Windows 8: chromenotice.com in AboutUrls

southz · 01.06.2015, 10:41

Hallo,

ich suche verzweifelt nach Hilfe. Ich habe bereits mit diversen Tools versucht das system zu bereinigen, allerdings konnte ich nichts auffälliges außer Tracking Coockies finden. Doch mal von vorne:

Vor zwei Tagen entdechte ich in allen Browsern (IE, FF, Chrome) überschriebene Suchmaschinen, Startseiten etc. Diese aus den Browsern zu entfernen war kein Problem und die Gefahr schien gebannt. Eher zufällig fand ich die AboutUrls, also die eigenen Fehlerseiten von Chrome und IE überschrieben. Im IE beispielsweise die res://ieframe.dll/defaultbrowser.htm oder im Chrome die DNS_ERROR page. Die ieframe.dll habe ich mit virustotal scannen lassen und dort wurde keine Bedrohung in der Datei gefunden. Die Seiten sehen wie folgt aus:

Unter der Suchleiste befindent sich dann noch eine werbeeinblendung, die jetzt von AdBlock deaktiviert ist. Der HTML der Seite weist einen IFRAME auf, der auf chromenotice.com verweist

Ad-Aware_Report_Quick_Automatic_2015-05-30T12-01-54.764241.xml

Code:

ATTFilter

<?xml version="1.0"?>
<Summary>
	<ScanInfo ScanMode="Automatic" ScanType="Quick" StartTime="20150530T100001.764241" EndTime="20150530T100154.764241" />
	<InfectedObjects />
</Summary>

defogger_disable.log

Code:

ATTFilter

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 09:17 on 01/06/2015 (Administrator)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-

FRST.txt

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 29-05-2015
Ran by Administrator (administrator) on XXX-XXX on 01-06-2015 09:18:24
Running from C:\Users\Administrator\Desktop
Loaded Profiles: UpdatusUser & Administrator & MSSQL$SQLEXPRESS &  (Available Profiles: UpdatusUser & xxx & Administrator & MSSQL$SQLEXPRESS)
Platform: Windows 8.1 Pro (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Lenovo.) C:\Windows\System32\ibmpmsvc.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCore64.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Lenovo Corporation) C:\Program Files\Lenovo\Communications Utility\AVControlCenter32.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Lenovo Corporation) C:\Program Files\Lenovo\Communications Utility\avfaudiosw.exe
(Lenovo) C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBService.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Phone Tools\CoreCon\11.0\bin\IpOverUsbSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
() C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareService.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\SettingsDependency\SettingsService.exe
(LENOVO INCORPORATED.) C:\Program Files\Lenovo\SystemAgent\SystemAgentService.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\VIRTSCRL\lvvsst.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL11.SQLEXPRESS\MSSQL\Binn\sqlservr.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(Validity Sensors, Inc.) C:\Program Files\Lenovo Fingerprint Reader\ValBioService.exe
(Synaptics Incorporated) C:\Windows\System32\valWBFPolicyService.exe
(Synaptics Incorporated) C:\Windows\System32\valWbioSyncSvc.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\micmute.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tphkload.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Microsoft Corporation) C:\Windows\System32\alg.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynFP\Shared\SensorDBSynch.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\VIRTSCRL\virtscrl.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tpnumlkd.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tposd.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\shtctky.exe
(Validity Sensors, Inc.) C:\Program Files\Lenovo Fingerprint Reader\SwipeMonitor.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor Corp.) C:\Windows\RtsCM64.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\extapsup.exe
(Lenovo.) C:\Windows\System32\TpShocks.exe
(Lenovo) C:\Program Files\Lenovo\Lenovo Mobile Hotspot\MobileHotspotclient.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
() C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareTray.exe
(Lenovo) C:\Program Files\Lenovo\Lenovo Solution Center\LSCNotify.exe
(Lenovo) C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBConsole.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Wondershare) C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
() C:\Program Files (x86)\Hama Mouse Assistant\mouse_driver.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(LENOVO INCORPORATED.) C:\Program Files\Lenovo\QuickSnipService\QuickSnipService.exe
(Lenovo) C:\Program Files\Lenovo\QuickSnipService\QuickSnipInput.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Lenovo Corporation) C:\Program Files\Lenovo\Communications Utility\tpknrres.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Lenovo) C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.exe
(Microsoft Corporation) C:\Windows\System32\Taskmgr.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtsCM] => C:\WINDOWS\RTSCM64.EXE [140872 2013-03-21] (Realtek Semiconductor Corp.)
HKLM\...\Run: [LenovoOptMouseUpdate] => C:\Program Files\Lenovo\HOTKEY\extapsup.exe [255480 2013-06-20] (Lenovo Group Limited)
HKLM\...\Run: [TpShocks] => C:\WINDOWS\system32\TpShocks.exe [382248 2013-02-12] (Lenovo.)
HKLM\...\Run: [LnvMobHotspotClient] => C:\Program Files\Lenovo\Lenovo Mobile Hotspot\MobileHotspotclient.exe [938032 2014-03-05] (Lenovo)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2809072 2014-02-24] (Synaptics Incorporated)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [500208 2010-03-06] (Adobe Systems Incorporated)
HKLM\...\Run: [LMCSSTART1] => C:\WINDOWS\SysWOW64\lmcfrundll.exe C:\Program Files\Lenovo\Communications Utility\libmcsrdllb.dll,InitSubsystemProcesses
HKLM\...\Run: [LMCSSTART2] => C:\WINDOWS\SysWOW64\lmcfrundll.exe C:\Program Files\Lenovo\Communications Utility\libstartstub2.dll,ProxyStart
HKLM\...\Run: [LMCSSTART3] => C:\WINDOWS\SysWOW64\lmcfrundll.exe C:\Program Files\Lenovo\Communications Utility\libmcsrdllb.dll,SetupCamplusDrop
HKLM\...\Run: [] => [X]
HKLM\...\Run: [AdAwareTray] => C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareTray.exe [9566192 2015-03-10] ()
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [133440 2012-07-19] (Intel Corporation)
HKLM-x32\...\Run: [Fastboot] => C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBConsole.exe [738032 2014-02-13] (Lenovo)
HKLM-x32\...\Run: [AdobeCS5ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe [402432 2010-07-22] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-07-08] (Apple Inc.)
HKLM-x32\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [2072928 2014-10-31] (Wondershare)
HKLM-x32\...\Run: [Wondershare Helper Compact] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [2072928 2014-10-31] (Wondershare)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [uni mouse driver] => C:\Program Files (x86)\Hama Mouse Assistant\mouse_driver.exe [1634296 2015-04-13] ()
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-2292532964-2513414724-1275699273-1001\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3696912 2014-03-04] (Disc Soft Ltd)
HKU\S-1-5-21-2292532964-2513414724-1275699273-1001\...\Run: [Lync] => C:\Program Files (x86)\Microsoft Office\Office15\lync.exe [24010920 2015-04-22] (Microsoft Corporation)
HKU\S-1-5-21-2292532964-2513414724-1275699273-1001\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [516608 2014-10-29] (Microsoft Corporation)
HKU\S-1-5-21-2292532964-2513414724-1275699273-1001\...\Policies\system: [Wallpaper] \\xxx.jpg
HKU\S-1-5-21-2292532964-2513414724-1275699273-1001\...\Policies\system: [WallpaperStyle] 0
HKU\S-1-5-21-2292532964-2513414724-1275699273-1001\...\Policies\Explorer: [NoAutoTrayNotify] 1
HKU\S-1-5-21-2292532964-2513414724-1275699273-1001\...\Policies\Explorer: [NoStartMenuMyGames] 1
HKU\S-1-5-21-2292532964-2513414724-1275699273-1001\...\Policies\Explorer: [NoSMHelp] 1
HKU\S-1-5-21-2292532964-2513414724-1275699273-1001\...\Policies\Explorer: [NoStartMenuMyMusic] 1
HKU\S-1-5-21-2292532964-2513414724-1275699273-1001\...\MountPoints2: {1a45eb2b-e463-11e3-be8c-00c2c63a0efc} - "E:\autorun.exe" 
HKU\S-1-5-21-2292532964-2513414724-1275699273-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3696912 2014-03-04] (Disc Soft Ltd)
HKU\S-1-5-21-2292532964-2513414724-1275699273-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Lync] => C:\Program Files (x86)\Microsoft Office\Office15\lync.exe [24010920 2015-04-22] (Microsoft Corporation)
HKU\S-1-5-21-2292532964-2513414724-1275699273-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [516608 2014-10-29] (Microsoft Corporation)
HKU\S-1-5-21-2292532964-2513414724-1275699273-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Policies\system: [Wallpaper] \\xxx.jpg
HKU\S-1-5-21-2292532964-2513414724-1275699273-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Policies\system: [WallpaperStyle] 0
HKU\S-1-5-21-2292532964-2513414724-1275699273-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Policies\Explorer: [NoAutoTrayNotify] 1
HKU\S-1-5-21-2292532964-2513414724-1275699273-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Policies\Explorer: [NoStartMenuMyGames] 1
HKU\S-1-5-21-2292532964-2513414724-1275699273-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Policies\Explorer: [NoSMHelp] 1
HKU\S-1-5-21-2292532964-2513414724-1275699273-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Policies\Explorer: [NoStartMenuMyMusic] 1
HKU\S-1-5-21-2292532964-2513414724-1275699273-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {1a45eb2b-e463-11e3-be8c-00c2c63a0efc} - "E:\autorun.exe" 
HKU\S-1-5-21-2292532964-2513414724-1275699273-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3696912 2014-03-04] (Disc Soft Ltd)
HKU\S-1-5-21-2292532964-2513414724-1275699273-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Lync] => C:\Program Files (x86)\Microsoft Office\Office15\lync.exe [24010920 2015-04-22] (Microsoft Corporation)
HKU\S-1-5-21-2292532964-2513414724-1275699273-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Policies\system: [Wallpaper] \\xxx.jpg
HKU\S-1-5-21-2292532964-2513414724-1275699273-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Policies\system: [WallpaperStyle] 0
HKU\S-1-5-21-2292532964-2513414724-1275699273-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Policies\Explorer: [NoAutoTrayNotify] 1
HKU\S-1-5-21-2292532964-2513414724-1275699273-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Policies\Explorer: [NoStartMenuMyGames] 1
HKU\S-1-5-21-2292532964-2513414724-1275699273-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Policies\Explorer: [NoSMHelp] 1
HKU\S-1-5-21-2292532964-2513414724-1275699273-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Policies\Explorer: [NoStartMenuMyMusic] 1
HKU\S-1-5-21-2292532964-2513414724-1275699273-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {1a45eb2b-e463-11e3-be8c-00c2c63a0efc} - "E:\autorun.exe" 
HKU\S-1-5-21-2292532964-2513414724-1275699273-500\...\Run: [ooVoo] => C\ooVoo.exe /minimized
HKU\S-1-5-21-2292532964-2513414724-1275699273-500-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [ooVoo] => C\ooVoo.exe /minimized
HKU\S-1-5-21-919205647-830002367-3966930364-1135-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3696912 2014-03-04] (Disc Soft Ltd)
HKU\S-1-5-21-919205647-830002367-3966930364-1135-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Wondershare Helper Compact] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [2072928 2014-10-31] (Wondershare)
HKU\S-1-5-21-919205647-830002367-3966930364-1135-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8204056 2015-04-23] (Piriform Ltd)
HKU\S-1-5-21-919205647-830002367-3966930364-1135-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [SUPERAntiSpyware] => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [7799576 2015-05-15] (SUPERAntiSpyware)
HKU\S-1-5-21-919205647-830002367-3966930364-1135-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Policies\system: [Wallpaper] \\xxx.jpg
HKU\S-1-5-21-919205647-830002367-3966930364-1135-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Policies\system: [WallpaperStyle] 0
HKU\S-1-5-21-919205647-830002367-3966930364-1135-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Policies\Explorer: [NoAutoTrayNotify] 1
HKU\S-1-5-21-919205647-830002367-3966930364-1135-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Policies\Explorer: [NoStartMenuMyGames] 1
HKU\S-1-5-21-919205647-830002367-3966930364-1135-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Policies\Explorer: [NoSMHelp] 1
HKU\S-1-5-21-919205647-830002367-3966930364-1135-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Policies\Explorer: [NoStartMenuMyMusic] 1
HKU\S-1-5-21-919205647-830002367-3966930364-1135-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {1a45eb2b-e463-11e3-be8c-00c2c63a0efc} - "E:\autorun.exe" 
HKU\S-1-5-80-3880006512-4290199581-1648723128-3569869737-3631323133\...\Run: [ooVoo] => C\ooVoo.exe /minimized
HKU\S-1-5-80-3880006512-4290199581-1648723128-3569869737-3631323133\...\RunOnce: [Lenovo.ShowBand] => C:\Program Files\Lenovo\SimpleTap DeskBand\ShowBand.exe /show
HKU\S-1-5-80-3880006512-4290199581-1648723128-3569869737-3631323133-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [ooVoo] => C\ooVoo.exe /minimized
HKU\S-1-5-80-3880006512-4290199581-1648723128-3569869737-3631323133-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\RunOnce: [Lenovo.ShowBand] => C:\Program Files\Lenovo\SimpleTap DeskBand\ShowBand.exe /show
Startup: C:\Users\xxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2014-11-15]
ShortcutTarget: Dropbox.lnk -> C:\Users\Administrator\AppData\Roaming\Dropbox\bin\Dropbox.exe (No File)
Startup: C:\Users\xxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Send to OneNote.lnk [2014-10-20]
ShortcutTarget: Send to OneNote.lnk -> C:\Program Files (x86)\Microsoft Office\Office15\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\xxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Spamihilator.lnk [2015-05-02]
ShortcutTarget: Spamihilator.lnk -> C:\Program Files (x86)\Spamihilator\spamihilator.exe (Michel Krämer)
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: [SugarSyncBackedUp] -> {0C4A258A-3F3B-4FFF-80A7-9B3BEC139472} =>  No File
ShellIconOverlayIdentifiers: [SugarSyncPending] -> {62CCD8E3-9C21-41E1-B55E-1E26DFC68511} =>  No File
ShellIconOverlayIdentifiers: [SugarSyncRoot] -> {A759AFF6-5851-457D-A540-F4ECED148351} =>  No File
ShellIconOverlayIdentifiers: [SugarSyncShared] -> {1574C9EF-7D58-488F-B358-8B78C1538F51} =>  No File
ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File
BootExecute: autocheck autochk * sdnclean64.exe
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-2292532964-2513414724-1275699273-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-2292532964-2513414724-1275699273-1001\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.lenovo.com/welcome/thinkpad
HKU\S-1-5-21-2292532964-2513414724-1275699273-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com/welcome/thinkpad
HKU\S-1-5-21-2292532964-2513414724-1275699273-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-2292532964-2513414724-1275699273-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.lenovo.com/welcome/thinkpad
HKU\S-1-5-21-2292532964-2513414724-1275699273-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com/welcome/thinkpad
HKU\S-1-5-21-2292532964-2513414724-1275699273-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://lenovo13-comm.msn.com/?pc=LNJB
HKU\S-1-5-21-2292532964-2513414724-1275699273-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://lenovo13-comm.msn.com/?pc=LNJB
HKU\S-1-5-21-2292532964-2513414724-1275699273-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com/welcome/thinkpad
HKU\S-1-5-21-2292532964-2513414724-1275699273-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.lenovo.com/welcome/thinkpad
HKU\S-1-5-21-2292532964-2513414724-1275699273-500\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://lenovo13-comm.msn.com/?pc=LNJB
HKU\S-1-5-21-2292532964-2513414724-1275699273-500\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://lenovo13-comm.msn.com/?pc=LNJB
HKU\S-1-5-21-2292532964-2513414724-1275699273-500\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com/welcome/thinkpad
HKU\S-1-5-21-2292532964-2513414724-1275699273-500\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.lenovo.com/welcome/thinkpad
HKU\S-1-5-21-2292532964-2513414724-1275699273-500-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://lenovo13-comm.msn.com/?pc=LNJB
HKU\S-1-5-21-2292532964-2513414724-1275699273-500-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://lenovo13-comm.msn.com/?pc=LNJB
HKU\S-1-5-21-2292532964-2513414724-1275699273-500-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com/welcome/thinkpad
HKU\S-1-5-21-2292532964-2513414724-1275699273-500-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.lenovo.com/welcome/thinkpad
HKU\S-1-5-21-919205647-830002367-3966930364-1135-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
URLSearchHook: [S-1-5-21-919205647-830002367-3966930364-500-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0] ATTENTION ==> Default URLSearchHook is missing
URLSearchHook: [S-1-5-80-3880006512-4290199581-1648723128-3569869737-3631323133] ATTENTION ==> Default URLSearchHook is missing
URLSearchHook: [S-1-5-80-3880006512-4290199581-1648723128-3569869737-3631323133-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0] ATTENTION ==> Default URLSearchHook is missing
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-2292532964-2513414724-1275699273-1001 -> DefaultScope {498C203F-0D3C-4088-8FD6-A0E12820BB29} URL = 
SearchScopes: HKU\S-1-5-21-2292532964-2513414724-1275699273-1001 -> {498C203F-0D3C-4088-8FD6-A0E12820BB29} URL = 
SearchScopes: HKU\S-1-5-21-2292532964-2513414724-1275699273-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {498C203F-0D3C-4088-8FD6-A0E12820BB29} URL = 
SearchScopes: HKU\S-1-5-21-2292532964-2513414724-1275699273-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {498C203F-0D3C-4088-8FD6-A0E12820BB29} URL = 
SearchScopes: HKU\S-1-5-21-2292532964-2513414724-1275699273-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {498C203F-0D3C-4088-8FD6-A0E12820BB29} URL = 
SearchScopes: HKU\S-1-5-21-2292532964-2513414724-1275699273-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {498C203F-0D3C-4088-8FD6-A0E12820BB29} URL = 
SearchScopes: HKU\S-1-5-21-2292532964-2513414724-1275699273-500 -> {498C203F-0D3C-4088-8FD6-A0E12820BB29} URL = 
SearchScopes: HKU\S-1-5-21-2292532964-2513414724-1275699273-500-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {498C203F-0D3C-4088-8FD6-A0E12820BB29} URL = 
SearchScopes: HKU\S-1-5-21-919205647-830002367-3966930364-1135-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {498C203F-0D3C-4088-8FD6-A0E12820BB29} URL = 
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2015-03-31] (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre8\bin\ssv.dll [2014-05-22] (Oracle Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2015-04-14] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre8\bin\jp2ssv.dll [2014-05-22] (Oracle Corporation)
BHO-x32: ContributeBHO Class -> {074C1DC5-9320-4A9A-947D-C042949C6216} -> C:\Program Files (x86)\Adobe\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll [2010-03-27] (Adobe Systems, Inc.)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2015-03-31] (Microsoft Corporation)
BHO-x32: Microsoft Web Test Recorder 12.0 Helper -> {432dd630-7e03-4c97-9d62-b99f52df4fc2} -> C:\Program Files (x86)\Microsoft Visual Studio 12.0\Common7\IDE\PrivateAssemblies\Microsoft.VisualStudio.QualityTools.RecorderBarBHO100.dll [2013-10-05] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2014-10-15] (Oracle Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2015-04-14] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2014-10-15] (Oracle Corporation)
Toolbar: HKLM-x32 - Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files (x86)\Adobe\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll [2010-03-27] (Adobe Systems, Inc.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 10.0.0.138

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_17_0_0_169.dll [2015-04-20] ()
FF Plugin: @java.com/DTPlugin,version=11.5.2 -> C:\Program Files\Java\jre8\bin\dtplugin\npDeployJava1.dll [2014-05-22] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.5.2 -> C:\Program Files\Java\jre8\bin\plugin2\npjp2.dll [2014-05-22] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-04-20] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-02-21] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-06-07] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-06-07] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll [2014-10-15] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2014-10-15] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2015-03-31] (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MIF5BA~1\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-16] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-16] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-05-01] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-919205647-830002367-3966930364-1135-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0: @citrix.com/CitrixOmegaPlugin -> C:\Users\xxx\AppData\Roaming\Citrix\CitrixOmegaPlugin\0.1.0.84\npCitrixOmegaPlugin.dll [2013-11-07] (Citrix)
FF Plugin HKU\S-1-5-21-919205647-830002367-3966930364-1135-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0: @citrixonline.com/appdetectorplugin -> C:\Users\xxx\AppData\Local\Citrix\Plugins\104\npappdetector.dll [2014-11-10] (Citrix Online)
FF Plugin HKU\S-1-5-21-919205647-830002367-3966930364-1135-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\xxx\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2014-02-20] (Unity Technologies ApS)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2015-03-31] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2015-05-01] (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}] - C:\Program Files (x86)\Adobe\Adobe Contribute CS5\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}
FF Extension: Adobe Contribute Toolbar - C:\Program Files (x86)\Adobe\Adobe Contribute CS5\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9} [2014-05-09]

Chrome: 
=======
CHR Profile: C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-05-31]
CHR Extension: (Google Drive) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-05-31]
CHR Extension: (YouTube) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-05-31]
CHR Extension: (Google Search) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-05-31]
CHR Extension: (Bookmark Manager) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik [2015-06-01]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-06-01]
CHR Extension: (Google Wallet) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-06-01]
CHR Extension: (Gmail) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-05-31]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [172344 2014-07-23] (SUPERAntiSpyware.com)
R2 AVControlCenter; C:\Program Files\Lenovo\Communications Utility\AVControlCenter32.exe [560584 2015-01-21] (Lenovo Corporation)
S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-10-29] (Microsoft Corporation)
S3 c2wts; C:\Program Files\Windows Identity Foundation\v3.5\c2wtshost.exe [5632 2014-05-08] (Microsoft Corporation)
R2 FastbootService; C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBService.exe [140016 2014-02-13] (Lenovo)
S3 fussvc; C:\Program Files (x86)\Windows Kits\8.1\App Certification Kit\fussvc.exe [142336 2014-02-20] (Microsoft Corporation) [File not signed]
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-07-19] (Intel Corporation)
S3 intelsba; C:\Program Files\Intel\Intel(R) Small Business Advantage\Service\Intel.SmallBusinessAdvantage.WindowsService.exe [48832 2013-04-10] (Intel Corporation)
R2 IpOverUsbSvc; C:\Program Files (x86)\Common Files\Microsoft Shared\Phone Tools\CoreCon\11.0\bin\IpOverUsbSvc.exe [22744 2014-10-15] (Microsoft Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-07-19] (Intel Corporation)
R2 LavasoftAdAwareService11; C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareService.exe [720760 2015-03-10] ()
R2 Lenovo QuickSnip Service; C:\Program Files\lenovo\QuickSnipService\QuickSnipService.exe [219976 2013-06-05] (LENOVO INCORPORATED.)
R2 Lenovo Settings Service; C:\Program Files\Lenovo\SettingsDependency\SettingsService.exe [2016472 2015-01-23] (Lenovo Group Limited)
R2 Lenovo System Agent Service; C:\Program Files\lenovo\SystemAgent\SystemAgentService.exe [562504 2013-06-05] (LENOVO INCORPORATED.)
S3 LENOVO.TVTVCAM; C:\Program Files\Lenovo\Communications Utility\vcamsvc.exe [626120 2015-01-21] (Lenovo Corporation)
R2 Lenovo.VIRTSCRLSVC; C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe [136288 2012-08-10] (Lenovo Group Limited)
S2 LnvHotSpotSvc; C:\Program Files\Lenovo\Lenovo Mobile Hotspot\LnvHotSpotSvc.exe [474160 2014-03-05] (Lenovo)
S4 LocationTaskManager; C:\Program Files (x86)\Lenovo\LocationAware\loctaskmgr.exe [470064 2014-03-10] ()
S3 LSCWinService; C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCWinService.exe [272440 2015-03-09] (Lenovo)
R2 MSSQL$SQLEXPRESS; c:\Program Files\Microsoft SQL Server\MSSQL11.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [191064 2012-02-11] (Microsoft Corporation)
S4 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273136 2013-08-28] ()
R2 Net Driver HPZ12; C:\Windows\System32\HPZinw12.dll [50688 2013-05-16] (Hewlett-Packard) [File not signed]
S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [1903472 2015-01-09] (Electronic Arts)
S3 OverwolfUpdater; C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe [999152 2015-05-04] (Overwolf LTD)
R2 Pml Driver HPZ12; C:\Windows\System32\HPZipm12.dll [66048 2013-05-16] (Hewlett-Packard) [File not signed]
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
S4 SQLAgent$SQLEXPRESS; c:\Program Files\Microsoft SQL Server\MSSQL11.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [597080 2012-02-11] (Microsoft Corporation)
S4 SUService; C:\Program Files (x86)\Lenovo\System Update\SUService.exe [24560 2014-06-18] ()
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
S3 Te.Service; C:\Program Files (x86)\Windows Kits\8.1\Testing\Runtimes\TAEF\Wex.Services.exe [119808 2013-08-22] (Microsoft Corporation) [File not signed]
R2 ValBioService; C:\Program Files\Lenovo Fingerprint Reader\ValBioService.exe [23600 2013-03-20] (Validity Sensors, Inc.)
R2 valWBFPolicyService; C:\Windows\system32\valWBFPolicyService.exe [49040 2014-07-21] (Synaptics Incorporated)
R2 valWbioSyncSvc; C:\Windows\system32\valWbioSyncSvc.exe [32256 2014-07-21] (Synaptics Incorporated)
S3 VsEtwService120; C:\Program Files\Microsoft Visual Studio 12.0\Common7\Packages\Debugger\Services\VsEtwService.exe [89232 2014-07-22] (Microsoft Corporation)
S3 wampapache64; c:\wamp\bin\apache\apache2.4.9\bin\httpd.exe [24576 2014-05-01] (Apache Software Foundation) [File not signed]
S3 wampmysqld64; c:\wamp\bin\mysql\mysql5.6.17\bin\mysqld.exe [12942848 2014-05-01] () [File not signed]
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-04] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-04] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3378416 2013-08-28] (Intel® Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2014-09-05] ()
R3 avc3; C:\Windows\System32\DRIVERS\avc3.sys [727592 2015-01-06] (BitDefender)
R3 avchv; C:\Windows\system32\DRIVERS\avchv.sys [261496 2015-01-06] (BitDefender)
R3 avckf; C:\Windows\System32\DRIVERS\avckf.sys [601360 2015-01-06] (BitDefender)
R1 BdfNdisf; C:\Program Files\Lavasoft\Ad-Aware Antivirus\Firewall Engine\1.6.0.0\Drivers\bdfndisf6.sys [97816 2015-01-06] (BitDefender LLC)
R1 bdfwfpf; C:\Program Files\Lavasoft\Ad-Aware Antivirus\Firewall Engine\1.6.0.0\Drivers\bdfwfpf.sys [107080 2015-01-06] (BitDefender LLC)
S3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-03-18] (Microsoft Corporation)
R1 dtsoftbus01; C:\Windows\System32\drivers\dtsoftbus01.sys [283064 2014-05-29] (Disc Soft Ltd)
R2 Ext2Fsd; C:\WINDOWS\system32\Drivers\Ext2Fsd.sys [771224 2014-08-26] (www.ext2fsd.com)
R0 Fastboot; C:\Windows\System32\DRIVERS\fastboot.sys [66288 2014-02-13] (Windows (R) Win 7 DDK provider)
R3 gzflt; C:\Program Files\Lavasoft\Ad-Aware Antivirus\Antimalware Engine\3.0.98.0\gzflt.sys [155912 2015-01-22] (BitDefender LLC)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2014-09-05] ()
S3 LUMDriver; C:\WINDOWS\system32\drivers\LUMDriver.sys [24848 2008-01-02] (IBM)
S3 mbamchameleon; C:\WINDOWS\system32\drivers\mbamchameleon.sys [107736 2015-05-30] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [136408 2015-06-01] (Malwarebytes Corporation)
R3 NETwNe64; C:\Windows\system32\DRIVERS\Netwew00.sys [3345376 2013-10-08] (Intel Corporation)
S4 RsFx0200; C:\Windows\System32\DRIVERS\RsFx0200.sys [334936 2012-02-11] (Microsoft Corporation)
R3 RSP2STOR; C:\Windows\system32\DRIVERS\RtsP2Stor.sys [288840 2013-05-16] (Realtek Semiconductor Corp.)
R3 rtsuvc; C:\Windows\system32\DRIVERS\rtsuvc.sys [8243272 2013-03-21] (Realtek Semiconductor Corp.)
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R3 SensorsSimulatorDriver; C:\Windows\system32\DRIVERS\WUDFRd.sys [226304 2014-10-29] (Microsoft Corporation)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [31472 2014-02-24] (Synaptics Incorporated)
R1 SMIDriver; C:\Windows\System32\drivers\smi.sys [19760 2014-07-21] (Windows (R) Win 7 DDK provider)
S3 SWIX64; C:\Program Files (x86)\Lenovo\System Update\tvsuhd64.sys [33856 2012-09-12] (Lenovo Group Limited)
S3 Trufos; C:\Windows\System32\DRIVERS\Trufos.sys [452040 2015-01-22] (BitDefender S.R.L.)
R3 usb3Hub; C:\Windows\System32\drivers\usb3Hub.sys [47072 2012-11-29] (Windows (R) Win 7 DDK provider)
S3 VBoxUSB; C:\Windows\System32\Drivers\VBoxUSB.sys [115488 2014-03-26] (Oracle Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-04] (Microsoft Corporation)
R3 XHCIPort; C:\Windows\System32\drivers\XHCIPort.sys [188896 2012-11-29] (Windows (R) Win 7 DDK provider)
S3 btmhsf; \SystemRoot\system32\DRIVERS\btmhsf.sys [X]
S3 iBtFltCoex; \SystemRoot\system32\DRIVERS\iBtFltCoex.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-06-01 09:18 - 2015-06-01 09:19 - 00042558 _____ () C:\Users\Administrator\Desktop\FRST.txt
2015-06-01 09:18 - 2015-06-01 09:18 - 00000000 ____D () C:\FRST
2015-06-01 09:17 - 2015-06-01 09:17 - 00000488 _____ () C:\Users\Administrator\Desktop\defogger_disable.log
2015-06-01 09:17 - 2015-06-01 09:17 - 00000000 _____ () C:\Users\Administrator\defogger_reenable
2015-06-01 09:16 - 2015-06-01 09:03 - 00380416 _____ () C:\Users\Administrator\Desktop\u0ysquyh.exe
2015-06-01 09:16 - 2015-06-01 09:02 - 02108928 _____ (Farbar) C:\Users\Administrator\Desktop\FRST64.exe
2015-06-01 09:16 - 2015-06-01 08:57 - 00050477 _____ () C:\Users\Administrator\Desktop\Defogger.exe
2015-06-01 09:03 - 2015-06-01 09:03 - 00380416 _____ () C:\Users\Administrator\Downloads\u0ysquyh.exe
2015-06-01 09:02 - 2015-06-01 09:02 - 02108928 _____ (Farbar) C:\Users\Administrator\Downloads\FRST64.exe
2015-06-01 08:57 - 2015-06-01 08:57 - 00050477 _____ () C:\Users\Administrator\Downloads\Defogger.exe
2015-06-01 08:29 - 2015-06-01 09:17 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Notepad++
2015-06-01 08:22 - 2015-06-01 09:15 - 00000000 ____D () C:\Users\Administrator\AppData\Local\CrashDumps
2015-06-01 08:17 - 2015-06-01 08:22 - 00000000 ____D () C:\Users\Administrator\Downloads\ResEdit-x64
2015-06-01 08:15 - 2015-06-01 08:15 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\WinRAR
2015-06-01 08:14 - 2015-06-01 08:14 - 00603437 _____ () C:\Users\Administrator\Downloads\ResEdit-x64.7z
2015-06-01 08:08 - 2015-06-01 08:08 - 00000000 ____D () C:\Users\Administrator\Desktop\mbar
2015-06-01 08:00 - 2015-06-01 08:00 - 00003958 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{A9CEAD6E-28E3-4785-B978-F6E8FB34FD93}
2015-06-01 08:00 - 2015-06-01 08:00 - 00000000 __SHD () C:\Users\Administrator\AppData\Local\EmieUserList
2015-06-01 08:00 - 2015-06-01 08:00 - 00000000 __SHD () C:\Users\Administrator\AppData\Local\EmieSiteList
2015-06-01 08:00 - 2015-06-01 08:00 - 00000000 __SHD () C:\Users\Administrator\AppData\Local\EmieBrowserModeList
2015-06-01 07:59 - 2015-06-01 07:59 - 00000000 ____D () C:\WINDOWS\system32\LSC
2015-06-01 07:55 - 2015-06-01 08:02 - 00003596 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2292532964-2513414724-1275699273-500
2015-06-01 07:55 - 2015-06-01 07:55 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Lenovo
2015-06-01 07:52 - 2015-06-01 07:53 - 00000192 _____ () C:\Users\Administrator\AppData\Local\RegisteredPackageInformation.xml
2015-06-01 07:51 - 2015-06-01 07:51 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Apple Computer
2015-06-01 07:51 - 2015-06-01 07:51 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Wondershare
2015-06-01 07:50 - 2015-06-01 07:50 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Adobe
2015-06-01 07:49 - 2015-06-01 07:51 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Adobe
2015-06-01 07:49 - 2015-06-01 07:49 - 00001461 _____ () C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-06-01 07:49 - 2015-06-01 07:49 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Intel
2015-05-31 19:46 - 2015-05-31 19:51 - 00125362 _____ () C:\search.txt
2015-05-31 19:43 - 2015-05-31 19:43 - 00001224 _____ () C:\Users\Administrator\Desktop\cmd.lnk
2015-05-31 19:36 - 2015-05-31 19:36 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Google
2015-05-31 18:56 - 2015-06-01 07:54 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Packages
2015-05-31 18:55 - 2015-06-01 09:17 - 00000000 ____D () C:\Users\Administrator
2015-05-31 18:55 - 2015-05-31 18:55 - 00000020 ___SH () C:\Users\Administrator\ntuser.ini
2015-05-31 18:55 - 2015-05-31 18:55 - 00000000 _SHDL () C:\Users\Administrator\Vorlagen
2015-05-31 18:55 - 2015-05-31 18:55 - 00000000 _SHDL () C:\Users\Administrator\Startmenü
2015-05-31 18:55 - 2015-05-31 18:55 - 00000000 _SHDL () C:\Users\Administrator\Netzwerkumgebung
2015-05-31 18:55 - 2015-05-31 18:55 - 00000000 _SHDL () C:\Users\Administrator\Lokale Einstellungen
2015-05-31 18:55 - 2015-05-31 18:55 - 00000000 _SHDL () C:\Users\Administrator\Eigene Dateien
2015-05-31 18:55 - 2015-05-31 18:55 - 00000000 _SHDL () C:\Users\Administrator\Druckumgebung
2015-05-31 18:55 - 2015-05-31 18:55 - 00000000 _SHDL () C:\Users\Administrator\Documents\Eigene Musik
2015-05-31 18:55 - 2015-05-31 18:55 - 00000000 _SHDL () C:\Users\Administrator\Documents\Eigene Bilder
2015-05-31 18:55 - 2015-05-31 18:55 - 00000000 _SHDL () C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2015-05-31 18:55 - 2015-05-31 18:55 - 00000000 _SHDL () C:\Users\Administrator\AppData\Local\Verlauf
2015-05-31 18:55 - 2015-05-31 18:55 - 00000000 _SHDL () C:\Users\Administrator\AppData\Local\Anwendungsdaten
2015-05-31 18:55 - 2015-05-31 18:55 - 00000000 _SHDL () C:\Users\Administrator\Anwendungsdaten
2015-05-31 18:55 - 2015-03-16 10:38 - 00000000 ___RD () C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2015-05-31 18:55 - 2015-03-08 02:36 - 00000000 ____D () C:\Users\Administrator\Documents\Visual Studio 2008
2015-05-31 18:55 - 2015-03-04 13:41 - 00000000 ___RD () C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2015-05-31 18:55 - 2015-03-04 13:41 - 00000000 ___RD () C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2015-05-31 18:55 - 2014-08-15 03:50 - 00000000 ____D () C:\Users\Administrator\Documents\Visual Studio 2013
2015-05-31 18:55 - 2014-07-05 05:50 - 00000000 ____D () C:\Users\Administrator\Documents\Visual Studio 2010
2015-05-31 18:55 - 2014-05-10 00:44 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Microsoft Help
2015-05-31 18:55 - 2014-05-07 12:41 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Macromedia
2015-05-31 18:55 - 2014-03-18 12:11 - 00000369 _____ () C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pictures.lnk
2015-05-31 18:55 - 2014-03-18 12:11 - 00000369 _____ () C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Documents.lnk
2015-05-31 18:55 - 2013-12-11 18:40 - 00002092 _____ () C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Update Search.lnk
2015-05-31 18:55 - 2013-08-22 17:36 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2015-05-31 18:55 - 2013-01-14 20:58 - 00001599 _____ () C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\LenovoToast.lnk
2015-05-30 18:36 - 2015-05-30 18:36 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-05-30 18:35 - 2015-06-01 08:10 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-05-30 18:35 - 2015-06-01 08:09 - 00136408 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-05-30 18:29 - 2015-05-30 18:35 - 00107736 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2015-05-30 18:28 - 2015-05-30 18:28 - 16502728 _____ (Malwarebytes Corp.) C:\Users\xxx\Downloads\mbar-1.09.1.1004.exe
2015-05-30 18:28 - 2015-05-30 18:28 - 00000000 ____D () C:\Users\xxx\Desktop\mbar
2015-05-30 14:28 - 2015-05-30 15:10 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2015-05-30 14:28 - 2015-05-30 14:31 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2015-05-30 14:28 - 2015-05-30 14:28 - 00001414 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2015-05-30 14:28 - 2015-05-30 14:28 - 00001402 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2015-05-30 14:28 - 2015-05-30 14:28 - 00000000 ____D () C:\WINDOWS\System32\Tasks\Safer-Networking
2015-05-30 14:28 - 2015-05-30 14:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2015-05-30 14:28 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\WINDOWS\system32\sdnclean64.exe
2015-05-30 10:45 - 2015-05-30 10:47 - 46525608 _____ (Safer-Networking Ltd. ) C:\Users\xxx\Downloads\spybot-2.4.exe
2015-05-30 10:41 - 2015-05-30 10:41 - 01121785 _____ () C:\Users\xxx\Downloads\ProcessExplorer.zip
2015-05-30 10:41 - 2015-05-30 10:41 - 00000000 ____D () C:\Users\xxx\Downloads\ProcessExplorer
2015-05-29 17:49 - 2015-05-29 17:50 - 09437184 _____ () C:\Users\xxx\Downloads\msert.exe
2015-05-29 17:25 - 2015-05-29 17:25 - 00002242 _____ () C:\WINDOWS\PFRO.log
2015-05-29 17:19 - 2015-05-29 17:19 - 00000000 ____D () C:\ProgramData\BitDefender
2015-05-29 17:09 - 2015-06-01 07:48 - 00002356 _____ () C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk
2015-05-29 17:09 - 2015-05-29 17:09 - 00000000 ____D () C:\Users\xxx\AppData\Roaming\LavasoftStatistics
2015-05-29 17:09 - 2015-05-29 17:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft
2015-05-29 17:09 - 2015-01-06 12:47 - 01061776 _____ (BitDefender S.R.L.) C:\WINDOWS\system32\bdsmtpp.dll
2015-05-29 17:09 - 2015-01-06 12:47 - 00209984 _____ (BitDefender) C:\WINDOWS\system32\BdFirewallSDK.dll
2015-05-29 17:09 - 2015-01-06 12:47 - 00195016 _____ (BitDefender) C:\WINDOWS\system32\httproxy.dll
2015-05-29 17:09 - 2015-01-06 12:47 - 00156936 _____ () C:\WINDOWS\system32\bdfwcore.dll
2015-05-29 17:09 - 2015-01-06 12:47 - 00155912 _____ (BitDefender S.R.L.) C:\WINDOWS\system32\bdpop3p.dll
2015-05-29 17:09 - 2015-01-06 12:47 - 00122928 _____ (BitDefender) C:\WINDOWS\system32\OEMbdpredir.dll
2015-05-29 17:09 - 2015-01-06 12:47 - 00096160 _____ (BitDefender) C:\WINDOWS\system32\bdpredir.dll
2015-05-29 17:09 - 2015-01-06 12:37 - 02084072 _____ (Bitdefender) C:\WINDOWS\system32\bdnc.dll
2015-05-29 17:07 - 2015-06-01 07:59 - 00002353 _____ () C:\WINDOWS\setupact.log
2015-05-29 17:07 - 2015-05-29 17:07 - 00000000 ____H () C:\WINDOWS\system32\Drivers\Msft_Kernel_avchv_01009.Wdf
2015-05-29 17:07 - 2015-05-29 17:07 - 00000000 _____ () C:\WINDOWS\setuperr.log
2015-05-29 17:06 - 2015-05-29 17:06 - 00000000 ____D () C:\Program Files\Lavasoft
2015-05-29 17:05 - 2015-05-29 17:05 - 00000000 ____D () C:\Users\xxx\AppData\Roaming\Lavasoft
2015-05-29 17:04 - 2015-06-01 08:47 - 01025142 _____ () C:\WINDOWS\WindowsUpdate.log
2015-05-29 17:04 - 2015-05-29 17:04 - 00000000 ____D () C:\ProgramData\Lavasoft
2015-05-29 17:04 - 2015-05-29 17:04 - 00000000 ____D () C:\Program Files\Common Files\Lavasoft
2015-05-29 17:03 - 2015-05-29 17:03 - 00258628 _____ () C:\Users\xxx\Documents\cc_20150529_170316.reg
2015-05-29 16:00 - 2015-05-29 16:01 - 02057008 _____ () C:\Users\xxx\Downloads\Adaware_Installer.exe
2015-05-29 15:56 - 2015-05-29 15:57 - 06549184 _____ (Piriform Ltd) C:\Users\xxx\Downloads\ccsetup506.exe
2015-05-29 14:55 - 2015-05-29 14:55 - 00000000 ____D () C:\SUPERDelete
2015-05-29 14:54 - 2015-05-30 02:00 - 00000532 _____ () C:\WINDOWS\Tasks\SUPERAntiSpyware Scheduled Task dfc0f345-4c50-4aee-adb1-b2fff5208f26.job
2015-05-29 14:54 - 2015-05-29 22:54 - 00000532 _____ () C:\WINDOWS\Tasks\SUPERAntiSpyware Scheduled Task ab70ba7d-3101-4914-adbd-0bdd19f63ea1.job
2015-05-29 14:54 - 2015-05-29 14:54 - 00003590 _____ () C:\WINDOWS\System32\Tasks\SUPERAntiSpyware Scheduled Task dfc0f345-4c50-4aee-adb1-b2fff5208f26
2015-05-29 14:54 - 2015-05-29 14:54 - 00003508 _____ () C:\WINDOWS\System32\Tasks\SUPERAntiSpyware Scheduled Task ab70ba7d-3101-4914-adbd-0bdd19f63ea1
2015-05-29 14:54 - 2015-05-29 14:54 - 00000000 ____D () C:\Users\xxx\AppData\Roaming\SUPERAntiSpyware.com
2015-05-29 14:53 - 2015-05-30 18:24 - 00000000 ____D () C:\Program Files\SUPERAntiSpyware
2015-05-29 14:53 - 2015-05-29 14:53 - 00001831 _____ () C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
2015-05-29 14:53 - 2015-05-29 14:53 - 00000000 ____D () C:\ProgramData\SUPERAntiSpyware.com
2015-05-29 14:53 - 2015-05-29 14:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware
2015-05-29 14:50 - 2015-05-29 14:51 - 22078544 _____ (SUPERAntiSpyware) C:\Users\xxx\Downloads\SUPERAntiSpyware.exe
2015-05-29 11:38 - 2015-05-29 14:20 - 00000000 ____D () C:\AdwCleaner
2015-05-29 11:38 - 2015-05-29 11:38 - 02223104 _____ () C:\Users\xxx\Downloads\adwcleaner_4.205.exe
2015-05-29 11:13 - 2015-05-29 11:13 - 00000000 ____D () C:\Users\xxx\AppData\Roaming\WinZipper
2015-05-27 14:08 - 2015-05-27 14:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mouse driver
2015-05-27 14:08 - 2015-05-27 14:08 - 00000000 ____D () C:\Program Files (x86)\Hama Mouse Assistant
2015-05-27 11:21 - 2015-05-27 11:21 - 00000297 _____ () C:\Users\xxx\Desktop\temp.txt
2015-05-17 14:13 - 2015-05-17 14:13 - 00000000 ____D () C:\Users\xxx\AppData\Local\CrashRpt
2015-05-16 16:52 - 2015-05-05 19:59 - 00792568 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2015-05-16 16:52 - 2015-05-05 19:59 - 00178168 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2015-05-15 15:23 - 2015-05-29 11:13 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-05-13 16:43 - 2015-04-30 22:35 - 00124112 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 16:43 - 2015-04-30 22:35 - 00102608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 13:20 - 2015-04-10 02:34 - 02256896 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll
2015-05-13 13:20 - 2015-04-10 02:11 - 01943040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll
2015-05-13 13:20 - 2015-03-17 19:26 - 00467776 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBHUB3.SYS
2015-05-13 13:20 - 2015-03-09 04:02 - 00057856 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthhfenum.sys
2015-05-13 13:19 - 2015-05-01 01:05 - 00429568 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll
2015-05-13 13:19 - 2015-05-01 00:48 - 00358912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll
2015-05-13 13:19 - 2015-04-14 00:48 - 04180480 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2015-05-13 13:19 - 2015-04-10 03:00 - 01996800 _____ (Microsoft Corporation) C:\WINDOWS\system32\DWrite.dll
2015-05-13 13:19 - 2015-04-10 02:50 - 01387008 _____ (Microsoft Corporation) C:\WINDOWS\system32\FntCache.dll
2015-05-13 13:19 - 2015-04-10 02:26 - 01560576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DWrite.dll
2015-05-13 13:19 - 2015-04-09 00:55 - 00410128 _____ (Microsoft Corporation) C:\WINDOWS\system32\services.exe
2015-05-13 13:19 - 2015-04-03 02:35 - 00445440 _____ (Microsoft Corporation) C:\WINDOWS\system32\PhotoMetadataHandler.dll
2015-05-13 13:19 - 2015-04-03 02:14 - 00364544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PhotoMetadataHandler.dll
2015-05-13 13:19 - 2015-04-02 00:22 - 02985984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbgeng.dll
2015-05-13 13:19 - 2015-04-02 00:20 - 04417536 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbgeng.dll
2015-05-13 13:19 - 2015-04-01 05:45 - 01491456 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbghelp.dll
2015-05-13 13:19 - 2015-04-01 04:31 - 01207296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbghelp.dll
2015-05-13 13:19 - 2015-03-20 03:56 - 00080384 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ahcache.sys
2015-05-13 13:19 - 2015-03-13 04:02 - 00316416 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\udfs.sys
2015-05-13 13:19 - 2015-03-13 03:11 - 02162176 _____ (Microsoft Corporation) C:\WINDOWS\system32\SRH.dll
2015-05-13 13:19 - 2015-03-13 02:39 - 01812992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SRH.dll
2015-05-13 13:19 - 2015-03-06 04:47 - 01696256 _____ (Microsoft Corporation) C:\WINDOWS\system32\wevtsvc.dll
2015-05-13 13:19 - 2015-03-04 03:32 - 00172544 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Input.Inking.dll
2015-05-13 13:19 - 2015-03-04 03:12 - 00141824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Input.Inking.dll
2015-05-13 13:19 - 2015-01-30 02:53 - 02819584 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers.dll
2015-05-13 13:19 - 2014-11-14 08:58 - 00116736 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsDatabase.dll
2015-05-13 13:16 - 2015-04-24 23:32 - 00036864 _____ (Microsoft Corporation) C:\WINDOWS\system32\UtcResources.dll
2015-05-13 13:16 - 2015-03-30 07:47 - 00561928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2015-05-13 13:16 - 2015-03-27 05:27 - 00445440 _____ (Microsoft Corporation) C:\WINDOWS\system32\certcli.dll
2015-05-13 13:16 - 2015-03-27 04:50 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certcli.dll
2015-05-13 13:16 - 2015-03-27 04:48 - 01441792 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2015-05-13 13:16 - 2015-03-13 06:03 - 00239424 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdbus.sys
2015-05-13 13:16 - 2015-03-13 06:03 - 00154432 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dumpsd.sys
2015-05-13 13:16 - 2015-03-11 03:49 - 00024576 _____ (Microsoft Corporation) C:\WINDOWS\system32\sdbinst.exe
2015-05-13 13:16 - 2015-03-11 03:09 - 00021504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sdbinst.exe
2015-05-13 13:16 - 2015-03-05 01:09 - 01429504 _____ (Microsoft Corporation) C:\WINDOWS\system32\diagtrack.dll
2015-05-13 13:16 - 2015-02-18 01:19 - 00186368 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpapisrv.dll
2015-05-13 13:14 - 2015-04-21 19:14 - 24971776 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2015-05-13 13:14 - 2015-04-21 18:50 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2015-05-13 13:14 - 2015-04-21 18:50 - 00417792 _____ (Microsoft Corporation) C:\WINDOWS\system32\html.iec
2015-05-13 13:14 - 2015-04-21 18:49 - 02885120 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2015-05-13 13:14 - 2015-04-21 18:37 - 00633856 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieui.dll
2015-05-13 13:14 - 2015-04-21 18:35 - 00816640 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2015-05-13 13:14 - 2015-04-21 18:31 - 06025728 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2015-05-13 13:14 - 2015-04-21 18:24 - 19691008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2015-05-13 13:14 - 2015-04-21 18:13 - 00107520 _____ (Microsoft Corporation) C:\WINDOWS\system32\inseng.dll
2015-05-13 13:14 - 2015-04-21 18:11 - 00504320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2015-05-13 13:14 - 2015-04-21 18:09 - 00341504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\html.iec
2015-05-13 13:14 - 2015-04-21 18:08 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2015-05-13 13:14 - 2015-04-21 18:07 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll
2015-05-13 13:14 - 2015-04-21 18:05 - 00316928 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2015-05-13 13:14 - 2015-04-21 18:04 - 02278400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2015-05-13 13:14 - 2015-04-21 17:59 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2015-05-13 13:14 - 2015-04-21 17:58 - 00664576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2015-05-13 13:14 - 2015-04-21 17:52 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
2015-05-13 13:14 - 2015-04-21 17:49 - 00801280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2015-05-13 13:14 - 2015-04-21 17:49 - 00720384 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2015-05-13 13:14 - 2015-04-21 17:49 - 00374272 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2015-05-13 13:14 - 2015-04-21 17:46 - 02125824 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2015-05-13 13:14 - 2015-04-21 17:40 - 14401536 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2015-05-13 13:14 - 2015-04-21 17:38 - 00076288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
2015-05-13 13:14 - 2015-04-21 17:37 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll
2015-05-13 13:14 - 2015-04-21 17:36 - 00285696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2015-05-13 13:14 - 2015-04-21 17:32 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2015-05-13 13:14 - 2015-04-21 17:31 - 04305920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2015-05-13 13:14 - 2015-04-21 17:28 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll
2015-05-13 13:14 - 2015-04-21 17:27 - 02352128 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2015-05-13 13:14 - 2015-04-21 17:26 - 00688640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2015-05-13 13:14 - 2015-04-21 17:26 - 00327168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2015-05-13 13:14 - 2015-04-21 17:25 - 02052608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2015-05-13 13:14 - 2015-04-21 17:17 - 12828672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2015-05-13 13:14 - 2015-04-21 17:15 - 01547264 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2015-05-13 13:14 - 2015-04-21 17:03 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2015-05-13 13:14 - 2015-04-21 17:02 - 01882112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2015-05-13 13:14 - 2015-04-21 16:58 - 01310208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2015-05-13 13:14 - 2015-04-21 16:56 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2015-05-13 13:14 - 2015-03-13 02:29 - 00410017 _____ () C:\WINDOWS\system32\ApnDatabase.xml
2015-05-13 13:14 - 2015-03-06 05:08 - 02067968 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpdshext.dll
2015-05-13 13:14 - 2015-03-06 04:43 - 01969664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wpdshext.dll
2015-05-06 18:10 - 2015-05-06 18:10 - 00000000 ____D () C:\temp
2015-05-05 20:27 - 2015-05-05 20:27 - 00002003 _____ () C:\Users\xxx\Desktop\test.html
2015-05-05 12:13 - 2015-05-05 12:15 - 00000000 ____D () C:\Users\xxx\Desktop\cmd
2015-05-02 03:18 - 2015-05-02 03:18 - 00000000 ____D () C:\ProgramData\Spamihilator
2015-05-02 03:17 - 2015-05-02 03:17 - 00970912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvcr120.dll
2015-05-02 03:17 - 2015-05-02 03:17 - 00455328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvcp120.dll
2015-05-02 03:17 - 2015-05-02 03:17 - 00247984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vccorlib120.dll
2015-05-02 03:17 - 2015-05-02 03:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spamihilator
2015-05-02 03:17 - 2015-05-02 03:17 - 00000000 ____D () C:\Program Files (x86)\Spamihilator
2015-05-02 03:12 - 2015-05-30 18:24 - 00000000 ____D () C:\Users\xxx\AppData\Roaming\Spamihilator
2015-05-02 03:09 - 2015-05-02 03:09 - 02515456 _____ (Michel Krämer) C:\Users\xxx\Downloads\Spamihilator-win32-1.6.0.exe
2015-05-02 03:09 - 2015-05-02 03:09 - 00000000 ____D () C:\Users\xxx\AppData\Roaming\Thunderbird
2015-05-02 03:09 - 2015-05-02 03:09 - 00000000 ____D () C:\Users\xxx\AppData\Local\Thunderbird
2015-05-02 03:04 - 2015-05-02 03:04 - 00002121 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Thunderbird.lnk
2015-05-02 03:04 - 2015-05-02 03:04 - 00002109 _____ () C:\Users\Public\Desktop\Mozilla Thunderbird.lnk
2015-05-02 03:04 - 2015-05-02 03:04 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2015-05-02 03:02 - 2015-05-02 03:03 - 28745120 _____ (Mozilla) C:\Users\xxx\Downloads\Thunderbird Setup 31.6.0.exe

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-06-01 09:02 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2015-06-01 08:46 - 2014-05-08 15:08 - 00001122 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2015-06-01 08:10 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2015-06-01 07:51 - 2014-02-13 04:18 - 730247168 ___SH () C:\WINDOWS\lenovo_fastboot.img
2015-06-01 07:50 - 2014-05-08 15:08 - 00001118 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2015-06-01 07:47 - 2015-01-18 13:30 - 00000589 _____ () C:\WINDOWS\system32\Drivers\etc\hosts.ics
2015-06-01 07:46 - 2014-02-13 04:18 - 00000000 ____D () C:\ProgramData\Validity
2015-06-01 07:46 - 2013-08-22 16:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2015-05-31 19:36 - 2012-07-26 09:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
2015-05-30 18:25 - 2014-06-17 21:34 - 00000000 ___RD () C:\Users\xxx\Dropbox
2015-05-30 18:25 - 2014-06-17 21:31 - 00000000 ____D () C:\Users\xxx\AppData\Roaming\Dropbox
2015-05-30 18:25 - 2014-05-10 13:38 - 00000000 ____D () C:\Users\xxx\AppData\Local\CrashDumps
2015-05-30 17:15 - 2014-05-08 15:07 - 00003938 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{2E5FCE8E-190F-42B1-848F-D088FC3DC883}
2015-05-30 16:19 - 2014-05-07 14:56 - 00003596 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-919205647-830002367-3966930364-1135
2015-05-30 00:27 - 2014-08-06 06:05 - 00000000 ____D () C:\Users\xxx\AppData\Roaming\vlc
2015-05-29 17:25 - 2013-08-22 16:44 - 05115032 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2015-05-29 17:10 - 2014-05-09 19:47 - 00000000 ____D () C:\Users\xxx\AppData\Roaming\Skype
2015-05-29 17:01 - 2015-01-23 17:21 - 00000000 ____D () C:\Users\xxx\AppData\Roaming\TeamViewer
2015-05-29 17:01 - 2014-08-06 05:57 - 00000000 ____D () C:\Users\xxx\AppData\Roaming\DAEMON Tools Lite
2015-05-29 14:53 - 2014-05-07 13:56 - 00000112 _____ () C:\WINDOWS\system32\config\netlogon.ftl
2015-05-29 11:42 - 2013-08-22 15:25 - 00524288 ___SH () C:\WINDOWS\system32\config\BBI
2015-05-28 13:40 - 2014-03-18 12:03 - 02160128 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2015-05-28 13:40 - 2014-03-18 11:25 - 00916260 _____ () C:\WINDOWS\system32\perfh007.dat
2015-05-28 13:40 - 2014-03-18 11:25 - 00211972 _____ () C:\WINDOWS\system32\perfc007.dat
2015-05-27 15:40 - 2014-05-08 15:37 - 00000000 ____D () C:\Users\xxx\Documents\Visual Studio 2013
2015-05-27 11:50 - 2014-05-10 12:21 - 00000000 ____D () C:\Users\xxx\AppData\Roaming\Notepad++
2015-05-27 11:50 - 2014-05-10 12:21 - 00000000 ____D () C:\Program Files (x86)\Notepad++
2015-05-27 11:21 - 2014-05-07 14:43 - 00000000 ____D () C:\Users\xxx
2015-05-26 03:11 - 2014-05-08 15:08 - 00002206 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-05-25 20:51 - 2014-08-06 06:05 - 00000000 ____D () C:\Users\xxx\AppData\Roaming\dvdcss
2015-05-24 19:03 - 2014-07-05 04:26 - 00000000 ____D () C:\Users\MSSQL$SQLEXPRESS
2015-05-22 13:38 - 2014-07-18 04:03 - 00000600 _____ () C:\Users\xxx\AppData\Roaming\winscp.rnd
2015-05-22 12:35 - 2014-07-18 03:54 - 00000600 _____ () C:\Users\xxx\AppData\Local\PUTTY.RND
2015-05-21 16:06 - 2015-04-04 18:46 - 00000000 ___SD () C:\WINDOWS\SysWOW64\GWX
2015-05-21 16:06 - 2015-04-04 18:46 - 00000000 ___SD () C:\WINDOWS\system32\GWX
2015-05-18 14:10 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\tracing
2015-05-17 04:17 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\rescache
2015-05-16 16:50 - 2014-05-10 00:45 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2015-05-16 16:50 - 2014-05-10 00:45 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2015-05-16 16:50 - 2014-05-09 20:15 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-05-16 16:33 - 2013-08-22 17:36 - 00000000 ___RD () C:\WINDOWS\ImmersiveControlPanel
2015-05-16 16:33 - 2013-08-22 15:36 - 00000000 ____D () C:\WINDOWS\system32\AdvancedInstallers
2015-05-16 16:15 - 2014-06-20 14:29 - 00000000 ____D () C:\Users\xxx\Desktop\tmp
2015-05-16 13:40 - 2014-05-08 15:08 - 00004094 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2015-05-16 13:40 - 2014-05-08 15:08 - 00003858 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2015-05-15 06:26 - 2014-05-19 18:47 - 00002457 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-05-13 16:44 - 2014-05-09 12:29 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-05-13 16:42 - 2014-05-09 12:33 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2015-05-13 16:40 - 2014-05-07 13:24 - 00000000 ____D () C:\WINDOWS\system32\MRT
2015-05-13 16:30 - 2014-05-07 13:24 - 140425016 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2015-05-13 16:22 - 2013-08-22 15:25 - 00000167 _____ () C:\WINDOWS\win.ini
2015-05-13 16:18 - 2014-05-10 00:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-05-13 15:59 - 2014-03-18 11:40 - 00000000 ____D () C:\Program Files\Windows Journal
2015-05-12 12:46 - 2014-06-17 21:33 - 00000000 ____D () C:\Users\xxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-05-12 05:21 - 2014-05-17 21:08 - 00000132 _____ () C:\Users\xxx\AppData\Roaming\Adobe PNG Format CS5 Prefs
2015-05-11 12:43 - 2014-05-07 13:58 - 00006658 __RSH () C:\ProgramData\ntuser.pol
2015-05-10 18:05 - 2014-10-01 15:58 - 00009312 _____ () C:\Users\xxx\Desktop\ts.txt
2015-05-10 17:52 - 2014-05-07 14:43 - 00000000 ____D () C:\Users\xxx\AppData\Local\Packages
2015-05-07 16:30 - 2014-05-08 15:08 - 00000000 ____D () C:\Users\xxx\AppData\Local\Deployment
2015-05-06 23:33 - 2014-05-09 15:59 - 00000000 ____D () C:\Users\xxx\.VirtualBox
2015-05-06 22:14 - 2014-05-09 15:59 - 00000000 ____D () C:\Users\xxx\VirtualBox VMs
2015-05-06 10:59 - 2014-05-09 19:47 - 00000000 ____D () C:\ProgramData\Skype

==================== Files in the root of some directories =======

2015-06-01 07:52 - 2015-06-01 07:53 - 0000192 _____ () C:\Users\Administrator\AppData\Local\RegisteredPackageInformation.xml
2014-02-13 04:08 - 2014-02-13 04:08 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2014-02-13 04:22 - 2014-02-13 04:22 - 0000107 _____ () C:\ProgramData\{324F76CC-D8DD-4D87-B77D-D4AF5E1AA7B3}.log
2014-02-13 04:19 - 2014-02-13 04:20 - 0000105 _____ () C:\ProgramData\{40BF1E83-20EB-11D8-97C5-0009C5020658}.log
2014-02-13 04:20 - 2014-02-13 04:21 - 0000110 _____ () C:\ProgramData\{B7A0CE06-068E-11D6-97FD-0050BACBF861}.log
2014-02-13 04:21 - 2014-02-13 04:22 - 0000115 _____ () C:\ProgramData\{D6E853EC-8960-4D44-AF03-7361BB93227C}.log

Files to move or delete:
====================
C:\Users\xxx\eve_prod.js


Some files in TEMP:
====================
C:\Users\xxx\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp01emqg.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-05-23 04:28

==================== End of log ============================

southz · 01.06.2015, 10:49

Addition.txt

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 29-05-2015
Ran by Administrator at 2015-06-01 09:20:10
Running from C:\Users\Administrator\Desktop
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-2292532964-2513414724-1275699273-500 - Administrator - Enabled) => C:\Users\Administrator
Gast (S-1-5-21-2292532964-2513414724-1275699273-501 - Limited - Disabled)
xxx (S-1-5-21-2292532964-2513414724-1275699273-1002 - Administrator - Enabled) => C:\Users\xxx
UpdatusUser (S-1-5-21-2292532964-2513414724-1275699273-1001 - Limited - Enabled) => C:\Users\UpdatusUser

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Ad-Aware Antivirus (Enabled - Up to date) {D87B6541-12A1-DAEA-0033-9B8057AAB996}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Ad-Aware Antivirus (Enabled - Up to date) {631A84A5-349B-D564-3A83-A0F22C2DF32B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
FW: Ad-Aware Firewall (Disabled) {E040E464-58CE-DBB2-2B6C-32B5A979FEED}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

64 Bit HP CIO Components Installer (Version: 15.2.1 - Hewlett-Packard) Hidden
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Ad-Aware Antivirus (HKLM\...\{FF054A8C-C0A4-4C78-8910-E2A459BEFF05}_AdAwareUpdater) (Version: 11.6.306.7947 - Lavasoft)
AdAwareInstaller (Version: 11.6.306.7947 - Lavasoft) Hidden
AdAwareUpdater (Version: 11.6.306.7947 - Lavasoft) Hidden
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 17.0.0.144 - Adobe Systems Incorporated)
Adobe Community Help (HKLM-x32\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 3.0.0.400 - Adobe Systems Incorporated)
Adobe Flash Player 10 ActiveX (HKLM-x32\...\{6E9EF98E-259E-416D-B5F8-0ABDB99942CE}) (Version: 10.1.52.14 - Adobe Systems, Inc.)
Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Media Player (HKLM-x32\...\com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 1.8 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.11) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.11 - Adobe Systems Incorporated)
AntimalwareEngine (Version: 3.0.98.0 - Lavasoft) Hidden
AntispamEngine (Version: 2.4.2158.0 - Lavasoft) Hidden
Anzeige am Bildschirm (HKLM\...\OnScreenDisplay) (Version: 8.42.20 - )
Apple Application Support (HKLM-x32\...\{21ECABC3-40B2-42DF-8E21-ACF3A4D0D95A}) (Version: 3.0.5 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{6AF2AC2A-3532-43FD-9F4D-BDC9C0D724C7}) (Version: 7.1.2.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Application Insights Tools for Visual Studio 2013 (x32 Version: 2.4 - Microsoft Corporation) Hidden
ArgoUML 0.34 (HKLM-x32\...\ArgoUML) (Version: 0.34 - )
Autostart-Manager (HKLM-x32\...\{E0D34E99-B4E5-481D-A1A7-27BE957F5167}) (Version: 6.04.0000 - Wirth IT Design )
AvcEngine (Version: 3.10.7820.0 - Lavasoft) Hidden
Azure Resource Manager Tools (VS 2013) - v1.0 (x32 Version: 1.0.0.0 - Microsoft Corporation) Hidden
AzureTools.Notifications (x32 Version: 2.5.21104.1601 - Microsoft Corporation) Hidden
Behaviors SDK (Windows Phone) for Visual Studio 2013 (x32 Version: 12.0.50716.0 - Microsoft Corporation) Hidden
Behaviors SDK (Windows) for Visual Studio 2013 (x32 Version: 12.0.50429.0 - Microsoft Corporation) Hidden
Blend for Visual Studio 2013 (x32 Version: 12.0.41002.1 - Microsoft Corporation) Hidden
Blend for Visual Studio 2013 DEU resources (x32 Version: 12.0.41002.1 - Microsoft Corporation) Hidden
Blend for Visual Studio SDK for .NET 4.5 (x32 Version: 3.0.40218.0 - Microsoft Corporation) Hidden
Blend for Visual Studio SDK for Silverlight 5 (x32 Version: 3.0.40218.0 - Microsoft Corporation) Hidden
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Build Tools - amd64 (Version: 12.0.31101 - Microsoft Corporation) Hidden
Build Tools - x86 (x32 Version: 12.0.31101 - Microsoft Corporation) Hidden
Build Tools Language Resources - amd64 (Version: 12.0.31101 - Microsoft Corporation) Hidden
Build Tools Language Resources - x86 (x32 Version: 12.0.31101 - Microsoft Corporation) Hidden
Bullzip PDF Printer 9.2.0.1499 (HKLM\...\Bullzip PDF Printer_is1) (Version: 9.2.0.1499 - Bullzip)
CCleaner (HKLM\...\CCleaner) (Version: 5.05 - Piriform)
CDBurnerXP (HKLM-x32\...\{909A791A-DBB0-432F-BC0E-D0C81925E340}) (Version: 4.5.3.4746 - Canneverbe Limited)
Chunky (HKLM\...\Chunky) (Version:  - )
Cloud Deployment Project for Microsoft Visual Studio 2013 - v1.0 (x32 Version: 1.0.0.0 - Microsoft Corporation) Hidden
Conexant HD Audio (HKLM\...\CNXT_AUDIO_HDA) (Version: 8.54.48.0 - Conexant)
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.49.1.0356 - Disc Soft Ltd)
Dassault Systemes Software B19 (HKLM\...\Dassault Systemes B19_0) (Version:  - )
Dassault Systemes Software Prerequisites x86-x64 (HKLM\...\{CF1EB598-B424-436A-B15F-B763846BA970}) (Version: 8.1.3 - Dassault Systemes)
DataNumen PDF Repair v2.1 (HKLM-x32\...\DataNumen PDF Repair v2.1) (Version:  - )
Devenv-Ressourcen für Microsoft Visual Studio 2013 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
Dotfuscator and Analytics Community Edition (x32 Version: 5.5.4954.46574 - PreEmptive Solutions) Hidden
Dotfuscator and Analytics Community Edition Language Pack (x32 Version: 5.5.4954.46574 - PreEmptive Solutions) Hidden
Dropbox (HKU\S-1-5-21-2292532964-2513414724-1275699273-1001\...\Dropbox) (Version: 3.0.3 - Dropbox, Inc.)
Dropbox (HKU\S-1-5-21-2292532964-2513414724-1275699273-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Dropbox) (Version: 3.0.3 - Dropbox, Inc.)
Dropbox (HKU\S-1-5-21-2292532964-2513414724-1275699273-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Dropbox) (Version: 3.0.3 - Dropbox, Inc.)
Dropbox (HKU\S-1-5-21-919205647-830002367-3966930364-1135-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Dropbox) (Version: 3.4.6 - Dropbox, Inc.)
Entity Framework 6.1.1 Tools  for Visual Studio 2013 (HKLM-x32\...\{85253F13-EE42-4850-A3A5-79B90E92D7AC}) (Version: 12.0.30610.0 - Microsoft Corporation)
Erforderliche Komponenten für SSDT  (HKLM-x32\...\{2466E484-9D86-416B-9C88-AA533F15AF1C}) (Version: 12.0.2000.8 - Microsoft Corporation)
Erforderliche Komponenten für SSDT  (HKLM-x32\...\{3FF082A7-A5DE-4BDA-B56A-1D2BEFD617A3}) (Version: 11.1.3000.0 - Microsoft Corporation)
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version:  - )
Ext2Fsd 0.53 (HKLM\...\Ext2Fsd_is1) (Version: 0.53 - Matt Wu)
Finalizer deinstallieren (x32 Version: 2.4.20730.1601 - Microsoft Corporation) Hidden
Finalizer deinstallieren (x32 Version: 2.5.21104.1601 - Microsoft Corporation) Hidden
Finalizer installieren (x32 Version: 2.4.20730.1601 - Microsoft Corporation) Hidden
Finalizer installieren (x32 Version: 2.5.21104.1601 - Microsoft Corporation) Hidden
FirewallEngine (Version: 1.6.0.0 - Lavasoft) Hidden
Gemeinsam genutzte Microsoft Azure-Komponenten für Visual Studio 2013 Sprachpaket (DEU) - v1.3 (x32 Version: 1.3.21014.1603 - Microsoft Corporation) Hidden
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 43.0.2357.81 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.27.5 - Google Inc.) Hidden
Hotfix für Microsoft Visual Studio 2007 Tools for Applications - ENU (KB947789) (HKLM-x32\...\{8E87B944-4815-3C5E-947F-5035C9F64362}.KB947789) (Version: 1 - Microsoft Corporation)
IIS 8.0 Express (HKLM\...\{7BF61FA9-BDFB-4563-98AD-FCB0DA28CCC7}) (Version: 8.0.1557 - Microsoft Corporation)
IIS Express Application Compatibility Database for x64 (HKLM\...\{9f4f4a9b-eec5-4906-92fe-d1f43ccf5c8d}.sdb) (Version:  - )
IIS Express Application Compatibility Database for x86 (HKLM\...\{fdfba1f3-74ae-4255-9c10-a0f552b4610f}.sdb) (Version:  - )
Install Finalizer (x32 Version: 2.4.20730.1601 - Microsoft Corporation) Hidden
Install Finalizer (x32 Version: 2.5.21104.1601 - Microsoft Corporation) Hidden
Integrated Camera (HKLM-x32\...\{E0A7ED39-8CD6-4351-93C3-69CCA00D12B4}) (Version: 6.2.9200.10224 - Realtek Semiconductor Corp.)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1008 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1281 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3412 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
Intel(R) Update Manager (x32 Version: 1.0.0.36888 - Intel Corporation) Hidden
Intel(R) WiDi (HKLM\...\{23D486D4-FBE0-40F3-A245-E4D56D094764}) (Version: 3.5.41.0 - Intel Corporation)
Intel® PROSet/Wireless Software (HKLM-x32\...\{c9967fbd-e3c3-4ed0-992a-5b33260f2944}) (Version: 16.1.5 - Intel Corporation)
Intel® PROSet/Wireless Software (HKLM-x32\...\{fad118b4-798f-4755-9e67-a622eec95b62}) (Version: 15.6.1 - Intel Corporation)
iTunes (HKLM\...\{33E28B58-7BA0-47B7-AA01-9225ABA2B8A9}) (Version: 11.3.0.54 - Apple Inc.)
Java 8 Update 5 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418005FF}) (Version: 8.0.50 - Oracle Corporation)
Java SE Development Kit 8 Update 5 (64-bit) (HKLM\...\{64A3A4F4-B792-11D6-A78A-00B0D0180050}) (Version: 8.0.50 - Oracle Corporation)
Kit SDK de vérification de Visual Studio*2012 - fra (x32 Version: 12.0.30501 - Microsoft Corporation) Hidden
Lenovo Auto Scroll Utility (HKLM\...\LenovoAutoScrollUtility) (Version: 2.01 - )
Lenovo Dependency Package (HKLM-x32\...\Lenovo Dependency Package_is1) (Version: 1.5.37.0 - Lenovo Group Limited)
Lenovo Experience Improvement (HKLM\...\LenovoExperienceImprovement) (Version: 1.0.3.0 - Lenovo)
Lenovo Fingerprint Manager (HKLM\...\{709AB4C0-9DFF-4293-954F-FBCC7FC005DA}) (Version: 4.5.122.0 - Validity Sensors, Inc.)
Lenovo Multimedia and Communications Core Runtime (HKLM\...\{033DC0E0-DA89-4C33-B66C-89B64D312CD1}_is1) (Version: 5.0.13.94 - Lenovo Corporation)
Lenovo Patch Utility (HKLM-x32\...\{AD32F5E9-6BDD-480A-8B7B-95571D04691C}) (Version: 1.3.1.1 - Lenovo Group Limited)
Lenovo Patch Utility (x32 Version: 1.3.2.6 - Lenovo Group Limited) Hidden
Lenovo Patch Utility 64 bit (HKLM\...\{ABE4638D-D208-4061-9F26-E3E11E3A1E0C}) (Version: 1.3.1.1 - Lenovo Group Limited)
Lenovo Patch Utility 64 bit (Version: 1.3.2.6 - Lenovo Group Limited) Hidden
Lenovo Power Management Driver (HKLM\...\Power Management Driver) (Version: 1.67.04.05 - )
Lenovo Settings - Camera Audio (HKLM\...\{88C6A6D9-324C-46E8-BA87-563D14021442}_is1) (Version: 4.3.19.209 - Lenovo Corporation)
Lenovo Settings - Power (HKLM-x32\...\{DAC01CEE-5BAE-42D5-81FC-B687E84E8405}) (Version: 7.49.4 - Lenovo Group Limited)
Lenovo Settings Dependency Package (HKLM\...\{3694BA2E-BE31-4B7E-886B-A0B559E69D4D}_is1) (Version: 2.3.3.33 - Lenovo Group Limited)
Lenovo Settings Mobile Hotspot (HKLM\...\{42603F7D-B08D-436B-B0D8-3E2DEF1AFD41}_is1) (Version: 1.1.0.57 - Lenovo)
Lenovo Settings Service (HKLM\...\{8C6F1EBA-17F1-4481-B688-9777E63E985F}_is1) (Version: 2.3.3.7 - Lenovo Group Limited)
Lenovo Settings UMDF driver (HKLM\...\{2BDC7413-65EA-4B99-8C4B-02F11075BE6D}_is1) (Version: 1.2.0.7 - Lenovo Group Limited)
Lenovo Solution Center (HKLM\...\{1CA74803-5CB2-4C03-BDBE-061EDC81CC7F}) (Version: 2.8.004.00 - Lenovo Group Limited)
Lenovo Solutions for Small Business (HKLM-x32\...\{6A6D86CD-B004-46b7-8951-7BB75A776F8C}) (Version: 2.0.32.7350 - Intel(R) Corporation)
Lenovo Solutions for Small Business Customizations (HKLM-x32\...\{AFD7B869-3B70-40C7-8983-769256BA3BD2}) (Version: 2.0.0004.00 - Lenovo Group Limited)
Lenovo System Update (HKLM-x32\...\{25C64847-B900-48AD-A164-1B4F9B774650}) (Version: 5.06.0016 - Lenovo)
Lenovo User Guide (HKLM-x32\...\{13F59938-C595-479C-B479-F171AB9AF64F}) (Version: 1.0.0012.00 - Lenovo Group Limited)
Lenovo Warranty Information (HKLM-x32\...\{FD4EC278-C1B1-4496-99ED-C0BE1B0AA521}) (Version: 1.0.0011.00 - Lenovo)
LocalESPC Dev12 (x32 Version: 8.100.25984 - Microsoft Corporation) Hidden
LocalESPCui for de-de Dev12 (x32 Version: 8.100.25984 - Microsoft) Hidden
Memory Profiler (x32 Version: 12.0.31101 - Microsoft Corporation) Hidden
Metric Collection SDK (x32 Version: 1.1.0005.00 - Lenovo Group Limited) Hidden
Microsoft .NET Framework 4.5 Multi-Targeting Pack (HKLM-x32\...\{56E962F0-4FB0-3C67-88DB-9EAA6EEFC493}) (Version: 4.5.50710 - Microsoft Corporation)
Microsoft .NET Framework 4.5 SDK - DEU Lang Pack (HKLM-x32\...\{21B0F482-5EF9-45DA-8840-340AFE705A6C}) (Version: 4.5.50710 - Microsoft Corporation)
Microsoft .NET Framework 4.5 SDK (HKLM-x32\...\{4AE57014-05C4-4864-A13D-86517A7E1BA4}) (Version: 4.5.50710 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 Multi-Targeting Pack (HKLM-x32\...\{6A0C6700-EA93-372C-8871-DCCF13D160A4}) (Version: 4.5.50932 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 SDK (Deutsch) (HKLM-x32\...\{CBD7095F-7211-43FD-9FE7-FB08D753AF79}) (Version: 4.5.51641 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 SDK (HKLM-x32\...\{19A5926D-66E1-46FC-854D-163AA10A52D3}) (Version: 4.5.51641 - Microsoft Corporation)
Microsoft ASP.NET MVC 4 Runtime (HKLM-x32\...\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 - Microsoft Corporation)
Microsoft ASP.Net Web Frameworks 5.0 Security Update (KB2992080) (HKLM-x32\...\{3EC4A844-24F2-46DA-AEFB-FC3080C1BDB9}) (Version: 5.0.20821 - Microsoft Corporation)
Microsoft ASP.Net Web Frameworks 5.1 Security Update (KB2994397) (HKLM-x32\...\{94F716A3-CBBA-4005-9516-1C4267DDB824}) (Version: 5.1.20821 - Microsoft Corporation)
Microsoft Azure Authoring Tools - v2.4 (HKLM\...\{50D4178A-C2E6-4F95-9C54-8A31DFA68F32}) (Version: 2.4.6489.2 - Microsoft Corporation)
Microsoft Azure Authoring Tools - v2.5 (HKLM\...\{A46322D1-A353-4F9A-8DA1-C58401E33639}) (Version: 2.5.6496.10 - Microsoft Corporation)
Microsoft Azure Compute Emulator - v2.5 (HKLM\...\Microsoft Azure Compute Emulator - v2.5) (Version: 2.5.6496.10 - Microsoft Corporation)
Microsoft Azure HDInsight Tools for Visual Studio (HKLM-x32\...\{C6943238-E5DA-412D-850E-54181E5B4B65}) (Version: 1.0.0000.0 - Microsoft Corporation)
Microsoft Azure Libraries for .NET – v2.4 (HKLM\...\{D6B04ED9-386E-4157-AF50-64A43700FADC}) (Version: 2.4.0724.110 - Microsoft Corporation)
Microsoft Azure Libraries for .NET – v2.5 (HKLM\...\{22F9A831-CA56-4406-85FE-47FFB0472804}) (Version: 2.5.1024.161 - Microsoft Corporation)
Microsoft Azure PowerShell - November 2014 (HKLM-x32\...\{0A00707E-05D8-4096-A547-23BC7B9164D8}) (Version: 0.8.11 - Microsoft Corporation)
Microsoft Azure Quickstarts (HKLM-x32\...\{06747CB9-4E28-3164-A1C5-F7FD307F08B5}) (Version: 1.5.0 - Microsoft Corporation)
Microsoft Azure Storage Tools - v3.0.0 (HKLM-x32\...\{870D4E4E-1BE7-42E7-9655-E7792290FCB4}) (Version: 3.0.0.0 - Microsoft Corporation)
Microsoft Azure Tools for Microsoft Visual Studio 2013 - v2.4 (HKLM-x32\...\{59c9b964-1162-4063-886e-8410aa0fcbc8}) (Version: 2.4.20730.1601 - Microsoft Corporation)
Microsoft Azure Tools for Microsoft Visual Studio 2013 - v2.5 (HKLM-x32\...\{4be5d1d6-933d-4058-853b-047ed1258fc4}) (Version: 2.5.21104.1601 - Microsoft Corporation)
Microsoft Azure Tools für Microsoft Visual Studio 2013 Sprachpaket (DEU) - v2.4 (HKLM-x32\...\{98081515-e30f-4abe-93e8-827b0f7b1cee}) (Version: 2.4.20730.1601 - Microsoft Corporation)
Microsoft Azure-Tools für Microsoft Visual Studio 2013 Sprachpaket (DEU) - v2.5 (HKLM-x32\...\{bbc92f38-d7be-45f7-94ca-aa18f19702f3}) (Version: 2.5.21104.1601 - Microsoft Corporation)
Microsoft Help Viewer 1.1 (HKLM\...\Microsoft Help Viewer 1.1) (Version: 1.1.40219 - Microsoft Corporation)
Microsoft Help Viewer 1.1 Language Pack - DEU (HKLM\...\Microsoft Help Viewer 1.1 Language Pack - DEU) (Version: 1.1.40219 - Microsoft Corporation)
Microsoft Help Viewer 2.1 (HKLM-x32\...\Microsoft Help Viewer 2.1) (Version: 2.1.21005 - Microsoft Corporation)
Microsoft Help Viewer 2.1 Sprachpaket - DEU (HKLM-x32\...\Microsoft Help Viewer 2.1 Sprachpaket - DEU) (Version: 2.1.21005 - Microsoft Corporation)
Microsoft Hive ODBC Driver (HKLM\...\{AC9970E8-7F55-4F50-A6D3-2BC041589904}) (Version: 1.0.5.5 - Microsoft Corporation)
Microsoft Hive ODBC Driver (HKLM-x32\...\{7A580208-9E61-47FD-9AEB-DDDAA67CF0F6}) (Version: 1.0.5.5 - Microsoft Corporation)
Microsoft Office Developer Tools für Visual Studio 2013 - November 2014 Update (HKLM-x32\...\{1559e824-ca63-4f97-b1a3-7e2d8601db8a}) (Version: 12.0.31105.0 - Microsoft Corporation)
Microsoft Office Korrekturhilfen 2013 - Deutsch (HKLM-x32\...\{90150000-001F-0407-0000-0000000FF1CE}) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft Office Professional Plus 2013 (HKLM-x32\...\Office15.PROPLUSR) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation)
Microsoft Silverlight 5 SDK - DEU (HKLM-x32\...\{F351AA2C-723C-4CFE-A7CB-8E43AB164F7F}) (Version: 5.0.61118.0 - Microsoft Corporation)
Microsoft SQL Server 2008 (64-bit) (HKLM\...\Microsoft SQL Server 10 Release) (Version:  - Microsoft Corporation)
Microsoft SQL Server 2008 Native Client (HKLM\...\{1C3F92D0-3EC5-4CD4-9D5E-1E7834B65BB8}) (Version: 10.0.1600.22 - Microsoft Corporation)
Microsoft SQL Server 2008 R2 ADOMD.NET (HKLM-x32\...\{322B359D-BC0B-4E7D-9665-DF94C8B4D415}) (Version: 10.50.1600.1 - Microsoft Corporation)
Microsoft SQL Server 2008 R2 Management Objects (HKLM-x32\...\{5973B12E-5FC1-4EF6-B63B-49C1C4AF2AAA}) (Version: 10.51.2500.0 - Microsoft Corporation)
Microsoft SQL Server 2008-Richtlinien (HKLM-x32\...\{695E67B6-8B95-4160-9650-92974980CDC1}) (Version: 10.0.1600.22 - Microsoft Corporation)
Microsoft SQL Server 2012 (64-Bit) (HKLM\...\Microsoft SQL Server SQLServer2012) (Version:  - Microsoft Corporation)
Microsoft SQL Server 2012 Command Line Utilities  (HKLM\...\{F09DEB00-9F41-4BC9-BA81-9F131B12B3D5}) (Version: 11.1.3000.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Data-Tier App Framework  (HKLM-x32\...\{D4E30517-FE6F-491E-942F-AE10E1B18F38}) (Version: 11.1.2902.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Data-Tier App Framework  (x64) (HKLM\...\{B4EDAE03-DB34-4DD0-BA7E-2ED80DEA50B1}) (Version: 11.1.2902.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Express LocalDB  (HKLM\...\{269A8DF6-BBDA-441F-932B-233F9B746D72}) (Version: 11.1.3000.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Management Objects (HKLM-x32\...\{EC75BD20-F9CA-4E77-825F-ABD77E95BE91}) (Version: 11.1.3000.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Management Objects (x64) (HKLM\...\{0BF65908-D137-4A9E-B7C9-78F32F74F6FD}) (Version: 11.1.3000.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Native Client  (HKLM\...\{93945D16-4C3D-433E-B7E4-3D0D86B284C8}) (Version: 11.1.3000.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Setup (English) (HKLM\...\{8CB0713F-CFE0-445D-BCB2-538465860E1A}) (Version: 11.1.3128.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Transact-SQL ScriptDom  (HKLM\...\{6F173435-3F19-4043-BA3D-A46AA8472859}) (Version: 11.1.3000.0 - Microsoft Corporation)
Microsoft SQL Server 2012 T-SQL-Sprachdienst  (HKLM-x32\...\{1D812D86-D8EF-41AC-A518-BA12E1913747}) (Version: 11.1.3000.0 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP1 (Deutsch) (HKLM-x32\...\{FA440BE8-EC2F-4478-A01A-077DA0606501}) (Version: 3.5.5692.0 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP1-Abfragetools (Deutsch) (HKLM-x32\...\{0DD2DCC6-21AE-4678-8629-1084B17BE077}) (Version: 3.5.5692.0 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 ENU (HKLM-x32\...\{3A9FC03D-C685-4831-94CF-4EDFD3749497}) (Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft SQL Server Compact 4.0 SP1 x64 DEU  (HKLM\...\{98225B15-ECF5-4645-B5AC-F8C5E869A5D5}) (Version: 4.0.8876.1 - Microsoft Corporation)
Microsoft SQL Server Data Tools - DEU (12.0.41012.0) (HKLM-x32\...\{79AB8378-D661-4021-9941-FE5F4AEB57BB}) (Version: 12.0.41012.0 - Microsoft Corporation)
Microsoft SQL Server Data Tools 2013 (HKLM-x32\...\{1de65d33-0833-463b-b8f7-810c823c7015}) (Version: 12.0.40706.0 - Microsoft Corporation)
Microsoft SQL Server Data Tools Build Utilities - DEU (12.0.30919.1) (HKLM-x32\...\{BCB8A870-2B3D-4CC0-87D6-F931E065AC0C}) (Version: 12.0.30919.1 - Microsoft Corporation)
Microsoft SQL Server System CLR Types (HKLM-x32\...\{A282A232-780C-45E2-A5E5-9B61D74DCC6E}) (Version: 10.51.2500.0 - Microsoft Corporation)
Microsoft SQL Server System CLR Types (x64) (HKLM\...\{485F4AC6-F79E-4482-A0D2-EDF0CCE1E124}) (Version: 10.50.1600.1 - Microsoft Corporation)
Microsoft SQL Server*2014 Express LocalDB  (HKLM\...\{CA191120-4CB1-4E3D-89B8-79FDB9017A2E}) (Version: 12.0.2000.8 - Microsoft Corporation)
Microsoft SQL Server*2014 Management Objects  (HKLM-x32\...\{4F4CB3E2-9D2F-465A-854B-8276B02F4E7D}) (Version: 12.0.2000.8 - Microsoft Corporation)
Microsoft SQL Server*2014 Management Objects (x64) (HKLM\...\{03CB711D-679E-46ED-851B-C568418CF914}) (Version: 12.0.2000.8 - Microsoft Corporation)
Microsoft SQL Server*2014 Transact-SQL Compiler Service  (HKLM\...\{BC87D3DC-0257-4C81-8795-A0AAE6560B11}) (Version: 12.0.2000.8 - Microsoft Corporation)
Microsoft SQL Server*2014 Transact-SQL ScriptDom  (HKLM\...\{F2A2DB39-2C5A-4764-AA0F-5AB112663FFA}) (Version: 12.0.2000.8 - Microsoft Corporation)
Microsoft SQL Server*2014 T-SQL Language Service  (HKLM\...\{3D7A2828-3A40-4D35-A06C-E59E4B1FFCAE}) (Version: 12.0.2000.8 - Microsoft Corporation)
Microsoft SQL Server*2014 T-SQL Language Service  (HKLM-x32\...\{06BE8B71-46C6-434B-869E-85C58EF3120A}) (Version: 12.0.2000.8 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Runtime - 10.0.40219 (HKLM-x32\...\{5D9ED403-94DE-3BA0-B1D6-71F4BDA412E6}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual Studio 2010 Shell (Isolated) - DEU (HKLM-x32\...\{987AE03F-234A-3623-BD28-6B31FD1D3AB3}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio Tools for Applications 2.0 - ENU (HKLM-x32\...\{AA4A4B2C-0465-3CF8-BA76-27A027D8ACAB}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual Studio Tools for Applications 2.0 Language Pack - DEU (HKLM-x32\...\{8E87B944-4815-3C5E-947F-5035C9F64362}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual Studio Ultimate 2013 (HKLM-x32\...\{af15e1e3-cd81-4fbb-a41c-c1deef9f1691}) (Version: 12.0.21005.13 - Microsoft Corporation)
Microsoft VSS Writer für SQL Server 2012 (HKLM\...\{7647B46D-D4E6-43A5-AC9D-0BAA28C63271}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft Web Deploy 3.5 (HKLM\...\{69A998C5-00A9-42CA-AB4E-C31CFFCD9251}) (Version: 3.1237.1763 - Microsoft Corporation)
Microsoft Web Platform Installer 5.0 (HKLM\...\{4D84C195-86F0-4B34-8FDE-4A17EB41306A}) (Version: 5.0.50430.0 - Microsoft Corporation)
Microsoft-System-CLR-Typen für SQL Server 2012 (HKLM-x32\...\{43341417-7882-4F34-8390-53DFD00F6C0F}) (Version: 11.1.3366.16 - Microsoft Corporation)
Microsoft-System-CLR-Typen für SQL Server 2012 (x64) (HKLM\...\{24440413-490E-41CA-BD33-0B30FD3EBE3A}) (Version: 11.1.3366.16 - Microsoft Corporation)
Microsoft-System-CLR-Typen für SQL Server 2014 (HKLM\...\{9408684F-E1CC-4D2E-AE15-886023557682}) (Version: 12.0.2000.8 - Microsoft Corporation)
Microsoft-System-CLR-Typen für SQL Server 2014 (HKLM-x32\...\{B9A7B46F-0120-406B-9A12-3AD1DCC94D97}) (Version: 12.0.2000.8 - Microsoft Corporation)
Minimal ADB and Fastboot version 1.1.3 (HKLM-x32\...\{DE46417A-9E9E-4BCD-BBDD-DA21943193BB}_is1) (Version: 1.1.3 - )
Mouse driver v1.1 (HKLM-x32\...\uni mouse driver) (Version:  - )
Mozilla Firefox 38.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 38.0.1 (x86 de)) (Version: 38.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 31.6.0 - Mozilla)
Mozilla Thunderbird 31.6.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 31.6.0 (x86 de)) (Version: 31.6.0 - Mozilla)
MsgExtract (HKLM-x32\...\MsgExtract) (Version:  - MailDev)
MsgExtract (x32 Version: 2.9.1.649 - MailDev) Hidden
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.7.8.2 - Notepad++ Team)
NVIDIA Grafiktreiber 311.41 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 311.41 - NVIDIA Corporation)
NVIDIA PhysX (HKLM-x32\...\{3F5C371F-8EA2-4F25-9D3D-D0B4526E3AEA}) (Version: 9.10.0513 - NVIDIA Corporation)
NVIDIA Update 1.11.3 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.11.3 - NVIDIA Corporation)
OnlineThreatsEngine (Version: 2.2.3.0 - Lavasoft) Hidden
ooVoo (HKLM-x32\...\{FAA7F8FF-3C05-4A61-8F14-D8A6E9ED6623}) (Version: 3.6.4001 - ooVoo LLC.)
Open XML SDK 2.5 for Microsoft Office (x32 Version: 2.5.5631 - Microsoft Corporation) Hidden
Oracle VM VirtualBox 4.3.10 (HKLM\...\{5632714F-6A48-4BF2-89E0-F8B6CE9FE6D1}) (Version: 4.3.10 - Oracle Corporation)
Origin (HKLM-x32\...\Origin) (Version: 9.4.22.2815 - Electronic Arts, Inc.)
Outils de vérification linguistique 2013 de Microsoft Office*- Français (x32 Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Paket zur Festlegung von Zielversionen für Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM-x32\...\{D5409B11-EF28-37A1-AE7A-6051A5BAD923}) (Version: 4.5.50932 - Microsoft Corporation)
Paket zur Festlegung von Zielversionen für Microsoft .NET Framework 4.5.1 RC für Windows Store-Apps (Deutsch) (x32 Version: 4.5.21005 - Microsoft Corporation) Hidden
PDF Repair Toolbox 2.3 (HKLM-x32\...\PDF Repair Toolbox_is1) (Version:  - Recovery Toolbox, Inc.)
PDF Settings CS5 (x32 Version: 10.0 - Adobe Systems Incorporated) Hidden
PowreShellIntegration.Notifications (x32 Version: 2.5.21003.1603 - Microsoft Corporation) Hidden
PreEmptive Analytics Client German Language Pack (x32 Version: 1.2.3197.1 - PreEmptive Solutions) Hidden
PreEmptive Analytics Visual Studio Components (x32 Version: 1.2.3197.1 - PreEmptive Solutions) Hidden
PuTTY version 0.63 (HKLM-x32\...\PuTTY_is1) (Version: 0.63 - Simon Tatham)
Python Tools - Umleitungsvorlage (x32 Version: 1.3 - Microsoft Corporation) Hidden
RapidBoot HDD Accelerator (HKLM-x32\...\Fastboot) (Version: 2.1.1.0 - Lenovo)
Realtek Card Reader (HKLM-x32\...\{F0A8BF4A-972F-41E0-9800-1EFE3BF28266}) (Version: 6.2.9200.29064 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.3.730.2012 - Realtek)
Release Management for Visual Studio 2013 (x32 Version: 1.0 - Microsoft Corporation) Hidden
SDK de comprobación de Visual Studio 2012 - esn (x32 Version: 12.0.30501 - Microsoft Corporation) Hidden
Secure Download Manager (HKLM-x32\...\{C58626D6-7EBD-460D-8B6C-75B3C3464879}) (Version: 3.1.60 - Kivuto Solutions Inc.)
SharePoint Client Components (HKLM\...\{95150003-1163-0409-1000-0000000FF1CE}) (Version: 15.0.4641.1002 - Microsoft Corporation)
SharePoint Client Components (HKLM\...\{95160002-1163-0409-1000-0000000FF1CE}) (Version: 16.0.3104.1200 - Microsoft Corporation)
Skype™ 7.4 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.4.102 - Skype Technologies S.A.)
Spamihilator 1.6.0 (32-Bit) (HKLM-x32\...\{624CDCC7-9E58-46FE-956B-04A8004A9FCC}) (Version: 1.6.0 - Michel Krämer)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
SQL Server 2008 R2 Analysis Services OLE DB Provider (HKLM-x32\...\{453544C9-9977-4BCD-A1A1-DB457469E18B}) (Version: 10.50.1600.1 - Microsoft Corporation)
SQL Server 2012 Common Files (Version: 11.0.2100.60 - Microsoft Corporation) Hidden
SQL Server 2012 Database Engine Services (Version: 11.0.2100.60 - Microsoft Corporation) Hidden
SQL Server 2012 Database Engine Shared (Version: 11.0.2100.60 - Microsoft Corporation) Hidden
Sql Server Customer Experience Improvement Program (Version: 11.0.2100.60 - Microsoft Corporation) Hidden
SQL Server-Browser für SQL Server 2012 (HKLM-x32\...\{1A4C9497-7D4B-466D-8D3A-FE0D925386DC}) (Version: 11.0.2100.60 - Microsoft Corporation)
SUPERAntiSpyware (HKLM\...\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}) (Version: 6.0.1194 - SUPERAntiSpyware.com)
Synaptics WBF DDK 5011 (HKLM\...\{40CD122C-E6DF-45B1-BA54-4DB9416EFF9B}) (Version: 4.5.266.0 - Synaptics)
Synaptics WBF DDK 5011 (HKLM\...\{4D70781C-36A9-4335-9568-565C6F61B5EB}) (Version: 4.5.266.0 - )
Team Explorer for Microsoft Visual Studio 2013 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.15.1 - TeamSpeak Systems GmbH)
ThinkPad UltraNav Driver (HKLM\...\SynTPDeinstKey) (Version: 18.0.7.34 - Synaptics Incorporated)
ThinkVantage System für aktiven Festplattenschutz (HKLM\...\{46A84694-59EC-48F0-964C-7E76E9F8A2ED}) (Version: 1.77.0.11 - Lenovo)
TypeScript Power Tool (x32 Version: 1.0.5.0 - Microsoft Corporation) Hidden
TypeScript Tools for Microsoft Visual Studio 2013 (x32 Version: 1.0.5.0 - Microsoft Corporation) Hidden
Uninstall Finalizer (x32 Version: 2.4.20730.1601 - Microsoft Corporation) Hidden
Uninstall Finalizer (x32 Version: 2.5.21104.1601 - Microsoft Corporation) Hidden
Unity Web Player (HKU\S-1-5-21-2292532964-2513414724-1275699273-1001\...\UnityWebPlayer) (Version:  - Unity Technologies ApS)
Unity Web Player (HKU\S-1-5-21-2292532964-2513414724-1275699273-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\UnityWebPlayer) (Version:  - Unity Technologies ApS)
Unity Web Player (HKU\S-1-5-21-2292532964-2513414724-1275699273-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\UnityWebPlayer) (Version:  - Unity Technologies ApS)
Unity Web Player (HKU\S-1-5-21-919205647-830002367-3966930364-1135-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\UnityWebPlayer) (Version:  - Unity Technologies ApS)
Unterstützungsdateien für Microsoft SQL Server 2008-Setup  (HKLM\...\{6AF73222-EE90-434C-AE7E-B96F70A68D89}) (Version: 10.1.2731.0 - Microsoft Corporation)
Update for  (KB2504637) (HKLM-x32\...\{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}.KB2504637) (Version: 1 - Microsoft Corporation)
Update for Skype for Business 2015 (KB2889853) 32-Bit Edition (HKLM-x32\...\{90150000-012B-0409-0000-0000000FF1CE}_Office15.PROPLUSR_{BF1B3F01-93F3-4B83-93DB-132EB1AED259}) (Version:  - Microsoft)
VBA (3821b) (x32 Version: 6.01.00.1234 - Microsoft Corporation) Hidden
Visual Studio 2010 Prerequisites - English (HKLM\...\{53952792-BF16-300E-ADF2-E7E4367E00CF}) (Version: 10.0.40219 - Microsoft Corporation)
Visual Studio 2013 Update 4 (KB2829760) (HKLM-x32\...\{53d408db-eb91-43fb-9d8f-167681c19763}) (Version: 12.0.31101 - Microsoft Corporation)
Visual Studio Installer Projects Extension for Microsoft Visual Studio 2013 (HKLM-x32\...\{e50b7054-ce07-4b25-aead-4c7f0f8892d1}) (Version: 12.0.30122 - Microsoft Corporation)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.1 - VideoLAN)
VS Update core components (x32 Version: 12.0.31101 - Microsoft Corporation) Hidden
WampServer 2.5 (HKLM-x32\...\WampServer 2_is1) (Version:  - Hervé Leclerc (HeL))
WCF Data Services 5.6.0 DEU Language Pack (x32 Version: 5.6.61587.0 - Microsoft Corporation) Hidden
WCF Data Services 5.6.0 Runtime (x32 Version: 5.6.61587.0 - Microsoft Corporation) Hidden
WCF Data Services Tools for Microsoft Visual Studio 2013 (x32 Version: 5.6.61587.0 - Microsoft Corporation) Hidden
WCF Data Services Tools for Microsoft Visual Studio 2013 DEU Language Pack (x32 Version: 5.6.61587.0 - Microsoft Corporation) Hidden
WCF RIA Services V1.0 SP2 (HKLM-x32\...\{5D8DD6A8-C4D7-4554-93F9-F1CC28C72600}) (Version: 4.1.62812.0 - Microsoft Corporation)
Win32DiskImager version 0.9.5 (HKLM-x32\...\{D074CE74-912A-4AD3-A0BF-3937D9D01F17}_is1) (Version: 0.9.5 - ImageWriter Developers)
Winamp (HKLM-x32\...\Winamp) (Version: 5.666  - Nullsoft, Inc)
Windows 7 USB/DVD Download Tool (HKLM-x32\...\{CCF298AF-9CE1-4B26-B251-486E98A34789}) (Version: 1.0.30 - Microsoft Corporation)
Windows Azure Storage Emulator - v3.4 (HKLM-x32\...\Windows Azure Storage Emulator - v3.4) (Version: 3.4.6848.0 - Microsoft Corporation)
Windows Phone 8.1 Emulators - ENU (HKLM-x32\...\{166a69f6-6512-47ea-a342-17d954fc059a}) (Version: 12.0.31010.0 - Microsoft Corporation)
Windows-Treiberpaket - Intel Corporation (iaStorA) HDC  (09/01/2012 11.6.0.1030) (HKLM\...\C5447D3383070620C3892FF393F522D6225CBA13) (Version: 09/01/2012 11.6.0.1030 - Intel Corporation)
Windows-Treiberpaket - Lenovo 1.66.00.22 (11/30/2012 1.66.00.22) (HKLM\...\16E722986C4293F5D6BF43595DFFD631398D5F21) (Version: 11/30/2012 1.66.00.22 - Lenovo)
WinRAR 5.10 beta 4 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.10.4 - win.rar GmbH)
WinSCP 5.5.3 (HKLM-x32\...\winscp3_is1) (Version: 5.5.3 - Martin Prikryl)
Wondershare SafeEraser ( Version 2.1.2 ) (HKLM-x32\...\{1FD4D6F6-5A95-44EF-855F-02746470397C}_is1) (Version: 2.1.2 - Wondershare)
Workflow Manager Client 1.0 (Version: 2.0.40131.0 - Microsoft Corporation) Hidden
Workflow Manager Tools 1.0 for Visual Studio (Version: 2.0.40326.0 - Microsoft Corporation) Hidden
WorldPainter 1.10.3 (HKLM\...\4144-4862-0472-7103) (Version: 1.10.3 - pepsoft.org)
Пакет Visual Studio 2012 Verification SDK - rus (x32 Version: 12.0.30501 - Microsoft Corporation) Hidden

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-919205647-830002367-3966930364-1135-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\xxx\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-919205647-830002367-3966930364-1135-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\xxx\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-919205647-830002367-3966930364-1135-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\xxx\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-919205647-830002367-3966930364-1135-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\xxx\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-919205647-830002367-3966930364-1135-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\xxx\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-919205647-830002367-3966930364-1135-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\xxx\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-919205647-830002367-3966930364-1135-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\xxx\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-919205647-830002367-3966930364-1135-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\xxx\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-919205647-830002367-3966930364-1135-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\xxx\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-919205647-830002367-3966930364-1135-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\xxx\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)

==================== Restore Points =========================

29-05-2015 11:21:59 Geplanter Prüfpunkt

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 15:25 - 2014-08-13 08:30 - 00000851 ____A C:\WINDOWS\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {06F792AF-CF44-4EFD-A03F-41664E27B14F} - System32\Tasks\StartPowerDVDService => C:\PROGRAM FILES (x86)\Cyberlink\PowerDVD10\PDVD10Serv.exe
Task: {08B5541A-81BC-4FDB-94D2-04CA1D153E7A} - System32\Tasks\Lenovo\LSC\LSCHardwareScanPostpone => C:\Program Files\Lenovo\Lenovo Solution Center\LSC.exe [2015-03-09] ()
Task: {0BAC6A95-B6E1-42F8-B63A-5D6133184B56} - System32\Tasks\Lenovo\Lenovo Solution Center Launcher => C:\Program Files\lenovo\lenovo solution center\App\LSCService.exe [2015-03-09] (Lenovo)
Task: {10D094F0-5878-4FED-900D-E859FFD69D45} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe [2014-06-24] (Safer-Networking Ltd.)
Task: {1A20B9A4-2DA4-49DB-95B5-9536837AB624} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe [2014-06-24] (Safer-Networking Ltd.)
Task: {1A64DC02-8820-43FD-9AB4-7FB7627CB181} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-05-08] (Google Inc.)
Task: {38338109-CDF6-4E98-91A2-14CFC26517C3} - System32\Tasks\Lenovo\LenovoDependencyVersionTask => C:\Program Files\lenovo\SystemAgent\DependencyVersion.exe [2013-06-05] ()
Task: {383F02F8-71D3-4382-977B-EEAD5F97F647} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe [2014-06-27] (Safer-Networking Ltd.)
Task: {3A4A5CB7-F50D-41F6-83AA-AF41B087D343} - System32\Tasks\SUPERAntiSpyware Scheduled Task dfc0f345-4c50-4aee-adb1-b2fff5208f26 => C:\Program Files\SUPERAntiSpyware\SASTask.exe [2013-11-07] (SUPERAdBlocker.com)
Task: {3DCF1F57-B993-4995-976C-771FCE2402B2} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-21] (Microsoft Corporation)
Task: {47F4EDD1-6E10-4026-92C7-C274DFA81885} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe
Task: {4E6782A1-2F85-4626-A8CD-B8DFD014116D} - System32\Tasks\ProPCCleaner_Popup => C:\Program Files (x86)\Pro PC Cleaner\Splash.exe <==== ATTENTION
Task: {54BBD09A-5AB6-4216-A52A-39C52FC7B93A} - System32\Tasks\SUPERAntiSpyware Scheduled Task ab70ba7d-3101-4914-adbd-0bdd19f63ea1 => C:\Program Files\SUPERAntiSpyware\SASTask.exe [2013-11-07] (SUPERAdBlocker.com)
Task: {6670E955-FE5D-4EFF-A87F-8FC667BD0386} - System32\Tasks\Lenovo\LenovoWarrantyChinaTask => C:\Program Files\lenovo\SystemAgent\ChinaWarrantyService.exe [2013-06-05] ()
Task: {8170BCD5-7732-4208-A4D3-AFB70ED5866E} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-21] (Microsoft Corporation)
Task: {914B09C1-FCC4-43F2-A557-C586C079B661} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\OutOfIdle => C:\Windows\system32\GWX\GWX.exe [2015-05-06] (Microsoft Corporation)
Task: {91A95959-AB3F-494D-A59B-BABD58BE08B0} - System32\Tasks\Lenovo\LenovoMachineInformation => C:\Program Files\lenovo\SystemAgent\MachineInformation.exe [2013-06-05] ()
Task: {92A8455B-ACC6-4830-8207-C442D7F71596} - System32\Tasks\Lenovo\LSC\Lenovo Solution Center Notifications => C:\Program Files\Lenovo\Lenovo Solution Center\LSCNotify.exe [2015-03-09] (Lenovo)
Task: {A1E57457-FF9D-4D48-9DD5-D6A77057D063} - System32\Tasks\Intel(R) Small Business Advantage\Notifier => C:\Program Files\Intel\Intel(R) Small Business Advantage\UI\SBA_Notifier.exe [2013-04-10] (Intel Corporation)
Task: {A5469FCA-C05C-4376-8A3B-449A18E801F7} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\Logon => C:\Windows\system32\GWX\GWX.exe [2015-05-06] (Microsoft Corporation)
Task: {AE1F0B98-E9E6-4D8F-B5A0-6698CBAE7243} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-05-06] (Microsoft Corporation)
Task: {B1DE91FA-62B0-44C7-86DB-2F6A617A69B6} - System32\Tasks\Lenovo\LSC\LSCHardwareScan => C:\Program Files\Lenovo\Lenovo Solution Center\LSC.exe [2015-03-09] ()
Task: {B2C56685-A44E-4FE6-B2C3-FF735A85464C} - System32\Tasks\Microsoft\Windows\GroupPolicy\{3E0A038B-D834-4930-9981-E89C9BFF83AA}
Task: {B40C2DB7-1DD2-469D-A4FD-D57EAFE3A876} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-05-08] (Google Inc.)
Task: {B74CCD64-87DF-4F91-A69C-5B5DEAE9D674} - System32\Tasks\Lenovo\LSC\RebootCountTask => C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCService.exe [2015-03-09] (Lenovo)
Task: {B92C9630-C2FD-489F-9478-4F91736A369A} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program => C:\Program Files\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe
Task: {BE92E342-FB43-499D-84F4-6185F8B9ACDF} - System32\Tasks\Overwolf Updater Task => C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe [2015-05-04] (Overwolf LTD)
Task: {C15ED66A-782D-4296-A9BB-BEF86CFD876F} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {CF9618F8-2595-4DD1-A872-E2CC173F97EF} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-05-13] (Microsoft Corporation)
Task: {D27CC8AA-11FB-415F-80A5-5FD5E9B347B4} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-05-06] (Microsoft Corporation)
Task: {D2F3FF1C-BB13-48F4-ABEE-BFC8AB4D6C83} - System32\Tasks\ProPCCleaner_Start => C:\Program Files (x86)\Pro PC Cleaner\ProPCCleaner.exe <==== ATTENTION
Task: {DEF840D5-7C7C-4EC6-8C9E-CE68FBDC5064} - System32\Tasks\Lenovo\LSC\Time72Task => C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCService.exe [2015-03-09] (Lenovo)
Task: {DF3EAF75-093E-4ED3-BFDD-236E9EF096ED} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-04-23] (Piriform Ltd)
Task: {E09CC6B5-D0A8-4D09-8EA3-42CA3FAA9426} - System32\Tasks\Lenovo\Experience Improvement => C:\Program Files\Lenovo\ExperienceImprovement\LenovoExperienceImprovement.exe [2013-03-13] (Lenovo)
Task: {EBB160C9-557F-4167-81FF-91A224114982} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B => schtasks
Task: {ED1747FD-6549-4BB8-9072-E40DEE347C39} - System32\Tasks\Lenovo\LenovoUserguidesCopy => C:\Program Files\lenovo\SystemAgent\UserguidesCopy.exe [2013-06-05] ()
Task: {F08CC1D4-4563-45B1-A5AC-3D8C647A7A2A} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program 64 => C:\Program Files (x86)\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe [2014-02-13] (Lenovo)
Task: {F572AB57-11F2-44AA-8D71-11BC2D45D32A} - System32\Tasks\Lenovo\Lenovo Settings Power => Rundll32.exe "C:\Program Files (x86)\ThinkPad\Utilities\PWMTR64V.dll",PwrMgrBkGndMonitor
Task: {F5D211BD-4A3A-4EA5-A6F6-923D38DBCA7D} - System32\Tasks\AdobeAAMUpdater-1.0-XXX-xxx => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2010-03-06] (Adobe Systems Incorporated)
Task: {F9DD4F9F-3F8F-42AD-A536-82C83E86AE97} - System32\Tasks\TVT\TVSUUpdateTask => C:\Program Files (x86)\Lenovo\System Update\tvsuShim.exe [2014-06-18] ()
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\SUPERAntiSpyware Scheduled Task ab70ba7d-3101-4914-adbd-0bdd19f63ea1.job => C:\Program Files\SUPERAntiSpyware\SASTask.exedC:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe /TASK:ab70ba7d-3101-4914-adbd-0bdd19f63ea1XXX\xxx
Task: C:\WINDOWS\Tasks\SUPERAntiSpyware Scheduled Task dfc0f345-4c50-4aee-adb1-b2fff5208f26.job => C:\Program Files\SUPERAntiSpyware\SASTask.exedC:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe /TASK:dfc0f345-4c50-4aee-adb1-b2fff5208f26XXX\xxx
Task: C:\WINDOWS\Tasks\Synaptics TouchPad Enhancements.job => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

==================== Loaded Modules (Whitelisted) ==============

2013-12-26 19:42 - 2013-12-26 19:42 - 00013088 _____ () C:\Program Files\NVIDIA Corporation\CoProcManager\detoured.dll
2014-05-15 16:56 - 2015-01-16 08:49 - 00118272 ____N () C:\Program Files (x86)\ThinkPad\Utilities\GR\PWMRT64V.dll
2015-03-10 18:47 - 2015-03-10 18:47 - 00720760 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareService.exe
2015-03-10 18:51 - 2015-03-10 18:51 - 00107024 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\boost_thread-vc100-mt-1_57.dll
2015-03-10 18:51 - 2015-03-10 18:51 - 00024080 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\boost_system-vc100-mt-1_57.dll
2015-03-10 18:51 - 2015-03-10 18:51 - 00055320 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\boost_date_time-vc100-mt-1_57.dll
2015-03-10 18:51 - 2015-03-10 18:51 - 00125464 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\boost_filesystem-vc100-mt-1_57.dll
2015-03-10 18:51 - 2015-03-10 18:51 - 00033296 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\boost_chrono-vc100-mt-1_57.dll
2015-03-10 18:50 - 2015-03-10 18:50 - 12745216 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareServiceKernel.dll
2015-03-10 18:50 - 2015-03-10 18:50 - 03396064 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\RCF.dll
2015-03-10 18:51 - 2015-03-10 18:51 - 00785936 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\boost_regex-vc100-mt-1_57.dll
2015-03-10 18:50 - 2015-03-10 18:50 - 00744960 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareActivation.dll
2015-03-10 18:50 - 2015-03-10 18:50 - 00480272 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareApplicationUpdater.dll
2015-03-10 18:50 - 2015-03-10 18:50 - 00812032 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareGamingMode.dll
2015-03-10 18:50 - 2015-03-10 18:50 - 00099312 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareReset.dll
2015-03-10 18:50 - 2015-03-10 18:50 - 00119792 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareTime.dll
2015-03-10 18:50 - 2015-03-10 18:50 - 00963088 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareDefinitionsUpdater.dll
2015-03-10 18:50 - 2015-03-10 18:50 - 00868896 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareDefinitionsUpdaterScheduler.dll
2015-03-10 18:50 - 2015-03-10 18:50 - 01108992 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareIgnoreList.dll
2015-03-10 18:50 - 2015-03-10 18:50 - 00247808 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareQuarantine.dll
2015-03-10 18:50 - 2015-03-10 18:50 - 01013256 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareAntiMalwareEngine.dll
2015-03-10 18:50 - 2015-03-10 18:50 - 00211464 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareAntiRootkitEngine.dll
2015-03-10 18:50 - 2015-03-10 18:50 - 01177608 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareScannerHistory.dll
2015-03-10 18:50 - 2015-03-10 18:50 - 01302008 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareScanner.dll
2015-03-10 18:51 - 2015-03-10 18:51 - 00034832 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\boost_timer-vc100-mt-1_57.dll
2015-03-10 18:50 - 2015-03-10 18:50 - 00977416 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareScannerScheduler.dll
2015-03-10 18:50 - 2015-03-10 18:50 - 01143824 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareRealTimeProtection.dll
2015-03-10 18:50 - 2015-03-10 18:50 - 00237568 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareIncompatibles.dll
2015-03-10 18:50 - 2015-03-10 18:50 - 00893432 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareAntiSpam.dll
2015-03-10 18:50 - 2015-03-10 18:50 - 00847872 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareAntiPhishing.dll
2015-03-10 18:50 - 2015-03-10 18:50 - 03104776 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareParentalControl.dll
2015-03-10 18:50 - 2015-03-10 18:50 - 02958848 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareWebProtection.dll
2015-03-10 18:50 - 2015-03-10 18:50 - 01288712 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareEmailProtection.dll
2015-03-10 18:51 - 2015-03-10 18:51 - 00053272 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\boost_iostreams-vc100-mt-1_57.dll
2015-03-10 18:50 - 2015-03-10 18:50 - 01293832 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareNetworkProtection.dll
2015-03-10 18:50 - 2015-03-10 18:50 - 00969200 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwarePromo.dll
2015-03-10 18:50 - 2015-03-10 18:50 - 00366584 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareFeedback.dll
2015-03-10 18:50 - 2015-03-10 18:50 - 02787344 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareThreatWorkAlliance.dll
2015-03-10 18:50 - 2015-03-10 18:50 - 01232888 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwarePinCode.dll
2015-03-10 18:50 - 2015-03-10 18:50 - 00969208 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareNotice.dll
2015-03-10 18:50 - 2015-03-10 18:50 - 00963576 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareAvcEngine.dll
2015-03-10 18:50 - 2015-03-10 18:50 - 01184792 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareRealTimeProtectionHistory.dll
2015-05-29 17:09 - 2015-01-06 12:47 - 00156936 _____ () C:\WINDOWS\SYSTEM32\bdfwcore.dll
2015-05-29 17:19 - 2015-05-29 17:19 - 00789856 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Online Threats Engine\2.2.3.0\definitions\loc2\ashttpbr.mdl
2015-05-29 17:19 - 2015-05-29 17:19 - 00710016 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Online Threats Engine\2.2.3.0\definitions\loc2\ashttpdsp.mdl
2015-05-29 17:19 - 2015-05-29 17:19 - 02683008 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Online Threats Engine\2.2.3.0\definitions\loc2\ashttpph.mdl
2015-05-29 17:19 - 2015-05-29 17:19 - 01325480 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Online Threats Engine\2.2.3.0\definitions\loc2\ashttprbl.mdl
2015-03-18 14:08 - 2015-03-18 14:08 - 08898720 _____ () C:\Program Files\Microsoft Office\Office15\1033\GrooveIntlResource.dll
2015-03-10 18:50 - 2015-03-10 18:50 - 02756616 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareShellExtension.dll
2015-04-15 22:13 - 2015-04-15 22:13 - 00222720 _____ () C:\Program Files (x86)\Notepad++\NppShell_06.dll
2014-05-15 16:56 - 2015-01-16 08:49 - 00118272 ____N () C:\Program Files (x86)\ThinkPad\Utilities\GR\PWMRT64V.DLL
2014-01-25 02:22 - 2014-01-25 02:22 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2015-03-10 18:50 - 2015-03-10 18:50 - 09566192 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareTray.exe
2015-03-10 18:51 - 2015-03-10 18:51 - 00499728 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\boost_locale-vc100-mt-1_57.dll
2015-03-10 18:50 - 2015-03-10 18:50 - 02144248 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\HtmlFramework.dll
2015-03-10 18:50 - 2015-03-10 18:50 - 00869896 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareTrayDefaultSkin.dll
2015-04-13 05:08 - 2015-04-13 05:08 - 01634296 _____ () C:\Program Files (x86)\Hama Mouse Assistant\mouse_driver.exe
2014-07-03 13:20 - 2014-07-03 13:20 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-07-03 13:19 - 2014-07-03 13:19 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2014-02-13 04:18 - 2014-02-13 04:18 - 00033520 ____N () C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBServiceps.dll
2015-05-30 14:28 - 2014-05-13 12:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2015-05-30 14:28 - 2014-05-13 12:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2015-05-30 14:28 - 2014-05-13 12:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2015-05-30 14:28 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2015-05-30 14:28 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2015-02-01 05:44 - 2014-10-31 17:37 - 01498112 _____ () C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\DAQExp.dll
2015-02-01 05:44 - 2014-05-19 18:19 - 00137728 _____ () C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\CBSCreateVC.dll
2014-02-13 03:54 - 2012-07-18 20:55 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2015-05-26 03:08 - 2015-05-22 22:22 - 01281864 _____ () C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.81\libglesv2.dll
2015-05-26 03:08 - 2015-05-22 22:22 - 00080712 _____ () C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.81\libegl.dll
2015-05-26 03:08 - 2015-05-22 22:22 - 14982472 _____ () C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.81\PepperFlash\pepflashplayer.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

==================== Safe Mode (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mbamchameleon => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mbamchameleon => ""="Driver"

==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2292532964-2513414724-1275699273-1001\Control Panel\Desktop\\Wallpaper -> 
HKU\S-1-5-21-2292532964-2513414724-1275699273-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Control Panel\Desktop\\Wallpaper -> 
HKU\S-1-5-21-2292532964-2513414724-1275699273-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Control Panel\Desktop\\Wallpaper -> C:\WINDOWS\web\wallpaper\Lenovo\thinkdesktop.png
HKU\S-1-5-21-919205647-830002367-3966930364-1135-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Control Panel\Desktop\\Wallpaper -> C:\WINDOWS\web\wallpaper\Windows\img0.jpg
DNS Servers: 10.0.0.138

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\Services: LocationTaskManager => 2
MSCONFIG\Services: MyWiFiDHCPDNS => 3
MSCONFIG\Services: SUService => 3

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{242470B5-31E0-48E6-9EE5-29905C943162}] => (Allow) C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
FirewallRules: [{1CBC94E5-E109-4AB9-9FFD-3BA7925F2779}] => (Allow) C:\Program Files\Intel Corporation\Intel WiDi\WiDiApp.exe
FirewallRules: [{D7CFA47A-EF44-4BE2-A45F-2909F7B547A6}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [{77A45614-A6B7-472B-BF7D-4AAA2B6AFCBD}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppextcomobj.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppextcomobj.exe
FirewallRules: [{2C76795B-E1E3-4CE5-B3C4-AF7D0B8F6AE5}] => (Allow) C:\Program Files (x86)\Microsoft Visual Studio 12.0\Common7\IDE\devenv.exe
FirewallRules: [{33B495CD-7F80-4862-974F-DC2AF9224E1B}] => (Allow) C:\Program Files (x86)\Microsoft Visual Studio 12.0\Common7\IDE\devenv.exe
FirewallRules: [{1F548C80-DB33-4C1E-B770-C5C0D2792DB6}] => (Allow) C:\Program Files (x86)\Microsoft Visual Studio 12.0\Common7\IDE\devenv.exe
FirewallRules: [{E7DA9979-34FB-4972-8495-58D403F27254}] => (Allow) C:\Program Files (x86)\Microsoft Visual Studio 12.0\Common7\IDE\devenv.exe
FirewallRules: [{D9DD56BB-0B2D-4E23-B999-34EC54E2135B}] => (Allow) C:\Program Files (x86)\Microsoft Visual Studio 12.0\Common7\IDE\devenv.exe
FirewallRules: [{7C394281-95F1-4558-B478-D5928375574F}] => (Allow) C:\Program Files (x86)\Microsoft Visual Studio 12.0\Common7\IDE\devenv.exe
FirewallRules: [{5A43ACC2-0701-4F23-A480-61C065895359}] => (Allow) C:\Program Files (x86)\Microsoft Visual Studio 12.0\Common7\IDE\devenv.exe
FirewallRules: [{1FC9651E-8A31-4CD1-98E6-E185A9237CC2}] => (Allow) C:\Program Files (x86)\Microsoft Office\Office15\lync.exe
FirewallRules: [{177AF74D-31DC-4BB8-BED1-898BE6B923F3}] => (Allow) C:\Program Files (x86)\Microsoft Office\Office15\lync.exe
FirewallRules: [{FEF842C2-149D-400C-A6F3-B599C5B59A76}] => (Allow) C:\Program Files (x86)\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{35129276-AC4E-4BEF-8AFB-91F5562A27F0}] => (Allow) C:\Program Files (x86)\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [TCP Query User{3787E2D0-F9D0-49F5-884C-56EE080F3777}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [UDP Query User{10F107ED-3416-4909-B75A-A1CB46FB1677}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [{EA02D0AE-F9DB-4C78-B6DF-2D5456E060D7}] => (Allow) C:\Program Files (x86)\Microsoft Office\Office15\lync.exe
FirewallRules: [{C4C077A5-A186-4109-900E-35394D0A88F7}] => (Allow) C:\Program Files (x86)\Microsoft Office\Office15\lync.exe
FirewallRules: [{F1DD2171-22AE-423F-8596-48274C48AA6E}] => (Allow) C:\Program Files (x86)\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{38B81253-ADF3-4D86-A732-281A2F75E9E4}] => (Allow) C:\Program Files (x86)\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [TCP Query User{73D1F921-211B-423B-9589-A391CCF49752}C:\program files\java\jre8\bin\javaw.exe] => (Allow) C:\program files\java\jre8\bin\javaw.exe
FirewallRules: [UDP Query User{9C145ED3-3179-4CFF-9840-866F7372C545}C:\program files\java\jre8\bin\javaw.exe] => (Allow) C:\program files\java\jre8\bin\javaw.exe
FirewallRules: [TCP Query User{90216F89-6ACE-44C7-820A-14C4CDEA7D37}C:\program files\dassault systemes\b19\win_b64\code\bin\orbixd.exe] => (Allow) C:\program files\dassault systemes\b19\win_b64\code\bin\orbixd.exe
FirewallRules: [UDP Query User{1FD09EF0-8A2B-45B5-91F4-33FB8B1BC4CC}C:\program files\dassault systemes\b19\win_b64\code\bin\orbixd.exe] => (Allow) C:\program files\dassault systemes\b19\win_b64\code\bin\orbixd.exe
FirewallRules: [TCP Query User{BC462EFE-1716-4F69-8DF7-5CCBCE4C1946}C:\program files\dassault systemes\b19\win_b64\code\bin\cnext.exe] => (Allow) C:\program files\dassault systemes\b19\win_b64\code\bin\cnext.exe
FirewallRules: [UDP Query User{1CACF24E-81B1-4066-887E-D0DE4AB92975}C:\program files\dassault systemes\b19\win_b64\code\bin\cnext.exe] => (Allow) C:\program files\dassault systemes\b19\win_b64\code\bin\cnext.exe
FirewallRules: [TCP Query User{9974E944-8071-4A57-9649-138722BEFA5C}C:\program files\dassault systemes\b19\win_b64\code\bin\catsysdemon.exe] => (Block) C:\program files\dassault systemes\b19\win_b64\code\bin\catsysdemon.exe
FirewallRules: [UDP Query User{38075A48-FC94-4CBE-A5A5-BFB3A5E1D6B6}C:\program files\dassault systemes\b19\win_b64\code\bin\catsysdemon.exe] => (Block) C:\program files\dassault systemes\b19\win_b64\code\bin\catsysdemon.exe
FirewallRules: [TCP Query User{E95AAE43-1DC2-4387-94B7-24DBBF7F148F}C:\program files\dassault systemes\b19\win_b64\code\bin\catutil.exe] => (Block) C:\program files\dassault systemes\b19\win_b64\code\bin\catutil.exe
FirewallRules: [UDP Query User{6B953EFB-531F-4D12-B006-191B5A8B8C59}C:\program files\dassault systemes\b19\win_b64\code\bin\catutil.exe] => (Block) C:\program files\dassault systemes\b19\win_b64\code\bin\catutil.exe
FirewallRules: [TCP Query User{1661030B-EA8B-41B6-8932-0B2DAF4C698A}C:\program files\dassault systemes\b19\win_b64\code\bin\catbatchstarter.exe] => (Block) C:\program files\dassault systemes\b19\win_b64\code\bin\catbatchstarter.exe
FirewallRules: [UDP Query User{52371082-0C21-4F5F-9112-026440E48F9A}C:\program files\dassault systemes\b19\win_b64\code\bin\catbatchstarter.exe] => (Block) C:\program files\dassault systemes\b19\win_b64\code\bin\catbatchstarter.exe
FirewallRules: [{C24B5D7D-EA68-40AC-805F-7EE2E3DE4EAC}] => (Allow) C:\Program Files (x86)\Winamp\winamp.exe
FirewallRules: [{2A27B08A-0777-443E-8BAE-FC562146A04C}] => (Allow) C:\Program Files (x86)\Winamp\winamp.exe
FirewallRules: [{1A598A3F-0A77-47C2-8B59-4A6EE06A905A}] => (Allow) C:\Program Files (x86)\Winamp\winamp.exe
FirewallRules: [{C400173B-C4B8-452F-BF5D-B59038118EF3}] => (Allow) C:\Program Files (x86)\Winamp\winamp.exe
FirewallRules: [TCP Query User{719C61E6-C1DC-4559-8AD4-6C4547DB2179}C:\program files\java\jre8\bin\java.exe] => (Allow) C:\program files\java\jre8\bin\java.exe
FirewallRules: [UDP Query User{3FD2016E-DF0D-46FD-BBF3-6AA9E0BB83E9}C:\program files\java\jre8\bin\java.exe] => (Allow) C:\program files\java\jre8\bin\java.exe
FirewallRules: [{2C192423-97DD-4A0A-A203-D764CFAEEE1D}] => (Allow) C:\Users\xxx\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{C4D975D5-B66E-4A4F-BC17-1B7530C9876D}] => (Allow) C:\Users\xxx\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{DE875B9C-FF58-4EAC-B11F-54625F9D9EBA}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{35EC2319-902A-47ED-BE27-2E3C37D4C7B1}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{FCEFB336-CF51-429D-9F42-8B7E9CBEE25F}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{9DA7FD3B-E054-4635-A345-0B62387AC32B}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{6019E249-98D6-4C50-A3C2-C82C26120301}] => (Allow) C:\Program Files (x86)\iTunes\iTunes.exe
FirewallRules: [{3483FDFB-8BEA-4E9F-86D6-623FB8FFBDA6}] => (Allow) C:\Program Files (x86)\Lenovo\System Update\uncserver.exe
FirewallRules: [{8B659235-ADD0-46C5-98EF-79E823452DDD}] => (Allow) C:\Program Files (x86)\Lenovo\System Update\uncserver.exe
FirewallRules: [{DABB5380-FEC7-4F88-ADFD-DE809728A491}] => (Allow) LPort=16021
FirewallRules: [{168DD390-ABCD-45D2-8ADE-0B928FDF516F}] => (Allow) LPort=12292
FirewallRules: [{ACAD0436-57E3-4205-A019-B7622FFA306F}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{D169A576-D685-4780-98E9-6CC3BA0DC9B3}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{B32D5C53-F093-4BB5-9B87-EA1C6A329100}C:\program files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{0E0B4E94-13C2-4FA8-B89F-B664862F9E01}C:\program files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [{2863FB7C-F029-4A61-95FC-F621552A4079}] => (Allow) C:\Program Files (x86)\Spamihilator\spamihilator.exe
FirewallRules: [{D34C3F29-0D64-4F7F-8836-41CAC19E8EC2}] => (Allow) C:\Program Files (x86)\Spamihilator\cdcc.exe
FirewallRules: [{D2084B2E-B7D6-4DD0-A5FE-84543CEE6047}] => (Allow) C:\Program Files (x86)\Spamihilator\dccproc.exe
FirewallRules: [{26D76030-DF77-4293-8223-33A8C3B656FF}] => (Allow) %systemroot%\system32\alg.exe
FirewallRules: [{9BF0448B-83AB-49A7-B7DA-265C3738052A}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe] => Enabled:Spybot - Search & Destroy tray access
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe] => Enabled:Spybot-S&D 2 Scanner Service
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe] => Enabled:Spybot-S&D 2 Updater
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe] => Enabled:Spybot-S&D 2 Background update service

==================== Faulty Device Manager Devices =============

Name: IWD Bus Enumerator
Description: IWD Bus Enumerator
Class Guid: {4d36e97d-e325-11ce-bfc1-08002be10318}
Manufacturer: (Standard system devices)
Service: iwdbus
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver


==================== Event log errors: =========================

Application errors:
==================
Error: (06/01/2015 09:15:33 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: mbar.exe, Version: 1.9.1.1004, Zeitstempel: 0x54d5665f
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.3.9600.17736, Zeitstempel: 0x550f42c2
Ausnahmecode: 0xc00000fd
Fehleroffset: 0x00048e18
ID des fehlerhaften Prozesses: 0x19bc
Startzeit der fehlerhaften Anwendung: 0xmbar.exe0
Pfad der fehlerhaften Anwendung: mbar.exe1
Pfad des fehlerhaften Moduls: mbar.exe2
Berichtskennung: mbar.exe3
Vollständiger Name des fehlerhaften Pakets: mbar.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: mbar.exe5

Error: (06/01/2015 08:53:39 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: ResEdit.exe, Version: 1.6.6.0, Zeitstempel: 0x55440b92
Name des fehlerhaften Moduls: ResEdit.exe, Version: 1.6.6.0, Zeitstempel: 0x55440b92
Ausnahmecode: 0x40000015
Fehleroffset: 0x00000000000b40b9
ID des fehlerhaften Prozesses: 0xdc4
Startzeit der fehlerhaften Anwendung: 0xResEdit.exe0
Pfad der fehlerhaften Anwendung: ResEdit.exe1
Pfad des fehlerhaften Moduls: ResEdit.exe2
Berichtskennung: ResEdit.exe3
Vollständiger Name des fehlerhaften Pakets: ResEdit.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: ResEdit.exe5

Error: (06/01/2015 08:30:24 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: XXX-XXX)
Description: Bei der Aktivierung der App „winstore_cw5n1h2txyewy!Windows.Store“ ist folgender Fehler aufgetreten: -2144927149. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (06/01/2015 08:22:24 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: ResEdit.exe, Version: 1.6.6.0, Zeitstempel: 0x55440b92
Name des fehlerhaften Moduls: ResEdit.exe, Version: 1.6.6.0, Zeitstempel: 0x55440b92
Ausnahmecode: 0x40000015
Fehleroffset: 0x00000000000b40b9
ID des fehlerhaften Prozesses: 0x1930
Startzeit der fehlerhaften Anwendung: 0xResEdit.exe0
Pfad der fehlerhaften Anwendung: ResEdit.exe1
Pfad des fehlerhaften Moduls: ResEdit.exe2
Berichtskennung: ResEdit.exe3
Vollständiger Name des fehlerhaften Pakets: ResEdit.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: ResEdit.exe5

Error: (06/01/2015 07:57:32 AM) (Source: Microsoft-Windows-LocationProvider) (EventID: 2006) (User: NT-AUTORITÄT)
Description: There was an error with the Windows Location Provider database

Error: (06/01/2015 07:51:41 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: LnvHotSpotSvc.exe, Version: 2.3.0.83, Zeitstempel: 0x5317b709
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.3.9600.17736, Zeitstempel: 0x550f4336
Ausnahmecode: 0xc00000fd
Fehleroffset: 0x000000000003f69f
ID des fehlerhaften Prozesses: 0x1ad4
Startzeit der fehlerhaften Anwendung: 0xLnvHotSpotSvc.exe0
Pfad der fehlerhaften Anwendung: LnvHotSpotSvc.exe1
Pfad des fehlerhaften Moduls: LnvHotSpotSvc.exe2
Berichtskennung: LnvHotSpotSvc.exe3
Vollständiger Name des fehlerhaften Pakets: LnvHotSpotSvc.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: LnvHotSpotSvc.exe5

Error: (05/31/2015 07:36:07 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: Fehler beim Erstellen des Wiederherstellungspunkts (Prozess = C:\WINDOWS\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.3.9600.17709_none_fa7932f59afc2e40\TiWorker.exe -Embedding; Beschreibung = Windows Modules Installer; Fehler = 0x8007043c).

Error: (05/30/2015 06:24:17 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: MachineInformation.exe, Version: 1.5.37.0, Zeitstempel: 0x51af959a
Name des fehlerhaften Moduls: clr.dll, Version: 4.0.30319.34014, Zeitstempel: 0x52e0b784
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000f771
ID des fehlerhaften Prozesses: 0x1694
Startzeit der fehlerhaften Anwendung: 0xMachineInformation.exe0
Pfad der fehlerhaften Anwendung: MachineInformation.exe1
Pfad des fehlerhaften Moduls: MachineInformation.exe2
Berichtskennung: MachineInformation.exe3
Vollständiger Name des fehlerhaften Pakets: MachineInformation.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: MachineInformation.exe5

Error: (05/30/2015 06:24:16 PM) (Source: .NET Runtime) (EventID: 1023) (User: )
Description: Anwendung: MachineInformation.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund eines internen Fehlers in der .NET-Laufzeit beendet. bei IP 71F7F771 (71F70000) mit Exitcode 80131506.

Error: (05/30/2015 06:16:01 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: LnvHotSpotSvc.exe, Version: 2.3.0.83, Zeitstempel: 0x5317b709
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.3.9600.17736, Zeitstempel: 0x550f4336
Ausnahmecode: 0xc00000fd
Fehleroffset: 0x000000000003f69f
ID des fehlerhaften Prozesses: 0x112c
Startzeit der fehlerhaften Anwendung: 0xLnvHotSpotSvc.exe0
Pfad der fehlerhaften Anwendung: LnvHotSpotSvc.exe1
Pfad des fehlerhaften Moduls: LnvHotSpotSvc.exe2
Berichtskennung: LnvHotSpotSvc.exe3
Vollständiger Name des fehlerhaften Pakets: LnvHotSpotSvc.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: LnvHotSpotSvc.exe5


System errors:
=============
Error: (06/01/2015 08:00:34 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80246013 fehlgeschlagen: eBayInc.eBay

Error: (06/01/2015 08:00:22 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80246013 fehlgeschlagen: Microsoft.SkypeApp

Error: (06/01/2015 08:00:22 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80246013 fehlgeschlagen: E046963F.LenovoSupport

Error: (06/01/2015 08:00:05 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "LnvMHService" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (06/01/2015 07:54:02 AM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde nicht richtig gestartet.

Error: (06/01/2015 07:48:30 AM) (Source: Microsoft-Windows-GroupPolicy) (EventID: 1129) (User: NT-AUTORITÄT)
Description: Bei der Verarbeitung der Gruppenrichtlinie ist aufgrund fehlender Netzwerkkonnektivität mit einem Domänencontroller ein Fehler aufgetreten. Dies kann eine vorübergehende Bedingung sein. Es wird eine Erfolgsmeldung generiert, wenn die Verbindung des Computers mit dem Domänencontroller wiederhergestellt wurde und wenn die Gruppenrichtlinie erfolgreich verarbeitet wurde. Falls für mehrere Stunden keine Erfolgsmeldung angezeigt wird, wenden Sie sich an den Administrator.

Error: (06/01/2015 07:46:28 AM) (Source: NETLOGON) (EventID: 5719) (User: )
Description: Der Computer konnte eine sichere Sitzung mit einem
Domänencontroller in der Domäne xxx aufgrund der folgenden
Ursache nicht einrichten: 
%%1311

Dies kann zu Authentifizierungsproblemen führen. Stellen
Sie sicher, dass der Computer mit dem Netzwerk verbunden ist.
Wenden Sie sich an den Domänenadministrator, wenn das Problem
weiterhin besteht.



ZUSÄTZLICHE INFORMATIONEN

Wenn dieser Computer ein Domänencontroller der bestimmten
Domäne ist, wird eine sichere Sitzung zum primären
Domänencontrolleremulator in der bestimmten Domäne eingerichtet.
Andernfalls richtet dieser Computer eine sichere Sitzung zu
einem beliebigen Domänencontroller in der bestimmten Domäne ein.

Error: (06/01/2015 07:46:05 AM) (Source: BTHUSB) (EventID: 30) (User: )
Description: Der lokale Adapter bietet keine Unterstützung für einen wichtigen Controllerstatus für energiearme Geräte. Die mindestens erforderliche unterstützte Statusmaske ist "0x1f7fffff", vorhanden ist jedoch "0x1f3fffff". Die Funktionalität für energiearme Geräte wird deaktiviert.

Error: (06/01/2015 07:42:59 AM) (Source: DCOM) (EventID: 10005) (User: )
Description: 1084WSearchNicht verfügbar{9E175B68-F52A-11D8-B9A5-505054503030}

Error: (06/01/2015 07:42:59 AM) (Source: DCOM) (EventID: 10005) (User: )
Description: 1084ShellHWDetectionNicht verfügbar{DD522ACC-F821-461A-A407-50B198B896DC}


Microsoft Office:
=========================
Error: (06/01/2015 09:15:33 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: mbar.exe1.9.1.100454d5665fntdll.dll6.3.9600.17736550f42c2c00000fd00048e1819bc01d09c3172a0d7f9C:\Users\Administrator\Desktop\mbar\mbar.exeC:\WINDOWS\SYSTEM32\ntdll.dllfd943789-082d-11e5-bedb-00c2c63a0efc

Error: (06/01/2015 08:53:39 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: ResEdit.exe1.6.6.055440b92ResEdit.exe1.6.6.055440b924000001500000000000b40b9dc401d09c3353e92f3dC:\Users\Administrator\Downloads\ResEdit-x64\ResEdit.exeC:\Users\Administrator\Downloads\ResEdit-x64\ResEdit.exeee66b416-082a-11e5-bedb-00c2c63a0efc

Error: (06/01/2015 08:30:24 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: XXX-XXX)
Description: winstore_cw5n1h2txyewy!Windows.Store-2144927149

Error: (06/01/2015 08:22:24 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: ResEdit.exe1.6.6.055440b92ResEdit.exe1.6.6.055440b924000001500000000000b40b9193001d09c32998a97f0C:\Users\Administrator\Downloads\ResEdit-x64\ResEdit.exeC:\Users\Administrator\Downloads\ResEdit-x64\ResEdit.exe90f85cd5-0826-11e5-bedb-00c2c63a0efc

Error: (06/01/2015 07:57:32 AM) (Source: Microsoft-Windows-LocationProvider) (EventID: 2006) (User: NT-AUTORITÄT)
Description: -2147024883

Error: (06/01/2015 07:51:41 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: LnvHotSpotSvc.exe2.3.0.835317b709ntdll.dll6.3.9600.17736550f4336c00000fd000000000003f69f1ad401d09c2efe612d05C:\Program Files\Lenovo\Lenovo Mobile Hotspot\LnvHotSpotSvc.exeC:\WINDOWS\SYSTEM32\ntdll.dll465b0dec-0822-11e5-bedb-00c2c63a0efc

Error: (05/31/2015 07:36:07 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: C:\WINDOWS\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.3.9600.17709_none_fa7932f59afc2e40\TiWorker.exe -EmbeddingWindows Modules Installer0x8007043c

Error: (05/30/2015 06:24:17 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: MachineInformation.exe1.5.37.051af959aclr.dll4.0.30319.3401452e0b784c00000050000f771169401d09af5127d8458C:\Program Files\lenovo\SystemAgent\MachineInformation.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll50e40988-06e8-11e5-bed9-00c2c63a0efc

Error: (05/30/2015 06:24:16 PM) (Source: .NET Runtime) (EventID: 1023) (User: )
Description: Anwendung: MachineInformation.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund eines internen Fehlers in der .NET-Laufzeit beendet. bei IP 71F7F771 (71F70000) mit Exitcode 80131506.

Error: (05/30/2015 06:16:01 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: LnvHotSpotSvc.exe2.3.0.835317b709ntdll.dll6.3.9600.17736550f4336c00000fd000000000003f69f112c01d09af3e68eeb2fC:\Program Files\Lenovo\Lenovo Mobile Hotspot\LnvHotSpotSvc.exeC:\WINDOWS\SYSTEM32\ntdll.dll299b44d4-06e7-11e5-bed9-00c2c63a0efc


CodeIntegrity Errors:
===================================
  Date: 2015-05-29 16:08:14.870
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-05-29 16:08:14.706
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-05-29 16:08:14.528
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-05-28 19:10:30.192
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-05-28 16:46:25.449
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-05-28 16:46:25.180
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-05-28 16:46:24.635
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-05-26 19:47:29.303
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-05-18 14:27:54.454
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-05-18 14:27:54.045
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i5-3230M CPU @ 2.60GHz
Percentage of memory in use: 37%
Total physical RAM: 8009.47 MB
Available physical RAM: 5013 MB
Total Pagefile: 14409.47 MB
Available Pagefile: 10898.74 MB
Total Virtual: 131072 MB
Available Virtual: 131071.8 MB

==================== Drives ================================

Drive c: (Windows8_OS) (Fixed) (Total:916.58 GB) (Free:75.19 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: 573CACE8)

Partition: GPT Partition Type.

==================== End of log ============================

gmer.log

Code:

ATTFilter

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-06-01 09:37:14
Windows 6.3.9600  x64 \Device\Harddisk0\DR0 -> \Device\00000038 WDC_WD10JPVX-08JC3T5 rev.05.01A05 931,51GB
Running: u0ysquyh.exe; Driver: C:\Users\ADMINI~1\AppData\Local\Temp\uwldypow.sys


---- Kernel code sections - GMER 2.1 ----

.text   C:\WINDOWS\system32\ntoskrnl.exe!NtCallbackReturn + 960  fffff8004add8a00 12 bytes [40, BF, A7, FF, 82, F4, 4B, ...]
.text   C:\WINDOWS\system32\ntoskrnl.exe!NtCallbackReturn + 973  fffff8004add8a0d 39 bytes [D9, 4A, 02, 00, C4, FF, FF, ...]

---- Threads - GMER 2.1 ----

Thread  C:\WINDOWS\system32\csrss.exe [568:592]                  fffff960008482d0

---- Disk sectors - GMER 2.1 ----

Disk    \Device\Harddisk0\DR0                                    unknown MBR code

---- EOF - GMER 2.1 ----

Ich fand grade diesen Thread hier: http://www.trojaner-board.de/167301-...tartseite.html

Genau diese Suchmaschine hatte ich auch auf ein mal installiert

cosinus · 01.06.2015, 10:53

Hallo und

Adware/Junkware/Toolbars entfernen

1. Schritt: Malwarebytes

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

(alte Versionen von adwCleaner und falls vorhanden JRT vorher löschen, danach neu runterladen auf den Desktop!)

2. Schritt: adwCleaner

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

3. Schritt: JRT - Junkware Removal Tool

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

4. Schritt: Frisches Log mit FRST

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

southz · 01.06.2015, 14:24

Zuerst noch folgende Information: Auch im abgesicherten Modus sind die AboutUrls infiziert.

mbam.txt

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 01.06.2015
Suchlauf-Zeit: 12:12:34
Logdatei: mbam.txt
Administrator: Ja

Version: 2.01.6.1022
Malware Datenbank: v2015.06.01.01
Rootkit Datenbank: v2015.05.31.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 8.1
CPU: x64
Dateisystem: NTFS
Benutzer: Administrator

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 729463
Verstrichene Zeit: 1 Std, 4 Min, 42 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(Keine schädliche Elemente gefunden)

Module: 0
(Keine schädliche Elemente gefunden)

Registrierungsschlüssel: 0
(Keine schädliche Elemente gefunden)

Registrierungswerte: 0
(Keine schädliche Elemente gefunden)

Registrierungsdaten: 3
PUM.Hijack.Help, HKU\S-1-5-21-2292532964-2513414724-1275699273-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER|NoSMHelp, 1, Gut: (0), Schlecht: (1),Ersetzt,[394c961f6822e155e0db85a68a7c946c]
PUM.Hijack.Help, HKU\S-1-5-21-2292532964-2513414724-1275699273-1002\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER|NoSMHelp, 1, Gut: (0), Schlecht: (1),Ersetzt,[99ec684dc9c145f1b6052cff739348b8]
PUM.Hijack.Help, HKU\S-1-5-21-919205647-830002367-3966930364-1135\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER|NoSMHelp, 1, Gut: (0), Schlecht: (1),Ersetzt,[394ccde894f6cf675a6147e405019868]

Ordner: 0
(Keine schädliche Elemente gefunden)

Dateien: 6
PUP.Optional.OpenCandy, C:\Users\xxx\Downloads\DTLite4491-0356.exe, Keine Aktion durch Benutzer, [6a1bddd84a4067cf098faea9b551e917], 
PUP.Optional.OutBrowse, C:\Users\xxx\Downloads\Odin-V3.10.6.exe, Keine Aktion durch Benutzer, [711409ac6a2004329c4c9395bb4706fa], 
PUP.Optional.Comboapps, C:\Users\xxx\Downloads\DownloadManagerSetup.exe, In Quarantäne, [6c19298c0f7bd6608d7ca2cb05013dc3], 
PUP.Optional.Spigot.A, C:\Users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\epgz4efg.default\searchplugins\yahoo_ff.xml, In Quarantäne, [2b5a24912466072fb6ef46aeb74cd030], 
PUP.Optional.ProPCCleaner.A, C:\Windows\System32\Tasks\ProPCCleaner_Popup, In Quarantäne, [9aeb882d37533006c3499cdf9a6b6997], 
PUP.Optional.ProPCCleaner.A, C:\Windows\System32\Tasks\ProPCCleaner_Start, In Quarantäne, [9beab302c3c72610f01c403b1bea6b95], 

Physische Sektoren: 0
(Keine schädliche Elemente gefunden)


(end)

AdwCleaner[S1].txt

Code:

ATTFilter

# AdwCleaner v4.206 - Bericht erstellt 01/06/2015 um 14:41:14
# Aktualisiert 01/06/2015 von Xplode
# Datenbank : 2015-05-31.5 [Server]
# Betriebssystem : Windows 8.1 Pro  (x64)
# Benutzername : Administrator - XXX-XXX
# Gestarted von : C:\Users\Administrator\Downloads\AdwCleaner_4.206.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****


***** [ Geplante Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\adawarebp

***** [ Internetbrowser ] *****

-\\ Internet Explorer v11.0.9600.17416


-\\ Google Chrome v43.0.2357.81


*************************

AdwCleaner[R0].txt - [11043 Bytes] - [29/05/2015 11:38:45]
AdwCleaner[R1].txt - [970 Bytes] - [29/05/2015 11:49:01]
AdwCleaner[R2].txt - [1028 Bytes] - [29/05/2015 14:20:03]
AdwCleaner[R3].txt - [1094 Bytes] - [01/06/2015 14:38:46]
AdwCleaner[S0].txt - [8039 Bytes] - [29/05/2015 11:41:26]
AdwCleaner[S1].txt - [1015 Bytes] - [01/06/2015 14:41:14]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [1074  Bytes] ##########

JRT.txt

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.8.6 (05.31.2015:1)
OS: Windows 8.1 Pro x64
Ran by Administrator on 01.06.2015 at 14:49:22,86
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Tasks



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ Chrome


[C:\Users\Administrator\appdata\local\Google\Chrome\User Data\Default\Preferences] - default search provider reset

[C:\Users\Administrator\appdata\local\Google\Chrome\User Data\Default\Preferences] - Extensions Deleted:

[C:\Users\Administrator\appdata\local\Google\Chrome\User Data\Default\Secure Preferences] - default search provider reset

[C:\Users\Administrator\appdata\local\Google\Chrome\User Data\Default\Secure Preferences] - Extensions Deleted:





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 01.06.2015 at 14:51:36,34
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST.txt

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 29-05-2015
Ran by Administrator (administrator) on XXX-XXX on 01-06-2015 14:53:50
Running from C:\Users\Administrator\Desktop
Loaded Profiles: Administrator (Available Profiles: UpdatusUser & xxx & Administrator & MSSQL$SQLEXPRESS)
Platform: Windows 8.1 Pro (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Lenovo.) C:\Windows\System32\ibmpmsvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Microsoft Corporation) C:\Windows\System32\alg.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCore64.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.3.9600.17709_none_fa7932f59afc2e40\TiWorker.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtsCM] => C:\WINDOWS\RTSCM64.EXE [140872 2013-03-21] (Realtek Semiconductor Corp.)
HKLM\...\Run: [LenovoOptMouseUpdate] => C:\Program Files\Lenovo\HOTKEY\extapsup.exe [255480 2013-06-20] (Lenovo Group Limited)
HKLM\...\Run: [TpShocks] => C:\WINDOWS\system32\TpShocks.exe [382248 2013-02-12] (Lenovo.)
HKLM\...\Run: [LnvMobHotspotClient] => C:\Program Files\Lenovo\Lenovo Mobile Hotspot\MobileHotspotclient.exe [938032 2014-03-05] (Lenovo)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2809072 2014-02-24] (Synaptics Incorporated)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [500208 2010-03-06] (Adobe Systems Incorporated)
HKLM\...\Run: [LMCSSTART1] => C:\WINDOWS\SysWOW64\lmcfrundll.exe C:\Program Files\Lenovo\Communications Utility\libmcsrdllb.dll,InitSubsystemProcesses
HKLM\...\Run: [LMCSSTART2] => C:\WINDOWS\SysWOW64\lmcfrundll.exe C:\Program Files\Lenovo\Communications Utility\libstartstub2.dll,ProxyStart
HKLM\...\Run: [LMCSSTART3] => C:\WINDOWS\SysWOW64\lmcfrundll.exe C:\Program Files\Lenovo\Communications Utility\libmcsrdllb.dll,SetupCamplusDrop
HKLM\...\Run: [] => [X]
HKLM\...\Run: [AdAwareTray] => C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareTray.exe [9566192 2015-03-10] ()
HKLM\...\Run: [AdAwareTray] => C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareTray.exe [9566192 2015-03-10] ()
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [133440 2012-07-19] (Intel Corporation)
HKLM-x32\...\Run: [Fastboot] => C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBConsole.exe [738032 2014-02-13] (Lenovo)
HKLM-x32\...\Run: [AdobeCS5ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe [402432 2010-07-22] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-07-08] (Apple Inc.)
HKLM-x32\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [2072928 2014-10-31] (Wondershare)
HKLM-x32\...\Run: [Wondershare Helper Compact] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [2072928 2014-10-31] (Wondershare)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [uni mouse driver] => C:\Program Files (x86)\Hama Mouse Assistant\mouse_driver.exe [1634296 2015-04-13] ()
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-2292532964-2513414724-1275699273-500\...\Run: [ooVoo] => C\ooVoo.exe /minimized
HKU\S-1-5-21-2292532964-2513414724-1275699273-500\...\MountPoints2: {1a45eb2b-e463-11e3-be8c-00c2c63a0efc} - "E:\autorun.exe" 
Startup: C:\Users\xxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2014-11-15]
ShortcutTarget: Dropbox.lnk -> C:\Users\Administrator\AppData\Roaming\Dropbox\bin\Dropbox.exe (No File)
Startup: C:\Users\xxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Send to OneNote.lnk [2014-10-20]
ShortcutTarget: Send to OneNote.lnk -> C:\Program Files (x86)\Microsoft Office\Office15\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\xxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Spamihilator.lnk [2015-05-02]
ShortcutTarget: Spamihilator.lnk -> C:\Program Files (x86)\Spamihilator\spamihilator.exe (Michel Krämer)
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: [SugarSyncBackedUp] -> {0C4A258A-3F3B-4FFF-80A7-9B3BEC139472} =>  No File
ShellIconOverlayIdentifiers: [SugarSyncPending] -> {62CCD8E3-9C21-41E1-B55E-1E26DFC68511} =>  No File
ShellIconOverlayIdentifiers: [SugarSyncRoot] -> {A759AFF6-5851-457D-A540-F4ECED148351} =>  No File
ShellIconOverlayIdentifiers: [SugarSyncShared] -> {1574C9EF-7D58-488F-B358-8B78C1538F51} =>  No File
ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File
BootExecute: autocheck autochk * sdnclean64.exe
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-2292532964-2513414724-1275699273-500\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://lenovo13-comm.msn.com/?pc=LNJB
HKU\S-1-5-21-2292532964-2513414724-1275699273-500\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://lenovo13-comm.msn.com/?pc=LNJB
HKU\S-1-5-21-2292532964-2513414724-1275699273-500\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com/welcome/thinkpad
HKU\S-1-5-21-2292532964-2513414724-1275699273-500\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.lenovo.com/welcome/thinkpad
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-2292532964-2513414724-1275699273-500 -> {498C203F-0D3C-4088-8FD6-A0E12820BB29} URL = 
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2015-03-31] (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre8\bin\ssv.dll [2014-05-22] (Oracle Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2015-04-14] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre8\bin\jp2ssv.dll [2014-05-22] (Oracle Corporation)
BHO-x32: ContributeBHO Class -> {074C1DC5-9320-4A9A-947D-C042949C6216} -> C:\Program Files (x86)\Adobe\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll [2010-03-27] (Adobe Systems, Inc.)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2015-03-31] (Microsoft Corporation)
BHO-x32: Microsoft Web Test Recorder 12.0 Helper -> {432dd630-7e03-4c97-9d62-b99f52df4fc2} -> C:\Program Files (x86)\Microsoft Visual Studio 12.0\Common7\IDE\PrivateAssemblies\Microsoft.VisualStudio.QualityTools.RecorderBarBHO100.dll [2013-10-05] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2014-10-15] (Oracle Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2015-04-14] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2014-10-15] (Oracle Corporation)
Toolbar: HKLM-x32 - Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files (x86)\Adobe\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll [2010-03-27] (Adobe Systems, Inc.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 10.0.0.138

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_17_0_0_169.dll [2015-04-20] ()
FF Plugin: @java.com/DTPlugin,version=11.5.2 -> C:\Program Files\Java\jre8\bin\dtplugin\npDeployJava1.dll [2014-05-22] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.5.2 -> C:\Program Files\Java\jre8\bin\plugin2\npjp2.dll [2014-05-22] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-04-20] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-02-21] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-06-07] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-06-07] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll [2014-10-15] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2014-10-15] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2015-03-31] (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MIF5BA~1\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-16] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-16] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-05-01] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2015-03-31] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2015-05-01] (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}] - C:\Program Files (x86)\Adobe\Adobe Contribute CS5\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}
FF Extension: Adobe Contribute Toolbar - C:\Program Files (x86)\Adobe\Adobe Contribute CS5\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9} [2014-05-09]

Chrome: 
=======
CHR Profile: C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-05-31]
CHR Extension: (Google Drive) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-05-31]
CHR Extension: (YouTube) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-05-31]
CHR Extension: (Google Search) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-05-31]
CHR Extension: (Bookmark Manager) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik [2015-06-01]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-06-01]
CHR Extension: (Google Wallet) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-06-01]
CHR Extension: (Gmail) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-05-31]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [172344 2014-07-23] (SUPERAntiSpyware.com)
S2 AVControlCenter; C:\Program Files\Lenovo\Communications Utility\AVControlCenter32.exe [560584 2015-01-21] (Lenovo Corporation)
S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-10-29] (Microsoft Corporation)
S3 c2wts; C:\Program Files\Windows Identity Foundation\v3.5\c2wtshost.exe [5632 2014-05-08] (Microsoft Corporation)
S2 FastbootService; C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBService.exe [140016 2014-02-13] (Lenovo)
S3 fussvc; C:\Program Files (x86)\Windows Kits\8.1\App Certification Kit\fussvc.exe [142336 2014-02-20] (Microsoft Corporation) [File not signed]
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
S2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-07-19] (Intel Corporation)
S3 intelsba; C:\Program Files\Intel\Intel(R) Small Business Advantage\Service\Intel.SmallBusinessAdvantage.WindowsService.exe [48832 2013-04-10] (Intel Corporation)
S2 IpOverUsbSvc; C:\Program Files (x86)\Common Files\Microsoft Shared\Phone Tools\CoreCon\11.0\bin\IpOverUsbSvc.exe [22744 2014-10-15] (Microsoft Corporation)
S2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-07-19] (Intel Corporation)
S2 LavasoftAdAwareService11; C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareService.exe [720760 2015-03-10] ()
S2 Lenovo QuickSnip Service; C:\Program Files\lenovo\QuickSnipService\QuickSnipService.exe [219976 2013-06-05] (LENOVO INCORPORATED.)
S2 Lenovo Settings Service; C:\Program Files\Lenovo\SettingsDependency\SettingsService.exe [2016472 2015-01-23] (Lenovo Group Limited)
S2 Lenovo System Agent Service; C:\Program Files\lenovo\SystemAgent\SystemAgentService.exe [562504 2013-06-05] (LENOVO INCORPORATED.)
S3 LENOVO.TVTVCAM; C:\Program Files\Lenovo\Communications Utility\vcamsvc.exe [626120 2015-01-21] (Lenovo Corporation)
S2 Lenovo.VIRTSCRLSVC; C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe [136288 2012-08-10] (Lenovo Group Limited)
S2 LnvHotSpotSvc; C:\Program Files\Lenovo\Lenovo Mobile Hotspot\LnvHotSpotSvc.exe [474160 2014-03-05] (Lenovo)
S4 LocationTaskManager; C:\Program Files (x86)\Lenovo\LocationAware\loctaskmgr.exe [470064 2014-03-10] ()
S3 LSCWinService; C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCWinService.exe [272440 2015-03-09] (Lenovo)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
S2 MSSQL$SQLEXPRESS; c:\Program Files\Microsoft SQL Server\MSSQL11.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [191064 2012-02-11] (Microsoft Corporation)
S4 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273136 2013-08-28] ()
R2 Net Driver HPZ12; C:\Windows\System32\HPZinw12.dll [50688 2013-05-16] (Hewlett-Packard) [File not signed]
S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [1903472 2015-01-09] (Electronic Arts)
S3 OverwolfUpdater; C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe [999152 2015-05-04] (Overwolf LTD)
R2 Pml Driver HPZ12; C:\Windows\System32\HPZipm12.dll [66048 2013-05-16] (Hewlett-Packard) [File not signed]
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
S4 SQLAgent$SQLEXPRESS; c:\Program Files\Microsoft SQL Server\MSSQL11.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [597080 2012-02-11] (Microsoft Corporation)
S4 SUService; C:\Program Files (x86)\Lenovo\System Update\SUService.exe [24560 2014-06-18] ()
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
S3 Te.Service; C:\Program Files (x86)\Windows Kits\8.1\Testing\Runtimes\TAEF\Wex.Services.exe [119808 2013-08-22] (Microsoft Corporation) [File not signed]
S2 ValBioService; C:\Program Files\Lenovo Fingerprint Reader\ValBioService.exe [23600 2013-03-20] (Validity Sensors, Inc.)
S2 valWBFPolicyService; C:\Windows\system32\valWBFPolicyService.exe [49040 2014-07-21] (Synaptics Incorporated)
S2 valWbioSyncSvc; C:\Windows\system32\valWbioSyncSvc.exe [32256 2014-07-21] (Synaptics Incorporated)
S3 VsEtwService120; C:\Program Files\Microsoft Visual Studio 12.0\Common7\Packages\Debugger\Services\VsEtwService.exe [89232 2014-07-22] (Microsoft Corporation)
S3 wampapache64; c:\wamp\bin\apache\apache2.4.9\bin\httpd.exe [24576 2014-05-01] (Apache Software Foundation) [File not signed]
S3 wampmysqld64; c:\wamp\bin\mysql\mysql5.6.17\bin\mysqld.exe [12942848 2014-05-01] () [File not signed]
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-04] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-04] (Microsoft Corporation)
S2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3378416 2013-08-28] (Intel® Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2014-09-05] ()
R3 avc3; C:\Windows\System32\DRIVERS\avc3.sys [727592 2015-01-06] (BitDefender)
R3 avchv; C:\Windows\system32\DRIVERS\avchv.sys [261496 2015-01-06] (BitDefender)
R3 avckf; C:\Windows\System32\DRIVERS\avckf.sys [601360 2015-01-06] (BitDefender)
R1 BdfNdisf; C:\Program Files\Lavasoft\Ad-Aware Antivirus\Firewall Engine\1.6.0.0\Drivers\bdfndisf6.sys [97816 2015-01-06] (BitDefender LLC)
R1 bdfwfpf; C:\Program Files\Lavasoft\Ad-Aware Antivirus\Firewall Engine\1.6.0.0\Drivers\bdfwfpf.sys [107080 2015-01-06] (BitDefender LLC)
S3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-03-18] (Microsoft Corporation)
R1 dtsoftbus01; C:\Windows\System32\drivers\dtsoftbus01.sys [283064 2014-05-29] (Disc Soft Ltd)
R2 Ext2Fsd; C:\WINDOWS\system32\Drivers\Ext2Fsd.sys [771224 2014-08-26] (www.ext2fsd.com)
R0 Fastboot; C:\Windows\System32\DRIVERS\fastboot.sys [66288 2014-02-13] (Windows (R) Win 7 DDK provider)
R3 gzflt; C:\Program Files\Lavasoft\Ad-Aware Antivirus\Antimalware Engine\3.0.98.0\gzflt.sys [155912 2015-01-22] (BitDefender LLC)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2014-09-05] ()
S3 LUMDriver; C:\WINDOWS\system32\drivers\LUMDriver.sys [24848 2008-01-02] (IBM)
S3 mbamchameleon; C:\WINDOWS\system32\drivers\mbamchameleon.sys [107736 2015-04-14] (Malwarebytes Corporation)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2015-04-14] (Malwarebytes Corporation)
R3 NETwNe64; C:\Windows\system32\DRIVERS\Netwew00.sys [3345376 2013-10-08] (Intel Corporation)
S4 RsFx0200; C:\Windows\System32\DRIVERS\RsFx0200.sys [334936 2012-02-11] (Microsoft Corporation)
R3 RSP2STOR; C:\Windows\system32\DRIVERS\RtsP2Stor.sys [288840 2013-05-16] (Realtek Semiconductor Corp.)
R3 rtsuvc; C:\Windows\system32\DRIVERS\rtsuvc.sys [8243272 2013-03-21] (Realtek Semiconductor Corp.)
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R3 SensorsSimulatorDriver; C:\Windows\system32\DRIVERS\WUDFRd.sys [226304 2014-10-29] (Microsoft Corporation)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [31472 2014-02-24] (Synaptics Incorporated)
R1 SMIDriver; C:\Windows\System32\drivers\smi.sys [19760 2014-07-21] (Windows (R) Win 7 DDK provider)
S3 SWIX64; C:\Program Files (x86)\Lenovo\System Update\tvsuhd64.sys [33856 2012-09-12] (Lenovo Group Limited)
S3 Trufos; C:\Windows\System32\DRIVERS\Trufos.sys [452040 2015-01-22] (BitDefender S.R.L.)
R3 usb3Hub; C:\Windows\System32\drivers\usb3Hub.sys [47072 2012-11-29] (Windows (R) Win 7 DDK provider)
S3 VBoxUSB; C:\Windows\System32\Drivers\VBoxUSB.sys [115488 2014-03-26] (Oracle Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-04] (Microsoft Corporation)
R3 XHCIPort; C:\Windows\System32\drivers\XHCIPort.sys [188896 2012-11-29] (Windows (R) Win 7 DDK provider)
S3 btmhsf; \SystemRoot\system32\DRIVERS\btmhsf.sys [X]
S3 iBtFltCoex; \SystemRoot\system32\DRIVERS\iBtFltCoex.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-06-01 14:53 - 2015-06-01 14:54 - 00025193 _____ () C:\Users\Administrator\Desktop\FRST.txt
2015-06-01 14:51 - 2015-06-01 14:51 - 00001119 _____ () C:\Users\Administrator\Desktop\JRT.txt
2015-06-01 14:49 - 2015-06-01 14:49 - 00000207 _____ () C:\WINDOWS\tweaking.com-regbackup-XXX-XXX-Windows-8.1-Pro-(64-bit).dat
2015-06-01 14:49 - 2015-06-01 14:49 - 00000000 ____D () C:\RegBackup
2015-06-01 14:48 - 2015-06-01 14:48 - 02947675 _____ (Thisisu) C:\Users\Administrator\Downloads\JRT.exe
2015-06-01 14:38 - 2015-06-01 14:38 - 02231296 _____ () C:\Users\Administrator\Downloads\AdwCleaner_4.206.exe
2015-06-01 14:36 - 2015-06-01 14:36 - 00002633 _____ () C:\Users\Administrator\Desktop\mbam.txt
2015-06-01 12:27 - 2015-06-01 12:27 - 00001461 _____ () C:\Users\xxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-06-01 12:11 - 2015-06-01 12:11 - 00001125 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-06-01 12:11 - 2015-06-01 12:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-06-01 12:11 - 2015-06-01 12:11 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-06-01 12:11 - 2015-04-14 09:38 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2015-06-01 12:11 - 2015-04-14 09:37 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2015-06-01 12:10 - 2015-06-01 12:11 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\Administrator\Downloads\mbam-setup-2.1.6.1022.exe
2015-06-01 12:04 - 2015-06-01 12:04 - 00000000 ____D () C:\Users\Administrator\Documents\ProcAlyzer Dumps
2015-06-01 09:51 - 2015-06-01 09:51 - 00000184 _____ () C:\Users\Administrator\Desktop\Ad-Aware_Report_Quick_Automatic_2015-05-30T12-01-54.764241.xml
2015-06-01 09:37 - 2015-06-01 09:37 - 00000834 _____ () C:\Users\Administrator\Desktop\gmer.log
2015-06-01 09:25 - 2015-06-01 09:36 - 00000779 _____ () C:\Users\Administrator\Desktop\anleitung.txt
2015-06-01 09:20 - 2015-06-01 09:21 - 00094989 _____ () C:\Users\Administrator\Desktop\Addition01.txt
2015-06-01 09:20 - 2015-06-01 09:20 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Lavasoft
2015-06-01 09:18 - 2015-06-01 14:54 - 00000000 ____D () C:\FRST
2015-06-01 09:18 - 2015-06-01 09:21 - 00084219 _____ () C:\Users\Administrator\Desktop\FRST01.txt
2015-06-01 09:17 - 2015-06-01 09:17 - 00000488 _____ () C:\Users\Administrator\Desktop\defogger_disable.log
2015-06-01 09:17 - 2015-06-01 09:17 - 00000000 _____ () C:\Users\Administrator\defogger_reenable
2015-06-01 09:16 - 2015-06-01 09:03 - 00380416 _____ () C:\Users\Administrator\Desktop\u0ysquyh.exe
2015-06-01 09:16 - 2015-06-01 09:02 - 02108928 _____ (Farbar) C:\Users\Administrator\Desktop\FRST64.exe
2015-06-01 09:16 - 2015-06-01 08:57 - 00050477 _____ () C:\Users\Administrator\Desktop\Defogger.exe
2015-06-01 09:03 - 2015-06-01 09:03 - 00380416 _____ () C:\Users\Administrator\Downloads\u0ysquyh.exe
2015-06-01 09:02 - 2015-06-01 09:02 - 02108928 _____ (Farbar) C:\Users\Administrator\Downloads\FRST64.exe
2015-06-01 08:57 - 2015-06-01 08:57 - 00050477 _____ () C:\Users\Administrator\Downloads\Defogger.exe
2015-06-01 08:29 - 2015-06-01 10:49 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Notepad++
2015-06-01 08:22 - 2015-06-01 09:15 - 00000000 ____D () C:\Users\Administrator\AppData\Local\CrashDumps
2015-06-01 08:17 - 2015-06-01 08:22 - 00000000 ____D () C:\Users\Administrator\Downloads\ResEdit-x64
2015-06-01 08:15 - 2015-06-01 08:15 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\WinRAR
2015-06-01 08:14 - 2015-06-01 08:14 - 00603437 _____ () C:\Users\Administrator\Downloads\ResEdit-x64.7z
2015-06-01 08:08 - 2015-06-01 08:08 - 00000000 ____D () C:\Users\Administrator\Desktop\mbar
2015-06-01 08:00 - 2015-06-01 14:00 - 00003958 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{A9CEAD6E-28E3-4785-B978-F6E8FB34FD93}
2015-06-01 08:00 - 2015-06-01 08:00 - 00000000 __SHD () C:\Users\Administrator\AppData\Local\EmieUserList
2015-06-01 08:00 - 2015-06-01 08:00 - 00000000 __SHD () C:\Users\Administrator\AppData\Local\EmieSiteList
2015-06-01 08:00 - 2015-06-01 08:00 - 00000000 __SHD () C:\Users\Administrator\AppData\Local\EmieBrowserModeList
2015-06-01 07:59 - 2015-06-01 07:59 - 00000000 ____D () C:\WINDOWS\system32\LSC
2015-06-01 07:55 - 2015-06-01 14:50 - 00003596 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2292532964-2513414724-1275699273-500
2015-06-01 07:55 - 2015-06-01 07:55 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Lenovo
2015-06-01 07:52 - 2015-06-01 14:44 - 00000192 _____ () C:\Users\Administrator\AppData\Local\RegisteredPackageInformation.xml
2015-06-01 07:51 - 2015-06-01 07:51 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Apple Computer
2015-06-01 07:51 - 2015-06-01 07:51 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Wondershare
2015-06-01 07:50 - 2015-06-01 07:50 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Adobe
2015-06-01 07:49 - 2015-06-01 07:51 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Adobe
2015-06-01 07:49 - 2015-06-01 07:49 - 00001461 _____ () C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-06-01 07:49 - 2015-06-01 07:49 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Intel
2015-05-31 19:46 - 2015-05-31 19:51 - 00125362 _____ () C:\search.txt
2015-05-31 19:43 - 2015-05-31 19:43 - 00001224 _____ () C:\Users\Administrator\Desktop\cmd.lnk
2015-05-31 19:36 - 2015-05-31 19:36 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Google
2015-05-31 18:56 - 2015-06-01 07:54 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Packages
2015-05-31 18:55 - 2015-06-01 09:17 - 00000000 ____D () C:\Users\Administrator
2015-05-31 18:55 - 2015-05-31 18:55 - 00000020 ___SH () C:\Users\Administrator\ntuser.ini
2015-05-31 18:55 - 2015-05-31 18:55 - 00000000 _SHDL () C:\Users\Administrator\Vorlagen
2015-05-31 18:55 - 2015-05-31 18:55 - 00000000 _SHDL () C:\Users\Administrator\Startmenü
2015-05-31 18:55 - 2015-05-31 18:55 - 00000000 _SHDL () C:\Users\Administrator\Netzwerkumgebung
2015-05-31 18:55 - 2015-05-31 18:55 - 00000000 _SHDL () C:\Users\Administrator\Lokale Einstellungen
2015-05-31 18:55 - 2015-05-31 18:55 - 00000000 _SHDL () C:\Users\Administrator\Eigene Dateien
2015-05-31 18:55 - 2015-05-31 18:55 - 00000000 _SHDL () C:\Users\Administrator\Druckumgebung
2015-05-31 18:55 - 2015-05-31 18:55 - 00000000 _SHDL () C:\Users\Administrator\Documents\Eigene Musik
2015-05-31 18:55 - 2015-05-31 18:55 - 00000000 _SHDL () C:\Users\Administrator\Documents\Eigene Bilder
2015-05-31 18:55 - 2015-05-31 18:55 - 00000000 _SHDL () C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2015-05-31 18:55 - 2015-05-31 18:55 - 00000000 _SHDL () C:\Users\Administrator\AppData\Local\Verlauf
2015-05-31 18:55 - 2015-05-31 18:55 - 00000000 _SHDL () C:\Users\Administrator\AppData\Local\Anwendungsdaten
2015-05-31 18:55 - 2015-05-31 18:55 - 00000000 _SHDL () C:\Users\Administrator\Anwendungsdaten
2015-05-31 18:55 - 2015-03-16 10:38 - 00000000 ___RD () C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2015-05-31 18:55 - 2015-03-08 02:36 - 00000000 ____D () C:\Users\Administrator\Documents\Visual Studio 2008
2015-05-31 18:55 - 2015-03-04 13:41 - 00000000 ___RD () C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2015-05-31 18:55 - 2015-03-04 13:41 - 00000000 ___RD () C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2015-05-31 18:55 - 2014-08-15 03:50 - 00000000 ____D () C:\Users\Administrator\Documents\Visual Studio 2013
2015-05-31 18:55 - 2014-07-05 05:50 - 00000000 ____D () C:\Users\Administrator\Documents\Visual Studio 2010
2015-05-31 18:55 - 2014-05-10 00:44 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Microsoft Help
2015-05-31 18:55 - 2014-05-07 12:41 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Macromedia
2015-05-31 18:55 - 2014-03-18 12:11 - 00000369 _____ () C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pictures.lnk
2015-05-31 18:55 - 2014-03-18 12:11 - 00000369 _____ () C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Documents.lnk
2015-05-31 18:55 - 2013-12-11 18:40 - 00002092 _____ () C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Update Search.lnk
2015-05-31 18:55 - 2013-08-22 17:36 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2015-05-31 18:55 - 2013-01-14 20:58 - 00001599 _____ () C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\LenovoToast.lnk
2015-05-30 18:36 - 2015-06-01 12:11 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-05-30 18:35 - 2015-06-01 12:12 - 00136408 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-05-30 18:35 - 2015-06-01 08:10 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-05-30 18:29 - 2015-04-14 09:37 - 00107736 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2015-05-30 18:28 - 2015-05-30 18:28 - 16502728 _____ (Malwarebytes Corp.) C:\Users\xxx\Downloads\mbar-1.09.1.1004.exe
2015-05-30 18:28 - 2015-05-30 18:28 - 00000000 ____D () C:\Users\xxx\Desktop\mbar
2015-05-30 14:28 - 2015-05-30 15:10 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2015-05-30 14:28 - 2015-05-30 14:31 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2015-05-30 14:28 - 2015-05-30 14:28 - 00001414 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2015-05-30 14:28 - 2015-05-30 14:28 - 00001402 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2015-05-30 14:28 - 2015-05-30 14:28 - 00000000 ____D () C:\WINDOWS\System32\Tasks\Safer-Networking
2015-05-30 14:28 - 2015-05-30 14:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2015-05-30 14:28 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\WINDOWS\system32\sdnclean64.exe
2015-05-30 10:45 - 2015-05-30 10:47 - 46525608 _____ (Safer-Networking Ltd. ) C:\Users\xxx\Downloads\spybot-2.4.exe
2015-05-30 10:41 - 2015-05-30 10:41 - 01121785 _____ () C:\Users\xxx\Downloads\ProcessExplorer.zip
2015-05-30 10:41 - 2015-05-30 10:41 - 00000000 ____D () C:\Users\xxx\Downloads\ProcessExplorer
2015-05-29 17:49 - 2015-05-29 17:50 - 09437184 _____ () C:\Users\xxx\Downloads\msert.exe
2015-05-29 17:25 - 2015-06-01 14:42 - 00002614 _____ () C:\WINDOWS\PFRO.log
2015-05-29 17:19 - 2015-05-29 17:19 - 00000000 ____D () C:\ProgramData\BitDefender
2015-05-29 17:09 - 2015-06-01 14:44 - 00002356 _____ () C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk
2015-05-29 17:09 - 2015-05-29 17:09 - 00000000 ____D () C:\Users\xxx\AppData\Roaming\LavasoftStatistics
2015-05-29 17:09 - 2015-05-29 17:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft
2015-05-29 17:09 - 2015-01-06 12:47 - 01061776 _____ (BitDefender S.R.L.) C:\WINDOWS\system32\bdsmtpp.dll
2015-05-29 17:09 - 2015-01-06 12:47 - 00209984 _____ (BitDefender) C:\WINDOWS\system32\BdFirewallSDK.dll
2015-05-29 17:09 - 2015-01-06 12:47 - 00195016 _____ (BitDefender) C:\WINDOWS\system32\httproxy.dll
2015-05-29 17:09 - 2015-01-06 12:47 - 00156936 _____ () C:\WINDOWS\system32\bdfwcore.dll
2015-05-29 17:09 - 2015-01-06 12:47 - 00155912 _____ (BitDefender S.R.L.) C:\WINDOWS\system32\bdpop3p.dll
2015-05-29 17:09 - 2015-01-06 12:47 - 00122928 _____ (BitDefender) C:\WINDOWS\system32\OEMbdpredir.dll
2015-05-29 17:09 - 2015-01-06 12:47 - 00096160 _____ (BitDefender) C:\WINDOWS\system32\bdpredir.dll
2015-05-29 17:09 - 2015-01-06 12:37 - 02084072 _____ (Bitdefender) C:\WINDOWS\system32\bdnc.dll
2015-05-29 17:07 - 2015-06-01 14:53 - 00003031 _____ () C:\WINDOWS\setupact.log
2015-05-29 17:07 - 2015-05-29 17:07 - 00000000 ____H () C:\WINDOWS\system32\Drivers\Msft_Kernel_avchv_01009.Wdf
2015-05-29 17:07 - 2015-05-29 17:07 - 00000000 _____ () C:\WINDOWS\setuperr.log
2015-05-29 17:06 - 2015-05-29 17:06 - 00000000 ____D () C:\Program Files\Lavasoft
2015-05-29 17:05 - 2015-05-29 17:05 - 00000000 ____D () C:\Users\xxx\AppData\Roaming\Lavasoft
2015-05-29 17:04 - 2015-06-01 14:53 - 01599786 _____ () C:\WINDOWS\WindowsUpdate.log
2015-05-29 17:04 - 2015-05-29 17:04 - 00000000 ____D () C:\ProgramData\Lavasoft
2015-05-29 17:04 - 2015-05-29 17:04 - 00000000 ____D () C:\Program Files\Common Files\Lavasoft
2015-05-29 17:03 - 2015-05-29 17:03 - 00258628 _____ () C:\Users\xxx\Documents\cc_20150529_170316.reg
2015-05-29 16:00 - 2015-05-29 16:01 - 02057008 _____ () C:\Users\xxx\Downloads\Adaware_Installer.exe
2015-05-29 15:56 - 2015-05-29 15:57 - 06549184 _____ (Piriform Ltd) C:\Users\xxx\Downloads\ccsetup506.exe
2015-05-29 14:55 - 2015-05-29 14:55 - 00000000 ____D () C:\SUPERDelete
2015-05-29 14:54 - 2015-06-01 14:54 - 00000532 _____ () C:\WINDOWS\Tasks\SUPERAntiSpyware Scheduled Task ab70ba7d-3101-4914-adbd-0bdd19f63ea1.job
2015-05-29 14:54 - 2015-05-30 02:00 - 00000532 _____ () C:\WINDOWS\Tasks\SUPERAntiSpyware Scheduled Task dfc0f345-4c50-4aee-adb1-b2fff5208f26.job
2015-05-29 14:54 - 2015-05-29 14:54 - 00003590 _____ () C:\WINDOWS\System32\Tasks\SUPERAntiSpyware Scheduled Task dfc0f345-4c50-4aee-adb1-b2fff5208f26
2015-05-29 14:54 - 2015-05-29 14:54 - 00003508 _____ () C:\WINDOWS\System32\Tasks\SUPERAntiSpyware Scheduled Task ab70ba7d-3101-4914-adbd-0bdd19f63ea1
2015-05-29 14:54 - 2015-05-29 14:54 - 00000000 ____D () C:\Users\xxx\AppData\Roaming\SUPERAntiSpyware.com
2015-05-29 14:53 - 2015-06-01 12:28 - 00000000 ____D () C:\Program Files\SUPERAntiSpyware
2015-05-29 14:53 - 2015-05-29 14:53 - 00001831 _____ () C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
2015-05-29 14:53 - 2015-05-29 14:53 - 00000000 ____D () C:\ProgramData\SUPERAntiSpyware.com
2015-05-29 14:53 - 2015-05-29 14:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware
2015-05-29 14:50 - 2015-05-29 14:51 - 22078544 _____ (SUPERAntiSpyware) C:\Users\xxx\Downloads\SUPERAntiSpyware.exe
2015-05-29 14:24 - 2015-05-29 14:24 - 00002450 _____ () C:\Users\xxx\Downloads\software_removal_tool.log
2015-05-29 14:24 - 2015-05-29 14:24 - 00000198 _____ () C:\Users\xxx\Downloads\debug.log
2015-05-29 11:38 - 2015-06-01 14:41 - 00000000 ____D () C:\AdwCleaner
2015-05-29 11:38 - 2015-05-29 11:38 - 02223104 _____ () C:\Users\xxx\Downloads\adwcleaner_4.205.exe
2015-05-29 11:13 - 2015-05-29 11:13 - 00000000 ____D () C:\Users\xxx\AppData\Roaming\WinZipper
2015-05-27 14:08 - 2015-05-27 14:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mouse driver
2015-05-27 14:08 - 2015-05-27 14:08 - 00000000 ____D () C:\Program Files (x86)\Hama Mouse Assistant
2015-05-27 13:59 - 2015-05-27 14:06 - 01197490 _____ () C:\Users\xxx\Desktop\00053877_vista_7_8_81_10_v1_1.zip
2015-05-17 14:13 - 2015-05-17 14:13 - 00000000 ____D () C:\Users\xxx\AppData\Local\CrashRpt
2015-05-16 16:52 - 2015-05-05 19:59 - 00792568 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2015-05-16 16:52 - 2015-05-05 19:59 - 00178168 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2015-05-15 15:23 - 2015-05-29 11:13 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-05-13 16:43 - 2015-04-30 22:35 - 00124112 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 16:43 - 2015-04-30 22:35 - 00102608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 13:20 - 2015-04-10 02:34 - 02256896 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll
2015-05-13 13:20 - 2015-04-10 02:11 - 01943040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll
2015-05-13 13:20 - 2015-03-17 19:26 - 00467776 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBHUB3.SYS
2015-05-13 13:20 - 2015-03-09 04:02 - 00057856 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthhfenum.sys
2015-05-13 13:19 - 2015-05-01 01:05 - 00429568 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll
2015-05-13 13:19 - 2015-05-01 00:48 - 00358912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll
2015-05-13 13:19 - 2015-04-14 00:48 - 04180480 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2015-05-13 13:19 - 2015-04-10 03:00 - 01996800 _____ (Microsoft Corporation) C:\WINDOWS\system32\DWrite.dll
2015-05-13 13:19 - 2015-04-10 02:50 - 01387008 _____ (Microsoft Corporation) C:\WINDOWS\system32\FntCache.dll
2015-05-13 13:19 - 2015-04-10 02:26 - 01560576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DWrite.dll
2015-05-13 13:19 - 2015-04-09 00:55 - 00410128 _____ (Microsoft Corporation) C:\WINDOWS\system32\services.exe
2015-05-13 13:19 - 2015-04-03 02:35 - 00445440 _____ (Microsoft Corporation) C:\WINDOWS\system32\PhotoMetadataHandler.dll
2015-05-13 13:19 - 2015-04-03 02:14 - 00364544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PhotoMetadataHandler.dll
2015-05-13 13:19 - 2015-04-02 00:22 - 02985984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbgeng.dll
2015-05-13 13:19 - 2015-04-02 00:20 - 04417536 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbgeng.dll
2015-05-13 13:19 - 2015-04-01 05:45 - 01491456 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbghelp.dll
2015-05-13 13:19 - 2015-04-01 04:31 - 01207296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbghelp.dll
2015-05-13 13:19 - 2015-03-20 03:56 - 00080384 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ahcache.sys
2015-05-13 13:19 - 2015-03-13 04:02 - 00316416 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\udfs.sys
2015-05-13 13:19 - 2015-03-13 03:11 - 02162176 _____ (Microsoft Corporation) C:\WINDOWS\system32\SRH.dll
2015-05-13 13:19 - 2015-03-13 02:39 - 01812992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SRH.dll
2015-05-13 13:19 - 2015-03-06 04:47 - 01696256 _____ (Microsoft Corporation) C:\WINDOWS\system32\wevtsvc.dll
2015-05-13 13:19 - 2015-03-04 03:32 - 00172544 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Input.Inking.dll
2015-05-13 13:19 - 2015-03-04 03:12 - 00141824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Input.Inking.dll
2015-05-13 13:19 - 2015-01-30 02:53 - 02819584 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers.dll
2015-05-13 13:19 - 2014-11-14 08:58 - 00116736 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsDatabase.dll
2015-05-13 13:16 - 2015-04-24 23:32 - 00036864 _____ (Microsoft Corporation) C:\WINDOWS\system32\UtcResources.dll
2015-05-13 13:16 - 2015-03-30 07:47 - 00561928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2015-05-13 13:16 - 2015-03-27 05:27 - 00445440 _____ (Microsoft Corporation) C:\WINDOWS\system32\certcli.dll
2015-05-13 13:16 - 2015-03-27 04:50 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certcli.dll
2015-05-13 13:16 - 2015-03-27 04:48 - 01441792 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2015-05-13 13:16 - 2015-03-13 06:03 - 00239424 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdbus.sys
2015-05-13 13:16 - 2015-03-13 06:03 - 00154432 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dumpsd.sys
2015-05-13 13:16 - 2015-03-11 03:49 - 00024576 _____ (Microsoft Corporation) C:\WINDOWS\system32\sdbinst.exe
2015-05-13 13:16 - 2015-03-11 03:09 - 00021504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sdbinst.exe
2015-05-13 13:16 - 2015-03-05 01:09 - 01429504 _____ (Microsoft Corporation) C:\WINDOWS\system32\diagtrack.dll
2015-05-13 13:16 - 2015-02-18 01:19 - 00186368 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpapisrv.dll
2015-05-13 13:14 - 2015-04-21 19:14 - 24971776 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2015-05-13 13:14 - 2015-04-21 18:50 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2015-05-13 13:14 - 2015-04-21 18:50 - 00417792 _____ (Microsoft Corporation) C:\WINDOWS\system32\html.iec
2015-05-13 13:14 - 2015-04-21 18:49 - 02885120 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2015-05-13 13:14 - 2015-04-21 18:37 - 00633856 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieui.dll
2015-05-13 13:14 - 2015-04-21 18:35 - 00816640 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2015-05-13 13:14 - 2015-04-21 18:31 - 06025728 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2015-05-13 13:14 - 2015-04-21 18:24 - 19691008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2015-05-13 13:14 - 2015-04-21 18:13 - 00107520 _____ (Microsoft Corporation) C:\WINDOWS\system32\inseng.dll
2015-05-13 13:14 - 2015-04-21 18:11 - 00504320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2015-05-13 13:14 - 2015-04-21 18:09 - 00341504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\html.iec
2015-05-13 13:14 - 2015-04-21 18:08 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2015-05-13 13:14 - 2015-04-21 18:07 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll
2015-05-13 13:14 - 2015-04-21 18:05 - 00316928 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2015-05-13 13:14 - 2015-04-21 18:04 - 02278400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2015-05-13 13:14 - 2015-04-21 17:59 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2015-05-13 13:14 - 2015-04-21 17:58 - 00664576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2015-05-13 13:14 - 2015-04-21 17:52 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
2015-05-13 13:14 - 2015-04-21 17:49 - 00801280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2015-05-13 13:14 - 2015-04-21 17:49 - 00720384 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2015-05-13 13:14 - 2015-04-21 17:49 - 00374272 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2015-05-13 13:14 - 2015-04-21 17:46 - 02125824 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2015-05-13 13:14 - 2015-04-21 17:40 - 14401536 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2015-05-13 13:14 - 2015-04-21 17:38 - 00076288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
2015-05-13 13:14 - 2015-04-21 17:37 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll
2015-05-13 13:14 - 2015-04-21 17:36 - 00285696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2015-05-13 13:14 - 2015-04-21 17:32 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2015-05-13 13:14 - 2015-04-21 17:31 - 04305920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2015-05-13 13:14 - 2015-04-21 17:28 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll
2015-05-13 13:14 - 2015-04-21 17:27 - 02352128 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2015-05-13 13:14 - 2015-04-21 17:26 - 00688640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2015-05-13 13:14 - 2015-04-21 17:26 - 00327168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2015-05-13 13:14 - 2015-04-21 17:25 - 02052608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2015-05-13 13:14 - 2015-04-21 17:17 - 12828672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2015-05-13 13:14 - 2015-04-21 17:15 - 01547264 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2015-05-13 13:14 - 2015-04-21 17:03 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2015-05-13 13:14 - 2015-04-21 17:02 - 01882112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2015-05-13 13:14 - 2015-04-21 16:58 - 01310208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2015-05-13 13:14 - 2015-04-21 16:56 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2015-05-13 13:14 - 2015-03-13 02:29 - 00410017 _____ () C:\WINDOWS\system32\ApnDatabase.xml
2015-05-13 13:14 - 2015-03-06 05:08 - 02067968 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpdshext.dll
2015-05-13 13:14 - 2015-03-06 04:43 - 01969664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wpdshext.dll
2015-05-06 18:10 - 2015-05-06 18:10 - 00000000 ____D () C:\temp
2015-05-06 13:41 - 2015-05-06 13:42 - 00000000 ____D () C:\wcf
2015-05-05 12:13 - 2015-05-05 12:15 - 00000000 ____D () C:\Users\xxx\Desktop\cmd
2015-05-02 03:18 - 2015-05-02 03:18 - 00000000 ____D () C:\ProgramData\Spamihilator
2015-05-02 03:17 - 2015-05-02 03:17 - 00970912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvcr120.dll
2015-05-02 03:17 - 2015-05-02 03:17 - 00455328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvcp120.dll
2015-05-02 03:17 - 2015-05-02 03:17 - 00247984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vccorlib120.dll
2015-05-02 03:17 - 2015-05-02 03:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spamihilator
2015-05-02 03:17 - 2015-05-02 03:17 - 00000000 ____D () C:\Program Files (x86)\Spamihilator
2015-05-02 03:12 - 2015-06-01 12:29 - 00000000 ____D () C:\Users\xxx\AppData\Roaming\Spamihilator
2015-05-02 03:09 - 2015-05-02 03:09 - 02515456 _____ (Michel Krämer) C:\Users\xxx\Downloads\Spamihilator-win32-1.6.0.exe
2015-05-02 03:09 - 2015-05-02 03:09 - 00000000 ____D () C:\Users\xxx\AppData\Roaming\Thunderbird
2015-05-02 03:09 - 2015-05-02 03:09 - 00000000 ____D () C:\Users\xxx\AppData\Local\Thunderbird
2015-05-02 03:04 - 2015-05-02 03:04 - 00002121 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Thunderbird.lnk
2015-05-02 03:04 - 2015-05-02 03:04 - 00002109 _____ () C:\Users\Public\Desktop\Mozilla Thunderbird.lnk
2015-05-02 03:04 - 2015-05-02 03:04 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2015-05-02 03:02 - 2015-05-02 03:03 - 28745120 _____ (Mozilla) C:\Users\xxx\Downloads\Thunderbird Setup 31.6.0.exe

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-06-01 14:53 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2015-06-01 14:46 - 2014-02-13 04:18 - 730247168 ___SH () C:\WINDOWS\lenovo_fastboot.img
2015-06-01 14:45 - 2014-05-08 15:08 - 00001122 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2015-06-01 14:44 - 2015-01-18 13:30 - 00000589 _____ () C:\WINDOWS\system32\Drivers\etc\hosts.ics
2015-06-01 14:43 - 2014-05-08 15:08 - 00001118 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2015-06-01 14:43 - 2014-02-13 04:18 - 00000000 ____D () C:\ProgramData\Validity
2015-06-01 14:43 - 2013-08-22 16:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2015-06-01 14:02 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2015-06-01 13:58 - 2014-05-07 13:56 - 00000112 _____ () C:\WINDOWS\system32\config\netlogon.ftl
2015-06-01 13:33 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\rescache
2015-06-01 13:22 - 2014-05-07 14:56 - 00003596 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-919205647-830002367-3966930364-1135
2015-06-01 12:50 - 2014-05-10 13:38 - 00000000 ____D () C:\Users\xxx\AppData\Local\CrashDumps
2015-06-01 12:33 - 2014-06-17 21:34 - 00000000 ___RD () C:\Users\xxx\Dropbox
2015-06-01 12:30 - 2014-06-17 21:31 - 00000000 ____D () C:\Users\xxx\AppData\Roaming\Dropbox
2015-06-01 09:37 - 2013-08-22 15:25 - 00524288 ___SH () C:\WINDOWS\system32\config\BBI
2015-05-31 19:36 - 2012-07-26 09:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
2015-05-30 17:15 - 2014-05-08 15:07 - 00003938 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{2E5FCE8E-190F-42B1-848F-D088FC3DC883}
2015-05-30 00:27 - 2014-08-06 06:05 - 00000000 ____D () C:\Users\xxx\AppData\Roaming\vlc
2015-05-29 17:25 - 2013-08-22 16:44 - 05115032 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2015-05-29 17:10 - 2014-05-09 19:47 - 00000000 ____D () C:\Users\xxx\AppData\Roaming\Skype
2015-05-29 17:01 - 2015-01-23 17:21 - 00000000 ____D () C:\Users\xxx\AppData\Roaming\TeamViewer
2015-05-29 17:01 - 2014-08-06 05:57 - 00000000 ____D () C:\Users\xxx\AppData\Roaming\DAEMON Tools Lite
2015-05-28 13:40 - 2014-03-18 12:03 - 02160128 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2015-05-28 13:40 - 2014-03-18 11:25 - 00916260 _____ () C:\WINDOWS\system32\perfh007.dat
2015-05-28 13:40 - 2014-03-18 11:25 - 00211972 _____ () C:\WINDOWS\system32\perfc007.dat
2015-05-27 15:40 - 2014-05-08 15:37 - 00000000 ____D () C:\Users\xxx\Documents\Visual Studio 2013
2015-05-27 11:50 - 2014-05-10 12:21 - 00000000 ____D () C:\Users\xxx\AppData\Roaming\Notepad++
2015-05-27 11:50 - 2014-05-10 12:21 - 00000000 ____D () C:\Program Files (x86)\Notepad++
2015-05-27 11:21 - 2014-05-07 14:43 - 00000000 ____D () C:\Users\xxx
2015-05-26 03:11 - 2014-05-08 15:08 - 00002206 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-05-25 20:51 - 2014-08-06 06:05 - 00000000 ____D () C:\Users\xxx\AppData\Roaming\dvdcss
2015-05-24 19:03 - 2014-07-05 04:26 - 00000000 ____D () C:\Users\MSSQL$SQLEXPRESS
2015-05-22 13:38 - 2014-07-18 04:03 - 00000600 _____ () C:\Users\xxx\AppData\Roaming\winscp.rnd
2015-05-22 12:35 - 2014-07-18 03:54 - 00000600 _____ () C:\Users\xxx\AppData\Local\PUTTY.RND
2015-05-21 16:06 - 2015-04-04 18:46 - 00000000 ___SD () C:\WINDOWS\SysWOW64\GWX
2015-05-21 16:06 - 2015-04-04 18:46 - 00000000 ___SD () C:\WINDOWS\system32\GWX
2015-05-18 14:10 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\tracing
2015-05-16 16:50 - 2014-05-10 00:45 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2015-05-16 16:50 - 2014-05-10 00:45 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2015-05-16 16:50 - 2014-05-09 20:15 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-05-16 16:33 - 2013-08-22 17:36 - 00000000 ___RD () C:\WINDOWS\ImmersiveControlPanel
2015-05-16 16:33 - 2013-08-22 15:36 - 00000000 ____D () C:\WINDOWS\system32\AdvancedInstallers
2015-05-16 16:15 - 2014-06-20 14:29 - 00000000 ____D () C:\Users\xxx\Desktop\tmp
2015-05-16 13:40 - 2014-05-08 15:08 - 00004094 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2015-05-16 13:40 - 2014-05-08 15:08 - 00003858 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2015-05-15 06:26 - 2014-05-19 18:47 - 00002457 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-05-13 16:44 - 2014-05-09 12:29 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-05-13 16:42 - 2014-05-09 12:33 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2015-05-13 16:40 - 2014-05-07 13:24 - 00000000 ____D () C:\WINDOWS\system32\MRT
2015-05-13 16:30 - 2014-05-07 13:24 - 140425016 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2015-05-13 16:22 - 2013-08-22 15:25 - 00000167 _____ () C:\WINDOWS\win.ini
2015-05-13 16:18 - 2014-05-10 00:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-05-13 15:59 - 2014-03-18 11:40 - 00000000 ____D () C:\Program Files\Windows Journal
2015-05-12 12:46 - 2014-06-17 21:33 - 00000000 ____D () C:\Users\xxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-05-12 05:21 - 2014-05-17 21:08 - 00000132 _____ () C:\Users\xxx\AppData\Roaming\Adobe PNG Format CS5 Prefs
2015-05-11 12:43 - 2014-05-07 13:58 - 00006658 __RSH () C:\ProgramData\ntuser.pol
2015-05-10 17:52 - 2014-05-07 14:43 - 00000000 ____D () C:\Users\xxx\AppData\Local\Packages
2015-05-07 16:30 - 2014-05-08 15:08 - 00000000 ____D () C:\Users\xxx\AppData\Local\Deployment
2015-05-06 23:33 - 2014-05-09 15:59 - 00000000 ____D () C:\Users\xxx\.VirtualBox
2015-05-06 22:14 - 2014-05-09 15:59 - 00000000 ____D () C:\Users\xxx\VirtualBox VMs
2015-05-06 10:59 - 2014-05-09 19:47 - 00000000 ____D () C:\ProgramData\Skype

==================== Files in the root of some directories =======

2015-06-01 07:52 - 2015-06-01 14:44 - 0000192 _____ () C:\Users\Administrator\AppData\Local\RegisteredPackageInformation.xml
2014-02-13 04:08 - 2014-02-13 04:08 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2014-02-13 04:22 - 2014-02-13 04:22 - 0000107 _____ () C:\ProgramData\{324F76CC-D8DD-4D87-B77D-D4AF5E1AA7B3}.log
2014-02-13 04:19 - 2014-02-13 04:20 - 0000105 _____ () C:\ProgramData\{40BF1E83-20EB-11D8-97C5-0009C5020658}.log
2014-02-13 04:20 - 2014-02-13 04:21 - 0000110 _____ () C:\ProgramData\{B7A0CE06-068E-11D6-97FD-0050BACBF861}.log
2014-02-13 04:21 - 2014-02-13 04:22 - 0000115 _____ () C:\ProgramData\{D6E853EC-8960-4D44-AF03-7361BB93227C}.log

Files to move or delete:
====================
C:\Users\xxx\eve_prod.js


Some files in TEMP:
====================
C:\Users\Administrator\AppData\Local\Temp\Quarantine.exe
C:\Users\Administrator\AppData\Local\Temp\sqlite3.dll
C:\Users\xxx\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpg0_ngx.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-06-01 13:22

==================== End of log ============================

cosinus · 01.06.2015, 14:29

Bitte auch ne neue Addition.txt erstellen, dazu FRST starten und einen Haken setzen bei Addition.txt, dann auf Scan klicken.

southz · 02.06.2015, 11:50

Sorry, dachte nur beim ersten scan

Additions.txt

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 29-05-2015
Ran by Administrator at 2015-06-01 14:55:20
Running from C:\Users\Administrator\Desktop
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-2292532964-2513414724-1275699273-500 - Administrator - Enabled) => C:\Users\Administrator
Gast (S-1-5-21-2292532964-2513414724-1275699273-501 - Limited - Disabled)
xxx (S-1-5-21-2292532964-2513414724-1275699273-1002 - Administrator - Enabled) => C:\Users\xxx
UpdatusUser (S-1-5-21-2292532964-2513414724-1275699273-1001 - Limited - Enabled) => C:\Users\UpdatusUser

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Ad-Aware Antivirus (Enabled - Up to date) {D87B6541-12A1-DAEA-0033-9B8057AAB996}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Ad-Aware Antivirus (Enabled - Up to date) {631A84A5-349B-D564-3A83-A0F22C2DF32B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
FW: Ad-Aware Firewall (Disabled) {E040E464-58CE-DBB2-2B6C-32B5A979FEED}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

64 Bit HP CIO Components Installer (Version: 15.2.1 - Hewlett-Packard) Hidden
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Ad-Aware Antivirus (HKLM\...\{FF054A8C-C0A4-4C78-8910-E2A459BEFF05}_AdAwareUpdater) (Version: 11.6.306.7947 - Lavasoft)
AdAwareInstaller (Version: 11.6.306.7947 - Lavasoft) Hidden
AdAwareUpdater (Version: 11.6.306.7947 - Lavasoft) Hidden
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 17.0.0.144 - Adobe Systems Incorporated)
Adobe Community Help (HKLM-x32\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 3.0.0.400 - Adobe Systems Incorporated)
Adobe Flash Player 10 ActiveX (HKLM-x32\...\{6E9EF98E-259E-416D-B5F8-0ABDB99942CE}) (Version: 10.1.52.14 - Adobe Systems, Inc.)
Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Media Player (HKLM-x32\...\com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 1.8 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.11) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.11 - Adobe Systems Incorporated)
AntimalwareEngine (Version: 3.0.98.0 - Lavasoft) Hidden
AntispamEngine (Version: 2.4.2158.0 - Lavasoft) Hidden
Anzeige am Bildschirm (HKLM\...\OnScreenDisplay) (Version: 8.42.20 - )
Apple Application Support (HKLM-x32\...\{21ECABC3-40B2-42DF-8E21-ACF3A4D0D95A}) (Version: 3.0.5 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{6AF2AC2A-3532-43FD-9F4D-BDC9C0D724C7}) (Version: 7.1.2.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Application Insights Tools for Visual Studio 2013 (x32 Version: 2.4 - Microsoft Corporation) Hidden
ArgoUML 0.34 (HKLM-x32\...\ArgoUML) (Version: 0.34 - )
Autostart-Manager (HKLM-x32\...\{E0D34E99-B4E5-481D-A1A7-27BE957F5167}) (Version: 6.04.0000 - Wirth IT Design )
AvcEngine (Version: 3.10.7820.0 - Lavasoft) Hidden
Azure Resource Manager Tools (VS 2013) - v1.0 (x32 Version: 1.0.0.0 - Microsoft Corporation) Hidden
AzureTools.Notifications (x32 Version: 2.5.21104.1601 - Microsoft Corporation) Hidden
Behaviors SDK (Windows Phone) for Visual Studio 2013 (x32 Version: 12.0.50716.0 - Microsoft Corporation) Hidden
Behaviors SDK (Windows) for Visual Studio 2013 (x32 Version: 12.0.50429.0 - Microsoft Corporation) Hidden
Blend for Visual Studio 2013 (x32 Version: 12.0.41002.1 - Microsoft Corporation) Hidden
Blend for Visual Studio 2013 DEU resources (x32 Version: 12.0.41002.1 - Microsoft Corporation) Hidden
Blend for Visual Studio SDK for .NET 4.5 (x32 Version: 3.0.40218.0 - Microsoft Corporation) Hidden
Blend for Visual Studio SDK for Silverlight 5 (x32 Version: 3.0.40218.0 - Microsoft Corporation) Hidden
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Build Tools - amd64 (Version: 12.0.31101 - Microsoft Corporation) Hidden
Build Tools - x86 (x32 Version: 12.0.31101 - Microsoft Corporation) Hidden
Build Tools Language Resources - amd64 (Version: 12.0.31101 - Microsoft Corporation) Hidden
Build Tools Language Resources - x86 (x32 Version: 12.0.31101 - Microsoft Corporation) Hidden
Bullzip PDF Printer 9.2.0.1499 (HKLM\...\Bullzip PDF Printer_is1) (Version: 9.2.0.1499 - Bullzip)
CCleaner (HKLM\...\CCleaner) (Version: 5.05 - Piriform)
CDBurnerXP (HKLM-x32\...\{909A791A-DBB0-432F-BC0E-D0C81925E340}) (Version: 4.5.3.4746 - Canneverbe Limited)
Chunky (HKLM\...\Chunky) (Version:  - )
Cloud Deployment Project for Microsoft Visual Studio 2013 - v1.0 (x32 Version: 1.0.0.0 - Microsoft Corporation) Hidden
Conexant HD Audio (HKLM\...\CNXT_AUDIO_HDA) (Version: 8.54.48.0 - Conexant)
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.49.1.0356 - Disc Soft Ltd)
Dassault Systemes Software B19 (HKLM\...\Dassault Systemes B19_0) (Version:  - )
Dassault Systemes Software Prerequisites x86-x64 (HKLM\...\{CF1EB598-B424-436A-B15F-B763846BA970}) (Version: 8.1.3 - Dassault Systemes)
DataNumen PDF Repair v2.1 (HKLM-x32\...\DataNumen PDF Repair v2.1) (Version:  - )
Devenv-Ressourcen für Microsoft Visual Studio 2013 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
Dotfuscator and Analytics Community Edition (x32 Version: 5.5.4954.46574 - PreEmptive Solutions) Hidden
Dotfuscator and Analytics Community Edition Language Pack (x32 Version: 5.5.4954.46574 - PreEmptive Solutions) Hidden
Entity Framework 6.1.1 Tools  for Visual Studio 2013 (HKLM-x32\...\{85253F13-EE42-4850-A3A5-79B90E92D7AC}) (Version: 12.0.30610.0 - Microsoft Corporation)
Erforderliche Komponenten für SSDT  (HKLM-x32\...\{2466E484-9D86-416B-9C88-AA533F15AF1C}) (Version: 12.0.2000.8 - Microsoft Corporation)
Erforderliche Komponenten für SSDT  (HKLM-x32\...\{3FF082A7-A5DE-4BDA-B56A-1D2BEFD617A3}) (Version: 11.1.3000.0 - Microsoft Corporation)
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version:  - )
Ext2Fsd 0.53 (HKLM\...\Ext2Fsd_is1) (Version: 0.53 - Matt Wu)
Finalizer deinstallieren (x32 Version: 2.4.20730.1601 - Microsoft Corporation) Hidden
Finalizer deinstallieren (x32 Version: 2.5.21104.1601 - Microsoft Corporation) Hidden
Finalizer installieren (x32 Version: 2.4.20730.1601 - Microsoft Corporation) Hidden
Finalizer installieren (x32 Version: 2.5.21104.1601 - Microsoft Corporation) Hidden
FirewallEngine (Version: 1.6.0.0 - Lavasoft) Hidden
Gemeinsam genutzte Microsoft Azure-Komponenten für Visual Studio 2013 Sprachpaket (DEU) - v1.3 (x32 Version: 1.3.21014.1603 - Microsoft Corporation) Hidden
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 43.0.2357.81 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.27.5 - Google Inc.) Hidden
Hotfix für Microsoft Visual Studio 2007 Tools for Applications - ENU (KB947789) (HKLM-x32\...\{8E87B944-4815-3C5E-947F-5035C9F64362}.KB947789) (Version: 1 - Microsoft Corporation)
IIS 8.0 Express (HKLM\...\{7BF61FA9-BDFB-4563-98AD-FCB0DA28CCC7}) (Version: 8.0.1557 - Microsoft Corporation)
IIS Express Application Compatibility Database for x64 (HKLM\...\{9f4f4a9b-eec5-4906-92fe-d1f43ccf5c8d}.sdb) (Version:  - )
IIS Express Application Compatibility Database for x86 (HKLM\...\{fdfba1f3-74ae-4255-9c10-a0f552b4610f}.sdb) (Version:  - )
Install Finalizer (x32 Version: 2.4.20730.1601 - Microsoft Corporation) Hidden
Install Finalizer (x32 Version: 2.5.21104.1601 - Microsoft Corporation) Hidden
Integrated Camera (HKLM-x32\...\{E0A7ED39-8CD6-4351-93C3-69CCA00D12B4}) (Version: 6.2.9200.10224 - Realtek Semiconductor Corp.)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1008 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1281 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3412 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
Intel(R) Update Manager (x32 Version: 1.0.0.36888 - Intel Corporation) Hidden
Intel(R) WiDi (HKLM\...\{23D486D4-FBE0-40F3-A245-E4D56D094764}) (Version: 3.5.41.0 - Intel Corporation)
Intel® PROSet/Wireless Software (HKLM-x32\...\{c9967fbd-e3c3-4ed0-992a-5b33260f2944}) (Version: 16.1.5 - Intel Corporation)
Intel® PROSet/Wireless Software (HKLM-x32\...\{fad118b4-798f-4755-9e67-a622eec95b62}) (Version: 15.6.1 - Intel Corporation)
iTunes (HKLM\...\{33E28B58-7BA0-47B7-AA01-9225ABA2B8A9}) (Version: 11.3.0.54 - Apple Inc.)
Java 8 Update 5 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418005FF}) (Version: 8.0.50 - Oracle Corporation)
Java SE Development Kit 8 Update 5 (64-bit) (HKLM\...\{64A3A4F4-B792-11D6-A78A-00B0D0180050}) (Version: 8.0.50 - Oracle Corporation)
Kit SDK de vérification de Visual Studio*2012 - fra (x32 Version: 12.0.30501 - Microsoft Corporation) Hidden
Lenovo Auto Scroll Utility (HKLM\...\LenovoAutoScrollUtility) (Version: 2.01 - )
Lenovo Dependency Package (HKLM-x32\...\Lenovo Dependency Package_is1) (Version: 1.5.37.0 - Lenovo Group Limited)
Lenovo Experience Improvement (HKLM\...\LenovoExperienceImprovement) (Version: 1.0.3.0 - Lenovo)
Lenovo Fingerprint Manager (HKLM\...\{709AB4C0-9DFF-4293-954F-FBCC7FC005DA}) (Version: 4.5.122.0 - Validity Sensors, Inc.)
Lenovo Multimedia and Communications Core Runtime (HKLM\...\{033DC0E0-DA89-4C33-B66C-89B64D312CD1}_is1) (Version: 5.0.13.94 - Lenovo Corporation)
Lenovo Patch Utility (HKLM-x32\...\{AD32F5E9-6BDD-480A-8B7B-95571D04691C}) (Version: 1.3.1.1 - Lenovo Group Limited)
Lenovo Patch Utility (x32 Version: 1.3.2.6 - Lenovo Group Limited) Hidden
Lenovo Patch Utility 64 bit (HKLM\...\{ABE4638D-D208-4061-9F26-E3E11E3A1E0C}) (Version: 1.3.1.1 - Lenovo Group Limited)
Lenovo Patch Utility 64 bit (Version: 1.3.2.6 - Lenovo Group Limited) Hidden
Lenovo Power Management Driver (HKLM\...\Power Management Driver) (Version: 1.67.04.05 - )
Lenovo Settings - Camera Audio (HKLM\...\{88C6A6D9-324C-46E8-BA87-563D14021442}_is1) (Version: 4.3.19.209 - Lenovo Corporation)
Lenovo Settings - Power (HKLM-x32\...\{DAC01CEE-5BAE-42D5-81FC-B687E84E8405}) (Version: 7.49.4 - Lenovo Group Limited)
Lenovo Settings Dependency Package (HKLM\...\{3694BA2E-BE31-4B7E-886B-A0B559E69D4D}_is1) (Version: 2.3.3.33 - Lenovo Group Limited)
Lenovo Settings Mobile Hotspot (HKLM\...\{42603F7D-B08D-436B-B0D8-3E2DEF1AFD41}_is1) (Version: 1.1.0.57 - Lenovo)
Lenovo Settings Service (HKLM\...\{8C6F1EBA-17F1-4481-B688-9777E63E985F}_is1) (Version: 2.3.3.7 - Lenovo Group Limited)
Lenovo Settings UMDF driver (HKLM\...\{2BDC7413-65EA-4B99-8C4B-02F11075BE6D}_is1) (Version: 1.2.0.7 - Lenovo Group Limited)
Lenovo Solution Center (HKLM\...\{1CA74803-5CB2-4C03-BDBE-061EDC81CC7F}) (Version: 2.8.004.00 - Lenovo Group Limited)
Lenovo Solutions for Small Business (HKLM-x32\...\{6A6D86CD-B004-46b7-8951-7BB75A776F8C}) (Version: 2.0.32.7350 - Intel(R) Corporation)
Lenovo Solutions for Small Business Customizations (HKLM-x32\...\{AFD7B869-3B70-40C7-8983-769256BA3BD2}) (Version: 2.0.0004.00 - Lenovo Group Limited)
Lenovo System Update (HKLM-x32\...\{25C64847-B900-48AD-A164-1B4F9B774650}) (Version: 5.06.0016 - Lenovo)
Lenovo User Guide (HKLM-x32\...\{13F59938-C595-479C-B479-F171AB9AF64F}) (Version: 1.0.0012.00 - Lenovo Group Limited)
Lenovo Warranty Information (HKLM-x32\...\{FD4EC278-C1B1-4496-99ED-C0BE1B0AA521}) (Version: 1.0.0011.00 - Lenovo)
LocalESPC Dev12 (x32 Version: 8.100.25984 - Microsoft Corporation) Hidden
LocalESPCui for de-de Dev12 (x32 Version: 8.100.25984 - Microsoft) Hidden
Malwarebytes Anti-Malware Version 2.1.6.1022 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)
Memory Profiler (x32 Version: 12.0.31101 - Microsoft Corporation) Hidden
Metric Collection SDK (x32 Version: 1.1.0005.00 - Lenovo Group Limited) Hidden
Microsoft .NET Framework 4.5 Multi-Targeting Pack (HKLM-x32\...\{56E962F0-4FB0-3C67-88DB-9EAA6EEFC493}) (Version: 4.5.50710 - Microsoft Corporation)
Microsoft .NET Framework 4.5 SDK - DEU Lang Pack (HKLM-x32\...\{21B0F482-5EF9-45DA-8840-340AFE705A6C}) (Version: 4.5.50710 - Microsoft Corporation)
Microsoft .NET Framework 4.5 SDK (HKLM-x32\...\{4AE57014-05C4-4864-A13D-86517A7E1BA4}) (Version: 4.5.50710 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 Multi-Targeting Pack (HKLM-x32\...\{6A0C6700-EA93-372C-8871-DCCF13D160A4}) (Version: 4.5.50932 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 SDK (Deutsch) (HKLM-x32\...\{CBD7095F-7211-43FD-9FE7-FB08D753AF79}) (Version: 4.5.51641 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 SDK (HKLM-x32\...\{19A5926D-66E1-46FC-854D-163AA10A52D3}) (Version: 4.5.51641 - Microsoft Corporation)
Microsoft ASP.NET MVC 4 Runtime (HKLM-x32\...\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 - Microsoft Corporation)
Microsoft ASP.Net Web Frameworks 5.0 Security Update (KB2992080) (HKLM-x32\...\{3EC4A844-24F2-46DA-AEFB-FC3080C1BDB9}) (Version: 5.0.20821 - Microsoft Corporation)
Microsoft ASP.Net Web Frameworks 5.1 Security Update (KB2994397) (HKLM-x32\...\{94F716A3-CBBA-4005-9516-1C4267DDB824}) (Version: 5.1.20821 - Microsoft Corporation)
Microsoft Azure Authoring Tools - v2.4 (HKLM\...\{50D4178A-C2E6-4F95-9C54-8A31DFA68F32}) (Version: 2.4.6489.2 - Microsoft Corporation)
Microsoft Azure Authoring Tools - v2.5 (HKLM\...\{A46322D1-A353-4F9A-8DA1-C58401E33639}) (Version: 2.5.6496.10 - Microsoft Corporation)
Microsoft Azure Compute Emulator - v2.5 (HKLM\...\Microsoft Azure Compute Emulator - v2.5) (Version: 2.5.6496.10 - Microsoft Corporation)
Microsoft Azure HDInsight Tools for Visual Studio (HKLM-x32\...\{C6943238-E5DA-412D-850E-54181E5B4B65}) (Version: 1.0.0000.0 - Microsoft Corporation)
Microsoft Azure Libraries for .NET – v2.4 (HKLM\...\{D6B04ED9-386E-4157-AF50-64A43700FADC}) (Version: 2.4.0724.110 - Microsoft Corporation)
Microsoft Azure Libraries for .NET – v2.5 (HKLM\...\{22F9A831-CA56-4406-85FE-47FFB0472804}) (Version: 2.5.1024.161 - Microsoft Corporation)
Microsoft Azure PowerShell - November 2014 (HKLM-x32\...\{0A00707E-05D8-4096-A547-23BC7B9164D8}) (Version: 0.8.11 - Microsoft Corporation)
Microsoft Azure Quickstarts (HKLM-x32\...\{06747CB9-4E28-3164-A1C5-F7FD307F08B5}) (Version: 1.5.0 - Microsoft Corporation)
Microsoft Azure Storage Tools - v3.0.0 (HKLM-x32\...\{870D4E4E-1BE7-42E7-9655-E7792290FCB4}) (Version: 3.0.0.0 - Microsoft Corporation)
Microsoft Azure Tools for Microsoft Visual Studio 2013 - v2.4 (HKLM-x32\...\{59c9b964-1162-4063-886e-8410aa0fcbc8}) (Version: 2.4.20730.1601 - Microsoft Corporation)
Microsoft Azure Tools for Microsoft Visual Studio 2013 - v2.5 (HKLM-x32\...\{4be5d1d6-933d-4058-853b-047ed1258fc4}) (Version: 2.5.21104.1601 - Microsoft Corporation)
Microsoft Azure Tools für Microsoft Visual Studio 2013 Sprachpaket (DEU) - v2.4 (HKLM-x32\...\{98081515-e30f-4abe-93e8-827b0f7b1cee}) (Version: 2.4.20730.1601 - Microsoft Corporation)
Microsoft Azure-Tools für Microsoft Visual Studio 2013 Sprachpaket (DEU) - v2.5 (HKLM-x32\...\{bbc92f38-d7be-45f7-94ca-aa18f19702f3}) (Version: 2.5.21104.1601 - Microsoft Corporation)
Microsoft Help Viewer 1.1 (HKLM\...\Microsoft Help Viewer 1.1) (Version: 1.1.40219 - Microsoft Corporation)
Microsoft Help Viewer 1.1 Language Pack - DEU (HKLM\...\Microsoft Help Viewer 1.1 Language Pack - DEU) (Version: 1.1.40219 - Microsoft Corporation)
Microsoft Help Viewer 2.1 (HKLM-x32\...\Microsoft Help Viewer 2.1) (Version: 2.1.21005 - Microsoft Corporation)
Microsoft Help Viewer 2.1 Sprachpaket - DEU (HKLM-x32\...\Microsoft Help Viewer 2.1 Sprachpaket - DEU) (Version: 2.1.21005 - Microsoft Corporation)
Microsoft Hive ODBC Driver (HKLM\...\{AC9970E8-7F55-4F50-A6D3-2BC041589904}) (Version: 1.0.5.5 - Microsoft Corporation)
Microsoft Hive ODBC Driver (HKLM-x32\...\{7A580208-9E61-47FD-9AEB-DDDAA67CF0F6}) (Version: 1.0.5.5 - Microsoft Corporation)
Microsoft Office Developer Tools für Visual Studio 2013 - November 2014 Update (HKLM-x32\...\{1559e824-ca63-4f97-b1a3-7e2d8601db8a}) (Version: 12.0.31105.0 - Microsoft Corporation)
Microsoft Office Korrekturhilfen 2013 - Deutsch (HKLM-x32\...\{90150000-001F-0407-0000-0000000FF1CE}) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft Office Professional Plus 2013 (HKLM-x32\...\Office15.PROPLUSR) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation)
Microsoft Silverlight 5 SDK - DEU (HKLM-x32\...\{F351AA2C-723C-4CFE-A7CB-8E43AB164F7F}) (Version: 5.0.61118.0 - Microsoft Corporation)
Microsoft SQL Server 2008 (64-bit) (HKLM\...\Microsoft SQL Server 10 Release) (Version:  - Microsoft Corporation)
Microsoft SQL Server 2008 Native Client (HKLM\...\{1C3F92D0-3EC5-4CD4-9D5E-1E7834B65BB8}) (Version: 10.0.1600.22 - Microsoft Corporation)
Microsoft SQL Server 2008 R2 ADOMD.NET (HKLM-x32\...\{322B359D-BC0B-4E7D-9665-DF94C8B4D415}) (Version: 10.50.1600.1 - Microsoft Corporation)
Microsoft SQL Server 2008 R2 Management Objects (HKLM-x32\...\{5973B12E-5FC1-4EF6-B63B-49C1C4AF2AAA}) (Version: 10.51.2500.0 - Microsoft Corporation)
Microsoft SQL Server 2008-Richtlinien (HKLM-x32\...\{695E67B6-8B95-4160-9650-92974980CDC1}) (Version: 10.0.1600.22 - Microsoft Corporation)
Microsoft SQL Server 2012 (64-Bit) (HKLM\...\Microsoft SQL Server SQLServer2012) (Version:  - Microsoft Corporation)
Microsoft SQL Server 2012 Command Line Utilities  (HKLM\...\{F09DEB00-9F41-4BC9-BA81-9F131B12B3D5}) (Version: 11.1.3000.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Data-Tier App Framework  (HKLM-x32\...\{D4E30517-FE6F-491E-942F-AE10E1B18F38}) (Version: 11.1.2902.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Data-Tier App Framework  (x64) (HKLM\...\{B4EDAE03-DB34-4DD0-BA7E-2ED80DEA50B1}) (Version: 11.1.2902.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Express LocalDB  (HKLM\...\{269A8DF6-BBDA-441F-932B-233F9B746D72}) (Version: 11.1.3000.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Management Objects (HKLM-x32\...\{EC75BD20-F9CA-4E77-825F-ABD77E95BE91}) (Version: 11.1.3000.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Management Objects (x64) (HKLM\...\{0BF65908-D137-4A9E-B7C9-78F32F74F6FD}) (Version: 11.1.3000.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Native Client  (HKLM\...\{93945D16-4C3D-433E-B7E4-3D0D86B284C8}) (Version: 11.1.3000.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Setup (English) (HKLM\...\{8CB0713F-CFE0-445D-BCB2-538465860E1A}) (Version: 11.1.3128.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Transact-SQL ScriptDom  (HKLM\...\{6F173435-3F19-4043-BA3D-A46AA8472859}) (Version: 11.1.3000.0 - Microsoft Corporation)
Microsoft SQL Server 2012 T-SQL-Sprachdienst  (HKLM-x32\...\{1D812D86-D8EF-41AC-A518-BA12E1913747}) (Version: 11.1.3000.0 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP1 (Deutsch) (HKLM-x32\...\{FA440BE8-EC2F-4478-A01A-077DA0606501}) (Version: 3.5.5692.0 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP1-Abfragetools (Deutsch) (HKLM-x32\...\{0DD2DCC6-21AE-4678-8629-1084B17BE077}) (Version: 3.5.5692.0 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 ENU (HKLM-x32\...\{3A9FC03D-C685-4831-94CF-4EDFD3749497}) (Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft SQL Server Compact 4.0 SP1 x64 DEU  (HKLM\...\{98225B15-ECF5-4645-B5AC-F8C5E869A5D5}) (Version: 4.0.8876.1 - Microsoft Corporation)
Microsoft SQL Server Data Tools - DEU (12.0.41012.0) (HKLM-x32\...\{79AB8378-D661-4021-9941-FE5F4AEB57BB}) (Version: 12.0.41012.0 - Microsoft Corporation)
Microsoft SQL Server Data Tools 2013 (HKLM-x32\...\{1de65d33-0833-463b-b8f7-810c823c7015}) (Version: 12.0.40706.0 - Microsoft Corporation)
Microsoft SQL Server Data Tools Build Utilities - DEU (12.0.30919.1) (HKLM-x32\...\{BCB8A870-2B3D-4CC0-87D6-F931E065AC0C}) (Version: 12.0.30919.1 - Microsoft Corporation)
Microsoft SQL Server System CLR Types (HKLM-x32\...\{A282A232-780C-45E2-A5E5-9B61D74DCC6E}) (Version: 10.51.2500.0 - Microsoft Corporation)
Microsoft SQL Server System CLR Types (x64) (HKLM\...\{485F4AC6-F79E-4482-A0D2-EDF0CCE1E124}) (Version: 10.50.1600.1 - Microsoft Corporation)
Microsoft SQL Server*2014 Express LocalDB  (HKLM\...\{CA191120-4CB1-4E3D-89B8-79FDB9017A2E}) (Version: 12.0.2000.8 - Microsoft Corporation)
Microsoft SQL Server*2014 Management Objects  (HKLM-x32\...\{4F4CB3E2-9D2F-465A-854B-8276B02F4E7D}) (Version: 12.0.2000.8 - Microsoft Corporation)
Microsoft SQL Server*2014 Management Objects (x64) (HKLM\...\{03CB711D-679E-46ED-851B-C568418CF914}) (Version: 12.0.2000.8 - Microsoft Corporation)
Microsoft SQL Server*2014 Transact-SQL Compiler Service  (HKLM\...\{BC87D3DC-0257-4C81-8795-A0AAE6560B11}) (Version: 12.0.2000.8 - Microsoft Corporation)
Microsoft SQL Server*2014 Transact-SQL ScriptDom  (HKLM\...\{F2A2DB39-2C5A-4764-AA0F-5AB112663FFA}) (Version: 12.0.2000.8 - Microsoft Corporation)
Microsoft SQL Server*2014 T-SQL Language Service  (HKLM\...\{3D7A2828-3A40-4D35-A06C-E59E4B1FFCAE}) (Version: 12.0.2000.8 - Microsoft Corporation)
Microsoft SQL Server*2014 T-SQL Language Service  (HKLM-x32\...\{06BE8B71-46C6-434B-869E-85C58EF3120A}) (Version: 12.0.2000.8 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Runtime - 10.0.40219 (HKLM-x32\...\{5D9ED403-94DE-3BA0-B1D6-71F4BDA412E6}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual Studio 2010 Shell (Isolated) - DEU (HKLM-x32\...\{987AE03F-234A-3623-BD28-6B31FD1D3AB3}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio Tools for Applications 2.0 - ENU (HKLM-x32\...\{AA4A4B2C-0465-3CF8-BA76-27A027D8ACAB}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual Studio Tools for Applications 2.0 Language Pack - DEU (HKLM-x32\...\{8E87B944-4815-3C5E-947F-5035C9F64362}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual Studio Ultimate 2013 (HKLM-x32\...\{af15e1e3-cd81-4fbb-a41c-c1deef9f1691}) (Version: 12.0.21005.13 - Microsoft Corporation)
Microsoft VSS Writer für SQL Server 2012 (HKLM\...\{7647B46D-D4E6-43A5-AC9D-0BAA28C63271}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft Web Deploy 3.5 (HKLM\...\{69A998C5-00A9-42CA-AB4E-C31CFFCD9251}) (Version: 3.1237.1763 - Microsoft Corporation)
Microsoft Web Platform Installer 5.0 (HKLM\...\{4D84C195-86F0-4B34-8FDE-4A17EB41306A}) (Version: 5.0.50430.0 - Microsoft Corporation)
Microsoft-System-CLR-Typen für SQL Server 2012 (HKLM-x32\...\{43341417-7882-4F34-8390-53DFD00F6C0F}) (Version: 11.1.3366.16 - Microsoft Corporation)
Microsoft-System-CLR-Typen für SQL Server 2012 (x64) (HKLM\...\{24440413-490E-41CA-BD33-0B30FD3EBE3A}) (Version: 11.1.3366.16 - Microsoft Corporation)
Microsoft-System-CLR-Typen für SQL Server 2014 (HKLM\...\{9408684F-E1CC-4D2E-AE15-886023557682}) (Version: 12.0.2000.8 - Microsoft Corporation)
Microsoft-System-CLR-Typen für SQL Server 2014 (HKLM-x32\...\{B9A7B46F-0120-406B-9A12-3AD1DCC94D97}) (Version: 12.0.2000.8 - Microsoft Corporation)
Minimal ADB and Fastboot version 1.1.3 (HKLM-x32\...\{DE46417A-9E9E-4BCD-BBDD-DA21943193BB}_is1) (Version: 1.1.3 - )
Mouse driver v1.1 (HKLM-x32\...\uni mouse driver) (Version:  - )
Mozilla Firefox 38.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 38.0.1 (x86 de)) (Version: 38.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 31.6.0 - Mozilla)
Mozilla Thunderbird 31.6.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 31.6.0 (x86 de)) (Version: 31.6.0 - Mozilla)
MsgExtract (HKLM-x32\...\MsgExtract) (Version:  - MailDev)
MsgExtract (x32 Version: 2.9.1.649 - MailDev) Hidden
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.7.8.2 - Notepad++ Team)
NVIDIA Grafiktreiber 311.41 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 311.41 - NVIDIA Corporation)
NVIDIA PhysX (HKLM-x32\...\{3F5C371F-8EA2-4F25-9D3D-D0B4526E3AEA}) (Version: 9.10.0513 - NVIDIA Corporation)
NVIDIA Update 1.11.3 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.11.3 - NVIDIA Corporation)
OnlineThreatsEngine (Version: 2.2.3.0 - Lavasoft) Hidden
ooVoo (HKLM-x32\...\{FAA7F8FF-3C05-4A61-8F14-D8A6E9ED6623}) (Version: 3.6.4001 - ooVoo LLC.)
Open XML SDK 2.5 for Microsoft Office (x32 Version: 2.5.5631 - Microsoft Corporation) Hidden
Oracle VM VirtualBox 4.3.10 (HKLM\...\{5632714F-6A48-4BF2-89E0-F8B6CE9FE6D1}) (Version: 4.3.10 - Oracle Corporation)
Origin (HKLM-x32\...\Origin) (Version: 9.4.22.2815 - Electronic Arts, Inc.)
Outils de vérification linguistique 2013 de Microsoft Office*- Français (x32 Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Paket zur Festlegung von Zielversionen für Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM-x32\...\{D5409B11-EF28-37A1-AE7A-6051A5BAD923}) (Version: 4.5.50932 - Microsoft Corporation)
Paket zur Festlegung von Zielversionen für Microsoft .NET Framework 4.5.1 RC für Windows Store-Apps (Deutsch) (x32 Version: 4.5.21005 - Microsoft Corporation) Hidden
PDF Repair Toolbox 2.3 (HKLM-x32\...\PDF Repair Toolbox_is1) (Version:  - Recovery Toolbox, Inc.)
PDF Settings CS5 (x32 Version: 10.0 - Adobe Systems Incorporated) Hidden
PowreShellIntegration.Notifications (x32 Version: 2.5.21003.1603 - Microsoft Corporation) Hidden
PreEmptive Analytics Client German Language Pack (x32 Version: 1.2.3197.1 - PreEmptive Solutions) Hidden
PreEmptive Analytics Visual Studio Components (x32 Version: 1.2.3197.1 - PreEmptive Solutions) Hidden
PuTTY version 0.63 (HKLM-x32\...\PuTTY_is1) (Version: 0.63 - Simon Tatham)
Python Tools - Umleitungsvorlage (x32 Version: 1.3 - Microsoft Corporation) Hidden
RapidBoot HDD Accelerator (HKLM-x32\...\Fastboot) (Version: 2.1.1.0 - Lenovo)
Realtek Card Reader (HKLM-x32\...\{F0A8BF4A-972F-41E0-9800-1EFE3BF28266}) (Version: 6.2.9200.29064 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.3.730.2012 - Realtek)
Release Management for Visual Studio 2013 (x32 Version: 1.0 - Microsoft Corporation) Hidden
SDK de comprobación de Visual Studio 2012 - esn (x32 Version: 12.0.30501 - Microsoft Corporation) Hidden
Secure Download Manager (HKLM-x32\...\{C58626D6-7EBD-460D-8B6C-75B3C3464879}) (Version: 3.1.60 - Kivuto Solutions Inc.)
SharePoint Client Components (HKLM\...\{95150003-1163-0409-1000-0000000FF1CE}) (Version: 15.0.4641.1002 - Microsoft Corporation)
SharePoint Client Components (HKLM\...\{95160002-1163-0409-1000-0000000FF1CE}) (Version: 16.0.3104.1200 - Microsoft Corporation)
Skype™ 7.4 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.4.102 - Skype Technologies S.A.)
Spamihilator 1.6.0 (32-Bit) (HKLM-x32\...\{624CDCC7-9E58-46FE-956B-04A8004A9FCC}) (Version: 1.6.0 - Michel Krämer)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
SQL Server 2008 R2 Analysis Services OLE DB Provider (HKLM-x32\...\{453544C9-9977-4BCD-A1A1-DB457469E18B}) (Version: 10.50.1600.1 - Microsoft Corporation)
SQL Server 2012 Common Files (Version: 11.0.2100.60 - Microsoft Corporation) Hidden
SQL Server 2012 Database Engine Services (Version: 11.0.2100.60 - Microsoft Corporation) Hidden
SQL Server 2012 Database Engine Shared (Version: 11.0.2100.60 - Microsoft Corporation) Hidden
Sql Server Customer Experience Improvement Program (Version: 11.0.2100.60 - Microsoft Corporation) Hidden
SQL Server-Browser für SQL Server 2012 (HKLM-x32\...\{1A4C9497-7D4B-466D-8D3A-FE0D925386DC}) (Version: 11.0.2100.60 - Microsoft Corporation)
SUPERAntiSpyware (HKLM\...\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}) (Version: 6.0.1194 - SUPERAntiSpyware.com)
Synaptics WBF DDK 5011 (HKLM\...\{40CD122C-E6DF-45B1-BA54-4DB9416EFF9B}) (Version: 4.5.266.0 - Synaptics)
Synaptics WBF DDK 5011 (HKLM\...\{4D70781C-36A9-4335-9568-565C6F61B5EB}) (Version: 4.5.266.0 - )
Team Explorer for Microsoft Visual Studio 2013 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.15.1 - TeamSpeak Systems GmbH)
The Sims 4 Version 1.0 u1 (HKLM-x32\...\{27B947C0-320C-4997-9681-1E7010A15896}_is1) (Version: 1.0 u1 - EA Games)
ThinkPad UltraNav Driver (HKLM\...\SynTPDeinstKey) (Version: 18.0.7.34 - Synaptics Incorporated)
ThinkVantage System für aktiven Festplattenschutz (HKLM\...\{46A84694-59EC-48F0-964C-7E76E9F8A2ED}) (Version: 1.77.0.11 - Lenovo)
TypeScript Power Tool (x32 Version: 1.0.5.0 - Microsoft Corporation) Hidden
TypeScript Tools for Microsoft Visual Studio 2013 (x32 Version: 1.0.5.0 - Microsoft Corporation) Hidden
Uninstall Finalizer (x32 Version: 2.4.20730.1601 - Microsoft Corporation) Hidden
Uninstall Finalizer (x32 Version: 2.5.21104.1601 - Microsoft Corporation) Hidden
Unterstützungsdateien für Microsoft SQL Server 2008-Setup  (HKLM\...\{6AF73222-EE90-434C-AE7E-B96F70A68D89}) (Version: 10.1.2731.0 - Microsoft Corporation)
Update for  (KB2504637) (HKLM-x32\...\{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}.KB2504637) (Version: 1 - Microsoft Corporation)
Update for Skype for Business 2015 (KB2889853) 32-Bit Edition (HKLM-x32\...\{90150000-012B-0409-0000-0000000FF1CE}_Office15.PROPLUSR_{BF1B3F01-93F3-4B83-93DB-132EB1AED259}) (Version:  - Microsoft)
VBA (3821b) (x32 Version: 6.01.00.1234 - Microsoft Corporation) Hidden
Visual Studio 2010 Prerequisites - English (HKLM\...\{53952792-BF16-300E-ADF2-E7E4367E00CF}) (Version: 10.0.40219 - Microsoft Corporation)
Visual Studio 2013 Update 4 (KB2829760) (HKLM-x32\...\{53d408db-eb91-43fb-9d8f-167681c19763}) (Version: 12.0.31101 - Microsoft Corporation)
Visual Studio Installer Projects Extension for Microsoft Visual Studio 2013 (HKLM-x32\...\{e50b7054-ce07-4b25-aead-4c7f0f8892d1}) (Version: 12.0.30122 - Microsoft Corporation)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.1 - VideoLAN)
VS Update core components (x32 Version: 12.0.31101 - Microsoft Corporation) Hidden
WampServer 2.5 (HKLM-x32\...\WampServer 2_is1) (Version:  - Hervé Leclerc (HeL))
WCF Data Services 5.6.0 DEU Language Pack (x32 Version: 5.6.61587.0 - Microsoft Corporation) Hidden
WCF Data Services 5.6.0 Runtime (x32 Version: 5.6.61587.0 - Microsoft Corporation) Hidden
WCF Data Services Tools for Microsoft Visual Studio 2013 (x32 Version: 5.6.61587.0 - Microsoft Corporation) Hidden
WCF Data Services Tools for Microsoft Visual Studio 2013 DEU Language Pack (x32 Version: 5.6.61587.0 - Microsoft Corporation) Hidden
WCF RIA Services V1.0 SP2 (HKLM-x32\...\{5D8DD6A8-C4D7-4554-93F9-F1CC28C72600}) (Version: 4.1.62812.0 - Microsoft Corporation)
Win32DiskImager version 0.9.5 (HKLM-x32\...\{D074CE74-912A-4AD3-A0BF-3937D9D01F17}_is1) (Version: 0.9.5 - ImageWriter Developers)
Winamp (HKLM-x32\...\Winamp) (Version: 5.666  - Nullsoft, Inc)
Windows 7 USB/DVD Download Tool (HKLM-x32\...\{CCF298AF-9CE1-4B26-B251-486E98A34789}) (Version: 1.0.30 - Microsoft Corporation)
Windows Azure Storage Emulator - v3.4 (HKLM-x32\...\Windows Azure Storage Emulator - v3.4) (Version: 3.4.6848.0 - Microsoft Corporation)
Windows Phone 8.1 Emulators - ENU (HKLM-x32\...\{166a69f6-6512-47ea-a342-17d954fc059a}) (Version: 12.0.31010.0 - Microsoft Corporation)
Windows-Treiberpaket - Intel Corporation (iaStorA) HDC  (09/01/2012 11.6.0.1030) (HKLM\...\C5447D3383070620C3892FF393F522D6225CBA13) (Version: 09/01/2012 11.6.0.1030 - Intel Corporation)
Windows-Treiberpaket - Lenovo 1.66.00.22 (11/30/2012 1.66.00.22) (HKLM\...\16E722986C4293F5D6BF43595DFFD631398D5F21) (Version: 11/30/2012 1.66.00.22 - Lenovo)
WinRAR 5.10 beta 4 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.10.4 - win.rar GmbH)
WinSCP 5.5.3 (HKLM-x32\...\winscp3_is1) (Version: 5.5.3 - Martin Prikryl)
Wondershare SafeEraser ( Version 2.1.2 ) (HKLM-x32\...\{1FD4D6F6-5A95-44EF-855F-02746470397C}_is1) (Version: 2.1.2 - Wondershare)
Workflow Manager Client 1.0 (Version: 2.0.40131.0 - Microsoft Corporation) Hidden
Workflow Manager Tools 1.0 for Visual Studio (Version: 2.0.40326.0 - Microsoft Corporation) Hidden
WorldPainter 1.10.3 (HKLM\...\4144-4862-0472-7103) (Version: 1.10.3 - pepsoft.org)
Пакет Visual Studio 2012 Verification SDK - rus (x32 Version: 12.0.30501 - Microsoft Corporation) Hidden

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== Restore Points =========================

29-05-2015 11:21:59 Geplanter Prüfpunkt

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 15:25 - 2014-08-13 08:30 - 00000851 ____A C:\WINDOWS\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {0124DCD9-E680-43E8-8FAA-67AEF8312904} - System32\Tasks\Microsoft\Windows\GroupPolicy\{3E0A038B-D834-4930-9981-E89C9BFF83AA}
Task: {06F792AF-CF44-4EFD-A03F-41664E27B14F} - System32\Tasks\StartPowerDVDService => C:\PROGRAM FILES (x86)\Cyberlink\PowerDVD10\PDVD10Serv.exe
Task: {08B5541A-81BC-4FDB-94D2-04CA1D153E7A} - System32\Tasks\Lenovo\LSC\LSCHardwareScanPostpone => C:\Program Files\Lenovo\Lenovo Solution Center\LSC.exe [2015-03-09] ()
Task: {0BAC6A95-B6E1-42F8-B63A-5D6133184B56} - System32\Tasks\Lenovo\Lenovo Solution Center Launcher => C:\Program Files\lenovo\lenovo solution center\App\LSCService.exe [2015-03-09] (Lenovo)
Task: {0C2F28E9-A277-4363-990D-F8A5A257075B} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B => schtasks
Task: {10D094F0-5878-4FED-900D-E859FFD69D45} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe [2014-06-24] (Safer-Networking Ltd.)
Task: {17E107F1-3207-49C3-86B8-07F5638DA35F} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-05-13] (Microsoft Corporation)
Task: {1A20B9A4-2DA4-49DB-95B5-9536837AB624} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe [2014-06-24] (Safer-Networking Ltd.)
Task: {1A64DC02-8820-43FD-9AB4-7FB7627CB181} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-05-08] (Google Inc.)
Task: {38338109-CDF6-4E98-91A2-14CFC26517C3} - System32\Tasks\Lenovo\LenovoDependencyVersionTask => C:\Program Files\lenovo\SystemAgent\DependencyVersion.exe [2013-06-05] ()
Task: {383F02F8-71D3-4382-977B-EEAD5F97F647} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe [2014-06-27] (Safer-Networking Ltd.)
Task: {3A4A5CB7-F50D-41F6-83AA-AF41B087D343} - System32\Tasks\SUPERAntiSpyware Scheduled Task dfc0f345-4c50-4aee-adb1-b2fff5208f26 => C:\Program Files\SUPERAntiSpyware\SASTask.exe [2013-11-07] (SUPERAdBlocker.com)
Task: {3DCF1F57-B993-4995-976C-771FCE2402B2} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-21] (Microsoft Corporation)
Task: {47F4EDD1-6E10-4026-92C7-C274DFA81885} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe
Task: {4E6782A1-2F85-4626-A8CD-B8DFD014116D} - \ProPCCleaner_Popup No Task File <==== ATTENTION
Task: {54BBD09A-5AB6-4216-A52A-39C52FC7B93A} - System32\Tasks\SUPERAntiSpyware Scheduled Task ab70ba7d-3101-4914-adbd-0bdd19f63ea1 => C:\Program Files\SUPERAntiSpyware\SASTask.exe [2013-11-07] (SUPERAdBlocker.com)
Task: {6670E955-FE5D-4EFF-A87F-8FC667BD0386} - System32\Tasks\Lenovo\LenovoWarrantyChinaTask => C:\Program Files\lenovo\SystemAgent\ChinaWarrantyService.exe [2013-06-05] ()
Task: {8170BCD5-7732-4208-A4D3-AFB70ED5866E} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-21] (Microsoft Corporation)
Task: {91A95959-AB3F-494D-A59B-BABD58BE08B0} - System32\Tasks\Lenovo\LenovoMachineInformation => C:\Program Files\lenovo\SystemAgent\MachineInformation.exe [2013-06-05] ()
Task: {92A8455B-ACC6-4830-8207-C442D7F71596} - System32\Tasks\Lenovo\LSC\Lenovo Solution Center Notifications => C:\Program Files\Lenovo\Lenovo Solution Center\LSCNotify.exe [2015-03-09] (Lenovo)
Task: {A1E57457-FF9D-4D48-9DD5-D6A77057D063} - System32\Tasks\Intel(R) Small Business Advantage\Notifier => C:\Program Files\Intel\Intel(R) Small Business Advantage\UI\SBA_Notifier.exe [2013-04-10] (Intel Corporation)
Task: {AE1F0B98-E9E6-4D8F-B5A0-6698CBAE7243} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-05-06] (Microsoft Corporation)
Task: {B1DE91FA-62B0-44C7-86DB-2F6A617A69B6} - System32\Tasks\Lenovo\LSC\LSCHardwareScan => C:\Program Files\Lenovo\Lenovo Solution Center\LSC.exe [2015-03-09] ()
Task: {B40C2DB7-1DD2-469D-A4FD-D57EAFE3A876} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-05-08] (Google Inc.)
Task: {B74CCD64-87DF-4F91-A69C-5B5DEAE9D674} - System32\Tasks\Lenovo\LSC\RebootCountTask => C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCService.exe [2015-03-09] (Lenovo)
Task: {B92C9630-C2FD-489F-9478-4F91736A369A} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program => C:\Program Files\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe
Task: {BE92E342-FB43-499D-84F4-6185F8B9ACDF} - System32\Tasks\Overwolf Updater Task => C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe [2015-05-04] (Overwolf LTD)
Task: {C15ED66A-782D-4296-A9BB-BEF86CFD876F} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {D27CC8AA-11FB-415F-80A5-5FD5E9B347B4} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-05-06] (Microsoft Corporation)
Task: {D2F3FF1C-BB13-48F4-ABEE-BFC8AB4D6C83} - \ProPCCleaner_Start No Task File <==== ATTENTION
Task: {DBEB4922-6698-45FD-A2FD-177DB9EE7CA3} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\OutOfIdle => C:\Windows\system32\GWX\GWX.exe [2015-05-06] (Microsoft Corporation)
Task: {DEF840D5-7C7C-4EC6-8C9E-CE68FBDC5064} - System32\Tasks\Lenovo\LSC\Time72Task => C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCService.exe [2015-03-09] (Lenovo)
Task: {DF3EAF75-093E-4ED3-BFDD-236E9EF096ED} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-04-23] (Piriform Ltd)
Task: {E09CC6B5-D0A8-4D09-8EA3-42CA3FAA9426} - System32\Tasks\Lenovo\Experience Improvement => C:\Program Files\Lenovo\ExperienceImprovement\LenovoExperienceImprovement.exe [2013-03-13] (Lenovo)
Task: {ECF11F0B-39B1-49B3-9A53-8254D3CD533E} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\Logon => C:\Windows\system32\GWX\GWX.exe [2015-05-06] (Microsoft Corporation)
Task: {ED1747FD-6549-4BB8-9072-E40DEE347C39} - System32\Tasks\Lenovo\LenovoUserguidesCopy => C:\Program Files\lenovo\SystemAgent\UserguidesCopy.exe [2013-06-05] ()
Task: {F08CC1D4-4563-45B1-A5AC-3D8C647A7A2A} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program 64 => C:\Program Files (x86)\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe [2014-02-13] (Lenovo)
Task: {F572AB57-11F2-44AA-8D71-11BC2D45D32A} - System32\Tasks\Lenovo\Lenovo Settings Power => Rundll32.exe "C:\Program Files (x86)\ThinkPad\Utilities\PWMTR64V.dll",PwrMgrBkGndMonitor
Task: {F5D211BD-4A3A-4EA5-A6F6-923D38DBCA7D} - System32\Tasks\AdobeAAMUpdater-1.0-XXX-xxx => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2010-03-06] (Adobe Systems Incorporated)
Task: {F9DD4F9F-3F8F-42AD-A536-82C83E86AE97} - System32\Tasks\TVT\TVSUUpdateTask => C:\Program Files (x86)\Lenovo\System Update\tvsuShim.exe [2014-06-18] ()
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\SUPERAntiSpyware Scheduled Task ab70ba7d-3101-4914-adbd-0bdd19f63ea1.job => C:\Program Files\SUPERAntiSpyware\SASTask.exedC:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe /TASK:ab70ba7d-3101-4914-adbd-0bdd19f63ea1STR\xxx
Task: C:\WINDOWS\Tasks\SUPERAntiSpyware Scheduled Task dfc0f345-4c50-4aee-adb1-b2fff5208f26.job => C:\Program Files\SUPERAntiSpyware\SASTask.exedC:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe /TASK:dfc0f345-4c50-4aee-adb1-b2fff5208f26STR\xxx
Task: C:\WINDOWS\Tasks\Synaptics TouchPad Enhancements.job => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

==================== Loaded Modules (Whitelisted) ==============

2013-12-26 19:42 - 2013-12-26 19:42 - 00013088 _____ () C:\Program Files\NVIDIA Corporation\CoProcManager\detoured.dll
2014-05-15 16:56 - 2015-01-16 08:49 - 00118272 ____N () C:\Program Files (x86)\ThinkPad\Utilities\GR\PWMRT64V.dll
2015-03-18 14:08 - 2015-03-18 14:08 - 08898720 _____ () C:\Program Files\Microsoft Office\Office15\1033\GrooveIntlResource.dll
2015-03-10 18:50 - 2015-03-10 18:50 - 02756616 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareShellExtension.dll
2015-03-10 18:50 - 2015-03-10 18:50 - 03396064 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\RCF.dll
2015-03-10 18:51 - 2015-03-10 18:51 - 00125464 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\boost_filesystem-vc100-mt-1_57.dll
2015-03-10 18:51 - 2015-03-10 18:51 - 00024080 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\boost_system-vc100-mt-1_57.dll
2015-04-15 22:13 - 2015-04-15 22:13 - 00222720 _____ () C:\Program Files (x86)\Notepad++\NppShell_06.dll
2014-07-03 13:20 - 2014-07-03 13:20 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-07-03 13:19 - 2014-07-03 13:19 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2015-05-30 14:28 - 2014-05-13 12:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2015-05-30 14:28 - 2014-05-13 12:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2015-05-30 14:28 - 2014-05-13 12:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2015-05-30 14:28 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2015-05-30 14:28 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\Users\xxx\Downloads\Bilder EOS:com.dropbox.attributes

==================== Safe Mode (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mbamchameleon => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mbamchameleon => ""="Driver"

==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

DNS Servers: 10.0.0.138

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\Services: LocationTaskManager => 2
MSCONFIG\Services: MyWiFiDHCPDNS => 3
MSCONFIG\Services: SUService => 3

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{242470B5-31E0-48E6-9EE5-29905C943162}] => (Allow) C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
FirewallRules: [{1CBC94E5-E109-4AB9-9FFD-3BA7925F2779}] => (Allow) C:\Program Files\Intel Corporation\Intel WiDi\WiDiApp.exe
FirewallRules: [{D7CFA47A-EF44-4BE2-A45F-2909F7B547A6}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [{77A45614-A6B7-472B-BF7D-4AAA2B6AFCBD}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppextcomobj.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppextcomobj.exe
FirewallRules: [{2C76795B-E1E3-4CE5-B3C4-AF7D0B8F6AE5}] => (Allow) C:\Program Files (x86)\Microsoft Visual Studio 12.0\Common7\IDE\devenv.exe
FirewallRules: [{33B495CD-7F80-4862-974F-DC2AF9224E1B}] => (Allow) C:\Program Files (x86)\Microsoft Visual Studio 12.0\Common7\IDE\devenv.exe
FirewallRules: [{1F548C80-DB33-4C1E-B770-C5C0D2792DB6}] => (Allow) C:\Program Files (x86)\Microsoft Visual Studio 12.0\Common7\IDE\devenv.exe
FirewallRules: [{E7DA9979-34FB-4972-8495-58D403F27254}] => (Allow) C:\Program Files (x86)\Microsoft Visual Studio 12.0\Common7\IDE\devenv.exe
FirewallRules: [{D9DD56BB-0B2D-4E23-B999-34EC54E2135B}] => (Allow) C:\Program Files (x86)\Microsoft Visual Studio 12.0\Common7\IDE\devenv.exe
FirewallRules: [{7C394281-95F1-4558-B478-D5928375574F}] => (Allow) C:\Program Files (x86)\Microsoft Visual Studio 12.0\Common7\IDE\devenv.exe
FirewallRules: [{5A43ACC2-0701-4F23-A480-61C065895359}] => (Allow) C:\Program Files (x86)\Microsoft Visual Studio 12.0\Common7\IDE\devenv.exe
FirewallRules: [{1FC9651E-8A31-4CD1-98E6-E185A9237CC2}] => (Allow) C:\Program Files (x86)\Microsoft Office\Office15\lync.exe
FirewallRules: [{177AF74D-31DC-4BB8-BED1-898BE6B923F3}] => (Allow) C:\Program Files (x86)\Microsoft Office\Office15\lync.exe
FirewallRules: [{FEF842C2-149D-400C-A6F3-B599C5B59A76}] => (Allow) C:\Program Files (x86)\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{35129276-AC4E-4BEF-8AFB-91F5562A27F0}] => (Allow) C:\Program Files (x86)\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [TCP Query User{3787E2D0-F9D0-49F5-884C-56EE080F3777}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [UDP Query User{10F107ED-3416-4909-B75A-A1CB46FB1677}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [{EA02D0AE-F9DB-4C78-B6DF-2D5456E060D7}] => (Allow) C:\Program Files (x86)\Microsoft Office\Office15\lync.exe
FirewallRules: [{C4C077A5-A186-4109-900E-35394D0A88F7}] => (Allow) C:\Program Files (x86)\Microsoft Office\Office15\lync.exe
FirewallRules: [{F1DD2171-22AE-423F-8596-48274C48AA6E}] => (Allow) C:\Program Files (x86)\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{38B81253-ADF3-4D86-A732-281A2F75E9E4}] => (Allow) C:\Program Files (x86)\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [TCP Query User{73D1F921-211B-423B-9589-A391CCF49752}C:\program files\java\jre8\bin\javaw.exe] => (Allow) C:\program files\java\jre8\bin\javaw.exe
FirewallRules: [UDP Query User{9C145ED3-3179-4CFF-9840-866F7372C545}C:\program files\java\jre8\bin\javaw.exe] => (Allow) C:\program files\java\jre8\bin\javaw.exe
FirewallRules: [TCP Query User{90216F89-6ACE-44C7-820A-14C4CDEA7D37}C:\program files\dassault systemes\b19\win_b64\code\bin\orbixd.exe] => (Allow) C:\program files\dassault systemes\b19\win_b64\code\bin\orbixd.exe
FirewallRules: [UDP Query User{1FD09EF0-8A2B-45B5-91F4-33FB8B1BC4CC}C:\program files\dassault systemes\b19\win_b64\code\bin\orbixd.exe] => (Allow) C:\program files\dassault systemes\b19\win_b64\code\bin\orbixd.exe
FirewallRules: [TCP Query User{BC462EFE-1716-4F69-8DF7-5CCBCE4C1946}C:\program files\dassault systemes\b19\win_b64\code\bin\cnext.exe] => (Allow) C:\program files\dassault systemes\b19\win_b64\code\bin\cnext.exe
FirewallRules: [UDP Query User{1CACF24E-81B1-4066-887E-D0DE4AB92975}C:\program files\dassault systemes\b19\win_b64\code\bin\cnext.exe] => (Allow) C:\program files\dassault systemes\b19\win_b64\code\bin\cnext.exe
FirewallRules: [TCP Query User{9974E944-8071-4A57-9649-138722BEFA5C}C:\program files\dassault systemes\b19\win_b64\code\bin\catsysdemon.exe] => (Block) C:\program files\dassault systemes\b19\win_b64\code\bin\catsysdemon.exe
FirewallRules: [UDP Query User{38075A48-FC94-4CBE-A5A5-BFB3A5E1D6B6}C:\program files\dassault systemes\b19\win_b64\code\bin\catsysdemon.exe] => (Block) C:\program files\dassault systemes\b19\win_b64\code\bin\catsysdemon.exe
FirewallRules: [TCP Query User{E95AAE43-1DC2-4387-94B7-24DBBF7F148F}C:\program files\dassault systemes\b19\win_b64\code\bin\catutil.exe] => (Block) C:\program files\dassault systemes\b19\win_b64\code\bin\catutil.exe
FirewallRules: [UDP Query User{6B953EFB-531F-4D12-B006-191B5A8B8C59}C:\program files\dassault systemes\b19\win_b64\code\bin\catutil.exe] => (Block) C:\program files\dassault systemes\b19\win_b64\code\bin\catutil.exe
FirewallRules: [TCP Query User{1661030B-EA8B-41B6-8932-0B2DAF4C698A}C:\program files\dassault systemes\b19\win_b64\code\bin\catbatchstarter.exe] => (Block) C:\program files\dassault systemes\b19\win_b64\code\bin\catbatchstarter.exe
FirewallRules: [UDP Query User{52371082-0C21-4F5F-9112-026440E48F9A}C:\program files\dassault systemes\b19\win_b64\code\bin\catbatchstarter.exe] => (Block) C:\program files\dassault systemes\b19\win_b64\code\bin\catbatchstarter.exe
FirewallRules: [{C24B5D7D-EA68-40AC-805F-7EE2E3DE4EAC}] => (Allow) C:\Program Files (x86)\Winamp\winamp.exe
FirewallRules: [{2A27B08A-0777-443E-8BAE-FC562146A04C}] => (Allow) C:\Program Files (x86)\Winamp\winamp.exe
FirewallRules: [{1A598A3F-0A77-47C2-8B59-4A6EE06A905A}] => (Allow) C:\Program Files (x86)\Winamp\winamp.exe
FirewallRules: [{C400173B-C4B8-452F-BF5D-B59038118EF3}] => (Allow) C:\Program Files (x86)\Winamp\winamp.exe
FirewallRules: [TCP Query User{719C61E6-C1DC-4559-8AD4-6C4547DB2179}C:\program files\java\jre8\bin\java.exe] => (Allow) C:\program files\java\jre8\bin\java.exe
FirewallRules: [UDP Query User{3FD2016E-DF0D-46FD-BBF3-6AA9E0BB83E9}C:\program files\java\jre8\bin\java.exe] => (Allow) C:\program files\java\jre8\bin\java.exe
FirewallRules: [{2C192423-97DD-4A0A-A203-D764CFAEEE1D}] => (Allow) C:\Users\xxx\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{C4D975D5-B66E-4A4F-BC17-1B7530C9876D}] => (Allow) C:\Users\xxx\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{DE875B9C-FF58-4EAC-B11F-54625F9D9EBA}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{35EC2319-902A-47ED-BE27-2E3C37D4C7B1}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{FCEFB336-CF51-429D-9F42-8B7E9CBEE25F}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{9DA7FD3B-E054-4635-A345-0B62387AC32B}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{6019E249-98D6-4C50-A3C2-C82C26120301}] => (Allow) C:\Program Files (x86)\iTunes\iTunes.exe
FirewallRules: [{3483FDFB-8BEA-4E9F-86D6-623FB8FFBDA6}] => (Allow) C:\Program Files (x86)\Lenovo\System Update\uncserver.exe
FirewallRules: [{8B659235-ADD0-46C5-98EF-79E823452DDD}] => (Allow) C:\Program Files (x86)\Lenovo\System Update\uncserver.exe
FirewallRules: [{DABB5380-FEC7-4F88-ADFD-DE809728A491}] => (Allow) LPort=16021
FirewallRules: [{168DD390-ABCD-45D2-8ADE-0B928FDF516F}] => (Allow) LPort=12292
FirewallRules: [{ACAD0436-57E3-4205-A019-B7622FFA306F}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{D169A576-D685-4780-98E9-6CC3BA0DC9B3}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{B32D5C53-F093-4BB5-9B87-EA1C6A329100}C:\program files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{0E0B4E94-13C2-4FA8-B89F-B664862F9E01}C:\program files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [{2863FB7C-F029-4A61-95FC-F621552A4079}] => (Allow) C:\Program Files (x86)\Spamihilator\spamihilator.exe
FirewallRules: [{D34C3F29-0D64-4F7F-8836-41CAC19E8EC2}] => (Allow) C:\Program Files (x86)\Spamihilator\cdcc.exe
FirewallRules: [{D2084B2E-B7D6-4DD0-A5FE-84543CEE6047}] => (Allow) C:\Program Files (x86)\Spamihilator\dccproc.exe
FirewallRules: [{26D76030-DF77-4293-8223-33A8C3B656FF}] => (Allow) %systemroot%\system32\alg.exe
FirewallRules: [{9BF0448B-83AB-49A7-B7DA-265C3738052A}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe] => Enabled:Spybot - Search & Destroy tray access
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe] => Enabled:Spybot-S&D 2 Scanner Service
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe] => Enabled:Spybot-S&D 2 Updater
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe] => Enabled:Spybot-S&D 2 Background update service

==================== Faulty Device Manager Devices =============

Name: IWD Bus Enumerator
Description: IWD Bus Enumerator
Class Guid: {4d36e97d-e325-11ce-bfc1-08002be10318}
Manufacturer: (Standard system devices)
Service: iwdbus
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver


==================== Event log errors: =========================

Application errors:
==================
Error: (06/01/2015 02:47:52 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: LnvHotSpotSvc.exe, Version: 2.3.0.83, Zeitstempel: 0x5317b709
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.3.9600.17736, Zeitstempel: 0x550f4336
Ausnahmecode: 0xc00000fd
Fehleroffset: 0x000000000003f69f
ID des fehlerhaften Prozesses: 0x1988
Startzeit der fehlerhaften Anwendung: 0xLnvHotSpotSvc.exe0
Pfad der fehlerhaften Anwendung: LnvHotSpotSvc.exe1
Pfad des fehlerhaften Moduls: LnvHotSpotSvc.exe2
Berichtskennung: LnvHotSpotSvc.exe3
Vollständiger Name des fehlerhaften Pakets: LnvHotSpotSvc.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: LnvHotSpotSvc.exe5

Error: (06/01/2015 01:25:07 PM) (Source: SideBySide) (EventID: 9) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Das Stammelement der Manifestdatei muss assembliert sein.

Error: (06/01/2015 00:51:40 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm devenv.exe, Version 12.0.31101.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 2b9c

Startzeit: 01d09c5888ca9431

Endzeit: 16

Anwendungspfad: C:\Program Files (x86)\Microsoft Visual Studio 12.0\Common7\IDE\devenv.exe

Berichts-ID: 06e0fa40-084c-11e5-bedd-00c2c63a0efc

Vollständiger Name des fehlerhaften Pakets: 

Anwendungs-ID, die relativ zum fehlerhaften Paket ist:

Error: (06/01/2015 00:37:40 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: MachineInformation.exe, Version: 1.5.37.0, Zeitstempel: 0x51af959a
Name des fehlerhaften Moduls: clr.dll, Version: 4.0.30319.34014, Zeitstempel: 0x52e0b784
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000f771
ID des fehlerhaften Prozesses: 0x1fe0
Startzeit der fehlerhaften Anwendung: 0xMachineInformation.exe0
Pfad der fehlerhaften Anwendung: MachineInformation.exe1
Pfad des fehlerhaften Moduls: MachineInformation.exe2
Berichtskennung: MachineInformation.exe3
Vollständiger Name des fehlerhaften Pakets: MachineInformation.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: MachineInformation.exe5

Error: (06/01/2015 00:36:27 PM) (Source: .NET Runtime) (EventID: 1023) (User: )
Description: Anwendung: MachineInformation.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund eines internen Fehlers in der .NET-Laufzeit beendet. bei IP 7198F771 (71980000) mit Exitcode 80131506.

Error: (06/01/2015 00:10:24 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm SDLogReport.exe, Version 2.4.40.107 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 120c

Startzeit: 01d09c40fbc29909

Endzeit: 6

Anwendungspfad: C:\Program Files (x86)\Spybot - Search & Destroy 2\SDLogReport.exe

Berichts-ID: 657466c1-0846-11e5-bedd-00c2c63a0efc

Vollständiger Name des fehlerhaften Pakets: 

Anwendungs-ID, die relativ zum fehlerhaften Paket ist:

Error: (06/01/2015 09:43:50 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: LnvHotSpotSvc.exe, Version: 2.3.0.83, Zeitstempel: 0x5317b709
Name des fehlerhaften Moduls: RPCRT4.dll, Version: 6.3.9600.17415, Zeitstempel: 0x545045a8
Ausnahmecode: 0xc00000fd
Fehleroffset: 0x000000000000575d
ID des fehlerhaften Prozesses: 0x450
Startzeit der fehlerhaften Anwendung: 0xLnvHotSpotSvc.exe0
Pfad der fehlerhaften Anwendung: LnvHotSpotSvc.exe1
Pfad des fehlerhaften Moduls: LnvHotSpotSvc.exe2
Berichtskennung: LnvHotSpotSvc.exe3
Vollständiger Name des fehlerhaften Pakets: LnvHotSpotSvc.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: LnvHotSpotSvc.exe5

Error: (06/01/2015 09:15:33 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: mbar.exe, Version: 1.9.1.1004, Zeitstempel: 0x54d5665f
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.3.9600.17736, Zeitstempel: 0x550f42c2
Ausnahmecode: 0xc00000fd
Fehleroffset: 0x00048e18
ID des fehlerhaften Prozesses: 0x19bc
Startzeit der fehlerhaften Anwendung: 0xmbar.exe0
Pfad der fehlerhaften Anwendung: mbar.exe1
Pfad des fehlerhaften Moduls: mbar.exe2
Berichtskennung: mbar.exe3
Vollständiger Name des fehlerhaften Pakets: mbar.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: mbar.exe5

Error: (06/01/2015 08:53:39 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: ResEdit.exe, Version: 1.6.6.0, Zeitstempel: 0x55440b92
Name des fehlerhaften Moduls: ResEdit.exe, Version: 1.6.6.0, Zeitstempel: 0x55440b92
Ausnahmecode: 0x40000015
Fehleroffset: 0x00000000000b40b9
ID des fehlerhaften Prozesses: 0xdc4
Startzeit der fehlerhaften Anwendung: 0xResEdit.exe0
Pfad der fehlerhaften Anwendung: ResEdit.exe1
Pfad des fehlerhaften Moduls: ResEdit.exe2
Berichtskennung: ResEdit.exe3
Vollständiger Name des fehlerhaften Pakets: ResEdit.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: ResEdit.exe5

Error: (06/01/2015 08:30:24 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: XXX-XXX)
Description: Bei der Aktivierung der App „winstore_cw5n1h2txyewy!Windows.Store“ ist folgender Fehler aufgetreten: -2144927149. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.


System errors:
=============
Error: (06/01/2015 02:51:57 PM) (Source: Service Control Manager) (EventID: 7032) (User: )
Description: Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden des Dienstes "Windows Modules Installer" Korrekturmaßnahmen (Neustart des Diensts) durchzuführen, ist fehlgeschlagen. Fehler: 
%%1056

Error: (06/01/2015 02:49:57 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Modules Installer" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (06/01/2015 02:49:57 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Intel(R) Management and Security Application User Notification Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (06/01/2015 02:49:57 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "NVIDIA Update Service Daemon" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (06/01/2015 02:49:57 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "LnvMHService" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (06/01/2015 02:49:57 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Lenovo QuickSnip Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (06/01/2015 02:49:57 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Intel(R) ME Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (06/01/2015 02:49:57 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Intel(R) Centrino(R) Wireless Bluetooth(R) + High Speed Security Service" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 5000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (06/01/2015 02:49:55 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Intel® Centrino® Wireless Bluetooth® + High Speed Service" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (06/01/2015 02:49:55 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Lenovo Settings Power Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.


Microsoft Office:
=========================
Error: (06/01/2015 02:47:52 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: LnvHotSpotSvc.exe2.3.0.835317b709ntdll.dll6.3.9600.17736550f4336c00000fd000000000003f69f198801d09c691e0c9b17C:\Program Files\Lenovo\Lenovo Mobile Hotspot\LnvHotSpotSvc.exeC:\WINDOWS\SYSTEM32\ntdll.dll6a46b8d2-085c-11e5-bede-00c2c63a0efc

Error: (06/01/2015 01:25:07 PM) (Source: SideBySide) (EventID: 9) (User: )
Description: c:\program files\windowsapps\c59ad0af.lenovocloudstoragebysugarsync_1.3.0.889_neutral__m3tnjedffpfhj\SugarSyncWin8.exec:\program files\windowsapps\c59ad0af.lenovocloudstoragebysugarsync_1.3.0.889_neutral__m3tnjedffpfhj\SugarSyncWin8.exe2

Error: (06/01/2015 00:51:40 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: devenv.exe12.0.31101.02b9c01d09c5888ca943116C:\Program Files (x86)\Microsoft Visual Studio 12.0\Common7\IDE\devenv.exe06e0fa40-084c-11e5-bedd-00c2c63a0efc

Error: (06/01/2015 00:37:40 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: MachineInformation.exe1.5.37.051af959aclr.dll4.0.30319.3401452e0b784c00000050000f7711fe001d09c55961380a3C:\Program Files\lenovo\SystemAgent\MachineInformation.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll372edb87-084a-11e5-bedd-00c2c63a0efc

Error: (06/01/2015 00:36:27 PM) (Source: .NET Runtime) (EventID: 1023) (User: )
Description: Anwendung: MachineInformation.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund eines internen Fehlers in der .NET-Laufzeit beendet. bei IP 7198F771 (71980000) mit Exitcode 80131506.

Error: (06/01/2015 00:10:24 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: SDLogReport.exe2.4.40.107120c01d09c40fbc299096C:\Program Files (x86)\Spybot - Search & Destroy 2\SDLogReport.exe657466c1-0846-11e5-bedd-00c2c63a0efc

Error: (06/01/2015 09:43:50 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: LnvHotSpotSvc.exe2.3.0.835317b709RPCRT4.dll6.3.9600.17415545045a8c00000fd000000000000575d45001d09c3e8c55bce0C:\Program Files\Lenovo\Lenovo Mobile Hotspot\LnvHotSpotSvc.exeC:\WINDOWS\system32\RPCRT4.dllf0f7dc23-0831-11e5-bedd-00c2c63a0efc

Error: (06/01/2015 09:15:33 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: mbar.exe1.9.1.100454d5665fntdll.dll6.3.9600.17736550f42c2c00000fd00048e1819bc01d09c3172a0d7f9C:\Users\Administrator\Desktop\mbar\mbar.exeC:\WINDOWS\SYSTEM32\ntdll.dllfd943789-082d-11e5-bedb-00c2c63a0efc

Error: (06/01/2015 08:53:39 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: ResEdit.exe1.6.6.055440b92ResEdit.exe1.6.6.055440b924000001500000000000b40b9dc401d09c3353e92f3dC:\Users\Administrator\Downloads\ResEdit-x64\ResEdit.exeC:\Users\Administrator\Downloads\ResEdit-x64\ResEdit.exeee66b416-082a-11e5-bedb-00c2c63a0efc

Error: (06/01/2015 08:30:24 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: STR-LCH)
Description: winstore_cw5n1h2txyewy!Windows.Store-2144927149


CodeIntegrity Errors:
===================================
  Date: 2015-05-29 16:08:14.870
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-05-29 16:08:14.706
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-05-29 16:08:14.528
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-05-28 19:10:30.192
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-05-28 16:46:25.449
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-05-28 16:46:25.180
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-05-28 16:46:24.635
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-05-26 19:47:29.303
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-05-18 14:27:54.454
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-05-18 14:27:54.045
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i5-3230M CPU @ 2.60GHz
Percentage of memory in use: 21%
Total physical RAM: 8009.47 MB
Available physical RAM: 6254.41 MB
Total Pagefile: 14409.47 MB
Available Pagefile: 12713.89 MB
Total Virtual: 131072 MB
Available Virtual: 131071.83 MB

==================== Drives ================================

Drive c: (Windows8_OS) (Fixed) (Total:916.58 GB) (Free:75.01 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: 573CACE8)

Partition: GPT Partition Type.

==================== End of log ============================

cosinus · 02.06.2015, 13:25

FRST-Fix

Virenscanner jetzt bitte komplett deaktivieren, damit sichergestellt ist, dass der Fix sauber durchläuft!

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
Task: {4E6782A1-2F85-4626-A8CD-B8DFD014116D} - \ProPCCleaner_Popup No Task File <==== ATTENTION
Task: {D2F3FF1C-BB13-48F4-ABEE-BFC8AB4D6C83} - \ProPCCleaner_Start No Task File <==== ATTENTION
C:\Users\xxx\eve_prod.js
EmptyTemp:

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

southz · 02.06.2015, 13:50

Der Fix ist soweit duchgelaufen, das Problem besteht weiterhin

Die im Fix erwähnte js Datei war eine selbst erstelle, ich hab sie trotzdem löschen lassen
Fixlog.txt

Code:

ATTFilter

Fix result of Farbar Recovery Scan Tool (x64) Version: 29-05-2015
Ran by Administrator at 2015-06-02 14:39:27 Run:2
Running from C:\Users\Administrator\Desktop
Loaded Profiles: Administrator & xxx (Available Profiles: UpdatusUser & xxx & Administrator & xxx & MSSQL$SQLEXPRESS)
Boot Mode: Normal
==============================================

fixlist content:
*****************
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
Task: {4E6782A1-2F85-4626-A8CD-B8DFD014116D} - \ProPCCleaner_Popup No Task File <==== ATTENTION
Task: {D2F3FF1C-BB13-48F4-ABEE-BFC8AB4D6C83} - \ProPCCleaner_Start No Task File <==== ATTENTION
C:\Users\xxx\eve_prod.js
EmptyTemp:
         
*****************

C:\WINDOWS\system32\GroupPolicy\Machine => Moved successfully.
C:\WINDOWS\system32\GroupPolicy\GPT.ini => Moved successfully.
C:\WINDOWS\SysWOW64\GroupPolicy\GPT.ini => Moved successfully.
"HKLM\SOFTWARE\Policies\Google" => key Removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{4E6782A1-2F85-4626-A8CD-B8DFD014116D}" => key Removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4E6782A1-2F85-4626-A8CD-B8DFD014116D}" => key Removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\ProPCCleaner_Popup" => key Removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{D2F3FF1C-BB13-48F4-ABEE-BFC8AB4D6C83}" => key Removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D2F3FF1C-BB13-48F4-ABEE-BFC8AB4D6C83}" => key Removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\ProPCCleaner_Start" => key Removed successfully
C:\Users\xxx\eve_prod.js => Moved successfully.
EmptyTemp: => Removed 130.6 MB temporary data.


The system needed a reboot. 

==== End of Fixlog 14:39:48 ====

cosinus · 02.06.2015, 14:17

Okay, dann Kontrollscans mit ESET und SC bitte:

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

southz · 03.06.2015, 08:52

Zwischendrin schon mal ein danke für die Hilfe.

An sich nichts auffälliges bis jetzt. Ein Paar offizielle Lenovo Treiber, ein paar Setups von Chip.de, und im Temp Ordner eine Infizierte zip Datei, die ich nie geöffnet habe. Im älteren Log Teil noch in Quarantäne verschobene Files

log.txt

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=99efe639dffdfa43a7233f3698fc5360
# engine=23253
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2015-04-07 01:29:47
# local_time=2015-04-07 03:29:47 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.2.9200 NT 
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 119240 5495779 0 0
# scanned=1855533
# found=11
# cleaned=0
# scan_time=76580
sh=E750C443A83F9B135B499E7917C5A93120384BB3 ft=1 fh=4eedbac881d1fc72 vn="Win32/DownWare.L evtl. unerwünschte Anwendung" ac=I fn="C:\Users\xxx\Downloads\DTLite4491-0356.exe"
sh=7056180C6A2E7621EE17210EE416A360F57FFC13 ft=0 fh=0000000000000000 vn="Win32/TrojanDownloader.Wauchos.A Trojaner" ac=I fn="C:\Users\xxx\AppData\Local\Temp\2013_01rechnung_229015055.zip"
sh=08131ADF7C15E801A902E72ADA9DBA8EF81AD101 ft=1 fh=0e19461b6ef503f8 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\xxx\AppData\Local\Temp\DMR\dmr_72.exe"
sh=9ED1BE63209CB827D638ABA2CE12635CD5CCB24E ft=1 fh=2308bdfb841a9f9b vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\xxx\AppData\Local\Temp\OCS\ocs_v71b.exe"
sh=693E52464B6675E51E026CF8CFB01EEFCA322618 ft=1 fh=ed14db9a8c730dcf vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\xxx\Desktop\sicherung trifoo 2015\Double Driver - CHIP-Installer.exe"
sh=CB4EA389EDC69D94227335620B2B53B59BAB13A4 ft=1 fh=8ccf98396f9ec510 vn="Variante von Win32/OpenCandy.C potenziell unsichere Anwendung" ac=I fn="C:\Users\xxx\Documents\Sicherung Stick Kingston\t60 driver\chipset\g1ic09ww.exe"
sh=C981DB835B79DFE287B209892B402384439D2A89 ft=1 fh=17fbb3645bd11088 vn="Variante von Win32/OpenCandy.C potenziell unsichere Anwendung" ac=I fn="C:\Users\xxx\Documents\Sicherung Stick Kingston\t60 driver\keyboard mouse\6hgx79ww.exe"
sh=693E52464B6675E51E026CF8CFB01EEFCA322618 ft=1 fh=ed14db9a8c730dcf vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\xxx\Downloads\Double Driver - CHIP-Installer.exe"
sh=E8225DA813EB35B14EE3969BC4D76225051BC753 ft=1 fh=c71c00114b6b2392 vn="Variante von Win32/InstallCore.PK evtl. unerwünschte Anwendung" ac=I fn="C:\Users\xxx\Downloads\DownloadManagerSetup.exe"
sh=9BD39B6AF1D337CC8388FFC5D34A9F3B1DCE1173 ft=1 fh=80d65bf702e6ac62 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\xxx\Downloads\OblyTile - CHIP-Installer.exe"
sh=F504C91B9389F21282385EEC74E4F99075DBFEE5 ft=1 fh=fdcbff53dbef07a1 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\xxx\Downloads\Win32 Disk Imager - CHIP-Installer.exe"
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=99efe639dffdfa43a7233f3698fc5360
# end=init
# utc_time=2015-06-02 01:45:46
# local_time=2015-06-02 03:45:46 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.2.9200 NT 
Update Init
Update Download
Update Finalize
Updated modules version: 24134
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=99efe639dffdfa43a7233f3698fc5360
# end=updated
# utc_time=2015-06-02 01:48:40
# local_time=2015-06-02 03:48:40 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.2.9200 NT 
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7777
# api_version=3.1.1
# EOSSerial=99efe639dffdfa43a7233f3698fc5360
# engine=24134
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-06-02 01:56:44
# local_time=2015-06-02 03:56:44 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.2.9200 NT 
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 0 10335796 0 0
# scanned=19907
# found=5
# cleaned=0
# scan_time=483
sh=1A34042AC2035878B5ACBBE6D8FC7C268CBDF560 ft=1 fh=a04a7234dec62c72 vn="Variante von Win32/ELEX.BR evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WinZipper\TrayDownloader.exe.vir"
sh=2646C43777F777FD8EE89D8674DBD198C2E000B0 ft=1 fh=afc27b2d0dc54a23 vn="Variante von Win32/ELEX.CK evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WinZipper\winzipersvc.exe.vir"
sh=1C88A7C4FD5E9BBE5F558AB731149EC1E59A67AC ft=0 fh=0000000000000000 vn="Win32/Toolbar.TNT2.I evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\ffsearch_toolbar!1.0.0.1031.xpi.vir"
sh=E4467B135983FBA0624DE173BF0E906508F01660 ft=1 fh=3098ea6ccd6508f2 vn="Variante von Win32/ELEX.BM evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\ProtectService.exe.vir"
sh=013990E215CB6DF14B5B7CA5A98DB6F280FC2E9E ft=1 fh=855f5140049ebb80 vn="Variante von Win32/Thinknice.B evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\SupTab.dll.vir"

Die paar updates mache ich dann mal gleich, trotzdem irgendwie nichts auffälliges zu finden
checkup.txt

Code:

ATTFilter

 Results of screen317's Security Check version 1.002  
   x64 (UAC is enabled)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:`````````````` 
Ad-Aware Antivirus   
Windows Defender     
 Antivirus out of date! (On Access scanning disabled!) 
`````````Anti-malware/Other Utilities Check:````````` 
 Spybot - Search & Destroy 
 Visual Studio Extensions for Windows Library for JavaScript 
 Java version 32-bit out of Date! 
 Adobe Flash Player 10 Flash Player out of Date! 
 Adobe Flash Player 	17.0.0.169  
 Adobe Reader XI  
 Mozilla Firefox (38.0.1) 
 Mozilla Thunderbird (31.6.0) 
 Google Chrome (43.0.2357.65) 
 Google Chrome (43.0.2357.81) 
````````Process Check: objlist.exe by Laurent````````  
 Spybot Teatimer.exe is disabled! 
 Lavasoft Ad-Aware Antivirus Ad-Aware Antivirus 11.6.306.7947\AdAwareTray.exe 
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  % 
````````````````````End of Log``````````````````````

mir wurde grade ein weiterer fall im persönlichen Umfeld bekannt, bei dem delta-homes als Suchmaschine erschien und der gleiche Virus/Trojaner/etc in den AboutUrls vorhanden ist

cosinus · 03.06.2015, 09:35

Zitat:

C:\Users\xxx\Desktop\sicherung trifoo 2015\Double Driver - CHIP-Installer.exe

Keine Downloads mehr von chip.de! => CHIP-Installer - was ist das? - Anleitungen

Räum mal die Ordner auf, in denen ESET was gefunden hat. Man muss zB irgendwelche Setups nicht in alle Ewigkeiten im Downloadordner mitschleppen...v.a. keine Müll-Setup von Portalen, die für Junk sorgen

Und schmeiß Spybot runter, das Teil ist unnötig weil weitgehend wirkungslos.

southz · 03.06.2015, 10:22

Zitat:

Zitat von cosinus

Räum mal die Ordner auf, in denen ESET was gefunden hat. Man muss zB irgendwelche Setups nicht in alle Ewigkeiten im Downloadordner mitschleppen...v.a. keine Müll-Setup von Portalen, die für Junk sorgen

Und schmeiß Spybot runter, das Teil ist unnötig weil weitgehend wirkungslos.

Danke für den Hinweis, da war der Installer grade neu und ich hab eh nur die Option entpacken gewählt. Soweit alles runter, aber wie gehen wir jetzt weiter vor um das eigentliche Problem zu lösen?

cosinus · 03.06.2015, 10:25

Wenn die Browser noch spinnen, musst du die resetten bzw neue Profile erstellen und testen:

Firefox => http://support.mozilla.com/de/kb/Profile%20verwalten
Chrome => https://support.google.com/chrome/answer/3296214?hl=de

southz · 03.06.2015, 10:30

Zitat:

Zitat von cosinus

Wenn die Browser noch spinnen, musst du die resetten bzw neue Profile erstellen und testen:

Firefox => hxxp://support.mozilla.com/de/kb/Profile%20verwalten
Chrome => https://support.google.com/chrome/answer/3296214?hl=de

Ist alles schon geschehen. Sowohl FF als auch IE als auch Chrome wurden von mir komplett deinstalliert, Profile gelöscht und neu installiert. Auch neu angelegte bzw andere Nutzer auf dem Rechner haben das Problem. Die Scans laufen ja zum Beispiel alle unter dem Administrator Account, der sonst nur zur Installation genutzt wurde

cosinus · 03.06.2015, 10:44

Zitat:

Sowohl FF als auch IE als auch Chrome wurden von mir komplett deinstalliert, Profile gelöscht und neu installiert.

Du hast auch die Profile von den betroffenen Benutzerkonten erneuert? Nur vom "admin" reicht nicht....

01.06.2015, 14:29	#5
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Windows 8: chromenotice.com in AboutUrls Bitte auch ne neue Addition.txt erstellen, dazu FRST starten und einen Haken setzen bei Addition.txt, dann auf Scan klicken. __________________ Logfiles bitte immer in CODE-Tags posten

03.06.2015, 10:25	#13
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Windows 8: chromenotice.com in AboutUrls Wenn die Browser noch spinnen, musst du die resetten bzw neue Profile erstellen und testen: Firefox => http://support.mozilla.com/de/kb/Profile%20verwalten Chrome => https://support.google.com/chrome/answer/3296214?hl=de __________________ Logfiles bitte immer in CODE-Tags posten

Windows 8: chromenotice.com in AboutUrls

Log-Analyse und Auswertung: Windows 8: chromenotice.com in AboutUrls