Lästige Werbung beim Internet Explorer

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 29-05-2015
Ran by Riehl (administrator) on RIEHL-PC on 30-05-2015 11:09:18
Running from C:\Users\Riehl\Downloads
Loaded Profiles: Riehl & Acronis Agent User (Available Profiles: Riehl & Acronis Agent User)
Platform: Microsoft Windows 7 Professional  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 10 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Acronis) C:\Program Files\Common Files\Acronis\Agent\agent.exe
(Acronis) C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
(Acronis) C:\Program Files\Acronis\ARSM\arsm.exe
(AVM Berlin) C:\Program Files\Common Files\AVM\De_serv.exe
(ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Acronis) C:\Program Files\Acronis\BackupAndRecovery\mms.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Update Core\NvBackend.exe
(Acronis) C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
(Acronis) C:\Program Files\Common Files\Acronis\TibMounter\TibMounterMonitor.exe
(Acronis) C:\Program Files\Acronis\TrayMonitor\TrayMonitor.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Microsoft Corporation) C:\Program Files\Microsoft IntelliType Pro\itype.exe
(Microsoft Corporation) C:\Program Files\Microsoft IntelliPoint\ipoint.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
(Dropbox, Inc.) C:\Users\Riehl\AppData\Roaming\Dropbox\bin\Dropbox.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Program Files\Game til you Die\game_til_you_die_helper_service.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [NvBackend] => C:\Program Files\NVIDIA Corporation\Update Core\NvBackend.exe [2234144 2014-02-05] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [Acronis Scheduler2 Service] => C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe [396680 2013-04-04] (Acronis)
HKLM\...\Run: [BackupAndRecoveryMonitor.exe] => C:\Program Files\Acronis\BackupAndRecovery\BackupAndRecoveryMonitor.exe [1562296 2013-04-04] (Acronis)
HKLM\...\Run: [AcronisTibMounterMonitor] => C:\Program Files\Common Files\Acronis\TibMounter\TibMounterMonitor.exe [1104608 2013-01-22] (Acronis)
HKLM\...\Run: [TrayMonitor.exe] => C:\Program Files\Acronis\TrayMonitor\TrayMonitor.exe [1492664 2013-04-04] (Acronis)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [10996368 2012-06-11] (Realtek Semiconductor)
HKLM\...\Run: [itype] => C:\Program Files\Microsoft IntelliType Pro\itype.exe [1505144 2009-11-05] (Microsoft Corporation)
HKLM\...\Run: [IntelliPoint] => C:\Program Files\Microsoft IntelliPoint\ipoint.exe [1468256 2009-11-05] (Microsoft Corporation)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [334896 2015-04-30] (Oracle Corporation)
HKLM\...\Run: [egui] => C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [5088456 2015-01-28] (ESET)
HKU\S-1-5-21-1956295977-2440402935-1114064478-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner.exe [6278424 2015-04-23] (Piriform Ltd)
Startup: C:\Users\Riehl\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2015-01-22]
ShortcutTarget: Dropbox.lnk -> C:\Users\Riehl\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Riehl\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FRITZ!fax.lnk [2014-03-03]
ShortcutTarget: FRITZ!fax.lnk -> C:\Program Files\Fritz!\FriFax32.exe (AVM Berlin)
ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Riehl\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Riehl\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Riehl\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Riehl\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Riehl\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Riehl\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Riehl\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Riehl\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=56626&homepage=hxxp://go.microsoft.com/fwlink/p/?LinkId=255141
HKU\S-1-5-21-1956295977-2440402935-1114064478-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKU\S-1-5-21-1956295977-2440402935-1114064478-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://google.de/
HKU\S-1-5-21-1956295977-2440402935-1114064478-1002\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=56626&homepage=hxxp://go.microsoft.com/fwlink/?LinkId=69157
HKU\S-1-5-21-1956295977-2440402935-1114064478-1002\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-1956295977-2440402935-1114064478-1000 -> DefaultScope {A034533F-7766-44C8-A0BA-2337B86577CF} URL = https://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-1956295977-2440402935-1114064478-1000 -> {A034533F-7766-44C8-A0BA-2337B86577CF} URL = https://www.google.com/search?q={searchTerms}
BHO: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll [2014-04-09] (McAfee, Inc.)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_45\bin\ssv.dll [2015-05-15] (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-05-15] (Oracle Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.77.253
Tcpip\..\Interfaces\{E18D4E09-AD6C-4156-9375-44EDC8C95F81}: [NameServer] 192.168.120.252,192.168.120.253

FireFox:
========
FF ProfilePath: C:\Users\Riehl\AppData\Roaming\Mozilla\Firefox\Profiles\mfu8zyb6.default
FF Homepage: https://www.google.de/
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-04-15] ()
FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin: @google.com/npPicasa3,version=3.0.0 -> C:\Users\Riehl\Desktop\Picasa3\npPicasa3.dll [2015-02-13] (Google, Inc.)
FF Plugin: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-05-15] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-05-15] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.)
FF Plugin: @nvidia.com/3DVision -> C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll [2014-02-08] (NVIDIA Corporation)
FF Plugin: @nvidia.com/3DVisionStreaming -> C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2014-02-08] (NVIDIA Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-15] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-15] (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-02-05] (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-05-01] (Adobe Systems Inc.)
FF Plugin: synology.com/SurveillanceHelper -> C:\Program Files\Synology\SurveillanceHelper\1.0.0.3\npSurveillanceHelper.dll [2013-11-11] (Synology)
FF Plugin: synology.com/SurveillancePlugin -> C:\Program Files\Synology\SurveillancePlugin\1.0.0.64\npSurveillancePlugin.dll [2013-11-26] (Synology)
FF HKLM\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird
FF HKU\S-1-5-21-1956295977-2440402935-1114064478-1000\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: McAfee Security Scan Plus - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]

Chrome: 
=======
CHR Profile: C:\Users\Riehl\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Riehl\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-04-08]
CHR Extension: (Google Drive) - C:\Users\Riehl\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-04-08]
CHR Extension: (YouTube) - C:\Users\Riehl\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-04-08]
CHR Extension: (Google Search) - C:\Users\Riehl\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-04-08]
CHR Extension: (Bookmark Manager) - C:\Users\Riehl\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik [2015-05-29]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Riehl\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-13]
CHR Extension: (Google Wallet) - C:\Users\Riehl\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-04-08]
CHR Extension: (Gmail) - C:\Users\Riehl\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-04-08]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AcronisAgent; C:\Program Files\Common Files\Acronis\Agent\agent.exe [2059256 2012-12-29] (Acronis)
R2 AcrSch2Svc; C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe [802272 2013-04-04] (Acronis)
R2 ARSM; C:\Program Files\Acronis\ARSM\arsm.exe [5847944 2013-04-04] (Acronis)
R2 de_serv; C:\Program Files\Common Files\AVM\de_serv.exe [206128 2007-10-25] (AVM Berlin)
R2 ekrn; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [1349576 2015-01-28] (ESET)
R2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2015-04-14] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [235696 2014-04-09] (McAfee, Inc.)
R2 MMS; C:\Program Files\Acronis\BackupAndRecovery\mms.exe [10349448 2013-04-04] (Acronis)
R2 NvNetworkService; C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe [1593632 2014-02-05] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15904544 2014-02-05] (NVIDIA Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 aksusb; C:\Windows\System32\DRIVERS\aksusb.sys [296200 2013-08-09] (SafeNet Inc.)
R3 AVMCOWAN; C:\Windows\System32\DRIVERS\AVMCOWAN.sys [64000 2009-07-14] (AVM GmbH)
R1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [193464 2015-03-10] (ESET)
R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [135808 2015-03-10] (ESET)
R2 epfwwfpr; C:\Windows\System32\DRIVERS\epfwwfpr.sys [123424 2015-03-10] (ESET)
R3 FPCIBASE; C:\Windows\System32\DRIVERS\fpcibase.sys [559104 2009-07-14] (AVM Berlin)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2015-04-14] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [119512 2015-05-30] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2015-04-14] (Malwarebytes Corporation)
R3 NETFRITZ; C:\Windows\System32\DRIVERS\NETFRITZ.SYS [334640 2007-10-25] (AVM Berlin)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad32v.sys [34080 2013-12-27] (NVIDIA Corporation)
R0 tib; C:\Windows\System32\DRIVERS\tib.sys [736312 2014-03-02] (Acronis)
R0 tib_mounter; C:\Windows\System32\DRIVERS\tib_mounter.sys [130488 2014-03-02] (Acronis)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-05-30 11:09 - 2015-05-30 11:09 - 00016362 _____ () C:\Users\Riehl\Downloads\FRST.txt
2015-05-30 11:09 - 2015-05-30 11:09 - 00000000 ____D () C:\FRST
2015-05-30 11:08 - 2015-05-30 11:08 - 01147392 _____ (Farbar) C:\Users\Riehl\Downloads\FRST.exe
2015-05-30 11:03 - 2015-05-30 11:03 - 00187456 _____ () C:\Users\Riehl\Documents\cc_20150530_110320.reg
2015-05-30 10:56 - 2015-05-30 10:56 - 00000969 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2015-05-30 10:56 - 2015-05-30 10:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2015-05-30 10:55 - 2015-05-30 10:56 - 00000000 ____D () C:\Program Files\CCleaner
2015-05-30 10:54 - 2015-05-30 10:54 - 05248848 _____ (Piriform Ltd) C:\Users\Riehl\Downloads\ccsetup505_slim.exe
2015-05-30 10:53 - 2015-05-30 10:53 - 00000000 ____D () C:\Windows\system32\appmgmt
2015-05-30 10:31 - 2015-05-30 10:31 - 00000000 ____D () C:\Users\Riehl\AppData\Roaming\WinRAR
2015-05-30 10:31 - 2015-05-30 10:31 - 00000000 ____D () C:\Users\Riehl\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2015-05-30 10:31 - 2015-05-30 10:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2015-05-30 10:30 - 2015-05-30 10:31 - 00000000 ____D () C:\Program Files\WinRAR
2015-05-30 10:30 - 2015-05-30 10:30 - 01869952 _____ () C:\Users\Riehl\Downloads\wrar521d.exe
2015-05-29 15:35 - 2015-05-29 15:35 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2015-05-29 13:59 - 2015-05-29 13:59 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Riehl\Downloads\revosetup95.exe
2015-05-29 13:59 - 2015-05-29 13:59 - 00000000 ____D () C:\Program Files\VS Revo Group
2015-05-29 13:50 - 2015-05-29 14:40 - 00000000 ____D () C:\Windows\pss
2015-05-29 13:16 - 2015-05-29 13:16 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-RIEHL-PC-Windows-7-Professional-(32-bit).dat
2015-05-29 13:16 - 2015-05-29 13:16 - 00000000 ____D () C:\RegBackup
2015-05-29 13:14 - 2015-05-29 13:14 - 02946603 _____ (Thisisu) C:\Users\Riehl\Downloads\JRT681.exe
2015-05-29 12:56 - 2015-05-29 13:41 - 00000000 ____D () C:\AdwCleaner
2015-05-29 12:55 - 2015-05-29 12:56 - 00000000 ____D () C:\Users\Riehl\Downloads\20150304PM
2015-05-29 12:55 - 2015-05-29 12:55 - 02223104 _____ () C:\Users\Riehl\Downloads\adwcleaner_4.205 (2).exe
2015-05-29 12:52 - 2015-05-29 12:52 - 02222592 _____ () C:\Users\Riehl\Downloads\AdwCleaner_4.205 (1).exe.uy9wy6n.partial
2015-05-29 12:50 - 2015-05-29 12:51 - 02222592 _____ () C:\Users\Riehl\Downloads\AdwCleaner_4.205.exe.rsiqstp.partial
2015-05-29 11:57 - 2015-05-30 10:50 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-05-29 11:56 - 2015-05-29 14:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-05-29 11:56 - 2015-05-29 14:40 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2015-05-29 11:56 - 2015-05-29 11:58 - 00001064 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-05-29 11:56 - 2015-04-14 09:37 - 00092888 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-05-29 11:56 - 2015-04-14 09:37 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-05-29 11:56 - 2015-04-14 09:37 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-05-28 13:39 - 2015-05-30 10:49 - 00000526 _____ () C:\Windows\Tasks\game_til_you_die_helper_service.job
2015-05-28 13:39 - 2015-05-29 14:40 - 00000000 ____D () C:\Program Files\Game til you Die
2015-05-26 14:03 - 2015-05-26 14:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ESET
2015-05-26 14:03 - 2015-05-26 14:03 - 00000000 ____D () C:\Program Files\ESET
2015-05-26 09:08 - 2015-01-29 05:02 - 02311168 _____ (Microsoft Corporation) C:\Windows\system32\wpdshext.dll
2015-05-19 08:57 - 2015-04-13 05:19 - 00259072 _____ (Microsoft Corporation) C:\Windows\system32\services.exe
2015-05-18 09:04 - 2015-03-04 06:11 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\shimeng.dll
2015-05-18 09:04 - 2015-03-04 06:10 - 00295936 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll
2015-05-18 09:04 - 2015-03-04 06:10 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\aelupsvc.dll
2015-05-18 09:04 - 2015-03-04 06:10 - 00020992 _____ (Microsoft Corporation) C:\Windows\system32\sdbinst.exe
2015-05-15 18:08 - 2015-04-08 05:14 - 00216064 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2015-05-15 18:08 - 2015-04-08 05:14 - 00019968 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll
2015-05-15 14:30 - 2015-05-30 10:49 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d08f0af9fd279c.job
2015-05-15 14:30 - 2015-05-30 10:35 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA1d08f0afa90bced.job
2015-05-15 09:18 - 2015-05-15 09:18 - 00000000 ____D () C:\Program Files\Common Files\Java
2015-05-13 18:47 - 2015-05-01 15:16 - 00102608 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 18:41 - 2015-04-20 04:56 - 01250816 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-05-13 18:41 - 2015-04-20 04:56 - 00909312 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-05-13 18:41 - 2015-04-20 04:03 - 02382336 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-05-13 18:40 - 2015-05-05 03:12 - 00248832 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-05-13 18:40 - 2015-04-18 04:56 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-05-13 18:40 - 2015-04-04 05:10 - 00137656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-05-13 18:40 - 2015-04-04 05:10 - 00067512 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-05-13 18:40 - 2015-04-04 05:05 - 01061376 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-05-13 18:40 - 2015-04-04 05:05 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-05-13 18:40 - 2015-04-04 05:05 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-05-13 18:40 - 2015-04-04 05:05 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-05-13 18:40 - 2015-04-04 05:05 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-05-13 18:40 - 2015-04-04 05:05 - 00100352 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-05-13 18:40 - 2015-04-04 05:05 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-05-13 18:40 - 2015-04-04 05:05 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-05-13 18:40 - 2015-04-04 05:05 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-05-13 18:40 - 2015-04-04 05:05 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-05-13 18:40 - 2015-04-04 05:04 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-05-13 18:40 - 2015-04-04 05:04 - 00022528 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-05-13 18:40 - 2015-04-04 05:01 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-05-13 18:40 - 2015-04-04 05:01 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-05-13 18:40 - 2015-04-04 04:59 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-05-13 18:38 - 2015-02-18 09:06 - 00123904 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-05-30 11:00 - 2014-09-22 10:15 - 00000000 ____D () C:\Users\Riehl\AppData\Local\CrashDumps
2015-05-30 11:00 - 2014-05-08 09:43 - 00000000 ____D () C:\Windows\Minidump
2015-05-30 11:00 - 2014-02-28 14:44 - 00000000 ____D () C:\Windows\Panther
2015-05-30 10:56 - 2009-07-14 06:34 - 00031680 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-05-30 10:56 - 2009-07-14 06:34 - 00031680 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-05-30 10:50 - 2015-01-22 16:01 - 00000000 ___RD () C:\Users\Riehl\Dropbox
2015-05-30 10:50 - 2015-01-22 15:58 - 00000000 ____D () C:\Users\Riehl\AppData\Roaming\Dropbox
2015-05-30 10:49 - 2015-02-05 15:25 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d041474328cdaf.job
2015-05-30 10:49 - 2014-04-08 10:58 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cf5308b6d0df61.job
2015-05-30 10:49 - 2014-03-02 18:02 - 00000000 ____D () C:\Users\Riehl\AppData\Local\FRITZ!
2015-05-30 10:48 - 2014-03-02 12:56 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-05-30 10:48 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-05-30 10:46 - 2014-02-28 14:48 - 01820143 ____N () C:\Windows\WindowsUpdate.log
2015-05-30 10:46 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE
2015-05-30 10:43 - 2014-03-02 13:31 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-05-30 10:35 - 2015-02-05 15:25 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA1d0414743b07c1f.job
2015-05-30 10:30 - 2014-06-26 09:09 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA1cf910d83c5b24b.job
2015-05-30 08:57 - 2014-03-02 13:32 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2015-05-29 18:30 - 2014-03-02 18:37 - 00000000 ____D () C:\Users\Riehl\Desktop\Bestellungen,Kasse,Umsatz
2015-05-29 14:40 - 2015-04-09 21:10 - 00000000 ___SD () C:\Windows\system32\GWX
2015-05-29 14:40 - 2014-09-01 18:44 - 00000000 ____D () C:\ProgramData\McAfee Security Scan
2015-05-29 14:40 - 2014-02-28 14:50 - 00000000 ____D () C:\Users\Riehl
2015-05-29 14:40 - 2011-04-12 03:39 - 00000000 ___RD () C:\Users\Public\Recorded TV
2015-05-29 14:40 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\registration
2015-05-29 13:00 - 2014-05-05 15:58 - 02591232 ___SH () C:\Users\Riehl\Desktop\Thumbs.db
2015-05-29 11:58 - 2010-11-20 23:01 - 01620612 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-05-29 09:10 - 2014-03-02 18:37 - 00000000 ___RD () C:\Users\Riehl\Desktop\Fax,Scan,Fritz-Fax
2015-05-27 19:17 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\AdvancedInstallers
2015-05-26 15:32 - 2015-03-21 12:28 - 00000000 ____D () C:\Users\Riehl\Desktop\Bayerischer Abend 2008
2015-05-26 09:33 - 2014-04-08 10:53 - 00002121 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-05-20 11:53 - 2014-03-02 18:37 - 00000000 ____D () C:\Users\Riehl\Desktop\FIBAK AG
2015-05-18 09:09 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2015-05-16 14:16 - 2014-03-02 13:23 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-05-15 18:09 - 2011-04-12 03:39 - 00000000 ____D () C:\Program Files\Windows Journal
2015-05-15 15:40 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache
2015-05-15 09:15 - 2014-03-02 13:32 - 00000000 ____D () C:\ProgramData\Oracle
2015-05-15 09:13 - 2014-03-02 13:30 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-05-15 09:04 - 2014-10-10 18:53 - 00096352 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2015-05-15 09:03 - 2014-10-10 18:53 - 00000000 ____D () C:\Program Files\Java
2015-05-15 08:54 - 2009-07-14 06:33 - 00303888 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-05-13 18:47 - 2014-03-02 14:14 - 00000000 ____D () C:\Windows\system32\MRT
2015-05-13 18:41 - 2014-03-02 14:14 - 137310008 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-05-13 18:38 - 2014-03-02 15:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-05-13 18:38 - 2014-03-02 15:30 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2015-05-12 08:52 - 2015-01-22 15:59 - 00000000 ____D () C:\Users\Riehl\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox

==================== Files in the root of some directories =======

2014-03-03 10:36 - 2014-03-03 10:36 - 0000057 _____ () C:\ProgramData\Ament.ini

Some files in TEMP:
====================
C:\Users\Riehl\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpmf1kux.dll
C:\Users\Riehl\AppData\Local\Temp\Quarantine.exe
C:\Users\Riehl\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-05-26 12:12

==================== End of log ============================