnisse.xml [2014-07-08]
FF SearchPlugin: C:\Users\Silverserver\AppData\Roaming\Mozilla\Firefox\Profiles\sf4b9g60.default-1402064898508\searchplugins\gmx-suche.xml [2014-07-08]
FF SearchPlugin: C:\Users\Silverserver\AppData\Roaming\Mozilla\Firefox\Profiles\sf4b9g60.default-1402064898508\searchplugins\lastminute.xml [2014-07-08]
FF SearchPlugin: C:\Users\Silverserver\AppData\Roaming\Mozilla\Firefox\Profiles\sf4b9g60.default-1402064898508\searchplugins\webde-suche.xml [2014-07-08]
FF Extension: Avira Browser Safety - C:\Users\Silverserver\AppData\Roaming\Mozilla\Firefox\Profiles\sf4b9g60.default-1402064898508\Extensions\abs@avira.com [2015-04-29]
FF Extension: Avira SafeSearch - C:\Users\Silverserver\AppData\Roaming\Mozilla\Firefox\Profiles\sf4b9g60.default-1402064898508\Extensions\safesearch@avira.com [2015-04-29]
FF Extension: Adblock Plus - C:\Users\Silverserver\AppData\Roaming\Mozilla\Firefox\Profiles\sf4b9g60.default-1402064898508\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-06-06]
FF Extension: Tab Mix Plus - C:\Users\Silverserver\AppData\Roaming\Mozilla\Firefox\Profiles\sf4b9g60.default-1402064898508\Extensions\{dc572301-7619-498c-a57d-39143191b318}.xpi [2014-07-20]
FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-05-19]
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\html5video
FF Extension: DivX Plus Web Player HTML5 &video& - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\html5video [2011-03-04]
FF HKLM-x32\...\Firefox\Extensions: [{6904342A-8307-11DF-A508-4AE2DFD72085}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\wpa
FF Extension: DivX HiQ - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\wpa [2011-03-04]
FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt [2013-05-13]
FF HKU\S-1-5-21-3728770155-2195705790-4138058334-1000\...\Firefox\Extensions: [mail@gutscheinrausch.de] - C:\Users\Silverserver\AppData\Roaming\Mozilla\Firefox\Profiles\p79hd61z.default\extensions\mail@gutscheinrausch.de

Chrome: 
=======
CHR HKLM-x32\...\Chrome\Extension: [fnjbmmemklcjgepojigaapkoodmkgbae] - C:\Program Files (x86)\DivX\DivX Plus Web Player\google_chrome\wpa\wpa.crx [2011-02-08]
CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\google_chrome\html5video\html5video.crx [2011-02-08]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY)
R2 AEADIFilters; C:\Windows\system32\AEADISRV.EXE [111616 2009-05-19] (Andrea Electronics Corporation) []
S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe [825856 2015-05-07] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [434424 2015-05-07] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [434424 2015-05-07] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1186040 2015-05-07] (Avira Operations GmbH & Co. KG)
S4 ASGT; C:\Windows\SysWOW64\ASGT.exe [55296 2012-01-17] () []
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [201008 2015-03-16] (Avira Operations GmbH & Co. KG)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) []
S2 MBAMService; E:\ Malwarebytes Anti-Malware \ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1320496 2013-04-08] (pdfforge GmbH)
R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [799280 2013-04-08] (pdfforge GmbH)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [66872 2009-05-22] ()
R2 SBSDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)
S3 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1229528 2013-12-06] (Secunia)
R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [662232 2013-12-06] (Secunia)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [383544 2008-01-21] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [14392 2007-12-17] ()
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2009-11-11] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [152744 2015-05-07] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132120 2015-05-07] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-26] (Avira Operations GmbH & Co. KG)
S3 ENTECH64; C:\Windows\system32\DRIVERS\ENTECH64.sys [12744 2008-09-17] (EnTech Taiwan)
R0 hotcore3; C:\Windows\System32\DRIVERS\hotcore3.sys [37392 2010-05-20] (Paragon Software Group)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2009-11-11] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2015-04-14] (Malwarebytes Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15680 2006-11-01] ()
S3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-12-06] (Secunia)
S3 RT73; C:\Windows\System32\DRIVERS\Dr71WU.sys [311296 2006-09-29] (Ralink Technology Inc.)
S3 s0016bus; C:\Windows\System32\DRIVERS\s0016bus.sys [115240 2008-05-16] (MCCI Corporation)
S3 s0016mdfl; C:\Windows\System32\DRIVERS\s0016mdfl.sys [19496 2008-05-16] (MCCI Corporation)
S3 s0016mdm; C:\Windows\System32\DRIVERS\s0016mdm.sys [158760 2008-05-16] (MCCI Corporation)
S3 s0016mgmt; C:\Windows\System32\DRIVERS\s0016mgmt.sys [137256 2008-05-16] (MCCI Corporation)
S3 s0016nd5; C:\Windows\System32\DRIVERS\s0016nd5.sys [34344 2008-05-16] (MCCI Corporation)
S3 s0016obex; C:\Windows\System32\DRIVERS\s0016obex.sys [136744 2008-05-16] (MCCI Corporation)
S3 s0016unic; C:\Windows\System32\DRIVERS\s0016unic.sys [151592 2008-05-16] (MCCI Corporation)
R3 seehcri; C:\Windows\System32\DRIVERS\seehcri.sys [34032 2008-01-09] (Sony Ericsson Mobile Communications)
S4 sptd; C:\Windows\System32\Drivers\sptd.sys [871408 2009-05-21] (Duplex Secure Ltd.)
R0 tdrpman251; C:\Windows\System32\DRIVERS\tdrpm251.sys [1455648 2009-12-17] (Acronis)
R2 {B154377D-700F-42cc-9474-23858FBDF4BD}; E:\PowerDVD\PowerDVD9\000.fcl [146928 2009-02-28] (CyberLink Corp.)
S3 ALSysIO; \??\C:\Users\SILVER~1\AppData\Local\Temp\ALSysIO64.sys [X]
S3 cpuz130; \??\C:\Users\SILVER~1\AppData\Local\Temp\cpuz130\cpuz_x64.sys [X]
S3 CrystalSysInfo; \??\E:\MediaCoder\SysInfoX64.sys [X]
S3 DIRECTIO; \??\C:\Program Files (x86)\BurnInTest\DirectIo.sys [X]
S3 GPU-Z; \??\C:\Users\SILVER~1\AppData\Local\Temp\GPU-Z.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S4 nvlddmkm; system32\DRIVERS\nvlddmkm.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S3 SANDRA; \??\E:\SiSoftware Sandra Lite 2009.SP3c\WNt500x64\Sandra.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-05-23 10:03 - 2015-05-23 10:04 - 00022555 _____ () C:\Users\Silverserver\Desktop\FRST.txt
2015-05-23 10:03 - 2015-05-23 10:03 - 00000000 ____D () C:\Users\Silverserver\Desktop\FRST-OlderVersion
2015-05-23 09:59 - 2015-05-23 09:59 - 00000596 _____ () C:\Users\Silverserver\Desktop\defogger_disable.log
2015-05-23 09:59 - 2015-05-23 09:59 - 00000020 _____ () C:\Users\Silverserver\defogger_reenable
2015-05-21 12:21 - 2015-05-23 10:03 - 02108416 _____ (Farbar) C:\Users\Silverserver\Desktop\FRST64.exe
2015-05-21 12:21 - 2015-05-21 12:21 - 00380416 _____ () C:\Users\Silverserver\Desktop\Gmer-19357.exe
2015-05-21 12:21 - 2015-05-21 12:21 - 00050477 _____ () C:\Users\Silverserver\Desktop\Defogger.exe
2015-05-18 11:45 - 2015-05-18 12:09 - 00000000 ____D () C:\AdwCleaner
2015-05-13 13:52 - 2015-04-19 23:24 - 01029120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10.dll
2015-05-13 13:52 - 2015-04-19 23:24 - 00219648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1core.dll
2015-05-13 13:52 - 2015-04-19 23:24 - 00189952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10core.dll
2015-05-13 13:52 - 2015-04-19 23:24 - 00160768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1.dll
2015-05-13 13:52 - 2015-04-19 22:19 - 01172480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2015-05-13 13:52 - 2015-04-19 22:18 - 00486400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10level9.dll
2015-05-13 13:52 - 2015-04-19 22:13 - 00682496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2015-05-13 13:52 - 2015-04-19 22:12 - 01072640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2015-05-13 13:52 - 2015-04-18 02:16 - 01268224 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll
2015-05-13 13:52 - 2015-04-18 02:16 - 00327680 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll
2015-05-13 13:52 - 2015-04-18 02:16 - 00287232 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll
2015-05-13 13:52 - 2015-04-18 02:16 - 00196096 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll
2015-05-13 13:52 - 2015-04-18 01:45 - 02002944 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2015-05-13 13:52 - 2015-04-18 01:44 - 00566272 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2015-05-13 13:52 - 2015-04-18 01:35 - 00834048 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2015-05-13 13:52 - 2015-04-18 01:33 - 01561088 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-05-13 13:52 - 2015-04-18 01:33 - 01154048 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-05-13 13:52 - 2015-04-18 01:30 - 02793472 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-05-13 13:44 - 2015-04-30 18:03 - 00279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-05-13 13:44 - 2015-04-30 17:41 - 00347648 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-05-13 13:41 - 2015-04-30 15:14 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 13:41 - 2015-04-30 15:14 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 13:41 - 2015-04-11 01:33 - 00384512 _____ (Microsoft Corporation) C:\Windows\system32\services.exe
2015-05-13 13:41 - 2015-04-11 01:22 - 00279552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\services.exe
2015-05-13 13:40 - 2015-04-10 02:10 - 17881088 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-05-13 13:40 - 2015-04-10 01:55 - 00448512 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-05-13 13:40 - 2015-04-10 01:53 - 10935808 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-05-13 13:40 - 2015-04-10 01:52 - 02339840 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-05-13 13:40 - 2015-04-10 01:48 - 01388032 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-05-13 13:40 - 2015-04-10 01:47 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-05-13 13:40 - 2015-04-10 01:46 - 02158080 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-05-13 13:40 - 2015-04-10 01:46 - 01494016 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-05-13 13:40 - 2015-04-10 01:46 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-05-13 13:40 - 2015-04-10 01:46 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-05-13 13:40 - 2015-04-10 01:46 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-05-13 13:40 - 2015-04-10 01:46 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-05-13 13:40 - 2015-04-10 01:46 - 00282112 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-05-13 13:40 - 2015-04-10 01:46 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2015-05-13 13:40 - 2015-04-10 01:46 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-05-13 13:40 - 2015-04-10 01:46 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-05-13 13:40 - 2015-04-10 01:45 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-05-13 13:40 - 2015-04-10 01:45 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-05-13 13:40 - 2015-04-10 01:45 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-05-13 13:40 - 2015-04-10 01:45 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2015-05-13 13:40 - 2015-04-10 01:45 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2015-05-13 13:40 - 2015-04-10 01:45 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2015-05-13 13:40 - 2015-04-10 01:14 - 12379136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-05-13 13:40 - 2015-04-10 01:10 - 01810944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-05-13 13:40 - 2015-04-10 01:08 - 09750528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-05-13 13:40 - 2015-04-10 01:08 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-05-13 13:40 - 2015-04-10 01:05 - 01139200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-05-13 13:40 - 2015-04-10 01:05 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-05-13 13:40 - 2015-04-10 01:04 - 01804288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-05-13 13:40 - 2015-04-10 01:04 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-05-13 13:40 - 2015-04-10 01:04 - 00421888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-05-13 13:40 - 2015-04-10 01:04 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2015-05-13 13:40 - 2015-04-10 01:04 - 00065024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-05-13 13:40 - 2015-04-10 01:03 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-05-13 13:40 - 2015-04-10 01:03 - 00718336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-05-13 13:40 - 2015-04-10 01:03 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-05-13 13:40 - 2015-04-10 01:03 - 00353792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-05-13 13:40 - 2015-04-10 01:03 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-05-13 13:40 - 2015-04-10 01:03 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-05-13 13:40 - 2015-04-10 01:03 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-05-13 13:40 - 2015-04-10 01:03 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-05-13 13:40 - 2015-04-10 01:03 - 00041472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2015-05-13 13:40 - 2015-04-10 01:03 - 00011776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2015-05-13 13:40 - 2015-04-10 01:03 - 00010752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2015-05-13 13:33 - 2015-05-13 13:33 - 00003886 _____ () C:\Windows\System32\Tasks\Adobe Acrobat Update Task

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-05-23 10:04 - 2014-06-15 11:58 - 00000000 ____D () C:\FRST
2015-05-23 10:04 - 2008-01-21 03:53 - 01357140 _____ () C:\Windows\WindowsUpdate.log
2015-05-23 10:01 - 2006-11-02 17:07 - 00000000 ___RD () C:\Users\Public\Recorded TV
2015-05-23 10:00 - 2009-11-21 00:08 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-05-23 10:00 - 2006-11-02 17:42 - 00032628 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-05-23 10:00 - 2006-11-02 17:42 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-05-23 10:00 - 2006-11-02 17:22 - 00003712 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2015-05-23 10:00 - 2006-11-02 17:22 - 00003712 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2015-05-23 09:59 - 2009-05-19 15:17 - 00000000 ____D () C:\Users\Silverserver
2015-05-21 18:55 - 2012-07-09 16:04 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-05-21 18:40 - 2009-11-21 00:08 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-05-21 18:11 - 2008-01-21 13:10 - 01567488 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-05-21 18:11 - 2008-01-21 13:09 - 00674024 _____ () C:\Windows\system32\perfh007.dat
2015-05-21 18:11 - 2008-01-21 13:09 - 00146036 _____ () C:\Windows\system32\perfc007.dat
2015-05-21 12:56 - 2012-07-09 16:04 - 00003736 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-05-21 12:56 - 2012-04-20 15:53 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-05-21 12:56 - 2011-05-18 18:21 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-05-21 12:13 - 2014-08-12 09:10 - 00000000 ____D () C:\Users\Silverserver\Desktop\KRD
2015-05-21 12:03 - 2014-06-15 16:36 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-05-15 14:44 - 2014-06-15 16:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-05-15 14:35 - 2009-11-21 00:08 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-05-15 14:35 - 2009-11-21 00:08 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-05-13 14:29 - 2014-04-03 13:37 - 00288136 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-05-13 14:28 - 2013-01-31 17:32 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2015-05-13 14:27 - 2006-11-02 17:07 - 00000000 ____D () C:\Program Files\Windows Journal
2015-05-13 13:50 - 2013-07-11 21:48 - 00000000 ____D () C:\Windows\system32\MRT
2015-05-13 13:45 - 2006-11-02 14:35 - 140425016 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2015-05-13 13:41 - 2013-01-31 17:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-05-13 13:41 - 2006-11-02 17:07 - 00000000 ____D () C:\Windows\SysWOW64\XPSViewer
2015-05-13 13:33 - 2011-05-10 11:55 - 00002425 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
2015-05-07 17:14 - 2013-03-08 11:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-05-07 17:13 - 2013-04-02 22:50 - 00152744 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2015-05-07 17:13 - 2013-04-02 22:50 - 00132120 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2015-05-05 00:23 - 2014-10-16 16:10 - 00000000 ____D () C:\Users\Silverserver\AppData\Local\Battle.net
2015-04-27 22:47 - 2014-10-16 16:09 - 00000000 ____D () C:\Program Files (x86)\Battle.net

==================== Files in the root of some directories =======

2011-08-30 14:05 - 2011-08-30 14:05 - 0016009 _____ () C:\Users\Silverserver\AppData\Roaming\PStrip.bak
2011-08-30 14:05 - 2011-08-30 14:04 - 0016009 _____ () C:\Users\Silverserver\AppData\Roaming\PStrip.bk!
2011-08-30 14:03 - 2011-08-30 14:07 - 0016009 _____ () C:\Users\Silverserver\AppData\Roaming\PStrip.ini
2011-12-20 12:30 - 2011-12-20 12:30 - 0000680 _____ () C:\Users\Silverserver\AppData\Local\d3d9caps.dat
2009-05-19 15:17 - 2014-08-13 09:47 - 0002188 _____ () C:\Users\Silverserver\AppData\Local\d3d9caps64.dat
2009-06-06 00:26 - 2011-03-05 23:31 - 0192000 _____ () C:\Users\Silverserver\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2012-01-24 12:10 - 2012-01-24 12:10 - 0539764 _____ () C:\Users\Silverserver\AppData\Local\dd_ATL80SP1_KB973923MSI3897.txt
2012-01-24 12:10 - 2012-01-24 12:10 - 0011764 _____ () C:\Users\Silverserver\AppData\Local\dd_ATL80SP1_KB973923UI3897.txt
2009-05-26 19:35 - 2009-05-26 19:35 - 0028166 _____ () C:\Users\Silverserver\AppData\Local\dd_depcheckdotnetfx30.txt
2009-05-19 17:10 - 2009-05-19 17:10 - 0036116 _____ () C:\Users\Silverserver\AppData\Local\dd_depcheck_NETFX_EXP_35.txt
2009-05-19 17:10 - 2009-05-19 17:10 - 0000002 _____ () C:\Users\Silverserver\AppData\Local\dd_dotnetfx35error_lp.txt
2009-05-19 17:10 - 2009-05-19 17:10 - 0076428 _____ () C:\Users\Silverserver\AppData\Local\dd_dotnetfx35install_lp.txt
2009-05-26 19:35 - 2009-05-26 19:35 - 0000718 _____ () C:\Users\Silverserver\AppData\Local\dd_dotnetfx3error.txt
2009-05-26 19:35 - 2009-05-26 19:35 - 0032038 _____ () C:\Users\Silverserver\AppData\Local\dd_dotnetfx3install.txt
2009-05-19 17:10 - 2009-05-19 17:10 - 0812466 _____ () C:\Users\Silverserver\AppData\Local\dd_NET_Framework35_LangPack_MSI039E.txt
2012-12-27 12:50 - 2012-12-27 12:50 - 0356976 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistMSI0066.txt
2014-10-16 19:24 - 2014-10-16 19:24 - 0356808 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistMSI00D2.txt
2014-10-16 19:31 - 2014-10-16 19:31 - 0356338 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistMSI065F.txt
2013-09-29 14:32 - 2013-09-29 14:32 - 0356974 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistMSI0A75.txt
2011-07-30 16:08 - 2011-07-30 16:08 - 0457042 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistMSI1AF6.txt
2010-03-28 14:47 - 2010-03-28 14:48 - 0441838 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistMSI1E41.txt
2010-03-28 14:48 - 2010-03-28 14:48 - 0361368 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistMSI1EB4.txt
2009-06-19 01:29 - 2009-06-19 01:29 - 0420714 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistMSI29E3.txt
2014-10-16 20:19 - 2014-10-16 20:19 - 0355950 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistMSI2AFE.txt
2014-10-16 20:22 - 2014-10-16 20:22 - 0355186 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistMSI2D71.txt
2014-08-18 18:23 - 2014-08-18 18:24 - 0428158 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistMSI50E3.txt
2009-11-11 20:56 - 2009-11-11 20:56 - 0329228 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistMSI6861.txt
2014-08-18 18:55 - 2014-08-18 18:55 - 0391520 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistMSI6964.txt
2011-07-05 18:34 - 2011-07-05 18:34 - 0460608 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistMSI6993.txt
2011-07-29 14:09 - 2011-07-29 14:09 - 0435038 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistMSI7178.txt
2011-07-29 14:09 - 2011-07-29 14:09 - 0433970 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistMSI718C.txt
2014-09-07 13:03 - 2014-09-07 13:03 - 0383404 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistMSI768A.txt
2013-10-17 08:37 - 2013-10-17 08:37 - 0431000 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistMSI7925.txt
2012-12-27 12:50 - 2012-12-27 12:50 - 0011250 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistUI0066.txt
2014-10-16 19:24 - 2014-10-16 19:24 - 0011218 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistUI00D2.txt
2014-10-16 19:31 - 2014-10-16 19:31 - 0014322 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistUI065F.txt
2013-09-29 14:32 - 2013-09-29 14:32 - 0011250 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistUI0A75.txt
2011-07-30 16:08 - 2011-07-30 16:08 - 0011610 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistUI1AF6.txt
2010-03-28 14:47 - 2010-03-28 14:48 - 0011634 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistUI1E41.txt
2010-03-28 14:48 - 2010-03-28 14:48 - 0011370 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistUI1EB4.txt
2009-06-19 01:29 - 2009-06-19 01:29 - 0011442 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistUI29E3.txt
2014-10-16 20:19 - 2014-10-16 20:19 - 0014306 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistUI2AFE.txt
2014-10-16 20:22 - 2014-10-16 20:22 - 0017162 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistUI2D71.txt
2014-08-18 18:23 - 2014-08-18 18:24 - 0014206 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistUI50E3.txt
2009-11-11 20:56 - 2009-11-11 20:56 - 0011170 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistUI6861.txt
2014-08-18 18:55 - 2014-08-18 18:55 - 0011174 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistUI6964.txt
2011-07-05 18:34 - 2011-07-05 18:34 - 0011706 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistUI6993.txt
2011-07-29 14:09 - 2011-07-29 14:09 - 0011610 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistUI7178.txt
2011-07-29 14:09 - 2011-07-29 14:09 - 0011642 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistUI718C.txt
2014-09-07 13:03 - 2014-09-07 13:03 - 0012692 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistUI768A.txt
2013-10-17 08:37 - 2013-10-17 08:37 - 0015698 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistUI7925.txt
2011-11-30 16:26 - 2011-11-30 16:26 - 0004922 _____ () C:\Users\Silverserver\AppData\Local\HWVendorDetection.log
2009-05-19 17:10 - 2009-05-26 19:35 - 0003116 _____ () C:\Users\Silverserver\AppData\Local\uxeventlog.txt
2011-06-29 11:18 - 2011-06-29 11:19 - 0000000 _____ () C:\Users\Silverserver\AppData\Local\{B8116D6B-9B03-4E14-83C8-655639D154C6}
2009-09-02 15:11 - 2009-09-02 15:11 - 0148736 _____ (Avanquest Software) C:\ProgramData\hpeBCBE.dll
2009-05-20 10:13 - 2009-05-20 10:13 - 0008519 _____ () C:\ProgramData\xml5946.tmp
2009-05-20 10:13 - 2009-05-20 10:13 - 0013425 _____ () C:\ProgramData\xml5B3A.tmp
2009-05-20 10:13 - 2009-05-20 10:13 - 0001621 _____ () C:\ProgramData\xml5BF6.tmp

Files to move or delete:
====================
C:\ProgramData\hpeBCBE.dll


Some files in TEMP:
====================
C:\Users\Silverserver\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-05-21 18:11

==================== End of log ============================
         

Addition.txt

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 22-05-2015 01
Ran by Silverserver at 2015-05-23 10:05:03
Running from C:\Users\Silverserver\Desktop
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-3728770155-2195705790-4138058334-500 - Administrator - Disabled) => C:\Users\Administrator
Gast (S-1-5-21-3728770155-2195705790-4138058334-501 - Limited - Disabled)
Silverserver (S-1-5-21-3728770155-2195705790-4138058334-1000 - Administrator - Enabled) => C:\Users\Silverserver
UpdatusUser (S-1-5-21-3728770155-2195705790-4138058334-1001 - Limited - Enabled) => C:\Users\UpdatusUser

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Antivirus (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Antivirus (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

3DMark06 (HKLM-x32\...\{7F3AD00A-1819-4B15-BB7D-08B3586336D7}) (Version: 1.1.1 - Futuremark Corporation)
7-Zip 4.65 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0465-000001000000}) (Version: 4.65.00.0 - Igor Pavlov)
ABBYY FineReader 9.0 Sprint (HKLM-x32\...\ABBYY FineReader 9.0 Sprint) (Version: 9.01.513.58212 - ABBYY)
ABBYY FineReader 9.0 Sprint (x32 Version: 9.01.513.58212 - ABBYY) Hidden
Acronis*True*Image*Home (HKLM-x32\...\{C2F1F96A-057E-5819-B52E-FEA1D1D2933B}) (Version: 13.0.5029 - Acronis)
Adobe Flash Player 18 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 18.0.0.144 - Adobe Systems Incorporated)
Adobe Flash Player 18 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 18.0.0.144 - Adobe Systems Incorporated)
Adobe Reader X (10.1.14) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.14 - Adobe Systems Incorporated)
Advanced Renamer (HKLM-x32\...\Advanced Renamer_is1) (Version: 3.64 - Hulubulu Software)
Advertising Center (x32 Version: 0.0.0.1 - Nero AG) Hidden
AMD Catalyst Install Manager (HKLM\...\{9248FA70-BD64-2FD1-CD23-448112E7ACE9}) (Version: 8.0.915.0 - Advanced Micro Devices, Inc.)
ASUS GPU Tweak (HKLM-x32\...\InstallShield_{532F6E8A-AF97-41C3-915F-39F718EC07D1}) (Version: 2.4.2.4 - ASUSTek COMPUTER INC.)
ASUS GPU Tweak (x32 Version: 2.4.2.4 - ASUSTek COMPUTER INC.) Hidden
Avanquest update (HKLM-x32\...\{76E41F43-59D2-4F30-BA42-9A762EE1E8DE}) (Version: 1.30 - Avanquest Software)
Avira (HKLM-x32\...\{b5675cc4-ab8b-4945-8c1d-4c5479556d6a}) (Version: 1.1.34.19732 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.34.19732 - Avira Operations GmbH & Co. KG) Hidden
Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.10.434 - Avira Operations GmbH & Co. KG)
AviSynth 2.5 (HKLM-x32\...\AviSynth) (Version:  - )
AVS Media Player 4.2.2.104 (HKLM-x32\...\AVS Media Player_is1) (Version: 4.2.2.104 - Online Media Technologies Ltd.)
Battle.net (HKLM-x32\...\Battle.net) (Version:  - Blizzard Entertainment)
Cinergy T USB XE V6.11.23.01 (HKLM-x32\...\Cinergy T USB XE) (Version: 6.11.23.01 - )
CyberLink PowerDVD 9 (HKLM-x32\...\InstallShield_{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}) (Version: 9.0.1501 - CyberLink Corp.)
DH Driver Cleaner Professional Edition (HKLM-x32\...\Driver Cleaner Pro) (Version: Version 1.5 - Ruud Ketelaars)
Diablo III (HKLM-x32\...\Diablo III) (Version:  - Blizzard Entertainment)
DivX-Setup (HKLM-x32\...\DivX Setup.divx.com) (Version: 2.4.1.4 - DivX, LLC)
DolbyFiles (x32 Version: 2.0 - Nero AG) Hidden
Druckerdeinstallation für EPSON SX130 Series (HKLM\...\EPSON SX130 Series) (Version:  - SEIKO EPSON Corporation)
DVD Shrink 3.2 (HKLM-x32\...\DVD Shrink_is1) (Version:  - DVD Shrink)
Easy CD-DA Extractor 2010 (HKLM-x32\...\Easy CD-DA Extractor 2010) (Version: 2010.6 - Poikosoft)
Epson Easy Photo Print 2 (HKLM-x32\...\{A02D7029-C4EF-44C1-9FD4-C0D3CA518113}) (Version: 2.2.4.0 - SEIKO EPSON CORPORATION)
Epson Easy Photo Print Plug-in for PMB(Picture Motion Browser) (HKLM-x32\...\{B2D55EB8-32C5-4B43-9006-9E97DECBA178}) (Version: 1.00.0000 - SEIKO EPSON CORPORATION)
Epson Event Manager (HKLM-x32\...\{8A17C27D-0325-400C-8AA9-DAA6B16CBD74}) (Version: 2.40.0009 - SEIKO EPSON CORPORATION)
EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version:  - Seiko Epson Corporation)
EVEREST Ultimate Edition v5.50 (HKLM-x32\...\EVEREST Ultimate Edition_is1) (Version: 5.50 - Lavalys, Inc.)
ffdshow [rev 2527] [2008-12-19] (HKLM-x32\...\ffdshow_is1) (Version: 1.0 - )
FileHippo.com Update Checker (HKLM-x32\...\FileHippo.com) (Version:  - )
Full Tilt Poker.Net (HKLM-x32\...\{E07B7A31-E160-466D-A003-3BB7B8989D52}) (Version: 4.55.4.WIN.FullTilt.NET - )
Futuremark SystemInfo (HKLM-x32\...\{BEE64C14-BEF1-4610-8A68-A16EAA47B882}) (Version: 3.20.1.2 - Futuremark Corporation)
Geeks3D.com FurMark 1.10.1 (HKLM-x32\...\{2397CAD4-2263-4CD0-96BE-E43A980B9C9A}_is1) (Version:  - Geeks3D.com)
Google Earth Plug-in (HKLM-x32\...\{4AB54F11-2F8C-11E3-B09F-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.6227.252 - Google Inc.)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.27.5 - Google Inc.) Hidden
Guild Wars 2 (HKLM-x32\...\Guild Wars 2) (Version:  - NCsoft Corporation, Ltd.)
Gunpoint Demo (HKLM-x32\...\Steam App 240570) (Version:  - Suspicious Developments)
GutscheinRausch.de - AddOn für Firefox (HKLM-x32\...\{2B11BA9C-7F97-4C16-970F-1491FD77969B}_is1) (Version: 2.81 - GutscheinRausch.de)
HD Tune 2.55 (HKLM-x32\...\HD Tune_is1) (Version:  - EFD Software)
Host OpenAL (ADI) (HKLM-x32\...\Host OpenAL (ADI)) (Version:  - )
ImagXpress (x32 Version: 7.0.74.0 - Nero AG) Hidden
Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version:  - Intel Corporation)
Java 7 Update 55 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417055FF}) (Version: 7.0.550 - Oracle)
Java 7 Update 55 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217055FF}) (Version: 7.0.550 - Oracle)
JavaFX 2.1.1 (HKLM-x32\...\{1111706F-666A-4037-7777-211328764D10}) (Version: 2.1.1 - Oracle Corporation)
LinuxLive USB Creator (HKLM-x32\...\LinuxLive USB Creator) (Version: 2.8 - Thibaut Lauziere)
Malwarebytes Anti-Malware Version 2.1.6.1022 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)
marvell 61xx (HKLM-x32\...\mv61xxDriver) (Version: 1.2.1.57 - Marvell)
Menu Templates - Starter Kit (x32 Version: 9.0.4.0 - Nero AG) Hidden
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office XP Professional mit FrontPage (HKLM-x32\...\{90280407-6000-11D3-8CFE-0050048383C9}) (Version: 10.0.2701.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
MKVtoolnix 2.9.9 (HKLM-x32\...\MKVtoolnix) (Version: 2.9.9 - Moritz Bunkus)
Movie Templates - Starter Kit (x32 Version: 9.0.4.0 - Nero AG) Hidden
Mozilla Firefox 38.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 38.0.1 (x86 de)) (Version: 38.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSVC90_x64 (Version: 1.0.1.2 - Nokia) Hidden
MSVC90_x86 (x32 Version: 1.0.1.2 - Nokia) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MyPhoneExplorer (HKLM-x32\...\MPE) (Version: 1.8.5 - F.J. Wechselberger)
Nero 9 (HKLM-x32\...\{4622550e-092a-4e7b-9fbb-ad35dcf0f65f}) (Version:  - Nero AG)
Nokia Connectivity Cable Driver (HKLM-x32\...\{A57025CC-5F2E-4D01-B387-06DB10500D43}) (Version: 7.1.78.0 - Nokia)
NVIDIA 3D Vision Controller-Treiber 331.82 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 331.82 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.13.0725 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.0725 - NVIDIA Corporation)
OpenAL (HKLM-x32\...\OpenAL) (Version:  - )
OpenOffice 4.1.1 (HKLM-x32\...\{ACD0FFF9-6B35-43C1-82DB-9FF6990E8602}) (Version: 4.11.9775 - Apache Software Foundation)
Paragon Partition Manager™ 11 Professional (HKLM-x32\...\{A35001F0-F1E4-11DD-A38B-005056C00008}) (Version: 90.00.0003 - Paragon Software)
PC Connectivity Solution (HKLM-x32\...\{644F4910-E812-49AD-93EC-86828CB81A0D}) (Version: 12.0.27.0 - Nokia)
PC Probe II (HKLM-x32\...\{F7338FA3-DAB5-49B2-900D-0AFB5760C166}) (Version: 1.04.57 - )
PDF Architect (HKLM-x32\...\{064A929A-4DE8-40CF-A901-BD40C14E4D25}) (Version: 1.1.83.9982 - pdfforge GmbH)
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.7.0 - pdfforge)
pdfforge Toolbar v1.0 (HKLM-x32\...\{B8B0FC8B-E69B-4215-AF1A-4BDFF20D794B}) (Version: 1.00.0000 - GreenTree Applications, Inc.) <==== ATTENTION
PL-2303 USB-to-Serial (HKLM-x32\...\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}) (Version: 1.00.000 - Prolific Technology INC)
PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.986 - Even Balance, Inc.)
RESIDENT EVIL 5 Benchmark Version (HKLM-x32\...\{A2770F50-89C7-433E-8E19-7148B21172EB}) (Version: 1.00.0000 - CAPCOM CO., LTD.)
Samsung Kies (HKLM-x32\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.6.0.13091_9 - Samsung Electronics Co., Ltd.)
Samsung Kies (x32 Version: 2.6.0.13091_9 - Samsung Electronics Co., Ltd.) Hidden
Samsung Kies3 (HKLM-x32\...\InstallShield_{88547073-C566-4895-9005-EBE98EA3F7C7}) (Version: 3.2.13114.22 - Samsung Electronics Co., Ltd.)
Samsung Kies3 (x32 Version: 3.2.13114.22 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.29.0 - SAMSUNG Electronics Co., Ltd.)
Secunia PSI (3.0.0.9016) (HKLM-x32\...\Secunia PSI) (Version: 3.0.0.9016 - Secunia)
SetEditMX04 (remove only) (HKLM-x32\...\SetEditMX04) (Version:  - )
Snap.Do (HKLM-x32\...\{B153BEB7-EF24-4323-8584-3FE956AAE7D1}) (Version: 1.149.1.12678 - ReSoft Ltd.) <==== ATTENTION
Snap.Do Engine (HKU\S-1-5-21-3728770155-2195705790-4138058334-1000\...\{28446b02-bf6d-442c-a5c7-0d2a706eb1fd}) (Version: 1.149.1.12678 - ReSoft Ltd.) <==== ATTENTION
SoundMAX (HKLM-x32\...\{F0A37341-D692-11D4-A984-009027EC0A9C}) (Version: 6.10.2.6520 - Analog Devices)
Speccy (HKLM\...\Speccy) (Version: 1.18 - Piriform)
SpeedFan (remove only) (HKLM-x32\...\SpeedFan) (Version:  - )
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1) (Version: 1.6.2 - Safer Networking Limited)
Star Wars: The Old Republic (HKLM-x32\...\{3B11D799-48E0-48ED-BFD7-EA655676D8BB}) (Version: 1.00 - Electronic Arts, Inc.)
StarMoney (x32 Version: 4.0.0.203 - StarFinanz) Hidden
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
Sun ODF Plugin for Microsoft Office 3.2 (HKLM-x32\...\{BD136CE7-6666-4273-A056-8D92F8625AAB}) (Version: 3.2.9483 - Sun Microsystems)
System Requirements Lab (HKLM-x32\...\SystemRequirementsLab) (Version:  - )
System Requirements Lab CYRI (HKLM-x32\...\{943A8D28-80D6-41DC-AE94-81FEB42041BF}) (Version: 4.5.1.0 - Husdawg, LLC)
TeamSpeak 2 RC2 (HKLM-x32\...\Teamspeak 2 RC2_is1) (Version: 2.0.32.60 - Dominating Bytes Design)
TeamSpeak 3 Client (HKLM-x32\...\TeamSpeak 3 Client) (Version: 3.0.10 - TeamSpeak Systems GmbH)
Top Set 2.00 (HKLM-x32\...\TFSETTOP_is1) (Version: 2.00 - Aldarin)
Ulead GIF Animator 5 Test (HKLM-x32\...\{8AF3E926-ED59-11D4-A44B-0000E86D2305}) (Version:  - )
Uninstall 1.0.0.1 (HKLM-x32\...\Uninstall_is1) (Version:  - )
VLC media player 2.1.2 (HKLM-x32\...\VLC media player) (Version: 2.1.2 - VideoLAN)
Windows 7 USB/DVD Download Tool (HKLM-x32\...\{CCF298AF-9CE1-4B26-B251-486E98A34789}) (Version: 1.0.30 - Microsoft Corporation)
Windows Media Player Firefox Plugin (HKLM-x32\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)
Windows-Treiberpaket - Nokia pccsmcfd LegacyDriver  (05/31/2012 7.1.2.0) (HKLM\...\62BBD193ADFDBB228C7E1ADB56463F5732FF7F6F) (Version: 05/31/2012 7.1.2.0 - Nokia)
WinRAR (HKLM\...\WinRAR archiver) (Version:  - )
Wolfenstein(TM) 1.1 Patch (x32 Version:  - ) Hidden
World of Warcraft (HKLM-x32\...\World of Warcraft) (Version:  - Blizzard Entertainment)
xp-AntiSpy 3.97-2 (HKLM-x32\...\xp-AntiSpy) (Version:  - Christian Taubenheim)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-3728770155-2195705790-4138058334-1000_Classes\CLSID\{2F5DA951-82C6-471e-90BD-CAB15552A932}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3728770155-2195705790-4138058334-1000_Classes\CLSID\{5b55a44a-d008-49aa-9234-86fb7709bc0a}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)

==================== Restore Points =========================

09-04-2015 17:34:49 Windows Update
16-04-2015 18:35:17 Windows Update
16-04-2015 18:53:15 Windows Update
23-04-2015 18:44:31 Windows Update
29-04-2015 11:04:53 Windows Update
03-05-2015 11:18:59 Windows Update
08-05-2015 11:48:46 Windows Update
13-05-2015 13:38:40 Windows Update
13-05-2015 13:40:52 Windows Update
19-05-2015 16:50:49 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2006-11-02 14:34 - 2011-12-09 16:11 - 00438870 ____N C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
127.0.0.1	www.007guard.com
127.0.0.1	007guard.com
127.0.0.1	008i.com
127.0.0.1	www.008k.com
127.0.0.1	008k.com
127.0.0.1	www.00hq.com
127.0.0.1	00hq.com
127.0.0.1	010402.com
127.0.0.1	www.032439.com
127.0.0.1	032439.com
127.0.0.1	www.0scan.com
127.0.0.1	0scan.com
127.0.0.1	1000gratisproben.com
127.0.0.1	www.1000gratisproben.com
127.0.0.1	1001namen.com
127.0.0.1	www.1001namen.com
127.0.0.1	100888290cs.com
127.0.0.1	www.100888290cs.com
127.0.0.1	www.100sexlinks.com
127.0.0.1	100sexlinks.com
127.0.0.1	10sek.com
127.0.0.1	www.10sek.com
127.0.0.1	www.1-2005-search.com
127.0.0.1	1-2005-search.com
127.0.0.1	123fporn.info
127.0.0.1	www.123fporn.info
127.0.0.1	123haustiereundmehr.com
127.0.0.1	www.123haustiereundmehr.com

There are 1000 more lines.


==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {075E688B-4B2A-4F6F-B603-608DE45D2CC7} - System32\Tasks\{DBB3F9AC-806C-4752-A04F-A065A7C17974} => pcalua.exe -a "E:\DivX Web Player\DivX\DivXWebPlayerUninstall.exe" -c /PLUGIN
Task: {19394B49-A21A-46C2-974F-D3453D82331C} - System32\Tasks\ASUS\ASUS RegRun Loader => C:\Program Files (x86)\ASUS\AASP\1.00.77\AsLoader.exe [2008-07-02] ()
Task: {26371E1B-057E-4008-BFA9-3788D014AB7D} - System32\Tasks\{ECF9A586-CDBF-428D-B4BC-42492609FB60} => pcalua.exe -a "C:\Program Files (x86)\Common Files\Nero\Nero ProductInstaller 4\SetupX.exe" -c REMOVESERIALNUMBER="9M03-01A1-PCX7-K31A-8A94-98PT-KT2E-522A"
Task: {412FBE55-39C1-4189-A75E-F4FDE9CBA181} - System32\Tasks\{81F06466-F428-4AB5-ADA2-F831FD01DAAA} => pcalua.exe -a "C:\Program Files (x86)\InstallShield Installation Information\{EE91E474-9298-47B8-817F-8E0042408998}\setup.exe" -c -runfromtemp -l0x0009 -removeonly
Task: {67D138EF-E207-4D8D-9F0A-E3077C93086B} - \GoforFilesUpdate No Task File <==== ATTENTION
Task: {88946AB8-46C9-4E9B-A08C-4DDC97C3DC85} - System32\Tasks\ASUS\ASUS ACPI Service Provider => C:\Program Files (x86)\ASUS\AASP\1.00.77\aaCenter.exe [2008-09-23] ()
Task: {A2FE0109-6222-4D5C-B6F3-ED6BB0D1E910} - System32\Tasks\{10593BAF-97B4-4F42-A097-F52C89DC2A46} => pcalua.exe -a "C:\Program Files (x86)\InstallShield Installation Information\{7E19B002-4CA3-4C9F-BA92-91D101B97219}\setup.exe" -c -runfromtemp -l0x0007 -removeonly
Task: {AE4159E8-B03B-4ECD-8DDC-A2A8656E589B} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-22] (Google Inc.)
Task: {DB677305-8A1D-4719-B301-B1BA963F0B76} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-05-21] (Adobe Systems Incorporated)
Task: {E0AB9818-CA1C-40D9-90B0-C072E7028790} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {E65D2AFF-EBA9-482B-928B-987330737B95} - System32\Tasks\{D812D4B0-B475-4A15-9B93-8083D0BD8B00} => pcalua.exe -a "C:\Program Files (x86)\Mozilla Firefox\uninstall\helper.exe"
Task: {FF11F587-16A6-4E6F-A385-07D951A2442B} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-22] (Google Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (Whitelisted) ==============

2010-02-22 17:07 - 2009-12-12 16:12 - 00166400 _____ () E:\WinRar\rarext.dll
2010-06-21 19:37 - 2010-06-30 13:10 - 00126264 _____ () E:\Extractor\ezcddax64.dll
2013-12-06 22:18 - 2013-12-06 22:18 - 00045056 _____ () C:\Windows\system32\atitmp64.dll
2008-09-23 10:16 - 2008-09-23 10:16 - 00622592 ____R () C:\Program Files (x86)\ASUS\AASP\1.00.77\aaCenter.exe
2009-05-21 23:06 - 2009-05-22 01:39 - 00066872 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2009-05-19 19:57 - 2005-06-22 11:39 - 00204851 ____R () C:\Program Files (x86)\ASUS\AASP\1.00.77\PowerDll.dll
2009-05-19 19:57 - 2008-01-17 10:46 - 00053248 ____R () C:\Program Files (x86)\ASUS\AASP\1.00.77\cpuutil.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE trusted site: HKU\.DEFAULT\...\clonewarsadventures.com -> clonewarsadventures.com
IE trusted site: HKU\.DEFAULT\...\freerealms.com -> freerealms.com
IE trusted site: HKU\.DEFAULT\...\soe.com -> soe.com
IE trusted site: HKU\.DEFAULT\...\sony.com -> sony.com

IE restricted site: HKU\.DEFAULT\...\007guard.com -> install.007guard.com
IE restricted site: HKU\.DEFAULT\...\008i.com -> 008i.com
IE restricted site: HKU\.DEFAULT\...\008k.com -> www.008k.com
IE restricted site: HKU\.DEFAULT\...\00hq.com -> www.00hq.com
IE restricted site: HKU\.DEFAULT\...\010402.com -> 010402.com
IE restricted site: HKU\.DEFAULT\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\.DEFAULT\...\0scan.com -> www.0scan.com
IE restricted site: HKU\.DEFAULT\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\.DEFAULT\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\.DEFAULT\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\.DEFAULT\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\.DEFAULT\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\.DEFAULT\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\.DEFAULT\...\10sek.com -> www.10sek.com
IE restricted site: HKU\.DEFAULT\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\.DEFAULT\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\.DEFAULT\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\.DEFAULT\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\.DEFAULT\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\.DEFAULT\...\123simsen.com -> www.123simsen.com

There are 7866 more restricted sites.

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3728770155-2195705790-4138058334-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Silverserver\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
DNS Servers: 217.0.43.17 - 192.168.0.1

==================== MSCONFIG/TASK MANAGER Error getting ==

(Currently there is no automatic fix for this section.)

MSCONFIG\Services: ASGT => 2
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan.lnk => C:\Windows\pss\McAfee Security Scan.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Microsoft Office.lnk => C:\Windows\pss\Microsoft Office.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^O&O Defrag Tray.lnk => C:\Windows\pss\O&O Defrag Tray.lnk.CommonStartup
MSCONFIG\startupreg: Acronis Scheduler2 Service => "C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe"
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: Adobe Reader Speed Launcher => "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
MSCONFIG\startupreg: BDRegion => "C:\Program Files (x86)\Cyberlink\Shared Files\brs.exe"
MSCONFIG\startupreg: DAEMON Tools Lite => "E:\DAEMON Tools Lite\daemon.exe" -autorun
MSCONFIG\startupreg: DivXUpdate => "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
MSCONFIG\startupreg: EEventManager => "C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe"
MSCONFIG\startupreg: EPSON SX130 Series => C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIHJE.EXE /FU "C:\Windows\TEMP\E_S4EBB.tmp" /EF "HKCU"
MSCONFIG\startupreg: FileHippo.com => "E:\FileHippo.com\UpdateChecker.exe" /background
MSCONFIG\startupreg: OODefragTray => C:\Program Files\OO Software\Defrag\oodtray.exe
MSCONFIG\startupreg: PC Suite Tray => "E:\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
MSCONFIG\startupreg: PDVD9LanguageShortcut => E:\PowerDVD\PowerDVD9\Language\Language.exe
MSCONFIG\startupreg: Prime95 => G:\Privat\CoreTemp&Auslastungsprog\CoreTemp64\prime95.exe
MSCONFIG\startupreg: RemoteControl9 => E:\PowerDVD\PowerDVD9\PDVD9Serv.exe
MSCONFIG\startupreg: Sony Ericsson PC Suite => "E:\Sony Ericsson\SEPCSuite.exe" /systray /nologon
MSCONFIG\startupreg: Steam => "F:\Steam\steam.exe" -silent
MSCONFIG\startupreg: SUPERAntiSpyware => E:\SuperAntiSpy\SUPERAntiSpyware.exe
MSCONFIG\startupreg: TrueImageMonitor.exe => E:\Acronis True Image\TrueImageMonitor.exe

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [WinCollab-Out-UDP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [WinCollab-In-UDP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [WinCollab-Out-TCP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [WinCollab-In-TCP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [WinCollab-DFSR-Out-TCP] => (Allow) %SystemRoot%\system32\dfsr.exe
FirewallRules: [WinCollab-DFSR-In-TCP] => (Allow) %SystemRoot%\system32\dfsr.exe
FirewallRules: [TCP Query User{D8A62F03-A31B-42E1-95CB-7FF6E7FDD14A}C:\programdata\kaspersky lab setup files\kaspersky internet security 2009\german\setup.exe] => (Allow) C:\programdata\kaspersky lab setup files\kaspersky internet security 2009\german\setup.exe
FirewallRules: [UDP Query User{2B543BCE-6A41-44BC-BF8C-6948B675ADE4}C:\programdata\kaspersky lab setup files\kaspersky internet security 2009\german\setup.exe] => (Allow) C:\programdata\kaspersky lab setup files\kaspersky internet security 2009\german\setup.exe
FirewallRules: [{5BE9B40B-DE9D-40C1-ABEC-5C6642F76BF2}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{95CECB8A-9CCB-48BD-8C6B-3D113C72006A}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{AFD1D2A4-B431-4C94-8F7A-E79EEA5DC2B1}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [{B92DE032-27FD-407E-BCC7-FA09E8C62731}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [{C09223DE-46A4-4191-B20D-79D0D8E7F219}] => (Allow) C:\Program Files\Windows Mail\WinMail.exe
FirewallRules: [{6A959BCA-422E-4D71-AF30-3EDD893B3C64}] => (Allow) C:\Program Files\Windows Mail\WinMail.exe
FirewallRules: [TCP Query User{642679AC-5CC2-4B41-8FB6-0F6CCCA56A03}C:\program files (x86)\internet explorer\iexplore.exe] => (Allow) C:\program files (x86)\internet explorer\iexplore.exe
FirewallRules: [UDP Query User{38E84894-AD59-4DD1-ADA8-7B72A58C9C66}C:\program files (x86)\internet explorer\iexplore.exe] => (Allow) C:\program files (x86)\internet explorer\iexplore.exe
FirewallRules: [{2E10D0BE-3CE9-48E3-AB4D-04490717C89F}] => (Allow) LPort=5
FirewallRules: [{2932E263-8643-49A2-B001-F11F3B94162E}] => (Allow) G:\Download\CryptLoad\CryptLoad.exe
FirewallRules: [{77385742-D8B4-4A49-A3BB-53EE803375C5}] => (Allow) G:\Download\CryptLoad\CryptLoad.exe
FirewallRules: [{BDAAC4D9-5688-4187-A153-422CEE2685D8}] => (Allow) C:\Users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-3.1.3.9947-to-3.2.0.10192-deDE-downloader.exe
FirewallRules: [{DC01AF64-E646-471D-8DB8-53F8A34A8C2C}] => (Allow) C:\Users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-3.1.3.9947-to-3.2.0.10192-deDE-downloader.exe
FirewallRules: [{B405F7A8-5A9E-4356-A98A-D93351602D2F}] => (Allow) C:\Users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-3.2.0.10192-to-3.2.0.10314-deDE-downloader.exe
FirewallRules: [{36698254-C05D-4D2C-A4D2-0123293275B7}] => (Allow) C:\Users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-3.2.0.10192-to-3.2.0.10314-deDE-downloader.exe
FirewallRules: [TCP Query User{8CDB9D65-34F7-4FAE-AC68-8F692BB159AD}E:\sopcast\adv\sopadver.exe] => (Allow) E:\sopcast\adv\sopadver.exe
FirewallRules: [UDP Query User{B33D3A52-1277-40FB-88B9-9970ABC9DED7}E:\sopcast\adv\sopadver.exe] => (Allow) E:\sopcast\adv\sopadver.exe
FirewallRules: [{86C13492-FAF2-4F1D-BE87-FE2F4C93EE00}] => (Allow) C:\Users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-3.2.0.10314-to-3.2.2.10482-deDE-downloader.exe
FirewallRules: [{AF066419-924B-449D-A5C2-86DAD062A8F7}] => (Allow) C:\Users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-3.2.0.10314-to-3.2.2.10482-deDE-downloader.exe
FirewallRules: [TCP Query User{4624EB56-9368-4DCB-9BB6-EAC6F836DB89}C:\program files (x86)\java\jre6\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre6\bin\javaw.exe
FirewallRules: [UDP Query User{118ED415-DE8D-4C42-A56E-6A2935FA63B5}C:\program files (x86)\java\jre6\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre6\bin\javaw.exe
FirewallRules: [{2E0C5820-8EB8-4D40-AE48-CEF238E3CA53}] => (Allow) E:\PowerDVD\PowerDVD9\PowerDVD Cinema\PowerDVDCinema.exe
FirewallRules: [{88271800-4125-4AF4-8F87-92F25437A7EC}] => (Allow) E:\PowerDVD\PowerDVD9\PowerDVD9.EXE
FirewallRules: [{DCC6E08A-941E-4E20-99EE-1288A444EE61}] => (Allow) LPort=80
FirewallRules: [{C51EFF47-746A-4427-BB53-55040A769C3A}] => (Allow) LPort=80
FirewallRules: [{38187D73-902F-48BB-9AC0-28C810B5416A}] => (Allow) LPort=80
FirewallRules: [{BFB27BE4-19BB-4D41-A83F-E7959B6C0336}] => (Allow) LPort=3724
FirewallRules: [{C30EB6AB-1CC0-490E-8DBF-FC13CEB3FC3F}] => (Allow) LPort=3724
FirewallRules: [TCP Query User{709F4B36-DA90-4468-AE1D-B5F893636AE5}C:\program files (x86)\google\google earth\plugin\geplugin.exe] => (Block) C:\program files (x86)\google\google earth\plugin\geplugin.exe
FirewallRules: [UDP Query User{3DCE3A16-0426-4F8C-96BD-F25DE58760A8}C:\program files (x86)\google\google earth\plugin\geplugin.exe] => (Block) C:\program files (x86)\google\google earth\plugin\geplugin.exe
FirewallRules: [{B2769F80-2486-44E2-B0D5-89B6546E068B}] => (Allow) C:\Users\Silverserver\AppData\Local\Temp\{61FCC39C-AC49-403C-A2EE-545D075DD254}\{63B9BAB5-F36A-4A3B-9E5C-68A7F212BFB9}\InstTool.exe
FirewallRules: [{F268F980-6A30-4294-8F0D-16AD65CEF980}] => (Allow) C:\Users\Silverserver\AppData\Local\Temp\{61FCC39C-AC49-403C-A2EE-545D075DD254}\{63B9BAB5-F36A-4A3B-9E5C-68A7F212BFB9}\InstTool.exe
FirewallRules: [TCP Query User{94DC26D1-BCBF-4EAB-9B2B-3AB54D774A6A}H:\star wars-the old republic\launcher.exe] => (Allow) H:\star wars-the old republic\launcher.exe
FirewallRules: [UDP Query User{AD26E4ED-66CD-4D1C-BD52-1D876AF9364C}H:\star wars-the old republic\launcher.exe] => (Allow) H:\star wars-the old republic\launcher.exe
FirewallRules: [TCP Query User{5AB93D42-C050-45DC-81F0-672EFD533AF5}F:\star wars-the old republic\launcher.exe] => (Allow) F:\star wars-the old republic\launcher.exe
FirewallRules: [UDP Query User{556D1424-AE67-4E9E-A553-53377D15E634}F:\star wars-the old republic\launcher.exe] => (Allow) F:\star wars-the old republic\launcher.exe
FirewallRules: [TCP Query User{BE90799F-5E59-418C-BF87-7D4973FD72E4}F:\star wars-the old republic\betatest\retailclient\swtor.exe] => (Allow) F:\star wars-the old republic\betatest\retailclient\swtor.exe
FirewallRules: [UDP Query User{6314A400-2114-4A2A-AC55-F0746F1B3A9B}F:\star wars-the old republic\betatest\retailclient\swtor.exe] => (Allow) F:\star wars-the old republic\betatest\retailclient\swtor.exe
FirewallRules: [TCP Query User{C911A192-2808-49CC-AE6E-AFCCD71E09A7}C:\program files\java\jre6\bin\javaw.exe] => (Allow) C:\program files\java\jre6\bin\javaw.exe
FirewallRules: [UDP Query User{C17EAF02-CC3B-4261-B565-740F261121DA}C:\program files\java\jre6\bin\javaw.exe] => (Allow) C:\program files\java\jre6\bin\javaw.exe
FirewallRules: [TCP Query User{37B55535-111E-44F3-ACEA-9F3ACF6D071C}C:\program files (x86)\epson software\event manager\eeventmanager.exe] => (Block) C:\program files (x86)\epson software\event manager\eeventmanager.exe
FirewallRules: [UDP Query User{28F015B3-44B0-4270-9E03-CF9905A4D025}C:\program files (x86)\epson software\event manager\eeventmanager.exe] => (Block) C:\program files (x86)\epson software\event manager\eeventmanager.exe
FirewallRules: [TCP Query User{78188FA6-62E2-44E6-9C3B-23032014286D}F:\guild wars 2\gw2.exe] => (Allow) F:\guild wars 2\gw2.exe
FirewallRules: [UDP Query User{EEAF8214-B099-4EA0-878E-BBE8FFD66699}F:\guild wars 2\gw2.exe] => (Allow) F:\guild wars 2\gw2.exe
FirewallRules: [{C3869788-18A1-4E14-87CB-E53CB5C04724}] => (Allow) F:\Diablo III\Diablo III.exe
FirewallRules: [{FDAD6112-36A8-46F0-A345-AE1DC623188C}] => (Allow) F:\Diablo III\Diablo III.exe
FirewallRules: [TCP Query User{07A7484C-B744-4B5E-A756-1521F5570370}E:\myphoneexplorer\myphoneexplorer.exe] => (Allow) E:\myphoneexplorer\myphoneexplorer.exe
FirewallRules: [UDP Query User{9D099855-B20C-4D57-9079-95E5D48CB11E}E:\myphoneexplorer\myphoneexplorer.exe] => (Allow) E:\myphoneexplorer\myphoneexplorer.exe
FirewallRules: [{45EA2027-6D7B-4917-BAE7-34C596A0727B}] => (Allow) F:\Steam\Steam.exe
FirewallRules: [{51FF6886-B56B-4F70-9661-397EA8BFF3C2}] => (Allow) F:\Steam\Steam.exe
FirewallRules: [{1BAF4257-5AE6-4F88-937B-4D015E286D6E}] => (Allow) F:\Steam\SteamApps\common\Gunpoint Demo\Gunpoint.exe
FirewallRules: [{8EBC5320-B5DA-4400-935C-DFA9910D6013}] => (Allow) F:\Steam\SteamApps\common\Gunpoint Demo\Gunpoint.exe
FirewallRules: [TCP Query User{CDFC5F4F-5A9E-49CB-9559-E4747F3C4277}F:\world of tanks\wotlauncher.exe] => (Allow) F:\world of tanks\wotlauncher.exe
FirewallRules: [UDP Query User{1BFA5646-802B-40C5-88DA-58FA31CB6854}F:\world of tanks\wotlauncher.exe] => (Allow) F:\world of tanks\wotlauncher.exe
FirewallRules: [{7372D9C6-2BBA-45D3-B9DB-1CAC96DC647B}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2328\Agent.exe
FirewallRules: [{111A5911-EF2B-4122-87FC-8A82B26D892C}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2328\Agent.exe
FirewallRules: [{AEB84B21-EB7D-4221-B2B7-65439B19D53A}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2380\Agent.exe
FirewallRules: [{557129B7-8CC5-40D9-BD30-9FA53FB1C76C}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2380\Agent.exe
FirewallRules: [{9539A763-8788-4C55-886B-CFBD1B1FFA02}] => (Allow) C:\Program Files (x86)\GoforFiles\goforfilesdl.exe
FirewallRules: [{727EE093-C9BF-4FE6-908B-0A8616757C6C}] => (Allow) C:\Program Files (x86)\GoforFiles\goforfilesdl.exe
FirewallRules: [{8C18069C-2CF0-4185-B057-6734820714A7}] => (Allow) C:\Program Files (x86)\GoforFiles\GoforFiles.exe
FirewallRules: [{3927275E-B17F-4162-83A6-3B9DF69EDFE3}] => (Allow) C:\Program Files (x86)\GoforFiles\GoforFiles.exe
FirewallRules: [{8483F419-8231-402F-96DB-9EC4491F78CC}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2689\Agent.exe
FirewallRules: [{B4C27316-3EB2-4833-AB83-1DDAC4E1BF87}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2689\Agent.exe
FirewallRules: [{596D6964-B25A-4272-87FD-10D4DF63C0AB}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2717\Agent.exe
FirewallRules: [{860CDB56-B9B0-4500-ACEF-6495F95B5787}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2717\Agent.exe
FirewallRules: [{74EB79AA-5AFD-48C4-A706-E2BBB7E19701}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2816\Agent.exe
FirewallRules: [{7644C5F2-252A-45EC-BA00-C5CA10B1D098}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2816\Agent.exe
FirewallRules: [{AF23F4DD-9B01-45AF-8E1D-9755346C1DE8}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3372\Agent.exe
FirewallRules: [{4CF46BE8-6E8D-4085-A4F9-2143AAE6CF30}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3372\Agent.exe
FirewallRules: [{127A003A-5A5C-4C9D-920C-B42E7F9A031B}] => (Allow) C:\Program Files (x86)\Battle.net\Battle.net.exe
FirewallRules: [{9BCA4879-45AC-4282-856F-B3FCAD3ADB46}] => (Allow) C:\Program Files (x86)\Battle.net\Battle.net.exe
FirewallRules: [TCP Query User{044F6965-6EDF-4D19-94CE-A0BA7A84D45B}C:\programdata\battle.net\agent\agent.3478\agent.exe] => (Allow) C:\programdata\battle.net\agent\agent.3478\agent.exe
FirewallRules: [UDP Query User{DD14B015-2DC4-49F5-B694-805EB5EA8037}C:\programdata\battle.net\agent\agent.3478\agent.exe] => (Allow) C:\programdata\battle.net\agent\agent.3478\agent.exe
FirewallRules: [{B54356D8-C314-44DB-A898-0E4D49B16F24}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3478\Agent.exe
FirewallRules: [{EC6547D9-6F25-4E00-A9B2-C07B8DD4DF00}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3478\Agent.exe
FirewallRules: [TCP Query User{46188B2B-B2D1-46AB-890D-83E5EC20AD2C}F:\diablo iii\diablo iii.exe] => (Allow) F:\diablo iii\diablo iii.exe
FirewallRules: [UDP Query User{67F276F3-0674-4F42-9ABE-C6D2B80D795A}F:\diablo iii\diablo iii.exe] => (Allow) F:\diablo iii\diablo iii.exe
FirewallRules: [{60965066-00D3-4F90-8765-CADCE01620A7}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3507\Agent.exe
FirewallRules: [{6556D7E4-C68C-4708-A06B-645DA97FA6F3}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3507\Agent.exe
FirewallRules: [{14FF3617-517E-45F1-976C-0C204E1D5E13}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3526\Agent.exe
FirewallRules: [{F9E23C64-F65A-4AF8-A5DA-B14DF3EB797E}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3526\Agent.exe
FirewallRules: [{C7E8551F-2057-4C68-9B41-BA122E44A95D}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3634\Agent.exe
FirewallRules: [{669F8CE9-3E19-4C25-8138-F9F8B1D12D2C}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3634\Agent.exe
FirewallRules: [{94C43BB5-A33E-46A5-BBDE-9F406E7FC96D}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3669\Agent.exe
FirewallRules: [{9EA7C154-06BD-44A3-AF2C-59A82E272F95}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3669\Agent.exe
FirewallRules: [{DC39FE55-C432-4179-86C1-FCAF25A6EC14}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3688\Agent.exe
FirewallRules: [{0E2719D1-A9E5-4C6E-87BB-50DFCCD8DF10}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3688\Agent.exe
FirewallRules: [TCP Query User{11F58B09-DE63-4A16-A952-45E7D08D04B6}E:\firefox\firefox.exe] => (Allow) E:\firefox\firefox.exe
FirewallRules: [UDP Query User{0310BDCE-CBED-4A96-8E95-E00FA8D56539}E:\firefox\firefox.exe] => (Allow) E:\firefox\firefox.exe

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (05/23/2015 10:01:07 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/23/2015 09:56:14 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/21/2015 06:04:25 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/21/2015 11:50:46 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/19/2015 06:40:02 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/19/2015 04:44:29 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/18/2015 04:06:20 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/18/2015 11:47:53 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/18/2015 11:37:41 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/18/2015 10:26:03 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (05/23/2015 10:01:12 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: i8042prt

Error: (05/23/2015 09:56:21 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: i8042prt

Error: (05/21/2015 06:04:31 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: i8042prt

Error: (05/21/2015 11:50:51 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: i8042prt

Error: (05/19/2015 06:40:08 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: i8042prt

Error: (05/19/2015 04:44:34 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: i8042prt

Error: (05/18/2015 04:06:26 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: i8042prt

Error: (05/18/2015 11:48:01 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: i8042prt

Error: (05/18/2015 11:45:59 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Windows Presentation Foundation Font Cache 4.0.0.0201Neustart des Diensts

Error: (05/18/2015 11:45:59 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Nero BackItUp Scheduler 4.025001Neustart des Diensts


Microsoft Office:
=========================
Error: (05/23/2015 10:01:07 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/23/2015 09:56:14 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/21/2015 06:04:25 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/21/2015 11:50:46 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/19/2015 06:40:02 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/19/2015 04:44:29 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/18/2015 04:06:20 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/18/2015 11:47:53 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/18/2015 11:37:41 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/18/2015 10:26:03 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


CodeIntegrity Errors:
===================================
  Date: 2015-05-23 10:04:23.711
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-05-23 10:04:23.508
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-05-23 10:04:23.289
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-05-23 10:04:23.071
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-05-21 12:11:59.059
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-05-21 12:11:58.841
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-05-21 12:11:58.607
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-05-21 12:11:58.388
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-05-21 12:11:58.170
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-05-21 12:11:57.920
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i7 CPU 920 @ 2.67GHz
Percentage of memory in use: 47%
Total physical RAM: 6134.18 MB
Available physical RAM: 3196.76 MB
Total Pagefile: 12379.86 MB
Available Pagefile: 9114 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:146.48 GB) (Free:69.08 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive e: (Programme) (Fixed) (Total:20 GB) (Free:15.63 GB) NTFS
Drive f: (Zox´s) (Fixed) (Total:350 GB) (Free:254.89 GB) NTFS
Drive g: (Daten) (Fixed) (Total:415.03 GB) (Free:262.7 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 66394308)
Partition 1: (Active) - (Size=146.5 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=20 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=350 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=415 GB) - (Type=05)

==================== End of log ============================
         

Gmer.txt

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-05-23 10:14:15
Windows 6.0.6002 Service Pack 2 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 Intel___ rev.1.0. 931,52GB
Running: Gmer-19357.exe; Driver: C:\Users\SILVER~1\AppData\Local\Temp\uwddypob.sys


---- User code sections - GMER 2.1 ----

.text    C:\Windows\SysWOW64\PnkBstrA.exe[3120] C:\Windows\SysWOW64\WSOCK32.dll!recv + 81                                                                                                                                                                                00000000733618a9 2 bytes CALL 752f143d C:\Windows\syswow64\kernel32.dll
.text    C:\Windows\SysWOW64\PnkBstrA.exe[3120] C:\Windows\SysWOW64\WSOCK32.dll!recvfrom + 87                                                                                                                                                                            000000007336190e 2 bytes CALL 752f143d C:\Windows\syswow64\kernel32.dll
.text    C:\Windows\SysWOW64\PnkBstrA.exe[3120] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 98                                                                                                                                                                          00000000733619f0 2 bytes JMP 76c18400 C:\Windows\syswow64\WS2_32.dll
.text    C:\Windows\SysWOW64\PnkBstrA.exe[3120] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 109                                                                                                                                                                         00000000733619fb 2 bytes JMP 76c28b38 C:\Windows\syswow64\WS2_32.dll
---- Processes - GMER 2.1 ----

Library  C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{B2242240-1681-4CD0-9A39-27BBE31D3BF5}\mpengine.dll (*** suspicious ***) @ C:\Windows\System32\svchost.exe [600] (Microsoft Malware Protection Engine/Microsoft Corporation)(2015-05-19 14:51:23)  000007fefa6b0000
Library  C:\Users\SILVER~1\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll (*** suspicious ***) @ C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [4228] (Avira.OE.ExtApi/Avira Operations GmbH & Co. KG)(2014-08-16 10:01:25)                                   0000000069440000
Process  \\?\C:\Windows\system32\wbem\WMIADAP.EXE (*** suspicious ***) @ \\?\C:\Windows\system32\wbem\WMIADAP.EXE [3092] (WMI Reverse Performance Adapter Maintenance Utility/Microsoft Corporation)(2009-12-26 17:59:21)                                                00000000ff340000

---- Registry - GMER 2.1 ----

Reg      HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC                                                                                                                                                                                
Reg      HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                                                                                                                                                             0
Reg      HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                                                                                                                                                          0xE7 0xF6 0x96 0x64 ...
Reg      HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)                                                                                                                                                            
Reg      HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                                                                                                                                                                 0
Reg      HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                                                                                                                                                              0xE7 0xF6 0x96 0x64 ...

---- EOF - GMER 2.1 ----
         

Malwarebytes

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 23.05.2015
Suchlauf-Zeit: 10:24:17
Logdatei: Malwarebytes.txt
Administrator: Ja

Version: 2.01.6.1022
Malware Datenbank: v2015.05.22.06
Rootkit Datenbank: v2015.05.16.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows Vista Service Pack 2
CPU: x64
Dateisystem: NTFS
Benutzer: Silverserver

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 444937
Verstrichene Zeit: 11 Min, 0 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(Keine schädliche Elemente gefunden)

Module: 0
(Keine schädliche Elemente gefunden)

Registrierungsschlüssel: 0
(Keine schädliche Elemente gefunden)

Registrierungswerte: 0
(Keine schädliche Elemente gefunden)

Registrierungsdaten: 0
(Keine schädliche Elemente gefunden)

Ordner: 0
(Keine schädliche Elemente gefunden)

Dateien: 0
(Keine schädliche Elemente gefunden)

Physische Sektoren: 0
(Keine schädliche Elemente gefunden)


(end)
         

Danke

Mein Name ist Jürgen und ich werde Dir bei Deinem Problem behilflich sein. Zusammen schaffen wir das...

• Bitte arbeite alle Schritte der Reihe nach ab.
• Lese die Anleitungen sorgfältig durch bevor Du beginnst. Wenn es Probleme gibt oder Du etwas nicht verstehst, dann stoppe mit Deiner Ausführung und beschreibe mir das Problem.
• Führe bitte nur Scans durch, zu denen Du von mir aufgefordert wurdest.
• Bitte kein Crossposting (posten in mehreren Foren).
• Installiere oder deinstalliere während der Bereinigung keine Software, außer Du wurdest dazu aufgefordert.
• Speichere alle unsere Tools auf dem Desktop ab. Link: So ladet Ihr unsere Tools richtig
• Poste die Logfiles direkt in Deinen Thread in Code-Tags.
• Bedenke, dass wir hier alle während unserer Freizeit tätig sind, wenn du innerhalb von 24 Stunden nichts von mir liest, dann schreibe mir bitte eine PM.

Hinweis:
Ich kann Dir niemals eine Garantie geben, dass wir alle schädlichen Dateien finden werden.
Eine Formatierung ist meist der schnellere und immer der sicherste Weg, aber auch nur bei wirklicher Malware empfehlenswert.
Adware & Co. können wir sehr gut entfernen.
Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis Du mein clean bekommst.

Los geht's:

Schritt 1

Lade Dir bitte von hier Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.

• Installiere und starte das Programm. (Bebilderte Anleitung zu Revo Uninstaller)
• Klicke auf Optionen und wähle als Sprache Deutsch.
• Suche im Uninstallerfeld nach den Programmen:
  pdfforge Toolbar v1.0
  Snap.Do
  Snap.Do Engine
  
• Wähle die Programme nacheinander aus und klicke jedes Mal auf Uninstall.
• Wähle anschließend den Modus "Moderat" aus.
  
• Reste löschen:
  Klicke auf dann auf und dann auf .

 

Schritt 2

• Schließe alle offenen Programme und Browser.
• Starte bitte Adwcleaner.
• Klicke auf Suchen und warte, bis der Suchlauf abgeschlossen ist.
• Klicke nun auf Löschen.
• Bestätige jeweils mit Ok.
• Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
• Poste mir den Inhalt mit deiner nächsten Antwort.
  Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Sx].txt. (x = fortlaufende Nummer).

Schritt 3



Bitte starte FRST erneut, und drücke auf Scan.
Bitte poste mir den Inhalt des Logs.

Hallo Jürgen. Danke für die schnelle Antwort. Hier die nächsten Logs

AdwCleaner

# AdwCleaner v4.204 - Bericht erstellt 23/05/2015 um 11:42:50
# Aktualisiert 12/05/2015 von Xplode
# Datenbank : 2015-05-12.2 [Lokal]
# Betriebssystem : Windows (TM) Vista Home Premium Service Pack 2 (x64)
# Benutzername : Silverserver - MARVEL4
# Gestarted von : E:\adwcleaner_4.204.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****


***** [ Geplante Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****


***** [ Internetbrowser ] *****

-\\ Internet Explorer v9.0.8112.16644


-\\ Mozilla Firefox v38.0.1 (x86 de)

[sf4b9g60.default-1402064898508\prefs.js] - Zeile Gelöscht : user_pref("avira.safe_search.installed", "[\"safesearch\"]");
[sf4b9g60.default-1402064898508\prefs.js] - Zeile Gelöscht : user_pref("browser.uiCustomization.state", "{\"placements\":{\"PanelUI-contents\":[\"edit-controls\",\"zoom-controls\",\"new-window-button\",\"privatebrowsing-button\",\"save-page-button\",\"print-but[...]
[sf4b9g60.default-1402064898508\prefs.js] - Zeile Gelöscht : user_pref("extensions.safesearch.MP_DISTINCT_ID", "\"723784a9dd080d001a07ef1215fafb01038d495f\"");
[sf4b9g60.default-1402064898508\prefs.js] - Zeile Gelöscht : user_pref("extensions.safesearch.SAUTH_rndsnr", "\"29fc363a30d22357c8f130107921545205e6fb9d\"");
[sf4b9g60.default-1402064898508\prefs.js] - Zeile Gelöscht : user_pref("extensions.safesearch.install", "1431942540917");
[sf4b9g60.default-1402064898508\prefs.js] - Zeile Gelöscht : user_pref("extensions.safesearch.search_offer_disabled", "true");
[sf4b9g60.default-1402064898508\prefs.js] - Zeile Gelöscht : user_pref("extensions.xpiState", "{\"app-profile\":{\"abs@avira.com\":{\"d\":\"C:\\\\Users\\\\Silverserver\\\\AppData\\\\Roaming\\\\Mozilla\\\\Firefox\\\\Profiles\\\\sf4b9g60.default-1402064898508\\\\[...]

*************************

AdwCleaner[R0].txt - [2016 Bytes] - [18/05/2015 11:45:02]
AdwCleaner[R1].txt - [2107 Bytes] - [18/05/2015 12:08:38]
AdwCleaner[R2].txt - [2166 Bytes] - [23/05/2015 11:41:56]
AdwCleaner[S0].txt - [2104 Bytes] - [18/05/2015 11:45:58]
AdwCleaner[S1].txt - [2115 Bytes] - [23/05/2015 11:42:50]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [2174  Bytes] ##########
         

FRST

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 22-05-2015 01
Ran by Silverserver (administrator) on MARVEL4 on 23-05-2015 11:51:16
Running from C:\Users\Silverserver\Desktop
Loaded Profiles: Silverserver (Available Profiles: Silverserver & UpdatusUser & Administrator)
Platform: Windows Vista (TM) Home Premium Service Pack 2 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
() C:\Program Files (x86)\ASUS\AASP\1.00.77\aaCenter.exe
(ABBYY) C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
(Andrea Electronics Corporation) C:\Windows\System32\AEADISRV.EXE
(Acronis) C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Nero AG) C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect\HelperService.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect\ConversionService.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(Safer Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Analog Devices, Inc.) C:\Program Files (x86)\Analog Devices\SoundMAX\SoundMAX.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Microsoft Corporation) C:\Windows\ehome\ehsched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Samsung Electronics Co., Ltd.) E:\Kies\KiesTrayAgent.exe
(Analog Devices, Inc.) C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\WPFFontCache_v0400.exe
(Microsoft Corporation) C:\Windows\ehome\ehrecvr.exe
(Mozilla Corporation) E:\FireFox\firefox.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM-x32\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1584184 2008-01-21] (Microsoft Corporation)
HKLM-x32\...\Run: [IAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-04] (Intel Corporation)
HKLM-x32\...\Run: [SoundMAX] => C:\Program Files (x86)\Analog Devices\SoundMAX\SoundMAX.exe [3858432 2008-09-02] (Analog Devices, Inc.)
HKLM-x32\...\Run: [Nvtmru] => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028384 2013-11-14] (NVIDIA Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [728312 2015-05-07] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [KiesTrayAgent] => E:\Kies\KiesTrayAgent.exe [311152 2013-12-11] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [SoundMAXPnP] => C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe [1310720 2009-05-19] (Analog Devices, Inc.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-12-06] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [129272 2015-03-16] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
HKU\S-1-5-21-3728770155-2195705790-4138058334-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [138240 2008-01-21] (Microsoft Corporation)
HKU\S-1-5-21-3728770155-2195705790-4138058334-1000\...\Run: [swg] => C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [68856 2009-08-06] (Google Inc.)
HKU\S-1-5-21-3728770155-2195705790-4138058334-1000\...\Run: [PnPUI Registrator] => C:\Program Files (x86)\Common Files\Sitecom Shared\PnP Universal Installer\PnPUIReg.exe [163840 2004-11-22] ()
HKU\S-1-5-21-3728770155-2195705790-4138058334-1000\...\Run: [] => E:\Kies\External\FirmwareUpdate\KiesPDLR.exe [845168 2013-12-11] (Samsung)
HKU\S-1-5-21-3728770155-2195705790-4138058334-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> 

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-3728770155-2195705790-4138058334-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.startseite24.net
HKU\S-1-5-21-3728770155-2195705790-4138058334-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKU\S-1-5-21-3728770155-2195705790-4138058334-1000\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.giga.de/
SearchScopes: HKLM -> {1C704259-9702-47AB-83C3-097AD8E55269} URL = hxxp://www.startseite24.net/?q={searchTerms}
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-3728770155-2195705790-4138058334-1000 -> {1C704259-9702-47AB-83C3-097AD8E55269} URL = hxxp://www.startseite24.net/?q={searchTerms}
SearchScopes: HKU\S-1-5-21-3728770155-2195705790-4138058334-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.de/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7GGLJ_deDE328
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll [2014-06-20] (Oracle Corporation)
BHO: Easy Photo Print -> {9421DD08-935F-4701-A9CA-22DF90AC4EA6} -> C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll [2009-08-24] (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-03-03] (Google Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll [2014-06-20] (Oracle Corporation)
BHO-x32: DivX Plus Web Player HTML5 <video> -> {326E768D-4182-46FD-9C16-1449A49795F4} -> C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll [2011-02-08] (DivX, LLC)
BHO-x32: PDF Architect Helper -> {3A2D5EBA-F86D-4BD3-A177-019765996711} -> C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll [2013-04-08] (pdfforge GmbH)
BHO-x32: Spybot-S&D IE Protection -> {53707962-6F74-2D53-2644-206D7942484F} -> C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll [2009-01-26] (Safer Networking Limited)
BHO-x32: DivX HiQ -> {593DDEC6-7468-4cdd-90E1-42DADAA222E9} -> C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll [2011-02-08] (DivX, LLC)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2014-06-20] (Oracle Corporation)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-03-03] (Google Inc.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2014-06-20] (Oracle Corporation)
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll [2009-08-24] (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-03-03] (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-03-03] (Google Inc.)
Toolbar: HKU\S-1-5-21-3728770155-2195705790-4138058334-1000 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-03-03] (Google Inc.)
DPF: HKLM-x32 {0D41B8C5-2599-4893-8183-00195EC8D5F9} hxxp://support.asus.com/common/asusTek_sys_ctrl.cab
DPF: HKLM-x32 {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: HKLM-x32 {34DC6011-88B5-4EA9-BA7A-DC7B4F4437FE} hxxp://ips.poi.de/ips-opdata/operator/69189345/objects/jordan.cab
DPF: HKLM-x32 {CAC677B6-4963-4305-9066-0BD135CD9233} https://as.photoprintit.de/ips-opdata/layout/default_cms01/activex/IPSUploader4.cab
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler-x32: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files (x86)\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL [2001-01-22] (Microsoft Corporation)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 217.0.43.17 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\Silverserver\AppData\Roaming\Mozilla\Firefox\Profiles\sf4b9g60.default-1402064898508
FF NewTab: www.google.de
FF SearchEngineOrder.1: Websuche
FF SelectedSearchEngine: eBay
FF Homepage: https://www.google.de/
FF Keyword.URL: hxxp://www.startseite24.net/?q=
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_18_0_0_144.dll [2015-05-21] ()
FF Plugin: @java.com/DTPlugin,version=10.55.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll [2014-06-20] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.55.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll [2014-06-20] (Oracle Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_18_0_0_144.dll [2015-05-21] ()
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll [2011-02-08] (DivX, LLC)
FF Plugin-x32: @divx.com/DivX Player Plugin,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll No File
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll [2011-01-24] (DivX, LLC.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll [2014-06-20] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2014-06-20] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-15] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-15] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2013-12-09] (VideoLAN)
FF Plugin-x32: Adobe Reader -> E:\Adobe Reader\Reader\AIR\nppdf32.dll [2015-04-30] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll [2007-04-10] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll [2011-02-02] (Sun Microsystems, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npDivxPlayerPlugin.dll [2009-11-14] (DivX, Inc)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2015-04-30] (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Silverserver\AppData\Roaming\Mozilla\Firefox\Profiles\sf4b9g60.default-1402064898508\searchplugins\avira-safesearch.xml [2015-05-23]
FF SearchPlugin: C:\Users\Silverserver\AppData\Roaming\Mozilla\Firefox\Profiles\sf4b9g60.default-1402064898508\searchplugins\englische-ergebnisse.xml [2014-07-08]
FF SearchPlugin: C:\Users\Silverserver\AppData\Roaming\Mozilla\Firefox\Profiles\sf4b9g60.default-1402064898508\searchplugins\gmx-suche.xml [2014-07-08]
FF SearchPlugin: C:\Users\Silverserver\AppData\Roaming\Mozilla\Firefox\Profiles\sf4b9g60.default-1402064898508\searchplugins\lastminute.xml [2014-07-08]
FF SearchPlugin: C:\Users\Silverserver\AppData\Roaming\Mozilla\Firefox\Profiles\sf4b9g60.default-1402064898508\searchplugins\webde-suche.xml [2014-07-08]
FF Extension: Avira Browser Safety - C:\Users\Silverserver\AppData\Roaming\Mozilla\Firefox\Profiles\sf4b9g60.default-1402064898508\Extensions\abs@avira.com [2015-04-29]
FF Extension: Avira SafeSearch - C:\Users\Silverserver\AppData\Roaming\Mozilla\Firefox\Profiles\sf4b9g60.default-1402064898508\Extensions\safesearch@avira.com [2015-04-29]
FF Extension: Adblock Plus - C:\Users\Silverserver\AppData\Roaming\Mozilla\Firefox\Profiles\sf4b9g60.default-1402064898508\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-06-06]
FF Extension: Tab Mix Plus - C:\Users\Silverserver\AppData\Roaming\Mozilla\Firefox\Profiles\sf4b9g60.default-1402064898508\Extensions\{dc572301-7619-498c-a57d-39143191b318}.xpi [2014-07-20]
FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-05-19]
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\html5video
FF Extension: DivX Plus Web Player HTML5 &video& - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\html5video [2011-03-04]
FF HKLM-x32\...\Firefox\Extensions: [{6904342A-8307-11DF-A508-4AE2DFD72085}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\wpa
FF Extension: DivX HiQ - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\wpa [2011-03-04]
FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt [2013-05-13]
FF HKU\S-1-5-21-3728770155-2195705790-4138058334-1000\...\Firefox\Extensions: [mail@gutscheinrausch.de] - C:\Users\Silverserver\AppData\Roaming\Mozilla\Firefox\Profiles\p79hd61z.default\extensions\mail@gutscheinrausch.de

Chrome: 
=======
CHR HKLM-x32\...\Chrome\Extension: [fnjbmmemklcjgepojigaapkoodmkgbae] - C:\Program Files (x86)\DivX\DivX Plus Web Player\google_chrome\wpa\wpa.crx [2011-02-08]
CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\google_chrome\html5video\html5video.crx [2011-02-08]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY)
R2 AEADIFilters; C:\Windows\system32\AEADISRV.EXE [111616 2009-05-19] (Andrea Electronics Corporation) []
S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe [825856 2015-05-07] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [434424 2015-05-07] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [434424 2015-05-07] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1186040 2015-05-07] (Avira Operations GmbH & Co. KG)
S4 ASGT; C:\Windows\SysWOW64\ASGT.exe [55296 2012-01-17] () []
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [201008 2015-03-16] (Avira Operations GmbH & Co. KG)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) []
S2 MBAMService; E:\ Malwarebytes Anti-Malware \ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1320496 2013-04-08] (pdfforge GmbH)
R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [799280 2013-04-08] (pdfforge GmbH)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [66872 2009-05-22] ()
R2 SBSDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)
S3 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1229528 2013-12-06] (Secunia)
R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [662232 2013-12-06] (Secunia)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [383544 2008-01-21] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [14392 2007-12-17] ()
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2009-11-11] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [152744 2015-05-07] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132120 2015-05-07] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-26] (Avira Operations GmbH & Co. KG)
S3 ENTECH64; C:\Windows\system32\DRIVERS\ENTECH64.sys [12744 2008-09-17] (EnTech Taiwan)
R0 hotcore3; C:\Windows\System32\DRIVERS\hotcore3.sys [37392 2010-05-20] (Paragon Software Group)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2009-11-11] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2015-04-14] (Malwarebytes Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15680 2006-11-01] ()
S3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-12-06] (Secunia)
S3 RT73; C:\Windows\System32\DRIVERS\Dr71WU.sys [311296 2006-09-29] (Ralink Technology Inc.)
S3 s0016bus; C:\Windows\System32\DRIVERS\s0016bus.sys [115240 2008-05-16] (MCCI Corporation)
S3 s0016mdfl; C:\Windows\System32\DRIVERS\s0016mdfl.sys [19496 2008-05-16] (MCCI Corporation)
S3 s0016mdm; C:\Windows\System32\DRIVERS\s0016mdm.sys [158760 2008-05-16] (MCCI Corporation)
S3 s0016mgmt; C:\Windows\System32\DRIVERS\s0016mgmt.sys [137256 2008-05-16] (MCCI Corporation)
S3 s0016nd5; C:\Windows\System32\DRIVERS\s0016nd5.sys [34344 2008-05-16] (MCCI Corporation)
S3 s0016obex; C:\Windows\System32\DRIVERS\s0016obex.sys [136744 2008-05-16] (MCCI Corporation)
S3 s0016unic; C:\Windows\System32\DRIVERS\s0016unic.sys [151592 2008-05-16] (MCCI Corporation)
R3 seehcri; C:\Windows\System32\DRIVERS\seehcri.sys [34032 2008-01-09] (Sony Ericsson Mobile Communications)
S4 sptd; C:\Windows\System32\Drivers\sptd.sys [871408 2009-05-21] (Duplex Secure Ltd.)
R0 tdrpman251; C:\Windows\System32\DRIVERS\tdrpm251.sys [1455648 2009-12-17] (Acronis)
R2 {B154377D-700F-42cc-9474-23858FBDF4BD}; E:\PowerDVD\PowerDVD9\000.fcl [146928 2009-02-28] (CyberLink Corp.)
S3 ALSysIO; \??\C:\Users\SILVER~1\AppData\Local\Temp\ALSysIO64.sys [X]
S3 cpuz130; \??\C:\Users\SILVER~1\AppData\Local\Temp\cpuz130\cpuz_x64.sys [X]
S3 CrystalSysInfo; \??\E:\MediaCoder\SysInfoX64.sys [X]
S3 DIRECTIO; \??\C:\Program Files (x86)\BurnInTest\DirectIo.sys [X]
S3 GPU-Z; \??\C:\Users\SILVER~1\AppData\Local\Temp\GPU-Z.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S4 nvlddmkm; system32\DRIVERS\nvlddmkm.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S3 SANDRA; \??\E:\SiSoftware Sandra Lite 2009.SP3c\WNt500x64\Sandra.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-05-23 11:45 - 2015-05-23 11:45 - 00002254 _____ () C:\Users\Silverserver\Desktop\AdwCleaner[S1].txt
2015-05-23 11:33 - 2015-05-23 11:33 - 00001099 _____ () C:\Users\Silverserver\Desktop\Revo Uninstaller.lnk
2015-05-23 11:29 - 2015-05-23 11:29 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Silverserver\Desktop\revosetup95.exe
2015-05-23 10:35 - 2015-05-23 10:35 - 00001229 _____ () C:\Users\Silverserver\Desktop\Malwarebytes.txt
2015-05-23 10:14 - 2015-05-23 10:14 - 00004265 _____ () C:\Users\Silverserver\Desktop\Gmer.txt
2015-05-23 10:05 - 2015-05-23 10:06 - 00050770 _____ () C:\Users\Silverserver\Desktop\Addition.txt
2015-05-23 10:03 - 2015-05-23 11:51 - 00022555 _____ () C:\Users\Silverserver\Desktop\FRST.txt
2015-05-23 10:03 - 2015-05-23 10:03 - 00000000 ____D () C:\Users\Silverserver\Desktop\FRST-OlderVersion
2015-05-23 09:59 - 2015-05-23 09:59 - 00000596 _____ () C:\Users\Silverserver\Desktop\defogger_disable.log
2015-05-23 09:59 - 2015-05-23 09:59 - 00000020 _____ () C:\Users\Silverserver\defogger_reenable
2015-05-21 12:21 - 2015-05-23 10:03 - 02108416 _____ (Farbar) C:\Users\Silverserver\Desktop\FRST64.exe
2015-05-21 12:21 - 2015-05-21 12:21 - 00380416 _____ () C:\Users\Silverserver\Desktop\Gmer-19357.exe
2015-05-21 12:21 - 2015-05-21 12:21 - 00050477 _____ () C:\Users\Silverserver\Desktop\Defogger.exe
2015-05-18 11:45 - 2015-05-23 11:42 - 00000000 ____D () C:\AdwCleaner
2015-05-13 13:52 - 2015-04-19 23:24 - 01029120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10.dll
2015-05-13 13:52 - 2015-04-19 23:24 - 00219648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1core.dll
2015-05-13 13:52 - 2015-04-19 23:24 - 00189952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10core.dll
2015-05-13 13:52 - 2015-04-19 23:24 - 00160768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1.dll
2015-05-13 13:52 - 2015-04-19 22:19 - 01172480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2015-05-13 13:52 - 2015-04-19 22:18 - 00486400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10level9.dll
2015-05-13 13:52 - 2015-04-19 22:13 - 00682496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2015-05-13 13:52 - 2015-04-19 22:12 - 01072640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2015-05-13 13:52 - 2015-04-18 02:16 - 01268224 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll
2015-05-13 13:52 - 2015-04-18 02:16 - 00327680 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll
2015-05-13 13:52 - 2015-04-18 02:16 - 00287232 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll
2015-05-13 13:52 - 2015-04-18 02:16 - 00196096 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll
2015-05-13 13:52 - 2015-04-18 01:45 - 02002944 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2015-05-13 13:52 - 2015-04-18 01:44 - 00566272 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2015-05-13 13:52 - 2015-04-18 01:35 - 00834048 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2015-05-13 13:52 - 2015-04-18 01:33 - 01561088 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-05-13 13:52 - 2015-04-18 01:33 - 01154048 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-05-13 13:52 - 2015-04-18 01:30 - 02793472 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-05-13 13:44 - 2015-04-30 18:03 - 00279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-05-13 13:44 - 2015-04-30 17:41 - 00347648 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-05-13 13:41 - 2015-04-30 15:14 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 13:41 - 2015-04-30 15:14 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 13:41 - 2015-04-11 01:33 - 00384512 _____ (Microsoft Corporation) C:\Windows\system32\services.exe
2015-05-13 13:41 - 2015-04-11 01:22 - 00279552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\services.exe
2015-05-13 13:40 - 2015-04-10 02:10 - 17881088 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-05-13 13:40 - 2015-04-10 01:55 - 00448512 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-05-13 13:40 - 2015-04-10 01:53 - 10935808 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-05-13 13:40 - 2015-04-10 01:52 - 02339840 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-05-13 13:40 - 2015-04-10 01:48 - 01388032 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-05-13 13:40 - 2015-04-10 01:47 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-05-13 13:40 - 2015-04-10 01:46 - 02158080 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-05-13 13:40 - 2015-04-10 01:46 - 01494016 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-05-13 13:40 - 2015-04-10 01:46 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-05-13 13:40 - 2015-04-10 01:46 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-05-13 13:40 - 2015-04-10 01:46 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-05-13 13:40 - 2015-04-10 01:46 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-05-13 13:40 - 2015-04-10 01:46 - 00282112 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-05-13 13:40 - 2015-04-10 01:46 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2015-05-13 13:40 - 2015-04-10 01:46 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-05-13 13:40 - 2015-04-10 01:46 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-05-13 13:40 - 2015-04-10 01:45 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-05-13 13:40 - 2015-04-10 01:45 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-05-13 13:40 - 2015-04-10 01:45 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-05-13 13:40 - 2015-04-10 01:45 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2015-05-13 13:40 - 2015-04-10 01:45 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2015-05-13 13:40 - 2015-04-10 01:45 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2015-05-13 13:40 - 2015-04-10 01:14 - 12379136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-05-13 13:40 - 2015-04-10 01:10 - 01810944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-05-13 13:40 - 2015-04-10 01:08 - 09750528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-05-13 13:40 - 2015-04-10 01:08 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-05-13 13:40 - 2015-04-10 01:05 - 01139200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-05-13 13:40 - 2015-04-10 01:05 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-05-13 13:40 - 2015-04-10 01:04 - 01804288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-05-13 13:40 - 2015-04-10 01:04 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-05-13 13:40 - 2015-04-10 01:04 - 00421888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-05-13 13:40 - 2015-04-10 01:04 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2015-05-13 13:40 - 2015-04-10 01:04 - 00065024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-05-13 13:40 - 2015-04-10 01:03 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-05-13 13:40 - 2015-04-10 01:03 - 00718336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-05-13 13:40 - 2015-04-10 01:03 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-05-13 13:40 - 2015-04-10 01:03 - 00353792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-05-13 13:40 - 2015-04-10 01:03 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-05-13 13:40 - 2015-04-10 01:03 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-05-13 13:40 - 2015-04-10 01:03 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-05-13 13:40 - 2015-04-10 01:03 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-05-13 13:40 - 2015-04-10 01:03 - 00041472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2015-05-13 13:40 - 2015-04-10 01:03 - 00011776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2015-05-13 13:40 - 2015-04-10 01:03 - 00010752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2015-05-13 13:33 - 2015-05-13 13:33 - 00003886 _____ () C:\Windows\System32\Tasks\Adobe Acrobat Update Task

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-05-23 11:51 - 2014-06-15 11:58 - 00000000 ____D () C:\FRST
2015-05-23 11:50 - 2006-11-02 17:07 - 00000000 ___RD () C:\Users\Public\Recorded TV
2015-05-23 11:49 - 2009-11-21 00:08 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-05-23 11:49 - 2006-11-02 17:42 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-05-23 11:49 - 2006-11-02 17:22 - 00003712 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2015-05-23 11:49 - 2006-11-02 17:22 - 00003712 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2015-05-23 11:48 - 2008-01-21 03:53 - 01385071 _____ () C:\Windows\WindowsUpdate.log
2015-05-23 11:48 - 2006-11-02 17:42 - 00032628 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-05-23 11:40 - 2009-11-21 00:08 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-05-23 11:34 - 2008-01-21 13:10 - 01567488 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-05-23 11:34 - 2008-01-21 13:09 - 00674024 _____ () C:\Windows\system32\perfh007.dat
2015-05-23 11:34 - 2008-01-21 13:09 - 00146036 _____ () C:\Windows\system32\perfc007.dat
2015-05-23 11:33 - 2014-06-15 16:17 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2015-05-23 10:24 - 2014-06-15 16:36 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-05-23 09:59 - 2009-05-19 15:17 - 00000000 ____D () C:\Users\Silverserver
2015-05-21 18:55 - 2012-07-09 16:04 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-05-21 12:56 - 2012-07-09 16:04 - 00003736 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-05-21 12:56 - 2012-04-20 15:53 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-05-21 12:56 - 2011-05-18 18:21 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-05-21 12:13 - 2014-08-12 09:10 - 00000000 ____D () C:\Users\Silverserver\Desktop\KRD
2015-05-15 14:44 - 2014-06-15 16:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-05-15 14:35 - 2009-11-21 00:08 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-05-15 14:35 - 2009-11-21 00:08 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-05-13 14:29 - 2014-04-03 13:37 - 00288136 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-05-13 14:28 - 2013-01-31 17:32 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2015-05-13 14:27 - 2006-11-02 17:07 - 00000000 ____D () C:\Program Files\Windows Journal
2015-05-13 13:50 - 2013-07-11 21:48 - 00000000 ____D () C:\Windows\system32\MRT
2015-05-13 13:45 - 2006-11-02 14:35 - 140425016 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2015-05-13 13:41 - 2013-01-31 17:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-05-13 13:41 - 2006-11-02 17:07 - 00000000 ____D () C:\Windows\SysWOW64\XPSViewer
2015-05-13 13:33 - 2011-05-10 11:55 - 00002425 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
2015-05-07 17:14 - 2013-03-08 11:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-05-07 17:13 - 2013-04-02 22:50 - 00152744 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2015-05-07 17:13 - 2013-04-02 22:50 - 00132120 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2015-05-05 00:23 - 2014-10-16 16:10 - 00000000 ____D () C:\Users\Silverserver\AppData\Local\Battle.net
2015-04-27 22:47 - 2014-10-16 16:09 - 00000000 ____D () C:\Program Files (x86)\Battle.net

==================== Files in the root of some directories =======

2011-08-30 14:05 - 2011-08-30 14:05 - 0016009 _____ () C:\Users\Silverserver\AppData\Roaming\PStrip.bak
2011-08-30 14:05 - 2011-08-30 14:04 - 0016009 _____ () C:\Users\Silverserver\AppData\Roaming\PStrip.bk!
2011-08-30 14:03 - 2011-08-30 14:07 - 0016009 _____ () C:\Users\Silverserver\AppData\Roaming\PStrip.ini
2011-12-20 12:30 - 2011-12-20 12:30 - 0000680 _____ () C:\Users\Silverserver\AppData\Local\d3d9caps.dat
2009-05-19 15:17 - 2014-08-13 09:47 - 0002188 _____ () C:\Users\Silverserver\AppData\Local\d3d9caps64.dat
2009-06-06 00:26 - 2011-03-05 23:31 - 0192000 _____ () C:\Users\Silverserver\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2012-01-24 12:10 - 2012-01-24 12:10 - 0539764 _____ () C:\Users\Silverserver\AppData\Local\dd_ATL80SP1_KB973923MSI3897.txt
2012-01-24 12:10 - 2012-01-24 12:10 - 0011764 _____ () C:\Users\Silverserver\AppData\Local\dd_ATL80SP1_KB973923UI3897.txt
2009-05-26 19:35 - 2009-05-26 19:35 - 0028166 _____ () C:\Users\Silverserver\AppData\Local\dd_depcheckdotnetfx30.txt
2009-05-19 17:10 - 2009-05-19 17:10 - 0036116 _____ () C:\Users\Silverserver\AppData\Local\dd_depcheck_NETFX_EXP_35.txt
2009-05-19 17:10 - 2009-05-19 17:10 - 0000002 _____ () C:\Users\Silverserver\AppData\Local\dd_dotnetfx35error_lp.txt
2009-05-19 17:10 - 2009-05-19 17:10 - 0076428 _____ () C:\Users\Silverserver\AppData\Local\dd_dotnetfx35install_lp.txt
2009-05-26 19:35 - 2009-05-26 19:35 - 0000718 _____ () C:\Users\Silverserver\AppData\Local\dd_dotnetfx3error.txt
2009-05-26 19:35 - 2009-05-26 19:35 - 0032038 _____ () C:\Users\Silverserver\AppData\Local\dd_dotnetfx3install.txt
2009-05-19 17:10 - 2009-05-19 17:10 - 0812466 _____ () C:\Users\Silverserver\AppData\Local\dd_NET_Framework35_LangPack_MSI039E.txt
2012-12-27 12:50 - 2012-12-27 12:50 - 0356976 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistMSI0066.txt
2014-10-16 19:24 - 2014-10-16 19:24 - 0356808 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistMSI00D2.txt
2014-10-16 19:31 - 2014-10-16 19:31 - 0356338 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistMSI065F.txt
2013-09-29 14:32 - 2013-09-29 14:32 - 0356974 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistMSI0A75.txt
2011-07-30 16:08 - 2011-07-30 16:08 - 0457042 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistMSI1AF6.txt
2010-03-28 14:47 - 2010-03-28 14:48 - 0441838 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistMSI1E41.txt
2010-03-28 14:48 - 2010-03-28 14:48 - 0361368 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistMSI1EB4.txt
2009-06-19 01:29 - 2009-06-19 01:29 - 0420714 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistMSI29E3.txt
2014-10-16 20:19 - 2014-10-16 20:19 - 0355950 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistMSI2AFE.txt
2014-10-16 20:22 - 2014-10-16 20:22 - 0355186 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistMSI2D71.txt
2014-08-18 18:23 - 2014-08-18 18:24 - 0428158 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistMSI50E3.txt
2009-11-11 20:56 - 2009-11-11 20:56 - 0329228 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistMSI6861.txt
2014-08-18 18:55 - 2014-08-18 18:55 - 0391520 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistMSI6964.txt
2011-07-05 18:34 - 2011-07-05 18:34 - 0460608 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistMSI6993.txt
2011-07-29 14:09 - 2011-07-29 14:09 - 0435038 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistMSI7178.txt
2011-07-29 14:09 - 2011-07-29 14:09 - 0433970 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistMSI718C.txt
2014-09-07 13:03 - 2014-09-07 13:03 - 0383404 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistMSI768A.txt
2013-10-17 08:37 - 2013-10-17 08:37 - 0431000 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistMSI7925.txt
2012-12-27 12:50 - 2012-12-27 12:50 - 0011250 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistUI0066.txt
2014-10-16 19:24 - 2014-10-16 19:24 - 0011218 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistUI00D2.txt
2014-10-16 19:31 - 2014-10-16 19:31 - 0014322 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistUI065F.txt
2013-09-29 14:32 - 2013-09-29 14:32 - 0011250 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistUI0A75.txt
2011-07-30 16:08 - 2011-07-30 16:08 - 0011610 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistUI1AF6.txt
2010-03-28 14:47 - 2010-03-28 14:48 - 0011634 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistUI1E41.txt
2010-03-28 14:48 - 2010-03-28 14:48 - 0011370 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistUI1EB4.txt
2009-06-19 01:29 - 2009-06-19 01:29 - 0011442 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistUI29E3.txt
2014-10-16 20:19 - 2014-10-16 20:19 - 0014306 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistUI2AFE.txt
2014-10-16 20:22 - 2014-10-16 20:22 - 0017162 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistUI2D71.txt
2014-08-18 18:23 - 2014-08-18 18:24 - 0014206 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistUI50E3.txt
2009-11-11 20:56 - 2009-11-11 20:56 - 0011170 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistUI6861.txt
2014-08-18 18:55 - 2014-08-18 18:55 - 0011174 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistUI6964.txt
2011-07-05 18:34 - 2011-07-05 18:34 - 0011706 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistUI6993.txt
2011-07-29 14:09 - 2011-07-29 14:09 - 0011610 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistUI7178.txt
2011-07-29 14:09 - 2011-07-29 14:09 - 0011642 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistUI718C.txt
2014-09-07 13:03 - 2014-09-07 13:03 - 0012692 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistUI768A.txt
2013-10-17 08:37 - 2013-10-17 08:37 - 0015698 _____ () C:\Users\Silverserver\AppData\Local\dd_vcredistUI7925.txt
2011-11-30 16:26 - 2011-11-30 16:26 - 0004922 _____ () C:\Users\Silverserver\AppData\Local\HWVendorDetection.log
2009-05-19 17:10 - 2009-05-26 19:35 - 0003116 _____ () C:\Users\Silverserver\AppData\Local\uxeventlog.txt
2011-06-29 11:18 - 2011-06-29 11:19 - 0000000 _____ () C:\Users\Silverserver\AppData\Local\{B8116D6B-9B03-4E14-83C8-655639D154C6}
2009-09-02 15:11 - 2009-09-02 15:11 - 0148736 _____ (Avanquest Software) C:\ProgramData\hpeBCBE.dll
2009-05-20 10:13 - 2009-05-20 10:13 - 0008519 _____ () C:\ProgramData\xml5946.tmp
2009-05-20 10:13 - 2009-05-20 10:13 - 0013425 _____ () C:\ProgramData\xml5B3A.tmp
2009-05-20 10:13 - 2009-05-20 10:13 - 0001621 _____ () C:\ProgramData\xml5BF6.tmp

Files to move or delete:
====================
C:\ProgramData\hpeBCBE.dll


Some files in TEMP:
====================
C:\Users\Silverserver\AppData\Local\Temp\avgnt.exe
C:\Users\Silverserver\AppData\Local\Temp\Quarantine.exe
C:\Users\Silverserver\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-05-23 11:40

==================== End of log ============================
         

Hi,

Avira Echtzeitscanner deaktivieren.




Schritt 1

• Bitte lade Dir von hier Panda Cloud Cleaner herunter.
• Installiere das Programm und klicke auf Accept and Scan.
• Der Scan benötigt einige Zeit.
• Wenn der Scan beendet wurde, klicke bei einer der Fund-Rubriken auf >.
• Klicke dann auf "View Report" und poste mir das Log. Die Funde nicht löschen lassen!
• Schließe den Cloudcleaner.

So hier die Log Datei

PCloudCleaner

Suspicious Policy. POLICY: HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED[START_SHOWRECENTDOCS] to be changed to: 1Suspicious Policy. POLICY: HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED[START_SHOWRECENTDOCS] to be changed to: 1Malware. REGKEY: HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM[DISABLEREGISTRYTOOLS]. Value: DISABLEREGISTRYTOOLS To be deleted.Malware. REGKEY: HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM[DISABLETASKMGR]. Value: DISABLETASKMGR To be deleted.
         

Den Echtzeitscanner von Antivirus deaktiviert lassen?

Panda kannst Du wieder deinstallieren und Avira aktivieren.

Schritt 1



Drücke bitte die + R Taste und schreibe notepad in das Ausführen Fenster.
Klicke auf OK und kopiere nun den Text aus der Codebox in das leere Textdokument:

CloseProcesses:
Task: {67D138EF-E207-4D8D-9F0A-E3077C93086B} - \GoforFilesUpdate No Task File 
HKU\S-1-5-21-3728770155-2195705790-4138058334-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.startseite24.net
SearchScopes: HKLM -> {1C704259-9702-47AB-83C3-097AD8E55269} URL = hxxp://www.startseite24.net/?q={searchTerms}
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-3728770155-2195705790-4138058334-1000 -> {1C704259-9702-47AB-83C3-097AD8E55269} URL = hxxp://www.startseite24.net/?q={searchTerms}
FF SearchEngineOrder.1: Websuche
FF Keyword.URL: hxxp://www.startseite24.net/?q=
C:\ProgramData\hpeBCBE.dll
EmptyTemp:
         

Speichere dieses bitte als Fixlist.txt in das Verzeichnis ab, in dem sich auch die FRST-Anwendung befindet.

• Starte FRST und drücke auf den Fix-Button.
• Das Tool erstellt eine "Fixlog.txt" -Datei.
• Poste mir bitte deren Inhalt.

Gibts jetzt noch irgendwelche Auffälligkeiten oder Probleme?

Bisher traten keine probleme auf. Und auch sonst alles ok.

Hier die Fixlog

Fix result of Farbar Recovery Scan Tool (x64) Version: 22-05-2015 01
Ran by Silverserver at 2015-05-23 12:54:41 Run:1
Running from C:\Users\Silverserver\Desktop
Loaded Profiles: Silverserver (Available Profiles: Silverserver & UpdatusUser & Administrator)
Boot Mode: Normal
==============================================

fixlist content:
*****************
CloseProcesses:
Task: {67D138EF-E207-4D8D-9F0A-E3077C93086B} - \GoforFilesUpdate No Task File 
HKU\S-1-5-21-3728770155-2195705790-4138058334-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.startseite24.net
SearchScopes: HKLM -> {1C704259-9702-47AB-83C3-097AD8E55269} URL = hxxp://www.startseite24.net/?q={searchTerms}
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-3728770155-2195705790-4138058334-1000 -> {1C704259-9702-47AB-83C3-097AD8E55269} URL = hxxp://www.startseite24.net/?q={searchTerms}
FF SearchEngineOrder.1: Websuche
FF Keyword.URL: hxxp://www.startseite24.net/?q=
C:\ProgramData\hpeBCBE.dll
EmptyTemp:
         
*****************

Processes closed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{67D138EF-E207-4D8D-9F0A-E3077C93086B}" => key Removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{67D138EF-E207-4D8D-9F0A-E3077C93086B}" => key Removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GoforFilesUpdate" => key Removed successfully
HKU\S-1-5-21-3728770155-2195705790-4138058334-1000\Software\Microsoft\Internet Explorer\Main\\Start Page => Value restored successfully
"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{1C704259-9702-47AB-83C3-097AD8E55269}" => key Removed successfully
HKCR\CLSID\{1C704259-9702-47AB-83C3-097AD8E55269} => key not found. 
HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value Removed successfully
HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value Removed successfully
"HKU\S-1-5-21-3728770155-2195705790-4138058334-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{1C704259-9702-47AB-83C3-097AD8E55269}" => key Removed successfully
HKCR\CLSID\{1C704259-9702-47AB-83C3-097AD8E55269} => key not found. 
Firefox SearchEngineOrder.1 Removed successfully
Firefox Keyword.URL Removed successfully
C:\ProgramData\hpeBCBE.dll => Moved successfully.
EmptyTemp: => Removed 367.2 MB temporary data.


The system needed a reboot. 

==== End of Fixlog 12:55:01 ====
         

OK.

Java 7 Update 55 unbedingt deinstallieren und bei Bedarf mit der aktuellen Version ersetzen.

>>clean<<
Wir haben es geschafft!
Die Logs sehen für mich im Moment sauber aus.

Wenn Du möchtest, kannst Du hier sagen, ob Du mit mir und meiner Hilfe zufrieden warst...und/oder das Forum mit einer kleinen Spende unterstützen.
Es bleibt mir nur noch, Dir unbeschwertes und sicheres Surfen zu wünschen und dass wir uns hier so bald nicht wiedersehen.

Cleanup:
(Die Reihenfolge ist hier entscheidend)

Falls Defogger verwendet wurde: Erneut starten und auf Re-enable klicken.

Falls Combofix verwendet wurde:
Combofix deinstallieren

• Wichtig: Bitte Antivirus-Programm, evtl. vorhandenes Skript-Blocking und Anti-Malware Programme deaktivieren.
  
• Drücke bitte die + R Taste und schreibe Combofix /Uninstall in das Ausführen-Fenster.
• Klicke auf OK.
  Damit wird Combofix komplett entfernt und der Cache der Systemwiederherstellung geleert.
• Nun die eben deaktivierten Programme wieder aktivieren.

Alle Logs gepostet? Dann lade Dir bitte DelFix herunter.

• Schließe alle offenen Programme.
• Starte die delfix.exe mit einem Doppelklick.
• Setze vor jede Funktion ein Häkchen.
• Klicke auf Start.

Hinweis: DelFix entfernt u.a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
Starte Deinen Rechner abschließend neu. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein, kannst Du diese bedenkenlos löschen.



Absicherung:
Beim Betriebsystem Windows die automatischen Updates aktivieren. Auch die sicherheitsrelevante Software sollte immer nur in der aktuellsten Version vorliegen:

Browser
Java
Flash-Player
PDF-Reader

Sicherheitslücken in deren alten Versionen werden dazu ausgenutzt, um beim einfachen Besuch einer manipulierten Website per "Drive-by" Malware zu installieren.
Ich empfehle z.B. die Verwendung von Mozilla Firefox statt des Internet Explorers. Zudem lassen sich mit dem Firefox auch PDF-Dokumente öffnen.

Aktiviere eine Firewall. Die in Windows integrierte genügt im Normalfall völlig.

Verwende ein Antivirusprogramm mit Echtzeitscanner und stets aktueller Signaturendatenbank.

Meine Kauf-Empfehlung:


ESET Smart Security

Zusätzlich kannst Du Deinen PC regelmäßig mit Malwarebytes Anti-Malware scannen.

Optional:
NoScript verhindert das Ausführen von aktiven Inhalten (Java, JavaScript, Flash,...) für sämtliche Websites. Man kann aber nach dem Prinzip einer Whitelist festlegen, auf welchen Seiten Scripts erlaubt werden sollen.
Malwarebytes Anti Exploit: Schützt die Anwendungen des Computers vor der Ausnutzung bekannter Schwachstellen.


Lade Software von einem sauberen Portal wie .
Wähle beim Installieren von Software immer die benutzerdefinierte Option und entferne den Haken bei allen optional angebotenen Toolbars oder sonstigen, fürs Programm, irrelevanten Ergänzungen.
Um Adware wieder los zu werden, empfiehlt sich zunächst die Deinstallation sowie die anschließende Resteentfernung mit Adwcleaner .


Abschließend noch ein paar grundsätzliche Bemerkungen:
Ändere regelmäßig Deine wichtigen Online-Passwörter und erstelle regelmäßig Backups Deiner wichtigen Dateien oder des Systems.
Der Nutzen von Registry-Cleanern, Optimizern usw. zur Performancesteigerung ist umstritten. Ich empfehle deshalb, die Finger von der Registry zu lassen und lieber die windowseigene Datenträgerbereinigung zu verwenden.

Danke Jürgen. Alle Logs und Programme sind jetzt weg. Werd jetzt direkt ma ein Sytembackup machen.
Wünsch ich dir noch ein schönes Wochenende

Danke, wünsch ich Dir auch!