Windows 8.1 (64-Bit): Zombie Invasion kann nicht deinstalliert werden

SasslP · 25.06.2015, 13:35

Hi,

irgendwie hat sich bei mir das Programm Zombie Invasion mit installiert. Ich kann das Programm über die Systemsteuerung und "Programme deinstallieren" nicht entfernen. Auch nicht als Administrator. Es kommt immer folgende Fehlermeldung:

"Sie verfügen nicht über ausreichende Berechtigungen, um Zombie Invasion zu deinstallieren. Wenden Sie sich an den Systemadministrator."

Kann mir jemand helfen?

Vielen Dank schon einmal!

Grüße

cosinus · 25.06.2015, 13:51

Hallo und

Hast du noch weitere Logs (mit Funden)? Malwarebytes und/oder andere Virenscanner, sind die mal fündig geworden?

Ich frage deswegen nach => http://www.trojaner-board.de/125889-...tml#post941520

Bitte keine neuen Virenscans machen sondern erst nur schon vorhandene Logs in CODE-Tags posten!
Relevant sind nur Logs der letzten 7 Tage bzw. seitdem das Problem besteht!

Zudem bitte auch ein Log mit Farbars Tool machen:

Scan mit Farbar's Recovery Scan Tool (FRST)

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit.
Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten.
Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

SasslP · 25.06.2015, 17:04

Hi cosinus,

ich habe keine anderen Logs, weil ich kein Virenprogramm habe durchlaufen lassen. Ich habe das Programm in der Systemsteuerung gefunden und bin deshalb darauf aufmerksam geworden.

Aber hier ist der Log von dem Farbars Tool:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:24-06-2015
Ran by Saskia (administrator) on SASSLPOGI on 25-06-2015 15:22:17
Running from C:\Users\Saskia\Downloads
Loaded Profiles: Saskia (Available Profiles: Saskia & Administrator)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(Windows (R) Win 7 DDK provider) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDService.exe
(Copyright 2013 SAMSUNG) C:\Program Files\Samsung\Samsung Link\Samsung Link.exe
(Copyright 2013 SAMSUNG) C:\Program Files\Samsung\Samsung Link\Samsung Link.exe
(Samsung Electronics CO., LTD.) C:\Program Files (x86)\Samsung\Settings\CmdServer\SettingsLauncher.exe
(Samsung Electronics CO., LTD.) C:\ProgramData\Samsung\SW Update Service\SWMAgent.exe
(Atheros) C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.27.5\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.27.5\GoogleCrashHandler64.exe
(Samsung) C:\Program Files\Samsung\AllShare Framework DMS\1.3.14\AllShareFrameworkManagerDMS.exe
(Samsung) C:\Program Files\Samsung\AllShare Framework DMS\1.3.14\AllShareFrameworkDMS.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(DTools LIMITED) C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe
(XTab system) C:\Program Files (x86)\MiuiTab\ProtectService.exe
(AMD) C:\Windows\System32\atieclxx.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDTouch.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20856_x64__8wekyb3d8bbwe\livecomm.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Samsung Electronics CO., LTD.) C:\Program Files (x86)\Samsung\Settings\CmdServer\SettingsCmdServer.exe
(Samsung Electronics CO., LTD.) C:\Program Files (x86)\Samsung\Settings\CmdServer\SettingsEventHandler.exe
(Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
() C:\Program Files (x86)\Bluetooth Suite\ActivateDesktop.exe
(Copyright 2013 SAMSUNG) C:\Program Files\Samsung\Samsung Link\Samsung Link Tray Agent.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Samsung Electronics CO., LTD.) C:\Program Files\Samsung\S Agent\CommonAgent.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Samsung Electronics CO., LTD.) C:\Program Files\Samsung\Support Center\GuaranaAgent.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\winword.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2894152 2013-11-04] (ELAN Microelectronics Corp.)
HKLM\...\Run: [Bitcasa] => C:\Program Files\Bitcasa\Bitcasa.exe [3965904 2013-06-06] ()
HKLM\...\Run: [Samsung Link] => C:\Program Files\Samsung\Samsung Link\Samsung Link Tray Agent.exe [597576 2013-07-05] (Copyright 2013 SAMSUNG)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [730416 2015-06-25] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [ApnTBMon] => "C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe"
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-08-30] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe [130864 2015-05-21] (Avira Operations GmbH & Co. KG)
HKLM\...\Policies\Explorer\Run: [BtvStack] => C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [134784 2014-06-17] (Atheros Communications)
HKU\S-1-5-21-3299057831-706162602-1696328398-1001\...\Run: [Skype] => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
SSODL: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\windows\system32\CbFsMntNtf3.dll (EldoS Corporation)
SSODL-x32: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\windows\SysWow64\CbFsMntNtf3.dll (EldoS Corporation)
ShellIconOverlayIdentifiers: [1EldosIconOverlay] -> {81F51070-A426-4160-A9F9-AB9B7C99F900} => C:\windows\SYSTEM32\CbFsMntNtf3.dll [2013-02-11] (EldoS Corporation)
ShellIconOverlayIdentifiers: [BitcasaIconOverlay] -> {A6975448-A999-49BB-B3E4-7730CF6A82C0} => C:\Program Files\Bitcasa\ExplorerMenu.dll [2013-06-06] ()
ShellIconOverlayIdentifiers: [BitcasaProgressOverlay] -> {6FB8D52A-0064-45B2-B687-F596FEAD09C2} => C:\Program Files\Bitcasa\ExplorerMenu.dll [2013-06-06] ()
ShellIconOverlayIdentifiers: [EldosIconOverlay] -> {5BB532A2-BF14-4CCC-86B7-71B81EF6F8BC} => C:\windows\system32\CbFsMntNtf3.dll [2013-02-11] (EldoS Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrivePro1 (ErrorConflict)] -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-05-28] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrivePro2 (SyncInProgress)] -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-05-28] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrivePro3 (InSync)] -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-05-28] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [1EldosIconOverlay] -> {81F51070-A426-4160-A9F9-AB9B7C99F900} => C:\windows\SysWOW64\CbFsMntNtf3.dll [2013-02-11] (EldoS Corporation)
ShellIconOverlayIdentifiers-x32: [EldosIconOverlay] -> {5BB532A2-BF14-4CCC-86B7-71B81EF6F8BC} => C:\windows\SysWow64\CbFsMntNtf3.dll [2013-02-11] (EldoS Corporation)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.istartsurf.com/?type=hppp&ts=1435231117&z=dd991957733fcfbc7a74096gfzfc8w4oec2gag2g9q&from=air&uid=SAMSUNGXMZMTD128HAFV-000_S15MNYAD635106
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.istartsurf.com/?type=hppp&ts=1435231117&z=dd991957733fcfbc7a74096gfzfc8w4oec2gag2g9q&from=air&uid=SAMSUNGXMZMTD128HAFV-000_S15MNYAD635106
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.istartsurf.com/web/?type=ds&ts=1435231037&z=47bf10f5f3d4e614ec0f04fgbz9c4wcoaccg8e5c6q&from=air&uid=SAMSUNGXMZMTD128HAFV-000_S15MNYAD635106&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.istartsurf.com/web/?type=ds&ts=1435231037&z=47bf10f5f3d4e614ec0f04fgbz9c4wcoaccg8e5c6q&from=air&uid=SAMSUNGXMZMTD128HAFV-000_S15MNYAD635106&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.istartsurf.com/?type=hppp&ts=1435231117&z=dd991957733fcfbc7a74096gfzfc8w4oec2gag2g9q&from=air&uid=SAMSUNGXMZMTD128HAFV-000_S15MNYAD635106
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.istartsurf.com/?type=hppp&ts=1435231117&z=dd991957733fcfbc7a74096gfzfc8w4oec2gag2g9q&from=air&uid=SAMSUNGXMZMTD128HAFV-000_S15MNYAD635106
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.istartsurf.com/web/?type=ds&ts=1435231037&z=47bf10f5f3d4e614ec0f04fgbz9c4wcoaccg8e5c6q&from=air&uid=SAMSUNGXMZMTD128HAFV-000_S15MNYAD635106&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.istartsurf.com/web/?type=ds&ts=1435231037&z=47bf10f5f3d4e614ec0f04fgbz9c4wcoaccg8e5c6q&from=air&uid=SAMSUNGXMZMTD128HAFV-000_S15MNYAD635106&q={searchTerms}
HKU\S-1-5-21-3299057831-706162602-1696328398-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.istartsurf.com/web/?type=ds&ts=1435231037&z=47bf10f5f3d4e614ec0f04fgbz9c4wcoaccg8e5c6q&from=air&uid=SAMSUNGXMZMTD128HAFV-000_S15MNYAD635106&q={searchTerms}
HKU\S-1-5-21-3299057831-706162602-1696328398-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.istartsurf.com/?type=hppp&ts=1435231117&z=dd991957733fcfbc7a74096gfzfc8w4oec2gag2g9q&from=air&uid=SAMSUNGXMZMTD128HAFV-000_S15MNYAD635106
HKU\S-1-5-21-3299057831-706162602-1696328398-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.istartsurf.com/?type=hppp&ts=1435231117&z=dd991957733fcfbc7a74096gfzfc8w4oec2gag2g9q&from=air&uid=SAMSUNGXMZMTD128HAFV-000_S15MNYAD635106
HKU\S-1-5-21-3299057831-706162602-1696328398-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.google.de/
hxxp://www.bwl.hm.edu/
hxxp://www.moodle.hm.edu/
hxxp://www.facebook.de/
HKU\S-1-5-21-3299057831-706162602-1696328398-1001\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.istartsurf.com/web/?type=ds&ts=1435231037&z=47bf10f5f3d4e614ec0f04fgbz9c4wcoaccg8e5c6q&from=air&uid=SAMSUNGXMZMTD128HAFV-000_S15MNYAD635106&q={searchTerms}
SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.istartsurf.com/web/?type=ds&ts=1435231037&z=47bf10f5f3d4e614ec0f04fgbz9c4wcoaccg8e5c6q&from=air&uid=SAMSUNGXMZMTD128HAFV-000_S15MNYAD635106&q={searchTerms}
SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.istartsurf.com/web/?type=ds&ts=1435231037&z=47bf10f5f3d4e614ec0f04fgbz9c4wcoaccg8e5c6q&from=air&uid=SAMSUNGXMZMTD128HAFV-000_S15MNYAD635106&q={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.istartsurf.com/web/?type=ds&ts=1435231037&z=47bf10f5f3d4e614ec0f04fgbz9c4wcoaccg8e5c6q&from=air&uid=SAMSUNGXMZMTD128HAFV-000_S15MNYAD635106&q={searchTerms}
SearchScopes: HKLM-x32 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.istartsurf.com/web/?type=ds&ts=1435231037&z=47bf10f5f3d4e614ec0f04fgbz9c4wcoaccg8e5c6q&from=air&uid=SAMSUNGXMZMTD128HAFV-000_S15MNYAD635106&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3299057831-706162602-1696328398-1001 -> DefaultScope {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = hxxp://www.istartsurf.com/web/?utm_source=b&utm_medium=air&utm_campaign=install_ie&utm_content=ds&from=air&uid=SAMSUNGXMZMTD128HAFV-000_S15MNYAD635106&ts=1435231146&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3299057831-706162602-1696328398-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.istartsurf.com/web/?utm_source=b&utm_medium=air&utm_campaign=install_ie&utm_content=ds&from=air&uid=SAMSUNGXMZMTD128HAFV-000_S15MNYAD635106&ts=1435231146&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3299057831-706162602-1696328398-1001 -> {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = hxxp://www.istartsurf.com/web/?utm_source=b&utm_medium=air&utm_campaign=install_ie&utm_content=ds&from=air&uid=SAMSUNGXMZMTD128HAFV-000_S15MNYAD635106&ts=1435231146&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3299057831-706162602-1696328398-1001 -> {4D82643C-6E97-475C-A34C-3E4945B61B6D} URL = hxxp://www.istartsurf.com/web/?utm_source=b&utm_medium=air&utm_campaign=install_ie&utm_content=ds&from=air&uid=SAMSUNGXMZMTD128HAFV-000_S15MNYAD635106&ts=1435231146&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3299057831-706162602-1696328398-1001 -> {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = hxxp://www.istartsurf.com/web/?utm_source=b&utm_medium=air&utm_campaign=install_ie&utm_content=ds&from=air&uid=SAMSUNGXMZMTD128HAFV-000_S15MNYAD635106&ts=1435231146&type=default&q={searchTerms}
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-05-19] (Microsoft Corporation)
BHO: Avira SearchFree Toolbar -> {41564952-412D-5637-4300-7A786E7484D7} -> "C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport_x64.dll" No File
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-05-01] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-05-28] (Microsoft Corporation)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll [2015-05-12] (Microsoft Corporation)
BHO-x32: Avira SearchFree Toolbar -> {41564952-412D-5637-4300-7A786E7484D7} -> "C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport.dll" No File
BHO-x32: LuckyTab Class -> {51D26BB4-4D2C-4AE4-9873-5FF41B6DED1F} -> C:\Program Files (x86)\MiuiTab\SupTab.dll [2015-06-16] (Thinknice Co. Limited)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-05-01] (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-05-28] (Microsoft Corporation)
Toolbar: HKLM - Avira SearchFree Toolbar - {41564952-412D-5637-4300-7A786E7484D7} - "C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport_x64.dll" No File
Toolbar: HKLM-x32 - Avira SearchFree Toolbar - {41564952-412D-5637-4300-7A786E7484D7} - "C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport.dll" No File
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-02-03] (Microsoft Corporation)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-05-01] (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-05-01] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.istartsurf.com/?type=sc&ts=1435231037&z=47bf10f5f3d4e614ec0f04fgbz9c4wcoaccg8e5c6q&from=air&uid=SAMSUNGXMZMTD128HAFV-000_S15MNYAD635106

FireFox:
========
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2015-02-17] (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2015-01-12] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-16] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-16] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-05-01] (Adobe Systems Inc.)
FF Plugin-x32: samsung.com/SamsungLinkPCPlugin -> C:\Program Files\Samsung\Samsung Link\utils\npSamsungLinkPCPlugin.dll [2013-07-05] (Samsung)

Chrome: 
=======
CHR Profile: C:\Users\Saskia\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Saskia\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-03-20]
CHR Extension: (Google Drive) - C:\Users\Saskia\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-03-20]
CHR Extension: (YouTube) - C:\Users\Saskia\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-03-20]
CHR Extension: (Adblock Plus) - C:\Users\Saskia\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2014-03-23]
CHR Extension: (Google Search) - C:\Users\Saskia\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-03-20]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Saskia\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-13]
CHR Extension: (Skype Click to Call) - C:\Users\Saskia\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2015-04-19]
CHR Extension: (Google Wallet) - C:\Users\Saskia\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-03-20]
CHR Extension: (Gmail) - C:\Users\Saskia\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-03-20]
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2015-05-01]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AllShare Framework DMS; C:\Program Files\Samsung\AllShare Framework DMS\1.3.14\AllShareFrameworkManagerDMS.exe [404360 2013-06-18] (Samsung) [File not signed]
S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [827184 2015-06-25] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [450808 2015-06-25] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [450808 2015-06-25] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1188360 2015-06-25] (Avira Operations GmbH & Co. KG)
R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [322176 2014-06-17] (Windows (R) Win 7 DDK provider) [File not signed]
R2 Avira.ServiceHost; C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe [208632 2015-05-21] (Avira Operations GmbH & Co. KG)
S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-10-29] (Microsoft Corporation)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1394816 2015-05-01] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1772672 2015-05-01] (Microsoft Corporation)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2739888 2015-05-19] (Microsoft Corporation)
R2 ETDService; C:\Program Files\Elantech\ETDService.exe [100104 2013-09-05] (ELAN Microelectronics Corp.)
R2 IHProtect Service; C:\Program Files (x86)\MiuiTab\ProtectService.exe [125112 2015-06-16] (XTab system)
R2 Samsung Link Service; C:\Program Files\Samsung\Samsung Link\Samsung Link.exe [605768 2013-07-05] (Copyright 2013 SAMSUNG)
R2 Settings Launcher; C:\Program Files (x86)\Samsung\Settings\CmdServer\SettingsLauncher.exe [1593664 2014-02-14] (Samsung Electronics CO., LTD.)
R2 SWUpdateService; C:\ProgramData\Samsung\SW Update Service\SWMAgent.exe [3020120 2015-04-21] (Samsung Electronics CO., LTD.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-04] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-04] (Microsoft Corporation)
R2 WindowsMangerProtect; C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe [695976 2015-06-25] (DTools LIMITED) <==== ATTENTION
R2 ZAtheros Bt and Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [323584 2014-06-17] (Atheros) [File not signed]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S2 APXACC; C:\Windows\system32\DRIVERS\appexDrv.sys [219360 2013-04-18] (AppEx Networks Corporation)
R3 athr; C:\Windows\system32\DRIVERS\athwbx.sys [3859968 2013-08-15] (Qualcomm Atheros Communications, Inc.)
R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWB6.sys [222720 2014-03-12] (Advanced Micro Devices)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [153256 2015-06-25] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [132656 2015-06-25] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-12-09] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [43576 2015-03-14] (Avira Operations GmbH & Co. KG)
R3 BTATH_HID; C:\Windows\system32\DRIVERS\btath_hid.sys [223432 2014-06-17] (Qualcomm Atheros)
R3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [77464 2014-06-17] (Qualcomm Atheros)
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-03-18] (Microsoft Corporation)
R1 cbfs3; C:\windows\system32\drivers\cbfs3.sys [352448 2013-02-11] (EldoS Corporation)
R3 RadioHIDMini; C:\Windows\System32\drivers\RadioHIDMini.sys [23408 2012-07-27] (Windows (R) Win 7 DDK provider)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-04] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-06-25 15:22 - 2015-06-25 15:22 - 00024491 _____ C:\Users\Saskia\Downloads\FRST.txt
2015-06-25 15:22 - 2015-06-25 15:22 - 00000000 ____D C:\FRST
2015-06-25 15:21 - 2015-06-25 15:21 - 02112512 _____ (Farbar) C:\Users\Saskia\Downloads\FRST64.exe
2015-06-25 14:17 - 2015-06-25 14:17 - 00000000 ___RD C:\Users\Saskia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices
2015-06-25 14:15 - 2015-06-25 14:15 - 00000000 ___RD C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices
2015-06-25 14:05 - 2015-06-25 14:05 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Avira
2015-06-25 14:00 - 2015-06-25 14:05 - 00000000 ____D C:\Users\Administrator\AppData\Local\SAMSUNG
2015-06-25 14:00 - 2015-06-25 14:00 - 00001214 _____ C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\S Agent.lnk
2015-06-25 14:00 - 2015-06-25 14:00 - 00000000 ____D C:\Users\Administrator\Documents\Bluetooth Folder
2015-06-25 14:00 - 2015-06-25 14:00 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Atheros
2015-06-25 14:00 - 2015-06-25 14:00 - 00000000 ____D C:\Users\Administrator\AppData\Local\GWX
2015-06-25 14:00 - 2015-06-25 14:00 - 00000000 ____D C:\Users\Administrator\AppData\Local\BMExplorer
2015-06-25 14:00 - 2015-06-25 14:00 - 00000000 ____D C:\Users\Administrator\.swt
2015-06-25 13:59 - 2015-06-25 14:03 - 00002267 _____ C:\Users\Administrator\Desktop\Google Chrome.lnk
2015-06-25 13:59 - 2015-06-25 14:00 - 00000000 ____D C:\Users\Administrator\AppData\Local\Packages
2015-06-25 13:59 - 2015-06-25 14:00 - 00000000 ____D C:\Users\Administrator
2015-06-25 13:59 - 2015-06-25 13:59 - 00001450 _____ C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-06-25 13:59 - 2015-06-25 13:59 - 00000020 ___SH C:\Users\Administrator\ntuser.ini
2015-06-25 13:59 - 2015-06-25 13:59 - 00000000 _SHDL C:\Users\Administrator\Vorlagen
2015-06-25 13:59 - 2015-06-25 13:59 - 00000000 _SHDL C:\Users\Administrator\Startmenü
2015-06-25 13:59 - 2015-06-25 13:59 - 00000000 _SHDL C:\Users\Administrator\Netzwerkumgebung
2015-06-25 13:59 - 2015-06-25 13:59 - 00000000 _SHDL C:\Users\Administrator\Lokale Einstellungen
2015-06-25 13:59 - 2015-06-25 13:59 - 00000000 _SHDL C:\Users\Administrator\Eigene Dateien
2015-06-25 13:59 - 2015-06-25 13:59 - 00000000 _SHDL C:\Users\Administrator\Druckumgebung
2015-06-25 13:59 - 2015-06-25 13:59 - 00000000 _SHDL C:\Users\Administrator\Documents\Eigene Musik
2015-06-25 13:59 - 2015-06-25 13:59 - 00000000 _SHDL C:\Users\Administrator\Documents\Eigene Bilder
2015-06-25 13:59 - 2015-06-25 13:59 - 00000000 _SHDL C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2015-06-25 13:59 - 2015-06-25 13:59 - 00000000 _SHDL C:\Users\Administrator\AppData\Local\Verlauf
2015-06-25 13:59 - 2015-06-25 13:59 - 00000000 _SHDL C:\Users\Administrator\AppData\Local\Anwendungsdaten
2015-06-25 13:59 - 2015-06-25 13:59 - 00000000 _SHDL C:\Users\Administrator\Anwendungsdaten
2015-06-25 13:59 - 2015-06-25 13:59 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Adobe
2015-06-25 13:59 - 2015-06-25 13:59 - 00000000 ____D C:\Users\Administrator\AppData\Local\Google
2015-06-25 13:59 - 2015-03-16 18:25 - 00000000 ___RD C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2015-06-25 13:59 - 2015-01-12 03:16 - 00000000 ___RD C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2015-06-25 13:59 - 2015-01-12 03:16 - 00000000 ___RD C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2015-06-25 13:59 - 2014-08-26 05:58 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\ATI
2015-06-25 13:59 - 2014-08-26 05:58 - 00000000 ____D C:\Users\Administrator\AppData\Local\ATI
2015-06-25 13:59 - 2014-03-18 12:11 - 00000369 _____ C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pictures.lnk
2015-06-25 13:59 - 2014-03-18 12:11 - 00000369 _____ C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Documents.lnk
2015-06-25 13:59 - 2013-08-22 17:36 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2015-06-25 13:46 - 2015-06-25 13:46 - 00003152 _____ C:\WINDOWS\System32\Tasks\{DA517BC8-E302-4D62-9C78-C0C70CEBE134}
2015-06-25 13:23 - 2015-06-25 13:43 - 00000000 ____D C:\Users\Saskia\AppData\Roaming\Steganos
2015-06-25 13:23 - 2015-06-25 13:23 - 00000000 ____D C:\Users\Saskia\AppData\Roaming\Steganos VPN
2015-06-25 13:19 - 2015-06-25 13:19 - 00000000 ____D C:\ProgramData\IHProtectUpDate
2015-06-25 13:19 - 2015-06-25 13:19 - 00000000 ____D C:\Program Files (x86)\MiuiTab
2015-06-25 13:18 - 2015-06-25 13:18 - 00000000 ____D C:\ProgramData\WindowsMangerProtect
2015-06-25 13:18 - 2015-06-25 13:18 - 00000000 _____ C:\WINDOWS\prleth.sys
2015-06-25 13:18 - 2015-06-25 13:18 - 00000000 _____ C:\WINDOWS\hgfs.sys
2015-06-25 12:43 - 2015-06-25 12:43 - 00003886 _____ C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task
2015-06-11 00:06 - 2015-06-11 00:06 - 00001136 _____ C:\Users\Public\Desktop\Avira.lnk
2015-06-04 15:01 - 2015-06-04 15:01 - 00000000 ____D C:\Users\Saskia\AppData\Local\GWX
2015-06-04 13:44 - 2015-06-04 13:44 - 00612955 _____ C:\Users\Saskia\Downloads\docx (1)
2015-06-04 13:43 - 2015-06-04 13:44 - 00612955 _____ C:\Users\Saskia\Downloads\docx
2015-06-04 11:11 - 2015-06-04 11:11 - 00059392 _____ C:\Users\Saskia\Desktop\Aufgabenblatt 3_Lösung.xls
2015-06-04 11:09 - 2015-06-04 12:15 - 00065024 _____ C:\Users\Saskia\Desktop\Aufgabenblatt 3.xls
2015-06-04 10:49 - 2015-06-04 10:49 - 00001910 _____ C:\Users\Public\Desktop\SW Update.lnk

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-06-25 15:04 - 2014-03-20 22:41 - 00001138 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2015-06-25 15:00 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\system32\sru
2015-06-25 14:49 - 2014-08-26 05:15 - 02029072 _____ C:\WINDOWS\WindowsUpdate.log
2015-06-25 14:21 - 2014-02-16 17:04 - 00003596 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3299057831-706162602-1696328398-1001
2015-06-25 14:17 - 2014-02-16 16:59 - 00000000 ____D C:\Users\Saskia\Documents\Bluetooth Folder
2015-06-25 14:16 - 2014-08-26 05:53 - 00000000 __RDO C:\Users\Saskia\OneDrive
2015-06-25 14:16 - 2014-03-20 22:41 - 00001134 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2015-06-25 14:15 - 2014-08-26 05:09 - 00065536 _____ C:\WINDOWS\system32\spu_storage.bin
2015-06-25 14:15 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\AppReadiness
2015-06-25 14:05 - 2013-07-05 06:28 - 00003594 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3299057831-706162602-1696328398-500
2015-06-25 14:02 - 2015-04-18 17:43 - 00000000 ___RD C:\Program Files (x86)\Skype
2015-06-25 14:02 - 2015-04-18 17:43 - 00000000 ____D C:\ProgramData\Skype
2015-06-25 14:00 - 2015-02-24 17:53 - 00000000 ____D C:\ProgramData\Atheros
2015-06-25 14:00 - 2014-02-16 16:56 - 00000000 ____D C:\WINDOWS\System32\Tasks\WPD
2015-06-25 13:48 - 2014-08-26 05:48 - 00001450 _____ C:\Users\Saskia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-06-25 13:46 - 2014-02-18 00:48 - 00000000 ____D C:\Users\Saskia\AppData\Local\CrashDumps
2015-06-25 13:43 - 2015-02-11 00:31 - 00000000 ____D C:\Users\Saskia\AppData\Local\FileTypeAssistant
2015-06-25 13:43 - 2015-02-11 00:31 - 00000000 ____D C:\Program Files (x86)\File Type Assistant
2015-06-25 13:22 - 2015-04-18 17:43 - 00000000 ____D C:\Users\Saskia\AppData\Roaming\Skype
2015-06-25 13:14 - 2014-02-16 16:54 - 00000000 ____D C:\Users\Saskia\AppData\Local\Packages
2015-06-25 13:10 - 2015-01-12 07:13 - 00000000 ____D C:\Program Files\Microsoft Office 15
2015-06-25 12:46 - 2014-02-16 20:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-06-25 12:44 - 2014-02-16 20:45 - 00153256 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avgntflt.sys
2015-06-25 12:44 - 2014-02-16 20:45 - 00132656 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avipbb.sys
2015-06-25 12:43 - 2014-09-27 19:26 - 00003938 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{082AE942-C95F-4BA7-A7DA-04E01F80A059}
2015-06-11 00:06 - 2014-08-18 15:16 - 00000000 ____D C:\ProgramData\Package Cache
2015-06-11 00:06 - 2014-02-16 20:45 - 00000000 ____D C:\ProgramData\Avira
2015-06-11 00:06 - 2014-02-16 20:45 - 00000000 ____D C:\Program Files (x86)\Avira
2015-06-08 21:02 - 2014-03-18 12:03 - 01776918 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2015-06-08 21:02 - 2014-03-18 11:25 - 00765582 _____ C:\WINDOWS\system32\perfh007.dat
2015-06-08 21:02 - 2014-03-18 11:25 - 00159366 _____ C:\WINDOWS\system32\perfc007.dat
2015-06-08 20:56 - 2014-10-15 23:40 - 00959604 _____ C:\WINDOWS\PFRO.log
2015-06-08 20:56 - 2014-10-15 22:05 - 00008838 _____ C:\WINDOWS\setupact.log
2015-06-08 20:56 - 2013-08-22 16:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2015-06-08 20:56 - 2013-08-22 15:25 - 00524288 ___SH C:\WINDOWS\system32\config\BBI
2015-06-04 10:50 - 2014-11-27 06:35 - 00002970 _____ C:\WINDOWS\System32\Tasks\SamsungLinkPC
2015-06-04 10:50 - 2013-07-05 00:54 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung
2015-06-04 10:50 - 2013-07-05 00:54 - 00000000 ____D C:\Program Files (x86)\Samsung

==================== Files in the root of some directories =======

2014-02-16 16:55 - 2014-02-18 00:31 - 0001516 _____ () C:\Users\Saskia\AppData\Roaming\AbsoluteReminder.xml
2014-03-21 00:10 - 2014-03-23 20:10 - 0000065 _____ () C:\Users\Saskia\AppData\Roaming\WB.CFG
2014-03-12 23:41 - 2014-03-12 16:04 - 0955488 _____ (AnyProtect.com) C:\Users\Saskia\AppData\Local\AnyProtectScannerSetup.exe
2014-03-12 23:14 - 2014-03-12 23:14 - 0955488 _____ (AnyProtect.com) C:\Users\Saskia\AppData\Local\nsx9D02.tmp
2015-02-23 23:52 - 2015-02-23 23:52 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2013-07-05 04:08 - 2013-02-19 09:34 - 2064264 _____ (Samsung Electronics) C:\ProgramData\MakeMarkerFile.exe
2013-07-05 04:08 - 2013-01-12 16:51 - 0003004 _____ () C:\ProgramData\MakeMarkerFile.xml

Files to move or delete:
====================
C:\ProgramData\MakeMarkerFile.exe
C:\Users\EasySurvey\EasySurvey.exe


Some files in TEMP:
====================
C:\Users\Administrator\AppData\Local\Temp\avgnt.exe
C:\Users\Saskia\AppData\Local\Temp\avgnt.exe
C:\Users\Saskia\AppData\Local\Temp\SkypeUpdateSetup.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-06-25 13:11

==================== End of log ============================

Soll ich zusätzlich mein AntiVir einmal durchlaufen lassen und den Log hier reinposten?

Danke

cosinus · 25.06.2015, 18:49

Nein, steht doch da. Keine neuen Scans machen. Von Virenscannern nur vorhandene Logs posten, ansonsten siehe weietere Instruktionen.

Außerdem fehlt das andere Log von FRST (addition.txt)

SasslP · 25.06.2015, 19:11

Sorry, hier ist es:

[CODE] Additional
FRST Logfile:

Code:

ATTFilter

scan result of Farbar Recovery Scan Tool (x64) Version:24-06-2015
Ran by Saskia at 2015-06-25 15:24:25
Running from C:\Users\Saskia\Downloads
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-3299057831-706162602-1696328398-500 - Administrator - Disabled) => C:\Users\Administrator
Gast (S-1-5-21-3299057831-706162602-1696328398-501 - Limited - Disabled)
Saskia (S-1-5-21-3299057831-706162602-1696328398-1001 - Administrator - Enabled) => C:\Users\Saskia

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Antivirus (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avira Antivirus (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Action Replay PowerSaves 3DS Version 1.21 (HKLM-x32\...\{CD24B06F-0A4D-410A-AEF2-DFE6A28AB4C0}_is1) (Version: 1.21 - Datel Design & Development)
Adobe Reader XI (11.0.11)  MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AB0000000001}) (Version: 11.0.11 - Adobe Systems Incorporated)
AllShare Framework DMS (HKLM\...\{C5850BE4-67AA-4CFB-894B-27F1172E42E0}) (Version: 1.3.14 - Samsung)
AMD Catalyst Install Manager (HKLM\...\{8D819115-F915-F5B3-3D4F-032A8DF32F5C}) (Version: 8.0.915.0 - Advanced Micro Devices, Inc.)
AMD Quick Stream (HKLM\...\{E9EED4AE-682B-4501-9574-D09A21717599}_is1) (Version: 3.4.4.2 - AppEx Networks)
Avira (HKLM-x32\...\{0696cc37-db90-4000-be99-4a173ca7c8af}) (Version: 1.1.39.17987 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.39.17987 - Avira Operations GmbH & Co. KG) Hidden
Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.11.574 - Avira Operations GmbH & Co. KG)
Bitcasa version 1.0.1.5011 (HKLM\...\{EDA09459-AD7D-4434-BA0C-647F6703EA12}_is1) (Version: 1.0.1.5011 - Bitcasa Inc.)
ETDWare X64 11.7.19.9_WHQL (HKLM\...\Elantech) (Version: 11.7.19.9 - ELAN Microelectronic Corp.)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 43.0.2357.130 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.27.5 - Google Inc.) Hidden
Help Desk (HKLM\...\{AEC9D273-E162-4614-83F1-722B8C74B185}) (Version: 1.0.96 - Samsung Electronics CO., LTD.)
Microsoft Office 365 ProPlus - de-de (HKLM\...\O365ProPlusRetail - de-de) (Version: 15.0.4727.1003 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation)
Microsoft SkyDrive (HKU\S-1-5-21-3299057831-706162602-1696328398-1001\...\SkyDriveSetup.exe) (Version: 17.0.2015.0811 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4727.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4727.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4727.1003 - Microsoft Corporation) Hidden
Phone Screen Sharing (HKLM-x32\...\{DF02C515-40B5-45AC-A601-5DC69D03885C}) (Version: 2.0.0.21 - RSUPPORT)
Qualcomm Atheros Bluetooth Suite (64) (HKLM\...\{A84A4FB1-D703-48DB-89E0-68B6499D2801}) (Version: 8.0.1.326 - Qualcomm Atheros Communications)
Qualcomm Atheros Client Installation Program (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 10.0 - Qualcomm Atheros)
Quick Starter (HKLM\...\{EC36E2BC-86F7-44C9-84B2-93930F0FBDBF}) (Version: 1.0.2 - Samsung Electronics CO., LTD.)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9200.39048 - Realtek Semiconductor Corp.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7045 - Realtek Semiconductor Corp.)
Realtek USB Card Reader (HKLM-x32\...\{1E496A68-4943-424E-829D-5C3C85B7B8F2}) (Version: 1.00.0000 - Realtek Semiconductor Corp.)
S Agent (Version: 1.1.52 - Samsung Electronics CO., LTD.) Hidden
Samsung Link (HKLM-x32\...\{82EC241F-DFCA-4166-A8C3-EA5D2B9A41C4}) (Version: 1.8.0.44 - Samsung Electronics CO., LTD.)
Samsung Link 1.6.0.1307060147 (HKLM\...\8474-7877-9059-0204) (Version: 1.6.0.1307060147 - Copyright 2013 SAMSUNG)
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.25.0 - SAMSUNG Electronics Co., Ltd.)
Settings (HKLM-x32\...\{3BB58176-B3A7-47FD-9F18-C3576431D193}) (Version: 2.2.0 - Samsung Electronics CO., LTD.)
SideSync (HKLM-x32\...\{59687468-8CE9-4ABF-9C6A-5C31F0E09F8B}) (Version: 2.0.0 - Samsung Electronics CO., LTD.)
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.4.0.9058 - Microsoft Corporation)
Support Center (HKLM\...\{711DE117-767F-48A8-9864-66C525B9539F}) (Version: 2.1.1223 - Samsung Electronics CO., LTD.)
Support Center FAQ (x32 Version: 1.0.17 - Samsung Electronics CO., LTD.) Hidden
SW Update (HKLM-x32\...\{AAFEFB05-CF98-48FC-985E-F04CD8AD620D}) (Version: 2.2.9 - Samsung Electronics CO., LTD.)
Teachmaster 4.3 (nur Entfernen) (HKLM-x32\...\Teachmaster 4.3) (Version:  - )
Windows-Treiberpaket - Samsung Electronics Co. Ltd. (RadioHIDMini) HIDClass  (08/23/2013 6.2.8400.4218) (HKLM\...\26BFE384C802803107F583AE1A739E4FEB56134B) (Version: 08/23/2013 6.2.8400.4218 - Samsung Electronics Co. Ltd.)
Zombie Invasion (HKLM-x32\...\ZombieInvasion) (Version: 2.7.66 - Time Lapse Solutions) <==== ATTENTION

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-3299057831-706162602-1696328398-1001_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Saskia\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3299057831-706162602-1696328398-1001_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Saskia\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3299057831-706162602-1696328398-1001_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32 -> C:\Users\Saskia\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3299057831-706162602-1696328398-1001_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Saskia\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3299057831-706162602-1696328398-1001_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Saskia\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\amd64\FileSyncApi64.dll (Microsoft Corporation)

==================== Restore Points =========================

30-05-2015 01:33:05 Installed SW Update
04-06-2015 10:48:46 Installed SW Update
13-06-2015 21:07:55 Geplanter Prüfpunkt
25-06-2015 14:01:55 Removed Skype™ 7.5

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {08AC5898-9465-4390-A2DC-883C979FC96D} - System32\Tasks\GenericSettingsHandler\Windows-Credentials\RetrySyncTask_for_S-1-5-21-3299057831-706162602-1696328398-1001
Task: {163C7F78-A74D-4952-9B26-94B8F827682B} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-10s => C:\Windows\system32\GWX\GWX.exe [2015-05-06] (Microsoft Corporation)
Task: {165615F0-2C1C-40AC-8677-F071FAD56FB3} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-10s => C:\Windows\system32\GWX\GWX.exe [2015-05-06] (Microsoft Corporation)
Task: {2D0669C4-1CF4-4495-B378-EF28D0E03579} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-10s => C:\Windows\system32\GWX\GWX.exe [2015-05-06] (Microsoft Corporation)
Task: {2DABA4A0-C8F1-4CCD-8158-E2FD400FB987} - System32\Tasks\SamsungLinkPC => C:\Program Files (x86)\Samsung\HomeSync Lite\RefreshToken.exe
Task: {45AD4C3F-28B1-432B-9F1F-7CE1335B8DE1} - \video-high-enabler No Task File <==== ATTENTION
Task: {53085854-AA2A-47C0-B737-1A826ED4E9CC} - System32\Tasks\RTKCPL => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2013-09-24] (Realtek Semiconductor)
Task: {585FB0AD-BE40-4420-91CA-B72BA1FFDCED} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B => schtasks
Task: {5AAF3239-F4CD-4FCE-86F4-837937F7C960} - \video-high-updater No Task File <==== ATTENTION
Task: {661F16D4-F2E8-4CFC-96C8-7D1887C7CF5D} - System32\Tasks\LaunchSettings => C:\Program Files (x86)\Samsung\Settings\Settings.exe [2014-02-14] ()
Task: {677CCFE1-9F00-4995-9EA0-DD79079842E6} - System32\Tasks\SAgent => C:\Program Files\Samsung\S Agent\CommonAgent.exe [2015-02-04] (Samsung Electronics CO., LTD.)
Task: {705563F9-702F-4E69-8822-4AF908BDBCE8} - System32\Tasks\SettingsHibernateMonitor => C:\Program Files (x86)\Samsung\Settings\SettingsHibernateMonitor.exe [2014-02-14] (Samsung Electronics CO., LTD.)
Task: {75216A85-0989-4FE4-858D-ECF90F3BF9BD} - System32\Tasks\RtHDVBg => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2013-09-16] (Realtek Semiconductor)
Task: {76249A4C-3142-495C-B62D-599031E34852} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-03-20] (Google Inc.)
Task: {7800A56F-63FA-48AF-AEA8-58291DDCDB80} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2015-05-28] (Microsoft Corporation)
Task: {7E819FE9-A14C-4C63-9DCF-699427B5C8B5} - \video-high-codedownloader No Task File <==== ATTENTION
Task: {8C2A980E-6B6B-4DDA-B584-180A73DD96F4} - System32\Tasks\{DA517BC8-E302-4D62-9C78-C0C70CEBE134} => pcalua.exe -a C:\Users\Saskia\AppData\Roaming\istartsurf\UninstallManager.exe -c  -ptid=air
Task: {8E186891-3DD7-41F6-9532-367B71293998} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office 15\root\Office15\msoia.exe [2015-05-12] (Microsoft Corporation)
Task: {9556D0F8-8AD9-4F33-8E7A-B0ADC44F4DA5} - System32\Tasks\APSnotifierCA => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {97F5CA00-FFEC-4BC7-A37B-553EBC501C3E} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-03-20] (Google Inc.)
Task: {9B15ACF5-E4B8-4553-B1C3-3A2C34559118} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-05-15] (Microsoft Corporation)
Task: {A639A484-7040-466E-AED4-E276CB95D5AA} - \video-high-firefoxinstaller No Task File <==== ATTENTION
Task: {B292E20E-5CE5-47DB-AD71-011A6BD8FCA6} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-06-12] (Adobe Systems Incorporated)
Task: {C0942911-A3AF-4B6A-9815-3D01B2B2E6A8} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-05-19] (Microsoft Corporation)
Task: {C91F65F0-5EC2-4D1C-947A-65D2289977A5} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\Time-10s => C:\Windows\system32\GWX\GWX.exe [2015-05-06] (Microsoft Corporation)
Task: {D0DB6C78-BE1D-4EBA-B719-3BA567F2F989} - \video-high-chromeinstaller No Task File <==== ATTENTION
Task: {DEBAC08F-D322-4FD9-A1E7-7776FCBC8B34} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\Logon-10s => C:\Windows\system32\GWX\GWX.exe [2015-05-06] (Microsoft Corporation)
Task: {DED6EFB3-CE73-4F0A-99F7-8D4E461DCE59} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-05-19] (Microsoft Corporation)
Task: {E232F266-EF7C-4D7C-9FD6-FF5FD288E1F5} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office 15\root\Office15\msoia.exe [2015-05-12] (Microsoft Corporation)
Task: {FB396963-5DF4-4BC0-A867-B0AC8D7E905F} - System32\Tasks\SettingsEventHandlerMonitor => C:\Program Files (x86)\Samsung\Settings\CmdServer\RSSettingEventHandler.exe [2014-02-14] (Samsung Electronics CO., LTD.)
Task: C:\WINDOWS\Tasks\APSnotifierCA.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (Whitelisted) ==============

2013-07-05 03:57 - 2013-07-05 18:47 - 00012800 _____ () C:\Program Files\Samsung\Samsung Link\JniSys.dll
2014-08-26 05:29 - 2014-08-26 05:29 - 00515584 ____N () C:\Windows\Temp\sqlite-3.7.2-sqlitejdbc.dll
2013-07-05 03:57 - 2013-07-05 18:47 - 01283584 _____ () C:\Program Files\Samsung\Samsung Link\SecProxyJNI.dll
2013-07-05 03:57 - 2013-07-05 18:47 - 01340928 _____ () C:\Program Files\Samsung\Samsung Link\SecStubJNI.dll
2013-07-05 03:57 - 2013-07-05 18:47 - 01588736 _____ () C:\Program Files\Samsung\Samsung Link\SppAgentSvc.dll
2013-06-18 06:51 - 2013-06-18 06:51 - 00036864 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.14\64bit\JNIInterface.dll
2013-06-18 06:51 - 2013-06-18 06:51 - 00144384 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.14\64bit\ASFAPI.dll
2013-06-18 06:54 - 2013-06-18 06:54 - 00018944 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.14\64bit\MediaDB_Manager.dll
2013-02-14 12:41 - 2013-02-14 12:41 - 00030720 _____ () C:\WINDOWS\SYSTEM32\MediaDB64.dll
2013-02-14 12:41 - 2013-02-14 12:41 - 00905216 _____ () C:\WINDOWS\SYSTEM32\ContentDirectoryPresenter64.dll
2013-06-18 06:55 - 2013-06-18 06:55 - 00521728 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.14\64bit\DMS_Manager.dll
2013-04-15 11:52 - 2013-04-15 11:52 - 00049152 _____ () C:\WINDOWS\SYSTEM32\boost_date_time-vc90-mt-1_47.dll
2013-04-15 11:52 - 2013-04-15 11:52 - 00016896 _____ () C:\WINDOWS\SYSTEM32\boost_system-vc90-mt-1_47.dll
2013-04-15 11:52 - 2013-04-15 11:52 - 00058880 _____ () C:\WINDOWS\SYSTEM32\boost_thread-vc90-mt-1_47.dll
2013-04-15 11:52 - 2013-04-15 11:52 - 00299520 _____ () C:\WINDOWS\SYSTEM32\boost_serialization-vc90-mt-1_47.dll
2015-01-12 07:13 - 2014-05-20 09:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2013-07-05 03:49 - 2013-06-06 06:15 - 00288720 _____ () C:\Program Files\Bitcasa\ExplorerMenu.dll
2013-07-05 03:49 - 2013-06-06 06:23 - 01645056 _____ () C:\Program Files\Bitcasa\bitcasaui.dll
2015-05-09 22:49 - 2015-05-09 22:49 - 00183296 _____ () C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20856_x64__8wekyb3d8bbwe\ErrorReporting.dll
2014-06-17 09:32 - 2014-06-17 09:32 - 00011264 _____ () C:\Program Files (x86)\Bluetooth Suite\Modules\ActivateDesktopDebugger\ActivateDesktopDebugger.dll
2014-06-17 09:29 - 2014-06-17 09:29 - 00086016 _____ () C:\Program Files (x86)\Bluetooth Suite\Modules\Map\MAP.dll
2014-06-17 09:35 - 2014-06-17 09:35 - 00012928 _____ () C:\Program Files (x86)\Bluetooth Suite\ActivateDesktop.exe
2013-07-05 03:57 - 2013-07-05 18:47 - 00042496 _____ () C:\Program Files\Samsung\Samsung Link\JniIO.dll
2015-02-04 16:11 - 2015-02-04 16:11 - 00088624 _____ () C:\Program Files\Samsung\S Agent\ToastX64.dll
2013-04-19 10:29 - 2013-04-19 10:29 - 01113600 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.14\DMSManager.dll
2013-04-15 11:52 - 2013-04-15 11:52 - 00227840 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.14\boost_serialization-vc90-mt-1_47.dll
2013-04-15 11:53 - 2013-04-15 11:53 - 00038912 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.14\boost_date_time-vc90-mt-1_47.dll
2013-04-15 11:52 - 2013-04-15 11:52 - 00012800 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.14\boost_system-vc90-mt-1_47.dll
2013-04-15 11:53 - 2013-04-15 11:53 - 00046592 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.14\boost_thread-vc90-mt-1_47.dll
2013-04-19 09:37 - 2013-04-19 09:37 - 00704000 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.14\ContentDirectoryPresenter.dll
2013-04-19 09:39 - 2013-04-19 09:39 - 00107008 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.14\DCMCDP.dll
2013-04-19 09:38 - 2013-04-19 09:38 - 00101376 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.14\FolderCDP.dll
2013-04-19 09:39 - 2013-04-19 09:39 - 00032768 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.14\Autobackup.dll
2013-04-19 09:38 - 2013-04-19 09:38 - 00055808 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.14\RosettaAllShare.dll
2013-04-19 10:29 - 2013-04-19 10:29 - 00077312 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.14\MetadataFramework.dll
2013-02-14 12:42 - 2013-02-14 12:42 - 00520234 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.14\sqlite3.dll
2013-02-14 12:42 - 2013-02-14 12:42 - 00450560 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.14\MoodExtractor.dll
2013-02-14 12:42 - 2013-02-14 12:42 - 05717504 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.14\DCMImgExtractor.dll
2013-04-12 01:58 - 2013-04-12 01:58 - 00028672 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.14\AutoChaptering.dll
2013-04-19 10:29 - 2013-04-19 10:29 - 00028160 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.14\AudioExtractor.dll
2013-04-19 09:58 - 2013-04-19 09:58 - 00017920 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.14\VideoExtractor.dll
2013-04-19 09:58 - 2013-04-19 09:58 - 00012288 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.14\ImageExtractor.dll
2013-04-19 09:58 - 2013-04-19 09:58 - 00013824 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.14\TextExtractor.dll
2013-02-14 12:42 - 2013-02-14 12:42 - 00147456 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.14\libexpat.dll
2013-04-12 01:58 - 2013-04-12 01:58 - 00012288 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.14\VideoThumb.dll
2013-04-19 10:29 - 2013-04-19 10:29 - 00064000 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.14\ID3Driver.dll
2013-04-19 09:58 - 2013-04-19 09:58 - 00023040 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.14\RichInfoDriver.dll
2013-04-19 09:58 - 2013-04-19 09:58 - 00117248 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.14\ThumbnailMaker.dll
2013-04-19 09:58 - 2013-04-19 09:58 - 00133632 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.14\VideoMetadataDriver.dll
2013-04-19 09:58 - 2013-04-19 09:58 - 00024064 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.14\SECMetaDriver.dll
2013-04-12 01:58 - 2013-04-12 01:58 - 00024064 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.14\photoDriver.dll
2013-02-14 12:42 - 2013-02-14 12:42 - 04671488 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.14\avcodec-52.dll
2013-02-14 12:42 - 2013-02-14 12:42 - 00686080 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.14\avformat-52.dll
2013-02-14 12:42 - 2013-02-14 12:42 - 00070656 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.14\avutil-50.dll
2013-02-14 12:42 - 2013-02-14 12:42 - 00152064 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.14\swscale-0.dll
2013-02-14 12:42 - 2013-02-14 12:42 - 00366592 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.14\tag.dll
2013-04-12 01:58 - 2013-04-12 01:58 - 00289792 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.14\libThumbnail.dll
2013-04-12 01:59 - 2013-04-12 01:59 - 01033216 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.14\ImageMagickWrapper.dll
2013-04-19 09:58 - 2013-04-19 09:58 - 00290816 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.14\libKeyFrame.dll
2013-02-14 12:42 - 2013-02-14 12:42 - 00399826 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.14\libexif-12.dll.dll
2013-02-14 12:42 - 2013-02-14 12:42 - 00044032 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.14\us.dll
2014-02-14 11:16 - 2014-02-14 11:16 - 00211064 _____ () C:\Program Files (x86)\Samsung\Settings\CmdServer\WinCRT.dll
2015-06-25 13:06 - 2015-06-20 07:46 - 01281864 _____ () C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.130\libglesv2.dll
2015-06-25 13:06 - 2015-06-20 07:46 - 00080712 _____ () C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.130\libegl.dll
2015-06-25 13:06 - 2015-06-20 07:46 - 15003976 _____ () C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.130\PepperFlash\pepflashplayer.dll
2015-01-12 07:13 - 2015-01-12 07:13 - 00316576 _____ () C:\Program Files\Microsoft Office 15\Root\Office15\AppVIsvStream32.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\Users\Saskia\OneDrive:ms-properties

==================== Safe Mode (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE trusted site: HKU\S-1-5-21-3299057831-706162602-1696328398-1001\...\sharepoint.com -> hxxps://hmedu.sharepoint.com


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3299057831-706162602-1696328398-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Saskia\AppData\Local\Microsoft\Windows\Themes\RoamedThemeFiles\DesktopBackground\spring shoes.jpg
DNS Servers: 192.168.178.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{6393F501-9947-4F7B-B42A-5D068F99C072}] => (Allow) C:\Users\Saskia\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
FirewallRules: [{EE0DAC83-559C-4807-AFE5-62EB539678C2}] => (Allow) C:\Program Files\Samsung\Samsung Link\Samsung Link Tray Agent.exe
FirewallRules: [{C2051B3E-56B0-4154-99E9-9C40EF5373D0}] => (Allow) C:\Program Files\Samsung\Samsung Link\Samsung Link Tray Agent.exe
FirewallRules: [{AA762439-11B4-43BE-AB8C-B42B5B86962C}] => (Allow) C:\Program Files\Samsung\Samsung Link\Samsung Link.exe
FirewallRules: [{FFCDA525-7122-4C83-9ED4-FF37F0177BBC}] => (Allow) C:\Program Files\Samsung\Samsung Link\Samsung Link.exe
FirewallRules: [{9C66F574-37C8-4D02-AEF4-D90D229BC475}] => (Allow) LPort=1900
FirewallRules: [{A12A7005-52FD-4AB0-86AA-1D0A2AC7D5FF}] => (Allow) LPort=7900
FirewallRules: [{BBED4E5D-0CB6-492F-8DEB-909FF2D32D41}] => (Allow) LPort=24234
FirewallRules: [{2737478A-81E4-4A42-9E1F-5A92B36BD392}] => (Allow) LPort=7679
FirewallRules: [{7E646746-2DD9-4BC2-9C73-02EA9BEDE741}] => (Allow) LPort=7676
FirewallRules: [{864DC9AA-709F-4A13-A38D-F9FA31531914}] => (Allow) LPort=8643
FirewallRules: [{45852E01-27FE-41C2-9B7E-EBA686E65012}] => (Allow) LPort=8743
FirewallRules: [{EEB1D163-6687-4C3D-A537-8F41A18A47CF}] => (Allow) C:\Program Files\Samsung\AllShare Framework DMS\1.3.14\AllShareFrameworkDMS.exe
FirewallRules: [{5C63FCF9-0629-4480-BE93-C911055D62AE}] => (Allow) C:\Program Files\Samsung\AllShare Framework DMS\1.3.14\AllShareFrameworkDMS.exe
FirewallRules: [{A4D45E9B-A7DC-4920-B055-EA6C1DE185E5}] => (Allow) C:\Program Files\Samsung\AllShare Framework DMS\1.3.14\AllShareFrameworkDMS.exe
FirewallRules: [{D91C0179-D70D-4121-BA3B-045FADD0B342}] => (Allow) C:\Program Files\Samsung\AllShare Framework DMS\1.3.14\AllShareFrameworkDMS.exe
FirewallRules: [{0130E8B4-4232-47D7-8A2F-38BB01227C1E}] => (Allow) C:\Program Files\Samsung\Samsung Link\Samsung Link Tray Agent.exe
FirewallRules: [{87589BF5-1258-40D1-85CE-794AE052E713}] => (Allow) C:\Program Files\Samsung\Samsung Link\Samsung Link.exe
FirewallRules: [{506B5859-0764-4669-BE25-95946006389C}] => (Allow) C:\Program Files\Samsung\Samsung Link\Samsung Link Tray Agent.exe
FirewallRules: [{40EEBD33-D125-43C3-89A4-EA7BA722EC58}] => (Allow) C:\Program Files\Samsung\Samsung Link\Samsung Link.exe
FirewallRules: [{DB75861B-C55E-48BD-B2B2-F0996BF4BD22}] => (Allow) C:\Windows\SysWOW64\muzapp.exe
FirewallRules: [{D3D76BA6-BBF9-4B48-BAF6-FDA919E167DC}] => (Allow) C:\Windows\SysWOW64\muzapp.exe
FirewallRules: [{C810FB50-DCA7-4AF9-B09A-B3064ADB05B8}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\Lync.exe
FirewallRules: [{F7874245-319E-4329-8674-7272EBE258A4}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\UcMapi.exe
FirewallRules: [{8595852E-F354-42B7-BA03-6366BA2B8E8C}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\outlook.exe
FirewallRules: [{59AFDACB-4C7F-4C65-BD4D-1FCBB32B5579}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{26DA443F-422E-4D01-ACB1-9C5A6B2922BE}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\Lync.exe
FirewallRules: [{EDD70935-225F-46B3-8BCD-9ED86010ABC0}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\UcMapi.exe
FirewallRules: [{EBD703E0-8F57-458B-90CB-F4401B67662C}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (06/25/2015 01:52:51 PM) (Source: Microsoft-Windows-LocationProvider) (EventID: 2006) (User: NT-AUTORITÄT)
Description: There was an error with the Windows Location Provider database

Error: (06/25/2015 01:46:00 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: chrome.exe, Version: 43.0.2357.130, Zeitstempel: 0x5584cfea
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.3.9600.17736, Zeitstempel: 0x550f42c2
Ausnahmecode: 0xc0000142
Fehleroffset: 0x0009d4f2
ID des fehlerhaften Prozesses: 0x59c
Startzeit der fehlerhaften Anwendung: 0xchrome.exe0
Pfad der fehlerhaften Anwendung: chrome.exe1
Pfad des fehlerhaften Moduls: chrome.exe2
Berichtskennung: chrome.exe3
Vollständiger Name des fehlerhaften Pakets: chrome.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: chrome.exe5

Error: (06/25/2015 01:11:03 PM) (Source: SideBySide) (EventID: 35) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"1". Fehler in Manifest- oder Richtliniendatei "UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"2" in Zeile  UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"3.
Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.
Verweis: UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0".
Definition: UccApi,processorArchitecture="x86",type="win32",version="15.0.0.0".
Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.

Error: (06/15/2015 11:08:45 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005

Error: (06/13/2015 09:13:33 PM) (Source: SideBySide) (EventID: 35) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"1". Fehler in Manifest- oder Richtliniendatei "UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"2" in Zeile  UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"3.
Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.
Verweis: UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0".
Definition: UccApi,processorArchitecture="x86",type="win32",version="15.0.0.0".
Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.

Error: (06/13/2015 09:07:14 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: SASSLPOGI)
Description: Bei der Aktivierung der App „microsoft.windowscommunicationsapps_8wekyb3d8bbwe!ppleae38af2e007f4358a809ac99a64a67c1“ ist folgender Fehler aufgetreten: -2147023174. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (06/13/2015 09:07:14 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: SASSLPOGI)
Description: Bei der Aktivierung der App „microsoft.windowscommunicationsapps_8wekyb3d8bbwe!ppleae38af2e007f4358a809ac99a64a67c1“ ist folgender Fehler aufgetreten: -2147023174. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (06/13/2015 08:39:27 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005

Error: (06/12/2015 00:03:30 AM) (Source: SideBySide) (EventID: 35) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"1". Fehler in Manifest- oder Richtliniendatei "UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"2" in Zeile  UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"3.
Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.
Verweis: UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0".
Definition: UccApi,processorArchitecture="x86",type="win32",version="15.0.0.0".
Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.

Error: (06/09/2015 11:52:40 PM) (Source: SideBySide) (EventID: 35) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"1". Fehler in Manifest- oder Richtliniendatei "UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"2" in Zeile  UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"3.
Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.
Verweis: UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0".
Definition: UccApi,processorArchitecture="x86",type="win32",version="15.0.0.0".
Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.


System errors:
=============
Error: (06/11/2015 00:05:05 AM) (Source: Schannel) (EventID: 4119) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung vom Remoteendpunkt empfangen. Die schwerwiegende Warnung hat folgenden für das TLS-Protokoll definierten Code: 20.

Error: (06/08/2015 08:56:29 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "AppEx Networks Accelerator LWF" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%31

Error: (06/08/2015 08:56:29 PM) (Source: APXACC) (EventID: 1003) (User: )
Description: The NDIS6 LWF initialization has failed. (0xC0000001)

Error: (06/04/2015 10:49:14 AM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "SW Update Service" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (06/04/2015 10:48:41 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "SW Update Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (05/30/2015 01:33:41 AM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "SW Update Service" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (05/30/2015 01:32:56 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "SW Update Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (05/29/2015 04:43:56 PM) (Source: DCOM) (EventID: 10001) (User: SASSLPOGI)
Description: "C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20856_x64__8wekyb3d8bbwe\LiveComm.exe" -ServerName:Microsoft.WindowsLive.Platform.Server31Microsoft.WindowsLive.Mail.AppXj3e9v0xw9sf8t58nqr15tqqb2yq4zsfg.mcaNicht verfügbarNicht verfügbar

Error: (05/28/2015 01:43:49 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Erkennung interaktiver Dienste" wurde mit folgendem Fehler beendet: 
%%1

Error: (05/24/2015 10:42:41 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "AppEx Networks Accelerator LWF" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%31


Microsoft Office:
=========================
Error: (06/25/2015 01:52:51 PM) (Source: Microsoft-Windows-LocationProvider) (EventID: 2006) (User: NT-AUTORITÄT)
Description: -2147024883

Error: (06/25/2015 01:46:00 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: chrome.exe43.0.2357.1305584cfeantdll.dll6.3.9600.17736550f42c2c00001420009d4f259c01d0af3c818ae53fC:\Program Files (x86)\Google\Chrome\Application\chrome.exeC:\WINDOWS\SYSTEM32\ntdll.dllbf8ae37d-1b2f-11e5-8269-48d2243efdd0

Error: (06/25/2015 01:11:03 PM) (Source: SideBySide) (EventID: 35) (User: )
Description: UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"UccApi,processorArchitecture="x86",type="win32",version="15.0.0.0"C:\Program Files\Microsoft Office 15\root\office15\lync.exe.ManifestC:\Program Files\Microsoft Office 15\root\office15\UccApi.DLL1

Error: (06/15/2015 11:08:45 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005

Error: (06/13/2015 09:13:33 PM) (Source: SideBySide) (EventID: 35) (User: )
Description: UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"UccApi,processorArchitecture="x86",type="win32",version="15.0.0.0"C:\Program Files\Microsoft Office 15\root\office15\lync.exe.ManifestC:\Program Files\Microsoft Office 15\root\office15\UccApi.DLL1

Error: (06/13/2015 09:07:14 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: SASSLPOGI)
Description: microsoft.windowscommunicationsapps_8wekyb3d8bbwe!ppleae38af2e007f4358a809ac99a64a67c1-2147023174

Error: (06/13/2015 09:07:14 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: SASSLPOGI)
Description: microsoft.windowscommunicationsapps_8wekyb3d8bbwe!ppleae38af2e007f4358a809ac99a64a67c1-2147023174

Error: (06/13/2015 08:39:27 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005

Error: (06/12/2015 00:03:30 AM) (Source: SideBySide) (EventID: 35) (User: )
Description: UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"UccApi,processorArchitecture="x86",type="win32",version="15.0.0.0"C:\Program Files\Microsoft Office 15\root\office15\lync.exe.ManifestC:\Program Files\Microsoft Office 15\root\office15\UccApi.DLL1

Error: (06/09/2015 11:52:40 PM) (Source: SideBySide) (EventID: 35) (User: )
Description: UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"UccApi,processorArchitecture="x86",type="win32",version="15.0.0.0"C:\Program Files\Microsoft Office 15\root\office15\lync.exe.ManifestC:\Program Files\Microsoft Office 15\root\office15\UccApi.DLL1


==================== Memory info =========================== 

Processor: Quad-Core Processor (up to 1.4GHz) 
Percentage of memory in use: 40%
Total physical RAM: 3526.71 MB
Available physical RAM: 2102.73 MB
Total Pagefile: 5126.71 MB
Available Pagefile: 2354.54 MB
Total Virtual: 131072 MB
Available Virtual: 131071.8 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:98.59 GB) (Free:67.37 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 119.2 GB) (Disk ID: BEA15CA0)

Partition: GPT Partition Type.

==================== End of log ============================

--- --- ---

cosinus · 25.06.2015, 19:26

Dann deinstallieren wir das mal mit Revo. Aber wir sind dann noch nicht fertig.

Lade Dir bitte von hier

Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.

Installiere und starte das Programm. (Bebilderte Anleitung zu Revo Uninstaller)
Klicke auf Optionen und wähle als Sprache Deutsch.
Suche im Uninstallerfeld nach den Programmen:

Zombie Invasion
Wähle die Programme nacheinander aus und klicke jedes Mal auf Uninstall.
Wähle anschließend den Modus "Moderat" aus.
Reste löschen:
Klicke auf dann auf und dann auf .

SasslP · 25.06.2015, 19:35

Ist erledigt!

cosinus · 25.06.2015, 19:40

Adware/Junkware/Toolbars entfernen

1. Schritt: Malwarebytes

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

(alte Versionen von adwCleaner und falls vorhanden JRT vorher löschen, danach neu runterladen auf den Desktop!)

2. Schritt: adwCleaner

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

3. Schritt: JRT - Junkware Removal Tool

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

4. Schritt: Frisches Log mit FRST

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

SasslP · 25.06.2015, 21:12

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 25.06.2015
Suchlauf-Zeit: 20:51:03
Logdatei: mbam.txt
Administrator: Ja

Version: 2.01.6.1022
Malware Datenbank: v2015.06.25.05
Rootkit Datenbank: v2015.06.22.01
Lizenz: Testversion
Malware Schutz: Aktiviert
Bösartiger Webseiten Schutz: Aktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 8.1
CPU: x64
Dateisystem: NTFS
Benutzer: Saskia

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 399381
Verstrichene Zeit: 19 Min, 9 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 2
PUP.Optional.XTab.A, C:\Program Files (x86)\MiuiTab\ProtectService.exe, 1240, Löschen bei Neustart, [97e28eb50b7f85b175dc9975b250ca36]
PUP.Optional.WPM.A, C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe, 1348, Löschen bei Neustart, [b9c081c2f09afd390f90e9977f84f40c]

Module: 0
(Keine schädliche Elemente gefunden)

Registrierungsschlüssel: 23
PUP.Optional.XTab.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\IHProtect Service, In Quarantäne, [97e28eb50b7f85b175dc9975b250ca36], 
PUP.Optional.WebSteroids.A, HKLM\SOFTWARE\CLASSES\CLSID\{051E9166-B275-4683-907B-372FAE22BC7C}, In Quarantäne, [19609ca758323df9eb4ad44d7b88a65a], 
PUP.Optional.WebSteroids.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{051E9166-B275-4683-907B-372FAE22BC7C}, In Quarantäne, [19609ca758323df9eb4ad44d7b88a65a], 
PUP.Optional.WebSteroids.A, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{051E9166-B275-4683-907B-372FAE22BC7C}, In Quarantäne, [19609ca758323df9eb4ad44d7b88a65a], 
PUP.Optional.DynConIE.A, HKLM\SOFTWARE\CLASSES\CLSID\{E5A7A645-8318-4895-B85C-EDC606B80DB6}, In Quarantäne, [1564350ecebcdb5bbb49e14035ce4cb4], 
PUP.Optional.DynConIE.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{E5A7A645-8318-4895-B85C-EDC606B80DB6}, In Quarantäne, [1564350ecebcdb5bbb49e14035ce4cb4], 
PUP.Optional.DynConIE.A, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{E5A7A645-8318-4895-B85C-EDC606B80DB6}, In Quarantäne, [1564350ecebcdb5bbb49e14035ce4cb4], 
PUP.Optional.Wajam.A, HKLM\SOFTWARE\WOW6432NODE\WajIntEnhance, In Quarantäne, [b7c2d3706525d75fd7ef0ca0ae5524dc], 
PUP.Optional.VideoHigh.A, HKU\S-1-5-18\SOFTWARE\APPDATALOW\SOFTWARE\video-high, In Quarantäne, [caaf1f24642669cde12afeec04ff6997], 
PUP.Optional.HomeTab.A, HKU\S-1-5-21-3299057831-706162602-1696328398-1001\SOFTWARE\HomeTab, In Quarantäne, [91e87bc8aae089adcd7381584cb70ef2], 
PUP.Optional.SearchProtect.A, HKU\S-1-5-21-3299057831-706162602-1696328398-1001\SOFTWARE\SearchProtectWS, In Quarantäne, [4930c87b5a3061d59cf121883ac99868], 
PUP.Optional.TNT.A, HKU\S-1-5-21-3299057831-706162602-1696328398-1001\SOFTWARE\TNT2, In Quarantäne, [dd9cfc47701ace688fdfd3d8976cdd23], 
PUP.Optional.Wajam.A, HKU\S-1-5-21-3299057831-706162602-1696328398-1001\SOFTWARE\WajIEnhance, In Quarantäne, [6910ac97b0dadd597139832fd132c53b], 
PUP.Optional.Wajam.A, HKU\S-1-5-21-3299057831-706162602-1696328398-1001\SOFTWARE\WajIntEnhance, In Quarantäne, [bfbadf64424872c42f98a507fd067789], 
PUP.Optional.MultiIE.A, HKU\S-1-5-21-3299057831-706162602-1696328398-1001\SOFTWARE\APPDATALOW\SOFTWARE\DynConIE, In Quarantäne, [e990d2717317a59190beca5e2dd8c040], 
PUP.Optional.ReMarkit.A, HKU\S-1-5-21-3299057831-706162602-1696328398-1001\SOFTWARE\APPDATALOW\SOFTWARE\Re_markit, In Quarantäne, [e99072d1f892f83ec7c3932dcd3645bb], 
PUP.Optional.Iminent.A, HKU\S-1-5-21-3299057831-706162602-1696328398-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IMBoosterARP, In Quarantäne, [6019380bd8b287af5a17772e61a22ed2], 
PUP.Optional.Iminent.A, HKU\S-1-5-21-3299057831-706162602-1696328398-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IminentToolbar, In Quarantäne, [7603ca798505e353284a2d78877c23dd], 
PUP.Optional.Linkey.A, HKU\S-1-5-21-3299057831-706162602-1696328398-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\Linkey, In Quarantäne, [6811b78c573377bff67d5a4ba55ed52b], 
PUP.Optional.Vosteran.A, HKU\S-1-5-21-3299057831-706162602-1696328398-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\Vosteran.com, In Quarantäne, [186144ff3f4b6cca284c2382c73cf010], 
PUP.Optional.Wajam.A, HKU\S-1-5-21-3299057831-706162602-1696328398-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WajIntEnhance, In Quarantäne, [cdac3310167449ed393cdbca17ecaf51], 
PUP.Optional.HomeTab.A, HKU\S-1-5-21-3299057831-706162602-1696328398-1001\SOFTWARE\SIMPLYTECH\HomeTab, In Quarantäne, [f0890f34038715210365f9f8de25af51], 
PUP.Optional.WPM.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\WindowsMangerProtect, In Quarantäne, [b9c081c2f09afd390f90e9977f84f40c], 

Registrierungswerte: 0
(Keine schädliche Elemente gefunden)

Registrierungsdaten: 16
PUP.Optional.IStartSurf.A, HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND, C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.istartsurf.com/?type=sc&ts=1435231037&z=47bf10f5f3d4e614ec0f04fgbz9c4wcoaccg8e5c6q&from=air&uid=SAMSUNGXMZMTD128HAFV-000_S15MNYAD635106, Gut: (iexplore.exe), Schlecht: (C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.istartsurf.com/?type=sc&ts=1435231037&z=47bf10f5f3d4e614ec0f04fgbz9c4wcoaccg8e5c6q&from=air&uid=SAMSUNGXMZMTD128HAFV-000_S15MNYAD635106),Ersetzt,[255492b1fa903105318b20b6e025ce32]
PUP.Optional.IStartSurf.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, hxxp://www.istartsurf.com/web/?type=ds&ts=1435231037&z=47bf10f5f3d4e614ec0f04fgbz9c4wcoaccg8e5c6q&from=air&uid=SAMSUNGXMZMTD128HAFV-000_S15MNYAD635106&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://www.istartsurf.com/web/?type=ds&ts=1435231037&z=47bf10f5f3d4e614ec0f04fgbz9c4wcoaccg8e5c6q&from=air&uid=SAMSUNGXMZMTD128HAFV-000_S15MNYAD635106&q={searchTerms}),Ersetzt,[3940073c95f52214d83e5b7a73924eb2]
PUP.Optional.IStartSurf.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, hxxp://www.istartsurf.com/?type=hppp&ts=1435231117&z=dd991957733fcfbc7a74096gfzfc8w4oec2gag2g9q&from=air&uid=SAMSUNGXMZMTD128HAFV-000_S15MNYAD635106, Gut: (www.google.com), Schlecht: (hxxp://www.istartsurf.com/?type=hppp&ts=1435231117&z=dd991957733fcfbc7a74096gfzfc8w4oec2gag2g9q&from=air&uid=SAMSUNGXMZMTD128HAFV-000_S15MNYAD635106),Ersetzt,[ceabe063dfab59dda3731cb9f70e659b]
PUP.Optional.IStartSurf.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, hxxp://www.istartsurf.com/web/?type=ds&ts=1435231037&z=47bf10f5f3d4e614ec0f04fgbz9c4wcoaccg8e5c6q&from=air&uid=SAMSUNGXMZMTD128HAFV-000_S15MNYAD635106&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://www.istartsurf.com/web/?type=ds&ts=1435231037&z=47bf10f5f3d4e614ec0f04fgbz9c4wcoaccg8e5c6q&from=air&uid=SAMSUNGXMZMTD128HAFV-000_S15MNYAD635106&q={searchTerms}),Ersetzt,[61185be87a1049edee287d58996c0ef2]
PUP.Optional.IStartSurf.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://www.istartsurf.com/?type=hppp&ts=1435231117&z=dd991957733fcfbc7a74096gfzfc8w4oec2gag2g9q&from=air&uid=SAMSUNGXMZMTD128HAFV-000_S15MNYAD635106, Gut: (www.google.com), Schlecht: (hxxp://www.istartsurf.com/?type=hppp&ts=1435231117&z=dd991957733fcfbc7a74096gfzfc8w4oec2gag2g9q&from=air&uid=SAMSUNGXMZMTD128HAFV-000_S15MNYAD635106),Ersetzt,[fc7db09359314cea04128d48bd48966a]
PUP.Optional.Qone8, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Gut: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Schlecht: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),Ersetzt,[ee8b83c00b7fcb6b8515f7ea61a4ab55]
PUP.Optional.IStartSurf.A, HKLM\SOFTWARE\WOW6432NODE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND, C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.istartsurf.com/?type=sc&ts=1435231037&z=47bf10f5f3d4e614ec0f04fgbz9c4wcoaccg8e5c6q&from=air&uid=SAMSUNGXMZMTD128HAFV-000_S15MNYAD635106, Gut: (iexplore.exe), Schlecht: (C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.istartsurf.com/?type=sc&ts=1435231037&z=47bf10f5f3d4e614ec0f04fgbz9c4wcoaccg8e5c6q&from=air&uid=SAMSUNGXMZMTD128HAFV-000_S15MNYAD635106),Ersetzt,[2257d46f2a6013230dafbf1738cd629e]
PUP.Optional.IStartSurf.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, hxxp://www.istartsurf.com/web/?type=ds&ts=1435231037&z=47bf10f5f3d4e614ec0f04fgbz9c4wcoaccg8e5c6q&from=air&uid=SAMSUNGXMZMTD128HAFV-000_S15MNYAD635106&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://www.istartsurf.com/web/?type=ds&ts=1435231037&z=47bf10f5f3d4e614ec0f04fgbz9c4wcoaccg8e5c6q&from=air&uid=SAMSUNGXMZMTD128HAFV-000_S15MNYAD635106&q={searchTerms}),Ersetzt,[ef8a71d23753eb4bbb5ba0354db8a060]
PUP.Optional.IStartSurf.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, hxxp://www.istartsurf.com/?type=hppp&ts=1435231117&z=dd991957733fcfbc7a74096gfzfc8w4oec2gag2g9q&from=air&uid=SAMSUNGXMZMTD128HAFV-000_S15MNYAD635106, Gut: (www.google.com), Schlecht: (hxxp://www.istartsurf.com/?type=hppp&ts=1435231117&z=dd991957733fcfbc7a74096gfzfc8w4oec2gag2g9q&from=air&uid=SAMSUNGXMZMTD128HAFV-000_S15MNYAD635106),Ersetzt,[d5a4ce7558325dd928ee6d68e421a15f]
PUP.Optional.IStartSurf.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://www.istartsurf.com/?type=hppp&ts=1435231117&z=dd991957733fcfbc7a74096gfzfc8w4oec2gag2g9q&from=air&uid=SAMSUNGXMZMTD128HAFV-000_S15MNYAD635106, Gut: (www.google.com), Schlecht: (hxxp://www.istartsurf.com/?type=hppp&ts=1435231117&z=dd991957733fcfbc7a74096gfzfc8w4oec2gag2g9q&from=air&uid=SAMSUNGXMZMTD128HAFV-000_S15MNYAD635106),Ersetzt,[b1c8142f662415218195eee7e71e7e82]
PUP.Optional.IStartSurf.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, hxxp://www.istartsurf.com/web/?type=ds&ts=1435231037&z=47bf10f5f3d4e614ec0f04fgbz9c4wcoaccg8e5c6q&from=air&uid=SAMSUNGXMZMTD128HAFV-000_S15MNYAD635106&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://www.istartsurf.com/web/?type=ds&ts=1435231037&z=47bf10f5f3d4e614ec0f04fgbz9c4wcoaccg8e5c6q&from=air&uid=SAMSUNGXMZMTD128HAFV-000_S15MNYAD635106&q={searchTerms}),Ersetzt,[1267f54e2e5cde582aec53828a7bc13f]
PUP.Optional.Qone8, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Gut: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Schlecht: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),Ersetzt,[413820234248ec4ab0eac120c34259a7]
PUP.Optional.IStartSurf.A, HKU\S-1-5-21-3299057831-706162602-1696328398-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, hxxp://www.istartsurf.com/web/?type=ds&ts=1435231037&z=47bf10f5f3d4e614ec0f04fgbz9c4wcoaccg8e5c6q&from=air&uid=SAMSUNGXMZMTD128HAFV-000_S15MNYAD635106&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://www.istartsurf.com/web/?type=ds&ts=1435231037&z=47bf10f5f3d4e614ec0f04fgbz9c4wcoaccg8e5c6q&from=air&uid=SAMSUNGXMZMTD128HAFV-000_S15MNYAD635106&q={searchTerms}),Ersetzt,[90e9af943d4df14524f07d589e67857b]
PUP.Optional.IStartSurf.A, HKU\S-1-5-21-3299057831-706162602-1696328398-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://www.istartsurf.com/?type=hppp&ts=1435231117&z=dd991957733fcfbc7a74096gfzfc8w4oec2gag2g9q&from=air&uid=SAMSUNGXMZMTD128HAFV-000_S15MNYAD635106, Gut: (www.google.com), Schlecht: (hxxp://www.istartsurf.com/?type=hppp&ts=1435231117&z=dd991957733fcfbc7a74096gfzfc8w4oec2gag2g9q&from=air&uid=SAMSUNGXMZMTD128HAFV-000_S15MNYAD635106),Ersetzt,[36439ca77e0c64d227ed4590ec19ae52]
PUP.Optional.IStartSurf.A, HKU\S-1-5-21-3299057831-706162602-1696328398-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, hxxp://www.istartsurf.com/?type=hppp&ts=1435231117&z=dd991957733fcfbc7a74096gfzfc8w4oec2gag2g9q&from=air&uid=SAMSUNGXMZMTD128HAFV-000_S15MNYAD635106, Gut: (www.google.com), Schlecht: (hxxp://www.istartsurf.com/?type=hppp&ts=1435231117&z=dd991957733fcfbc7a74096gfzfc8w4oec2gag2g9q&from=air&uid=SAMSUNGXMZMTD128HAFV-000_S15MNYAD635106),Ersetzt,[e39689babbcf0036c0542baa8b7a6e92]
PUP.Optional.IStartSurf.A, HKU\S-1-5-21-3299057831-706162602-1696328398-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, hxxp://www.istartsurf.com/web/?type=ds&ts=1435231037&z=47bf10f5f3d4e614ec0f04fgbz9c4wcoaccg8e5c6q&from=air&uid=SAMSUNGXMZMTD128HAFV-000_S15MNYAD635106&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://www.istartsurf.com/web/?type=ds&ts=1435231037&z=47bf10f5f3d4e614ec0f04fgbz9c4wcoaccg8e5c6q&from=air&uid=SAMSUNGXMZMTD128HAFV-000_S15MNYAD635106&q={searchTerms}),Ersetzt,[a0d9b68dee9c072f64b074615da89f61]

Ordner: 2
PUP.Optional.WPM.A, C:\ProgramData\WindowsMangerProtect, Löschen bei Neustart, [b9c081c2f09afd390f90e9977f84f40c], 
PUP.Optional.FileTypeAssistant, C:\Program Files (x86)\File Type Assistant, In Quarantäne, [4831e65dec9e40f6e324dab2cc379769], 

Dateien: 8
PUP.Optional.XTab.A, C:\Program Files (x86)\MiuiTab\ProtectService.exe, Löschen bei Neustart, [97e28eb50b7f85b175dc9975b250ca36], 
PUP.Optional.SmartBar, C:\Users\Saskia\AppData\Local\LPT\LPTInstaller.msi, In Quarantäne, [582165de99f1be78a4ed99c49c64946c], 
PUP.Optional.SmartBar, c:\users\saskia\appdata\local\lpt\smartbar.monetization.proxy.proxyremover.exe, In Quarantäne, [4732f84bed9dc3734051baa311efc53b], 
PUP.Optional.VeriStaff, c:\users\saskia\appdata\local\lpt\srptm.exe, In Quarantäne, [f386142f028852e4702583daea16659b], 
PUP.Optional.SnapDo.A, C:\Windows\Installer\2b9f7288.msi, In Quarantäne, [0d6cc47fcbbf57df21ec7b34fc058e72], 
PUP.Optional.IStartSurf.A, C:\Users\Saskia\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.istartsurf.com_0.localstorage, In Quarantäne, [f88168db0e7c1e1870f43007ba4b6b95], 
PUP.Optional.IStartSurf.A, C:\Users\Saskia\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.istartsurf.com_0.localstorage-journal, In Quarantäne, [aecb241fddaddd59fc6863d40cf9ed13], 
PUP.Optional.WPM.A, C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe, Löschen bei Neustart, [b9c081c2f09afd390f90e9977f84f40c], 

Physische Sektoren: 0
(Keine schädliche Elemente gefunden)


(end)

Code:

ATTFilter

# AdwCleaner v4.207 - Bericht erstellt 25/06/2015 um 21:32:14
# Aktualisiert 21/06/2015 von Xplode
# Datenbank : 2015-06-23.1 [Server]
# Betriebssystem : Windows 8.1  (x64)
# Benutzername : Saskia - SASSLPOGI
# Gestarted von : C:\Users\Saskia\Downloads\AdwCleaner_4.207.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\apn
Ordner Gelöscht : C:\Program Files (x86)\miuitab
Ordner Gelöscht : C:\WINDOWS\SysWOW64\config\systemprofile\AppData\Local\FileTypeAssistant
Ordner Gelöscht : C:\Users\Saskia\AppData\Local\FileTypeAssistant
Datei Gelöscht : C:\Users\Saskia\AppData\Local\AnyProtectScannerSetup.exe

***** [ Geplante Tasks ] *****

Task Gelöscht : APSnotifierCA

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [ApnTbMon]
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{44CBC005-6243-4502-8A02-3A096A282664}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{80703783-E415-4EE3-AB60-D36981C5A6F1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{D8278076-BC68-4484-9233-6E7F1628B56C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F297534D-7B06-459D-BC19-2DD8EF69297B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{80703783-E415-4EE3-AB60-D36981C5A6F1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{9945959C-AAD8-4312-8B57-2DE11927E770}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{A2D733A7-73B0-4C6B-B0C7-06A432950B66}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{EEA63863-87BC-4DCA-A5B5-EB97E3B04806}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{51D26BB4-4D2C-4AE4-9873-5FF41B6DED1F}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{51D26BB4-4D2C-4AE4-9873-5FF41B6DED1F}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{51D26BB4-4D2C-4AE4-9873-5FF41B6DED1F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6978F29A-3493-40B2-8CDC-9C13A02F85A4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D7949A66-D936-4028-9552-14F7DC50F38D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}
Schlüssel Gelöscht : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6978F29A-3493-40B2-8CDC-9C13A02F85A4}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D7949A66-D936-4028-9552-14F7DC50F38D}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{4D82643C-6E97-475C-A34C-3E4945B61B6D}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}
Schlüssel Gelöscht : HKCU\Software\AnyProtect
Schlüssel Gelöscht : HKCU\Software\APN PIP
Schlüssel Gelöscht : HKCU\Software\Bitberry Software
Schlüssel Gelöscht : HKCU\Software\Bitberry
Schlüssel Gelöscht : HKCU\Software\simplytech
Schlüssel Gelöscht : HKLM\SOFTWARE\Taronja
Schlüssel Gelöscht : HKLM\SOFTWARE\SpeedBit
Schlüssel Gelöscht : HKLM\SOFTWARE\searchult
Schlüssel Gelöscht : HKU\.DEFAULT\Software\AskPartnerNetwork
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Linkey
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3152E1F19977892449DC968802CE8964
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\649A52D257CA5DB4EAAE8BA9EB23E467
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\5E8031606EB60A64C882918F8FF38DD4
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\7AB5857A57A0687786597A857BFFFFFF

***** [ Internetbrowser ] *****

-\\ Internet Explorer v11.0.9600.17416


-\\ Google Chrome v43.0.2357.130

[C:\Users\Saskia\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://www.istartsurf.com/web/?type=dspp&ts=1435231117&z=dd991957733fcfbc7a74096gfzfc8w4oec2gag2g9q&from=air&uid=SAMSUNGXMZMTD128HAFV-000_S15MNYAD635106&q={searchTerms}

*************************

AdwCleaner[R0].txt - [15292 Bytes] - [23/03/2014 21:59:16]
AdwCleaner[R1].txt - [6123 Bytes] - [25/06/2015 21:28:16]
AdwCleaner[S0].txt - [11096 Bytes] - [23/03/2014 22:03:23]
AdwCleaner[S1].txt - [5136 Bytes] - [25/06/2015 21:32:14]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [5195  Bytes] ##########

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 7.1.4 (06.25.2015:1)
OS: Windows 8.1 x64
Ran by Saskia on 25.06.2015 at 21:43:46,91
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Tasks



~~~ Registry Values

Successfully deleted: [Registry Value] HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{41564952-412D-5637-4300-7A786E7484D7}
Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search\\SearchAssistant



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{41564952-412D-5637-4300-7A786E7484D7}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{41564952-412D-5637-4300-7A786E7484D7}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{41564952-412D-5637-4300-7A786E7484D7}



~~~ Files

Successfully deleted: [File] C:\Users\Saskia\appdata\local\nsx9D02.tmp



~~~ Folders



~~~ Chrome


[C:\Users\Saskia\appdata\local\Google\Chrome\User Data\Default\Preferences] - default search provider reset

[C:\Users\Saskia\appdata\local\Google\Chrome\User Data\Default\Preferences] - Extensions Deleted:

[C:\Users\Saskia\appdata\local\Google\Chrome\User Data\Default\Secure Preferences] - default search provider reset

[C:\Users\Saskia\appdata\local\Google\Chrome\User Data\Default\Secure Preferences] - Extensions Deleted:
[
  mkfokfffehpeedafpekjeddnmnjhmcmk
]





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 25.06.2015 at 21:49:10,00
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:24-06-2015
Ran by Saskia (administrator) on SASSLPOGI on 25-06-2015 21:55:20
Running from C:\Users\Saskia\Desktop
Loaded Profiles: Saskia (Available Profiles: Saskia & Administrator)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Samsung Electronics CO., LTD.) C:\Program Files (x86)\Samsung\Settings\CmdServer\SettingsCmdServer.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20856_x64__8wekyb3d8bbwe\livecomm.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2894152 2013-11-04] (ELAN Microelectronics Corp.)
HKLM\...\Run: [Bitcasa] => C:\Program Files\Bitcasa\Bitcasa.exe [3965904 2013-06-06] ()
HKLM\...\Run: [Samsung Link] => C:\Program Files\Samsung\Samsung Link\Samsung Link Tray Agent.exe [597576 2013-07-05] (Copyright 2013 SAMSUNG)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [730416 2015-06-25] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-08-30] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe [130864 2015-05-21] (Avira Operations GmbH & Co. KG)
HKLM\...\Policies\Explorer\Run: [BtvStack] => C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [134784 2014-06-17] (Atheros Communications)
HKU\S-1-5-21-3299057831-706162602-1696328398-1001\...\Run: [Skype] => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
SSODL: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\windows\system32\CbFsMntNtf3.dll (EldoS Corporation)
SSODL-x32: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\windows\SysWow64\CbFsMntNtf3.dll (EldoS Corporation)
ShellIconOverlayIdentifiers: [1EldosIconOverlay] -> {81F51070-A426-4160-A9F9-AB9B7C99F900} => C:\windows\SYSTEM32\CbFsMntNtf3.dll [2013-02-11] (EldoS Corporation)
ShellIconOverlayIdentifiers: [BitcasaIconOverlay] -> {A6975448-A999-49BB-B3E4-7730CF6A82C0} => C:\Program Files\Bitcasa\ExplorerMenu.dll [2013-06-06] ()
ShellIconOverlayIdentifiers: [BitcasaProgressOverlay] -> {6FB8D52A-0064-45B2-B687-F596FEAD09C2} => C:\Program Files\Bitcasa\ExplorerMenu.dll [2013-06-06] ()
ShellIconOverlayIdentifiers: [EldosIconOverlay] -> {5BB532A2-BF14-4CCC-86B7-71B81EF6F8BC} => C:\windows\system32\CbFsMntNtf3.dll [2013-02-11] (EldoS Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrivePro1 (ErrorConflict)] -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-05-28] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrivePro2 (SyncInProgress)] -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-05-28] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrivePro3 (InSync)] -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-05-28] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [1EldosIconOverlay] -> {81F51070-A426-4160-A9F9-AB9B7C99F900} => C:\windows\SysWOW64\CbFsMntNtf3.dll [2013-02-11] (EldoS Corporation)
ShellIconOverlayIdentifiers-x32: [EldosIconOverlay] -> {5BB532A2-BF14-4CCC-86B7-71B81EF6F8BC} => C:\windows\SysWow64\CbFsMntNtf3.dll [2013-02-11] (EldoS Corporation)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKU\S-1-5-21-3299057831-706162602-1696328398-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.google.de/
hxxp://www.bwl.hm.edu/
hxxp://www.moodle.hm.edu/
hxxp://www.facebook.de/
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-05-19] (Microsoft Corporation)
BHO: Avira SearchFree Toolbar -> {41564952-412D-5637-4300-7A786E7484D7} -> "C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport_x64.dll" No File
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-05-01] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-05-28] (Microsoft Corporation)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll [2015-05-12] (Microsoft Corporation)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-05-01] (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-05-28] (Microsoft Corporation)
Toolbar: HKLM - Avira SearchFree Toolbar - {41564952-412D-5637-4300-7A786E7484D7} - "C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport_x64.dll" No File
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-02-03] (Microsoft Corporation)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-05-01] (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-05-01] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
StartMenuInternet: IEXPLORE.EXE - iexplore.exe

FireFox:
========
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2015-02-17] (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2015-01-12] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-16] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-16] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-05-01] (Adobe Systems Inc.)
FF Plugin-x32: samsung.com/SamsungLinkPCPlugin -> C:\Program Files\Samsung\Samsung Link\utils\npSamsungLinkPCPlugin.dll [2013-07-05] (Samsung)

Chrome: 
=======
CHR Profile: C:\Users\Saskia\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Saskia\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-03-20]
CHR Extension: (Google Drive) - C:\Users\Saskia\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-03-20]
CHR Extension: (YouTube) - C:\Users\Saskia\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-03-20]
CHR Extension: (Adblock Plus) - C:\Users\Saskia\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2014-03-23]
CHR Extension: (Google Search) - C:\Users\Saskia\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-03-20]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Saskia\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-13]
CHR Extension: (Google Wallet) - C:\Users\Saskia\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-03-20]
CHR Extension: (Gmail) - C:\Users\Saskia\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-03-20]
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2015-05-01]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S2 AllShare Framework DMS; C:\Program Files\Samsung\AllShare Framework DMS\1.3.14\AllShareFrameworkManagerDMS.exe [404360 2013-06-18] (Samsung) [File not signed]
S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [827184 2015-06-25] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [450808 2015-06-25] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [450808 2015-06-25] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1188360 2015-06-25] (Avira Operations GmbH & Co. KG)
S2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [322176 2014-06-17] (Windows (R) Win 7 DDK provider) [File not signed]
R2 Avira.ServiceHost; C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe [208632 2015-05-21] (Avira Operations GmbH & Co. KG)
S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-10-29] (Microsoft Corporation)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1394816 2015-05-01] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1772672 2015-05-01] (Microsoft Corporation)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2739888 2015-05-19] (Microsoft Corporation)
S2 ETDService; C:\Program Files\Elantech\ETDService.exe [100104 2013-09-05] (ELAN Microelectronics Corp.)
S2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2015-04-14] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
S2 Samsung Link Service; C:\Program Files\Samsung\Samsung Link\Samsung Link.exe [605768 2013-07-05] (Copyright 2013 SAMSUNG)
S2 Settings Launcher; C:\Program Files (x86)\Samsung\Settings\CmdServer\SettingsLauncher.exe [1593664 2014-02-14] (Samsung Electronics CO., LTD.)
S2 SWUpdateService; C:\ProgramData\Samsung\SW Update Service\SWMAgent.exe [3020120 2015-04-21] (Samsung Electronics CO., LTD.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-04] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-04] (Microsoft Corporation)
S2 ZAtheros Bt and Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [323584 2014-06-17] (Atheros) [File not signed]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S2 APXACC; C:\Windows\system32\DRIVERS\appexDrv.sys [219360 2013-04-18] (AppEx Networks Corporation)
R3 athr; C:\Windows\system32\DRIVERS\athwbx.sys [3859968 2013-08-15] (Qualcomm Atheros Communications, Inc.)
R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWB6.sys [222720 2014-03-12] (Advanced Micro Devices)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [153256 2015-06-25] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [132656 2015-06-25] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-12-09] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [43576 2015-03-14] (Avira Operations GmbH & Co. KG)
R3 BTATH_HID; C:\Windows\system32\DRIVERS\btath_hid.sys [223432 2014-06-17] (Qualcomm Atheros)
R3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [77464 2014-06-17] (Qualcomm Atheros)
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-03-18] (Microsoft Corporation)
R1 cbfs3; C:\windows\system32\drivers\cbfs3.sys [352448 2013-02-11] (EldoS Corporation)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [136408 2015-06-25] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2015-04-14] (Malwarebytes Corporation)
R3 RadioHIDMini; C:\Windows\System32\drivers\RadioHIDMini.sys [23408 2012-07-27] (Windows (R) Win 7 DDK provider)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-04] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-06-25 21:55 - 2015-06-25 21:55 - 00016853 _____ C:\Users\Saskia\Desktop\FRST.txt
2015-06-25 21:49 - 2015-06-25 21:49 - 00001902 _____ C:\Users\Saskia\Desktop\JRT.txt
2015-06-25 21:43 - 2015-06-25 21:43 - 00000207 _____ C:\WINDOWS\tweaking.com-regbackup-SASSLPOGI-Windows-8.1-(64-bit).dat
2015-06-25 21:43 - 2015-06-25 21:43 - 00000000 ____D C:\RegBackup
2015-06-25 21:38 - 2015-06-25 21:39 - 02952250 _____ (Malwarebytes Corporation) C:\Users\Saskia\Desktop\JRT.exe
2015-06-25 21:36 - 2015-06-25 21:36 - 00005311 _____ C:\Users\Saskia\Desktop\AdwCleaner.txt
2015-06-25 21:36 - 2015-06-25 21:36 - 00000000 ___RD C:\Users\Saskia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices
2015-06-25 21:26 - 2015-06-25 21:26 - 02244096 _____ C:\Users\Saskia\Downloads\AdwCleaner_4.207.exe
2015-06-25 21:13 - 2015-06-25 21:25 - 00014124 _____ C:\Users\Saskia\Desktop\mbam.txt
2015-06-25 20:50 - 2015-06-25 21:35 - 00136408 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-06-25 20:50 - 2015-06-25 20:50 - 00001114 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-06-25 20:50 - 2015-06-25 20:50 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-06-25 20:50 - 2015-06-25 20:50 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-06-25 20:50 - 2015-06-25 20:50 - 00000000 ____D C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-06-25 20:50 - 2015-04-14 09:38 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2015-06-25 20:50 - 2015-04-14 09:37 - 00107736 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2015-06-25 20:50 - 2015-04-14 09:37 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2015-06-25 20:47 - 2015-06-25 20:49 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\Saskia\Downloads\mbam-setup-2.1.6.1022.exe
2015-06-25 20:31 - 2015-06-25 20:31 - 00001280 _____ C:\Users\Saskia\Desktop\Revo Uninstaller.lnk
2015-06-25 20:31 - 2015-06-25 20:31 - 00000000 ____D C:\Program Files (x86)\VS Revo Group
2015-06-25 20:30 - 2015-06-25 20:30 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Saskia\Downloads\revosetup95.exe
2015-06-25 15:44 - 2015-06-25 21:35 - 00005144 _____ C:\WINDOWS\System32\Tasks\Microsoft Office 15 Sync Maintenance for SASSLPOGI-Saskia SasslPogi
2015-06-25 15:22 - 2015-06-25 21:55 - 00000000 ____D C:\FRST
2015-06-25 15:21 - 2015-06-25 15:21 - 02112512 _____ (Farbar) C:\Users\Saskia\Desktop\FRST64.exe
2015-06-25 14:15 - 2015-06-25 14:15 - 00000000 ___RD C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices
2015-06-25 14:05 - 2015-06-25 14:05 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Avira
2015-06-25 14:00 - 2015-06-25 14:05 - 00000000 ____D C:\Users\Administrator\AppData\Local\SAMSUNG
2015-06-25 14:00 - 2015-06-25 14:00 - 00001214 _____ C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\S Agent.lnk
2015-06-25 14:00 - 2015-06-25 14:00 - 00000000 ____D C:\Users\Administrator\Documents\Bluetooth Folder
2015-06-25 14:00 - 2015-06-25 14:00 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Atheros
2015-06-25 14:00 - 2015-06-25 14:00 - 00000000 ____D C:\Users\Administrator\AppData\Local\GWX
2015-06-25 14:00 - 2015-06-25 14:00 - 00000000 ____D C:\Users\Administrator\AppData\Local\BMExplorer
2015-06-25 14:00 - 2015-06-25 14:00 - 00000000 ____D C:\Users\Administrator\.swt
2015-06-25 13:59 - 2015-06-25 14:03 - 00002267 _____ C:\Users\Administrator\Desktop\Google Chrome.lnk
2015-06-25 13:59 - 2015-06-25 14:00 - 00000000 ____D C:\Users\Administrator\AppData\Local\Packages
2015-06-25 13:59 - 2015-06-25 14:00 - 00000000 ____D C:\Users\Administrator
2015-06-25 13:59 - 2015-06-25 13:59 - 00001450 _____ C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-06-25 13:59 - 2015-06-25 13:59 - 00000020 ___SH C:\Users\Administrator\ntuser.ini
2015-06-25 13:59 - 2015-06-25 13:59 - 00000000 _SHDL C:\Users\Administrator\Vorlagen
2015-06-25 13:59 - 2015-06-25 13:59 - 00000000 _SHDL C:\Users\Administrator\Startmenü
2015-06-25 13:59 - 2015-06-25 13:59 - 00000000 _SHDL C:\Users\Administrator\Netzwerkumgebung
2015-06-25 13:59 - 2015-06-25 13:59 - 00000000 _SHDL C:\Users\Administrator\Lokale Einstellungen
2015-06-25 13:59 - 2015-06-25 13:59 - 00000000 _SHDL C:\Users\Administrator\Eigene Dateien
2015-06-25 13:59 - 2015-06-25 13:59 - 00000000 _SHDL C:\Users\Administrator\Druckumgebung
2015-06-25 13:59 - 2015-06-25 13:59 - 00000000 _SHDL C:\Users\Administrator\Documents\Eigene Musik
2015-06-25 13:59 - 2015-06-25 13:59 - 00000000 _SHDL C:\Users\Administrator\Documents\Eigene Bilder
2015-06-25 13:59 - 2015-06-25 13:59 - 00000000 _SHDL C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2015-06-25 13:59 - 2015-06-25 13:59 - 00000000 _SHDL C:\Users\Administrator\AppData\Local\Verlauf
2015-06-25 13:59 - 2015-06-25 13:59 - 00000000 _SHDL C:\Users\Administrator\AppData\Local\Anwendungsdaten
2015-06-25 13:59 - 2015-06-25 13:59 - 00000000 _SHDL C:\Users\Administrator\Anwendungsdaten
2015-06-25 13:59 - 2015-06-25 13:59 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Adobe
2015-06-25 13:59 - 2015-06-25 13:59 - 00000000 ____D C:\Users\Administrator\AppData\Local\Google
2015-06-25 13:59 - 2015-03-16 18:25 - 00000000 ___RD C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2015-06-25 13:59 - 2015-01-12 03:16 - 00000000 ___RD C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2015-06-25 13:59 - 2015-01-12 03:16 - 00000000 ___RD C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2015-06-25 13:59 - 2014-08-26 05:58 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\ATI
2015-06-25 13:59 - 2014-08-26 05:58 - 00000000 ____D C:\Users\Administrator\AppData\Local\ATI
2015-06-25 13:59 - 2014-03-18 12:11 - 00000369 _____ C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pictures.lnk
2015-06-25 13:59 - 2014-03-18 12:11 - 00000369 _____ C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Documents.lnk
2015-06-25 13:59 - 2013-08-22 17:36 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2015-06-25 13:46 - 2015-06-25 13:46 - 00003152 _____ C:\WINDOWS\System32\Tasks\{DA517BC8-E302-4D62-9C78-C0C70CEBE134}
2015-06-25 13:23 - 2015-06-25 13:43 - 00000000 ____D C:\Users\Saskia\AppData\Roaming\Steganos
2015-06-25 13:23 - 2015-06-25 13:23 - 00000000 ____D C:\Users\Saskia\AppData\Roaming\Steganos VPN
2015-06-25 13:18 - 2015-06-25 13:18 - 00000000 _____ C:\WINDOWS\prleth.sys
2015-06-25 13:18 - 2015-06-25 13:18 - 00000000 _____ C:\WINDOWS\hgfs.sys
2015-06-25 12:43 - 2015-06-25 12:43 - 00003886 _____ C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task
2015-06-11 00:06 - 2015-06-11 00:06 - 00001136 _____ C:\Users\Public\Desktop\Avira.lnk
2015-06-04 15:01 - 2015-06-04 15:01 - 00000000 ____D C:\Users\Saskia\AppData\Local\GWX
2015-06-04 13:44 - 2015-06-04 13:44 - 00612955 _____ C:\Users\Saskia\Downloads\docx (1)
2015-06-04 13:43 - 2015-06-04 13:44 - 00612955 _____ C:\Users\Saskia\Downloads\docx
2015-06-04 11:11 - 2015-06-04 11:11 - 00059392 _____ C:\Users\Saskia\Desktop\Aufgabenblatt 3_Lösung.xls
2015-06-04 11:09 - 2015-06-04 12:15 - 00065024 _____ C:\Users\Saskia\Desktop\Aufgabenblatt 3.xls
2015-06-04 10:49 - 2015-06-04 10:49 - 00001910 _____ C:\Users\Public\Desktop\SW Update.lnk

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-06-25 21:55 - 2014-08-26 05:15 - 02053049 _____ C:\WINDOWS\WindowsUpdate.log
2015-06-25 21:40 - 2014-02-16 17:04 - 00003596 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3299057831-706162602-1696328398-1001
2015-06-25 21:38 - 2014-03-18 12:03 - 01776918 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2015-06-25 21:38 - 2014-03-18 11:25 - 00765582 _____ C:\WINDOWS\system32\perfh007.dat
2015-06-25 21:38 - 2014-03-18 11:25 - 00159366 _____ C:\WINDOWS\system32\perfc007.dat
2015-06-25 21:35 - 2014-08-26 05:53 - 00000000 ___DO C:\Users\Saskia\OneDrive
2015-06-25 21:35 - 2014-03-20 22:41 - 00001134 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2015-06-25 21:33 - 2014-10-15 22:05 - 00009146 _____ C:\WINDOWS\setupact.log
2015-06-25 21:33 - 2013-08-22 16:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2015-06-25 21:32 - 2014-10-15 23:40 - 00971468 _____ C:\WINDOWS\PFRO.log
2015-06-25 21:32 - 2014-03-23 21:59 - 00000000 ____D C:\AdwCleaner
2015-06-25 21:32 - 2013-08-22 15:25 - 00524288 ___SH C:\WINDOWS\system32\config\BBI
2015-06-25 21:14 - 2014-08-26 05:17 - 00000000 ____D C:\Users\Saskia
2015-06-25 21:04 - 2014-03-20 22:41 - 00001138 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2015-06-25 21:00 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\system32\sru
2015-06-25 19:08 - 2014-09-27 19:26 - 00003938 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{082AE942-C95F-4BA7-A7DA-04E01F80A059}
2015-06-25 17:48 - 2014-02-18 00:48 - 00000000 ____D C:\Users\Saskia\AppData\Local\CrashDumps
2015-06-25 16:59 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\AppReadiness
2015-06-25 15:27 - 2014-02-16 20:45 - 00000000 ____D C:\ProgramData\Avira
2015-06-25 14:17 - 2014-02-16 16:59 - 00000000 ____D C:\Users\Saskia\Documents\Bluetooth Folder
2015-06-25 14:15 - 2014-08-26 05:09 - 00065536 _____ C:\WINDOWS\system32\spu_storage.bin
2015-06-25 14:05 - 2013-07-05 06:28 - 00003594 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3299057831-706162602-1696328398-500
2015-06-25 14:02 - 2015-04-18 17:43 - 00000000 ___RD C:\Program Files (x86)\Skype
2015-06-25 14:02 - 2015-04-18 17:43 - 00000000 ____D C:\ProgramData\Skype
2015-06-25 14:00 - 2015-02-24 17:53 - 00000000 ____D C:\ProgramData\Atheros
2015-06-25 14:00 - 2014-02-16 16:56 - 00000000 ____D C:\WINDOWS\System32\Tasks\WPD
2015-06-25 13:48 - 2014-08-26 05:48 - 00001450 _____ C:\Users\Saskia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-06-25 13:22 - 2015-04-18 17:43 - 00000000 ____D C:\Users\Saskia\AppData\Roaming\Skype
2015-06-25 13:14 - 2014-02-16 16:54 - 00000000 ____D C:\Users\Saskia\AppData\Local\Packages
2015-06-25 13:10 - 2015-01-12 07:13 - 00000000 ____D C:\Program Files\Microsoft Office 15
2015-06-25 12:46 - 2014-02-16 20:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-06-25 12:44 - 2014-02-16 20:45 - 00153256 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avgntflt.sys
2015-06-25 12:44 - 2014-02-16 20:45 - 00132656 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avipbb.sys
2015-06-11 00:06 - 2014-08-18 15:16 - 00000000 ____D C:\ProgramData\Package Cache
2015-06-11 00:06 - 2014-02-16 20:45 - 00000000 ____D C:\Program Files (x86)\Avira
2015-06-04 10:50 - 2014-11-27 06:35 - 00002970 _____ C:\WINDOWS\System32\Tasks\SamsungLinkPC
2015-06-04 10:50 - 2013-07-05 00:54 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung
2015-06-04 10:50 - 2013-07-05 00:54 - 00000000 ____D C:\Program Files (x86)\Samsung

==================== Files in the root of some directories =======

2014-02-16 16:55 - 2014-02-18 00:31 - 0001516 _____ () C:\Users\Saskia\AppData\Roaming\AbsoluteReminder.xml
2014-03-21 00:10 - 2014-03-23 20:10 - 0000065 _____ () C:\Users\Saskia\AppData\Roaming\WB.CFG
2015-02-23 23:52 - 2015-02-23 23:52 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2013-07-05 04:08 - 2013-02-19 09:34 - 2064264 _____ (Samsung Electronics) C:\ProgramData\MakeMarkerFile.exe
2013-07-05 04:08 - 2013-01-12 16:51 - 0003004 _____ () C:\ProgramData\MakeMarkerFile.xml

Files to move or delete:
====================
C:\ProgramData\MakeMarkerFile.exe
C:\Users\EasySurvey\EasySurvey.exe


Some files in TEMP:
====================
C:\Users\Administrator\AppData\Local\Temp\avgnt.exe
C:\Users\Saskia\AppData\Local\Temp\avgnt.exe
C:\Users\Saskia\AppData\Local\Temp\Quarantine.exe
C:\Users\Saskia\AppData\Local\Temp\SkypeUpdateSetup.exe
C:\Users\Saskia\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-06-25 16:19

==================== End of log ============================

--- --- ---

[CODE]Additional
FRST Logfile:

Code:

ATTFilter

scan result of Farbar Recovery Scan Tool (x64) Version:24-06-2015
Ran by Saskia at 2015-06-25 21:56:32
Running from C:\Users\Saskia\Desktop
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-3299057831-706162602-1696328398-500 - Administrator - Disabled) => C:\Users\Administrator
Gast (S-1-5-21-3299057831-706162602-1696328398-501 - Limited - Disabled)
Saskia (S-1-5-21-3299057831-706162602-1696328398-1001 - Administrator - Enabled) => C:\Users\Saskia

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Antivirus (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avira Antivirus (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Action Replay PowerSaves 3DS Version 1.21 (HKLM-x32\...\{CD24B06F-0A4D-410A-AEF2-DFE6A28AB4C0}_is1) (Version: 1.21 - Datel Design & Development)
Adobe Reader XI (11.0.11)  MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AB0000000001}) (Version: 11.0.11 - Adobe Systems Incorporated)
AllShare Framework DMS (HKLM\...\{C5850BE4-67AA-4CFB-894B-27F1172E42E0}) (Version: 1.3.14 - Samsung)
AMD Catalyst Install Manager (HKLM\...\{8D819115-F915-F5B3-3D4F-032A8DF32F5C}) (Version: 8.0.915.0 - Advanced Micro Devices, Inc.)
AMD Quick Stream (HKLM\...\{E9EED4AE-682B-4501-9574-D09A21717599}_is1) (Version: 3.4.4.2 - AppEx Networks)
Avira (HKLM-x32\...\{0696cc37-db90-4000-be99-4a173ca7c8af}) (Version: 1.1.39.17987 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.39.17987 - Avira Operations GmbH & Co. KG) Hidden
Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.11.574 - Avira Operations GmbH & Co. KG)
Bitcasa version 1.0.1.5011 (HKLM\...\{EDA09459-AD7D-4434-BA0C-647F6703EA12}_is1) (Version: 1.0.1.5011 - Bitcasa Inc.)
ETDWare X64 11.7.19.9_WHQL (HKLM\...\Elantech) (Version: 11.7.19.9 - ELAN Microelectronic Corp.)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 43.0.2357.130 - Google Inc.)
Google Update Helper (x32 Version: 1.3.27.5 - Google Inc.) Hidden
Help Desk (HKLM\...\{AEC9D273-E162-4614-83F1-722B8C74B185}) (Version: 1.0.96 - Samsung Electronics CO., LTD.)
Malwarebytes Anti-Malware Version 2.1.6.1022 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)
Microsoft Office 365 ProPlus - de-de (HKLM\...\O365ProPlusRetail - de-de) (Version: 15.0.4727.1003 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation)
Microsoft SkyDrive (HKU\S-1-5-21-3299057831-706162602-1696328398-1001\...\SkyDriveSetup.exe) (Version: 17.0.2015.0811 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4727.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4727.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4727.1003 - Microsoft Corporation) Hidden
Phone Screen Sharing (HKLM-x32\...\{DF02C515-40B5-45AC-A601-5DC69D03885C}) (Version: 2.0.0.21 - RSUPPORT)
Qualcomm Atheros Bluetooth Suite (64) (HKLM\...\{A84A4FB1-D703-48DB-89E0-68B6499D2801}) (Version: 8.0.1.326 - Qualcomm Atheros Communications)
Qualcomm Atheros Client Installation Program (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 10.0 - Qualcomm Atheros)
Quick Starter (HKLM\...\{EC36E2BC-86F7-44C9-84B2-93930F0FBDBF}) (Version: 1.0.2 - Samsung Electronics CO., LTD.)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9200.39048 - Realtek Semiconductor Corp.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7045 - Realtek Semiconductor Corp.)
Realtek USB Card Reader (HKLM-x32\...\{1E496A68-4943-424E-829D-5C3C85B7B8F2}) (Version: 1.00.0000 - Realtek Semiconductor Corp.)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
S Agent (Version: 1.1.52 - Samsung Electronics CO., LTD.) Hidden
Samsung Link (HKLM-x32\...\{82EC241F-DFCA-4166-A8C3-EA5D2B9A41C4}) (Version: 1.8.0.44 - Samsung Electronics CO., LTD.)
Samsung Link 1.6.0.1307060147 (HKLM\...\8474-7877-9059-0204) (Version: 1.6.0.1307060147 - Copyright 2013 SAMSUNG)
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.25.0 - SAMSUNG Electronics Co., Ltd.)
Settings (HKLM-x32\...\{3BB58176-B3A7-47FD-9F18-C3576431D193}) (Version: 2.2.0 - Samsung Electronics CO., LTD.)
SideSync (HKLM-x32\...\{59687468-8CE9-4ABF-9C6A-5C31F0E09F8B}) (Version: 2.0.0 - Samsung Electronics CO., LTD.)
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.4.0.9058 - Microsoft Corporation)
Support Center (HKLM\...\{711DE117-767F-48A8-9864-66C525B9539F}) (Version: 2.1.1223 - Samsung Electronics CO., LTD.)
Support Center FAQ (x32 Version: 1.0.17 - Samsung Electronics CO., LTD.) Hidden
SW Update (HKLM-x32\...\{AAFEFB05-CF98-48FC-985E-F04CD8AD620D}) (Version: 2.2.9 - Samsung Electronics CO., LTD.)
Teachmaster 4.3 (nur Entfernen) (HKLM-x32\...\Teachmaster 4.3) (Version:  - )
Windows-Treiberpaket - Samsung Electronics Co. Ltd. (RadioHIDMini) HIDClass  (08/23/2013 6.2.8400.4218) (HKLM\...\26BFE384C802803107F583AE1A739E4FEB56134B) (Version: 08/23/2013 6.2.8400.4218 - Samsung Electronics Co. Ltd.)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-3299057831-706162602-1696328398-1001_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Saskia\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3299057831-706162602-1696328398-1001_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Saskia\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3299057831-706162602-1696328398-1001_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32 -> C:\Users\Saskia\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3299057831-706162602-1696328398-1001_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Saskia\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3299057831-706162602-1696328398-1001_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Saskia\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\amd64\FileSyncApi64.dll (Microsoft Corporation)

==================== Restore Points =========================

04-06-2015 10:48:46 Installed SW Update
13-06-2015 21:07:55 Geplanter Prüfpunkt
25-06-2015 14:01:55 Removed Skype™ 7.5

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {08AC5898-9465-4390-A2DC-883C979FC96D} - System32\Tasks\GenericSettingsHandler\Windows-Credentials\RetrySyncTask_for_S-1-5-21-3299057831-706162602-1696328398-1001
Task: {23FEACAE-4B4F-4DFF-846E-E82B5E1506BC} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-10s => C:\Windows\system32\GWX\GWX.exe [2015-05-06] (Microsoft Corporation)
Task: {29BA5F80-880C-46A5-9741-07A7A1459078} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\Logon-10s => C:\Windows\system32\GWX\GWX.exe [2015-05-06] (Microsoft Corporation)
Task: {2DABA4A0-C8F1-4CCD-8158-E2FD400FB987} - System32\Tasks\SamsungLinkPC => C:\Program Files (x86)\Samsung\HomeSync Lite\RefreshToken.exe
Task: {30B9AB09-F397-46D9-A7FA-5B351C771A5C} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-10s => C:\Windows\system32\GWX\GWX.exe [2015-05-06] (Microsoft Corporation)
Task: {3E0860B8-0CED-44B1-A35D-8818AA260AF3} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-05-15] (Microsoft Corporation)
Task: {45AD4C3F-28B1-432B-9F1F-7CE1335B8DE1} - \video-high-enabler No Task File <==== ATTENTION
Task: {53085854-AA2A-47C0-B737-1A826ED4E9CC} - System32\Tasks\RTKCPL => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2013-09-24] (Realtek Semiconductor)
Task: {5AAF3239-F4CD-4FCE-86F4-837937F7C960} - \video-high-updater No Task File <==== ATTENTION
Task: {661F16D4-F2E8-4CFC-96C8-7D1887C7CF5D} - System32\Tasks\LaunchSettings => C:\Program Files (x86)\Samsung\Settings\Settings.exe [2014-02-14] ()
Task: {677CCFE1-9F00-4995-9EA0-DD79079842E6} - System32\Tasks\SAgent => C:\Program Files\Samsung\S Agent\CommonAgent.exe [2015-02-04] (Samsung Electronics CO., LTD.)
Task: {67F3908F-2A6A-4C83-B582-8CC4734458A9} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-10s => C:\Windows\system32\GWX\GWX.exe [2015-05-06] (Microsoft Corporation)
Task: {6B94B2EE-4693-4E60-A06F-D01639F6B39A} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B => schtasks
Task: {705563F9-702F-4E69-8822-4AF908BDBCE8} - System32\Tasks\SettingsHibernateMonitor => C:\Program Files (x86)\Samsung\Settings\SettingsHibernateMonitor.exe [2014-02-14] (Samsung Electronics CO., LTD.)
Task: {75216A85-0989-4FE4-858D-ECF90F3BF9BD} - System32\Tasks\RtHDVBg => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2013-09-16] (Realtek Semiconductor)
Task: {76249A4C-3142-495C-B62D-599031E34852} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-03-20] (Google Inc.)
Task: {7800A56F-63FA-48AF-AEA8-58291DDCDB80} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2015-05-28] (Microsoft Corporation)
Task: {7E819FE9-A14C-4C63-9DCF-699427B5C8B5} - \video-high-codedownloader No Task File <==== ATTENTION
Task: {8C2A980E-6B6B-4DDA-B584-180A73DD96F4} - System32\Tasks\{DA517BC8-E302-4D62-9C78-C0C70CEBE134} => pcalua.exe -a C:\Users\Saskia\AppData\Roaming\istartsurf\UninstallManager.exe -c  -ptid=air
Task: {8E186891-3DD7-41F6-9532-367B71293998} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office 15\root\Office15\msoia.exe [2015-05-12] (Microsoft Corporation)
Task: {97F5CA00-FFEC-4BC7-A37B-553EBC501C3E} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-03-20] (Google Inc.)
Task: {A639A484-7040-466E-AED4-E276CB95D5AA} - \video-high-firefoxinstaller No Task File <==== ATTENTION
Task: {B292E20E-5CE5-47DB-AD71-011A6BD8FCA6} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-06-12] (Adobe Systems Incorporated)
Task: {C0942911-A3AF-4B6A-9815-3D01B2B2E6A8} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-05-19] (Microsoft Corporation)
Task: {D0DB6C78-BE1D-4EBA-B719-3BA567F2F989} - \video-high-chromeinstaller No Task File <==== ATTENTION
Task: {DED6EFB3-CE73-4F0A-99F7-8D4E461DCE59} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-05-19] (Microsoft Corporation)
Task: {E232F266-EF7C-4D7C-9FD6-FF5FD288E1F5} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office 15\root\Office15\msoia.exe [2015-05-12] (Microsoft Corporation)
Task: {EE9D218F-2F42-4E03-8E77-027CE58EAB34} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\Time-10s => C:\Windows\system32\GWX\GWX.exe [2015-05-06] (Microsoft Corporation)
Task: {FB396963-5DF4-4BC0-A867-B0AC8D7E905F} - System32\Tasks\SettingsEventHandlerMonitor => C:\Program Files (x86)\Samsung\Settings\CmdServer\RSSettingEventHandler.exe [2014-02-14] (Samsung Electronics CO., LTD.)
Task: {FD55300F-3A98-4E0D-96C4-0C059B1D98A7} - System32\Tasks\Microsoft Office 15 Sync Maintenance for SASSLPOGI-Saskia SasslPogi => C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [2015-05-28] (Microsoft Corporation)
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (Whitelisted) ==============

2013-07-05 03:49 - 2013-06-06 06:15 - 00288720 _____ () C:\Program Files\Bitcasa\ExplorerMenu.dll
2013-07-05 03:49 - 2013-06-06 06:23 - 01645056 _____ () C:\Program Files\Bitcasa\bitcasaui.dll
2015-01-12 07:13 - 2014-05-20 09:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2015-05-09 22:49 - 2015-05-09 22:49 - 00183296 _____ () C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20856_x64__8wekyb3d8bbwe\ErrorReporting.dll
2015-06-25 13:06 - 2015-06-20 07:46 - 01281864 _____ () C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.130\libglesv2.dll
2015-06-25 13:06 - 2015-06-20 07:46 - 00080712 _____ () C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.130\libegl.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\Users\Saskia\OneDrive:ms-properties

==================== Safe Mode (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE trusted site: HKU\S-1-5-21-3299057831-706162602-1696328398-1001\...\sharepoint.com -> hxxps://hmedu.sharepoint.com


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3299057831-706162602-1696328398-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Saskia\AppData\Local\Microsoft\Windows\Themes\RoamedThemeFiles\DesktopBackground\spring shoes.jpg
DNS Servers: 192.168.178.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{6393F501-9947-4F7B-B42A-5D068F99C072}] => (Allow) C:\Users\Saskia\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
FirewallRules: [{EE0DAC83-559C-4807-AFE5-62EB539678C2}] => (Allow) C:\Program Files\Samsung\Samsung Link\Samsung Link Tray Agent.exe
FirewallRules: [{C2051B3E-56B0-4154-99E9-9C40EF5373D0}] => (Allow) C:\Program Files\Samsung\Samsung Link\Samsung Link Tray Agent.exe
FirewallRules: [{AA762439-11B4-43BE-AB8C-B42B5B86962C}] => (Allow) C:\Program Files\Samsung\Samsung Link\Samsung Link.exe
FirewallRules: [{FFCDA525-7122-4C83-9ED4-FF37F0177BBC}] => (Allow) C:\Program Files\Samsung\Samsung Link\Samsung Link.exe
FirewallRules: [{9C66F574-37C8-4D02-AEF4-D90D229BC475}] => (Allow) LPort=1900
FirewallRules: [{A12A7005-52FD-4AB0-86AA-1D0A2AC7D5FF}] => (Allow) LPort=7900
FirewallRules: [{BBED4E5D-0CB6-492F-8DEB-909FF2D32D41}] => (Allow) LPort=24234
FirewallRules: [{2737478A-81E4-4A42-9E1F-5A92B36BD392}] => (Allow) LPort=7679
FirewallRules: [{7E646746-2DD9-4BC2-9C73-02EA9BEDE741}] => (Allow) LPort=7676
FirewallRules: [{864DC9AA-709F-4A13-A38D-F9FA31531914}] => (Allow) LPort=8643
FirewallRules: [{45852E01-27FE-41C2-9B7E-EBA686E65012}] => (Allow) LPort=8743
FirewallRules: [{EEB1D163-6687-4C3D-A537-8F41A18A47CF}] => (Allow) C:\Program Files\Samsung\AllShare Framework DMS\1.3.14\AllShareFrameworkDMS.exe
FirewallRules: [{5C63FCF9-0629-4480-BE93-C911055D62AE}] => (Allow) C:\Program Files\Samsung\AllShare Framework DMS\1.3.14\AllShareFrameworkDMS.exe
FirewallRules: [{A4D45E9B-A7DC-4920-B055-EA6C1DE185E5}] => (Allow) C:\Program Files\Samsung\AllShare Framework DMS\1.3.14\AllShareFrameworkDMS.exe
FirewallRules: [{D91C0179-D70D-4121-BA3B-045FADD0B342}] => (Allow) C:\Program Files\Samsung\AllShare Framework DMS\1.3.14\AllShareFrameworkDMS.exe
FirewallRules: [{0130E8B4-4232-47D7-8A2F-38BB01227C1E}] => (Allow) C:\Program Files\Samsung\Samsung Link\Samsung Link Tray Agent.exe
FirewallRules: [{87589BF5-1258-40D1-85CE-794AE052E713}] => (Allow) C:\Program Files\Samsung\Samsung Link\Samsung Link.exe
FirewallRules: [{506B5859-0764-4669-BE25-95946006389C}] => (Allow) C:\Program Files\Samsung\Samsung Link\Samsung Link Tray Agent.exe
FirewallRules: [{40EEBD33-D125-43C3-89A4-EA7BA722EC58}] => (Allow) C:\Program Files\Samsung\Samsung Link\Samsung Link.exe
FirewallRules: [{DB75861B-C55E-48BD-B2B2-F0996BF4BD22}] => (Allow) C:\Windows\SysWOW64\muzapp.exe
FirewallRules: [{D3D76BA6-BBF9-4B48-BAF6-FDA919E167DC}] => (Allow) C:\Windows\SysWOW64\muzapp.exe
FirewallRules: [{C810FB50-DCA7-4AF9-B09A-B3064ADB05B8}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\Lync.exe
FirewallRules: [{F7874245-319E-4329-8674-7272EBE258A4}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\UcMapi.exe
FirewallRules: [{8595852E-F354-42B7-BA03-6366BA2B8E8C}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\outlook.exe
FirewallRules: [{59AFDACB-4C7F-4C65-BD4D-1FCBB32B5579}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{26DA443F-422E-4D01-ACB1-9C5A6B2922BE}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\Lync.exe
FirewallRules: [{EDD70935-225F-46B3-8BCD-9ED86010ABC0}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\UcMapi.exe
FirewallRules: [{EBD703E0-8F57-458B-90CB-F4401B67662C}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (06/25/2015 09:51:17 PM) (Source: SideBySide) (EventID: 35) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"1". Fehler in Manifest- oder Richtliniendatei "UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"2" in Zeile  UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"3.
Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.
Verweis: UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0".
Definition: UccApi,processorArchitecture="x86",type="win32",version="15.0.0.0".
Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.

Error: (06/25/2015 06:17:59 PM) (Source: SideBySide) (EventID: 35) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"1". Fehler in Manifest- oder Richtliniendatei "UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"2" in Zeile  UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"3.
Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.
Verweis: UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0".
Definition: UccApi,processorArchitecture="x86",type="win32",version="15.0.0.0".
Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.

Error: (06/25/2015 06:12:50 PM) (Source: SideBySide) (EventID: 35) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"1". Fehler in Manifest- oder Richtliniendatei "UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"2" in Zeile  UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"3.
Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.
Verweis: UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0".
Definition: UccApi,processorArchitecture="x86",type="win32",version="15.0.0.0".
Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.

Error: (06/25/2015 05:59:49 PM) (Source: SideBySide) (EventID: 35) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"1". Fehler in Manifest- oder Richtliniendatei "UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"2" in Zeile  UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"3.
Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.
Verweis: UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0".
Definition: UccApi,processorArchitecture="x86",type="win32",version="15.0.0.0".
Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.

Error: (06/25/2015 05:59:49 PM) (Source: SideBySide) (EventID: 35) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"1". Fehler in Manifest- oder Richtliniendatei "UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"2" in Zeile  UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"3.
Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.
Verweis: UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0".
Definition: UccApi,processorArchitecture="x86",type="win32",version="15.0.0.0".
Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.

Error: (06/25/2015 05:58:27 PM) (Source: SideBySide) (EventID: 35) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"1". Fehler in Manifest- oder Richtliniendatei "UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"2" in Zeile  UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"3.
Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.
Verweis: UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0".
Definition: UccApi,processorArchitecture="x86",type="win32",version="15.0.0.0".
Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.

Error: (06/25/2015 05:48:07 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: chrome.exe, Version: 43.0.2357.130, Zeitstempel: 0x5584cfea
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.3.9600.17736, Zeitstempel: 0x550f42c2
Ausnahmecode: 0xc0000142
Fehleroffset: 0x0009d4f2
ID des fehlerhaften Prozesses: 0x20cc
Startzeit der fehlerhaften Anwendung: 0xchrome.exe0
Pfad der fehlerhaften Anwendung: chrome.exe1
Pfad des fehlerhaften Moduls: chrome.exe2
Berichtskennung: chrome.exe3
Vollständiger Name des fehlerhaften Pakets: chrome.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: chrome.exe5

Error: (06/25/2015 05:45:01 PM) (Source: SideBySide) (EventID: 35) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"1". Fehler in Manifest- oder Richtliniendatei "UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"2" in Zeile  UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"3.
Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.
Verweis: UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0".
Definition: UccApi,processorArchitecture="x86",type="win32",version="15.0.0.0".
Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.

Error: (06/25/2015 05:41:41 PM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )
Description: Das Volume "\\?\Volume{92d29096-332f-4ac5-b1f4-63d04c56a1f3}\" wurde aufgrund eines Fehlers nicht optimiert: Falscher Parameter. (0x80070057)

Error: (06/25/2015 05:41:40 PM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )
Description: Das Volume "Windows RE tools" wurde aufgrund eines Fehlers nicht optimiert: Falscher Parameter. (0x80070057)


System errors:
=============
Error: (06/25/2015 09:44:59 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "AllShare Framework DMS" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (06/25/2015 09:44:53 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Avira Service Host" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 10000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (06/25/2015 09:44:53 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "ZAtheros Bt and Wlan Coex Agent" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (06/25/2015 09:44:53 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "SW Update Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (06/25/2015 09:44:53 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Settings Launcher" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (06/25/2015 09:44:53 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Samsung Link Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (06/25/2015 09:44:52 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "MBAMService" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (06/25/2015 09:44:52 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "MBAMScheduler" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (06/25/2015 09:44:51 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Elan Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (06/25/2015 09:44:50 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Microsoft Office-Klick-und-Los-Dienst" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 0 Millisekunden durchgeführt: Neustart des Diensts.


Microsoft Office:
=========================
Error: (06/25/2015 09:51:17 PM) (Source: SideBySide) (EventID: 35) (User: )
Description: UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"UccApi,processorArchitecture="x86",type="win32",version="15.0.0.0"C:\Program Files\Microsoft Office 15\root\office15\lync.exe.ManifestC:\Program Files\Microsoft Office 15\root\office15\UccApi.DLL1

Error: (06/25/2015 06:17:59 PM) (Source: SideBySide) (EventID: 35) (User: )
Description: UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"UccApi,processorArchitecture="x86",type="win32",version="15.0.0.0"C:\Program Files\Microsoft Office 15\root\office15\lync.exe.ManifestC:\Program Files\Microsoft Office 15\root\office15\UccApi.DLL1

Error: (06/25/2015 06:12:50 PM) (Source: SideBySide) (EventID: 35) (User: )
Description: UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"UccApi,processorArchitecture="x86",type="win32",version="15.0.0.0"C:\Program Files\Microsoft Office 15\root\office15\lync.exe.ManifestC:\Program Files\Microsoft Office 15\root\office15\UccApi.DLL1

Error: (06/25/2015 05:59:49 PM) (Source: SideBySide) (EventID: 35) (User: )
Description: UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"UccApi,processorArchitecture="x86",type="win32",version="15.0.0.0"C:\Program Files\Microsoft Office 15\root\office15\lync.exe.ManifestC:\Program Files\Microsoft Office 15\root\office15\UccApi.DLL1

Error: (06/25/2015 05:59:49 PM) (Source: SideBySide) (EventID: 35) (User: )
Description: UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"UccApi,processorArchitecture="x86",type="win32",version="15.0.0.0"C:\Program Files\Microsoft Office 15\root\office15\lync.exe.ManifestC:\Program Files\Microsoft Office 15\root\office15\UccApi.DLL1

Error: (06/25/2015 05:58:27 PM) (Source: SideBySide) (EventID: 35) (User: )
Description: UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"UccApi,processorArchitecture="x86",type="win32",version="15.0.0.0"C:\Program Files\Microsoft Office 15\root\office15\lync.exe.ManifestC:\Program Files\Microsoft Office 15\root\office15\UccApi.DLL1

Error: (06/25/2015 05:48:07 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: chrome.exe43.0.2357.1305584cfeantdll.dll6.3.9600.17736550f42c2c00001420009d4f220cc01d0af5e544f16a7C:\Program Files (x86)\Google\Chrome\Application\chrome.exeC:\WINDOWS\SYSTEM32\ntdll.dll925fc544-1b51-11e5-826b-48d2243efdd0

Error: (06/25/2015 05:45:01 PM) (Source: SideBySide) (EventID: 35) (User: )
Description: UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"UccApi,processorArchitecture="x86",type="win32",version="15.0.0.0"C:\Program Files\Microsoft Office 15\root\office15\lync.exe.ManifestC:\Program Files\Microsoft Office 15\root\office15\UccApi.DLL1

Error: (06/25/2015 05:41:41 PM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )
Description: \\?\Volume{92d29096-332f-4ac5-b1f4-63d04c56a1f3}\Falscher Parameter. (0x80070057)

Error: (06/25/2015 05:41:40 PM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )
Description: Windows RE toolsFalscher Parameter. (0x80070057)


==================== Memory info =========================== 

Processor: Quad-Core Processor (up to 1.4GHz) 
Percentage of memory in use: 39%
Total physical RAM: 3526.71 MB
Available physical RAM: 2143.95 MB
Total Pagefile: 5126.71 MB
Available Pagefile: 3421.36 MB
Total Virtual: 131072 MB
Available Virtual: 131071.84 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:98.59 GB) (Free:65.7 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 119.2 GB) (Disk ID: BEA15CA0)

Partition: GPT Partition Type.

==================== End of log ============================

--- --- ---

cosinus · 25.06.2015, 21:43

FRST-Fix

Virenscanner jetzt bitte komplett deaktivieren, damit sichergestellt ist, dass der Fix sauber durchläuft!

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
Task: {45AD4C3F-28B1-432B-9F1F-7CE1335B8DE1} - \video-high-enabler No Task File <==== ATTENTION
Task: {5AAF3239-F4CD-4FCE-86F4-837937F7C960} - \video-high-updater No Task File <==== ATTENTION
Task: {7E819FE9-A14C-4C63-9DCF-699427B5C8B5} - \video-high-codedownloader No Task File <==== ATTENTION
Task: {A639A484-7040-466E-AED4-E276CB95D5AA} - \video-high-firefoxinstaller No Task File <==== ATTENTION
Task: {D0DB6C78-BE1D-4EBA-B719-3BA567F2F989} - \video-high-chromeinstaller No Task File <==== ATTENTION
C:\ProgramData\MakeMarkerFile.exe
C:\Users\EasySurvey
EmptyTemp:

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

SasslP · 25.06.2015, 21:59

Code:

ATTFilter

Fix result of Farbar Recovery Scan Tool (x64) Version:24-06-2015
Ran by Saskia at 2015-06-25 22:51:23 Run:1
Running from C:\Users\Saskia\Desktop
Loaded Profiles: Saskia (Available Profiles: Saskia & Administrator)
Boot Mode: Normal
==============================================

fixlist content:
*****************
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
Task: {45AD4C3F-28B1-432B-9F1F-7CE1335B8DE1} - \video-high-enabler No Task File <==== ATTENTION
Task: {5AAF3239-F4CD-4FCE-86F4-837937F7C960} - \video-high-updater No Task File <==== ATTENTION
Task: {7E819FE9-A14C-4C63-9DCF-699427B5C8B5} - \video-high-codedownloader No Task File <==== ATTENTION
Task: {A639A484-7040-466E-AED4-E276CB95D5AA} - \video-high-firefoxinstaller No Task File <==== ATTENTION
Task: {D0DB6C78-BE1D-4EBA-B719-3BA567F2F989} - \video-high-chromeinstaller No Task File <==== ATTENTION
C:\ProgramData\MakeMarkerFile.exe
C:\Users\EasySurvey
EmptyTemp:
         
*****************

C:\WINDOWS\system32\GroupPolicy\Machine => moved successfully.
C:\WINDOWS\system32\GroupPolicy\GPT.ini => moved successfully.
C:\WINDOWS\SysWOW64\GroupPolicy\GPT.ini => moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{45AD4C3F-28B1-432B-9F1F-7CE1335B8DE1}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{45AD4C3F-28B1-432B-9F1F-7CE1335B8DE1}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\video-high-enabler" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{5AAF3239-F4CD-4FCE-86F4-837937F7C960}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{5AAF3239-F4CD-4FCE-86F4-837937F7C960}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\video-high-updater" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{7E819FE9-A14C-4C63-9DCF-699427B5C8B5}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7E819FE9-A14C-4C63-9DCF-699427B5C8B5}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\video-high-codedownloader" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{A639A484-7040-466E-AED4-E276CB95D5AA}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A639A484-7040-466E-AED4-E276CB95D5AA}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\video-high-firefoxinstaller" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{D0DB6C78-BE1D-4EBA-B719-3BA567F2F989}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D0DB6C78-BE1D-4EBA-B719-3BA567F2F989}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\video-high-chromeinstaller" => key removed successfully
C:\ProgramData\MakeMarkerFile.exe => moved successfully.
C:\Users\EasySurvey => moved successfully.
EmptyTemp: => 337.4 MB temporary data Removed.


The system needed a reboot.. 

==== End of Fixlog 22:51:54 ====

cosinus · 25.06.2015, 22:19

Okay, dann Kontrollscans mit ESET und SC bitte:

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

SasslP · 26.06.2015, 00:30

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=93b773ff2e055d4a822dbd99fa701a0d
# end=init
# utc_time=2015-06-25 09:49:03
# local_time=2015-06-25 11:49:03 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.2.9200 NT 
Update Init
Update Download
Update Finalize
Updated modules version: 24506
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=93b773ff2e055d4a822dbd99fa701a0d
# end=updated
# utc_time=2015-06-25 09:55:31
# local_time=2015-06-25 11:55:31 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.2.9200 NT 
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7777
# api_version=3.1.1
# EOSSerial=93b773ff2e055d4a822dbd99fa701a0d
# engine=24506
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-06-25 11:08:54
# local_time=2015-06-26 01:08:54 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.2.9200 NT 
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 8754207 26713510 0 0
# scanned=203352
# found=32
# cleaned=0
# scan_time=4402
sh=5103D93267466F22150C7D6F974B4ECE203D9E2F ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.E evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\video-high\51578.crx.vir"
sh=CDD312153F07E839ABBDAA336453DC61563B3149 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.F evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\video-high\51578.xpi.vir"
sh=8C0BD746945D8D44201F5A9F03FDD0D31E33B5DF ft=1 fh=5fee560e2ca4331a vn="Variante von Win32/Toolbar.CrossRider.BP evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\video-high\Uninstall.exe.vir"
sh=1DBD564D56B219913CECB64D9031F52F9F8CF9C9 ft=1 fh=982447ebc84e0e94 vn="Win32/Toolbar.CrossRider.AB evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\video-high\utils.exe.vir"
sh=9FF0C20DFF5C05DC0794FF45F97ED4D6852576AF ft=1 fh=c71c0011a0ffa023 vn="Win32/AnyProtect.F evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Saskia\AppData\Local\AnyProtectScannerSetup.exe.vir"
sh=3B861553E2E5AB5258BAE46D7A6FD4EAE9705B69 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.G evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Saskia\AppData\Local\Google\Chrome\User Data\Default\Extensions\lndipknmjijnalnkamonmljeaojdbpna\1.26.22_0\extensionData\plugins\19_CHAppAPIWrapper.js.vir"
sh=5902FC10054355A5B8B9CC41620445BAA0F1D0AB ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.F evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Saskia\AppData\Local\Google\Chrome\User Data\Default\Extensions\lndipknmjijnalnkamonmljeaojdbpna\1.26.22_0\extensionData\plugins\21_debug.js.vir"
sh=57F2136CD86B69E88017E3346CF16BE0C2A51A2B ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.F evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Saskia\AppData\Local\Google\Chrome\User Data\Default\Extensions\lndipknmjijnalnkamonmljeaojdbpna\1.26.22_0\extensionData\plugins\28_initializer.js.vir"
sh=DC790DFB6D4E0C15D927A3B20EFC147F44D4F5E7 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Saskia\AppData\Local\Google\Chrome\User Data\Default\Extensions\lndipknmjijnalnkamonmljeaojdbpna\1.26.22_0\extensionData\plugins\91_monetizationLoader.js.js.vir"
sh=34C11A75B2A93EDE2B3B945AA6A09250EF5C06F4 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.E evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Saskia\AppData\Local\Google\Chrome\User Data\Default\Extensions\lndipknmjijnalnkamonmljeaojdbpna\1.26.22_0\js\background.js.vir"
sh=832ADA6E9B2673CA1DE314A566FF76316F0A2997 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.G evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Saskia\AppData\Local\Google\Chrome\User Data\Default\Extensions\lndipknmjijnalnkamonmljeaojdbpna\1.26.22_0\js\api\chrome.js.vir"
sh=F4FE303A5886572113DF4DA3579956CEBB907F56 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.G evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Saskia\AppData\Local\Google\Chrome\User Data\Default\Extensions\lndipknmjijnalnkamonmljeaojdbpna\1.26.22_0\js\api\cookie.js.vir"
sh=FD2A3FEFF97D325433D2011C5ED5755B6D6A8FAA ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.G evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Saskia\AppData\Local\Google\Chrome\User Data\Default\Extensions\lndipknmjijnalnkamonmljeaojdbpna\1.26.22_0\js\api\message.js.vir"
sh=F12AB7ECE7B656776B6C51962B568E2ABCDE1D4D ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.G evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Saskia\AppData\Local\Google\Chrome\User Data\Default\Extensions\lndipknmjijnalnkamonmljeaojdbpna\1.26.22_0\js\api\monitor.js.vir"
sh=CA4563F63D05349DF3C504C456185B7559177496 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.G evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Saskia\AppData\Local\Google\Chrome\User Data\Default\Extensions\lndipknmjijnalnkamonmljeaojdbpna\1.26.22_0\js\lib\bg_app_api.js.vir"
sh=6B8D57805A81A0C2A68E87C410FF89D15BB71CC9 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.H evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Saskia\AppData\Local\Google\Chrome\User Data\Default\Extensions\lndipknmjijnalnkamonmljeaojdbpna\1.26.22_0\js\lib\cookie_store.js.vir"
sh=CCE2C38E8E351E54EF7624D60D5C8E8943A8C1D9 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.F evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Saskia\AppData\Local\Google\Chrome\User Data\Default\Extensions\lndipknmjijnalnkamonmljeaojdbpna\1.26.22_0\js\lib\crossriderAPI.js.vir"
sh=EDB82EF0A2AC160256F1A5C49F0778E3A42AC559 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.G evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Saskia\AppData\Local\Google\Chrome\User Data\Default\Extensions\lndipknmjijnalnkamonmljeaojdbpna\1.26.22_0\js\lib\events.js.vir"
sh=902E327ADBC89F0A47999D10E7F6F6554CFCC0F4 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.G evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Saskia\AppData\Local\Google\Chrome\User Data\Default\Extensions\lndipknmjijnalnkamonmljeaojdbpna\1.26.22_0\js\lib\onBGDocumentLoad.js.vir"
sh=09D5AE4A80F65C6B9123A1F494E3E181BF3C46FD ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.G evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Saskia\AppData\Local\Google\Chrome\User Data\Default\Extensions\lndipknmjijnalnkamonmljeaojdbpna\1.26.22_0\js\lib\reports.js.vir"
sh=BE038417E468CAA3BBA91CFFD2F554922504407C ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.G evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Saskia\AppData\Local\Google\Chrome\User Data\Default\Extensions\lndipknmjijnalnkamonmljeaojdbpna\1.26.22_0\js\lib\util.js.vir"
sh=D88F73897D0415B880A52D98AACBCBA8372956B2 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.G evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Saskia\AppData\Local\Google\Chrome\User Data\Default\Extensions\lndipknmjijnalnkamonmljeaojdbpna\1.26.22_0\js\lib\xhr.js.vir"
sh=A9371F4DE945B9264790BE2A7144DDDE6A32DA1F ft=1 fh=e74247cd22672007 vn="Win32/Toolbar.Linkury.D evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Saskia\AppData\Local\Smartbar\Application\amfclgbdpgndipgoegfpkkgobahigbcl\GoogleChromeRemotePlugin.dll.vir"
sh=793502EEE340FA280A2CB50B8C08D8B03FB7E610 ft=1 fh=ce07dfef74913d43 vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Saskia\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_22.dll.vir"
sh=BC0C36C0E7045ADD25170A1F31B672E6261C002E ft=1 fh=77d2b9b16374b9d6 vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Saskia\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_23.dll.vir"
sh=26A596DD2BF6D9D62EE6B33CCA09FAF05247719B ft=1 fh=8dbf6d95b61e0636 vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Saskia\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_24.dll.vir"
sh=89EFC978F9D85DACBA40C620176E0543D73DA98F ft=1 fh=d6a13e1e765f9307 vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Saskia\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_25.dll.vir"
sh=9A215B535704460ED7FD1DABE3B5E841AFCACB36 ft=1 fh=b41fb89cc5e354b1 vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Saskia\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_26.dll.vir"
sh=2BEE7B2CEBDCF9D99AD41DB8DC1C1CF7462F2D9B ft=1 fh=f48b38a96b116883 vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Saskia\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_27.dll.vir"
sh=476063885747EDD774A6B8CB2790703503A75A55 ft=1 fh=d7bb79193adaee2e vn="Win32/Systweak.G evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Saskia\AppData\Roaming\Systweak\ssd\SSDPTstub.exe.vir"
sh=BA39F8C9886EF4AABD72262B192DB8A177C7E206 ft=1 fh=078180abaf06d010 vn="Variante von Win64/Systweak.A evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\windows\System32\roboot64.exe.vir"
sh=2C64472CE377FB6C7E015F0844853BD896EAC2BA ft=1 fh=57a2d92182ab7f7c vn="Variante von Win32/FileTypeAssistant.A evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\Users\Saskia\Downloads\Install\FreeFileViewerSetup.exe"

Code:

ATTFilter

 Results of screen317's Security Check version 1.004  
   x64 (UAC is enabled)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:`````````````` 
Avira Antivirus    
Windows Defender   
 Antivirus up to date!  (On Access scanning disabled!) 
`````````Anti-malware/Other Utilities Check:````````` 
 Adobe Reader XI  
 Google Chrome (43.0.2357.124) 
 Google Chrome (43.0.2357.130) 
````````Process Check: objlist.exe by Laurent````````  
 Malwarebytes Anti-Malware mbamservice.exe  
 Malwarebytes Anti-Malware mbam.exe  
 Avira Antivir avgnt.exe 
 Avira Antivir avguard.exe 
 Malwarebytes Anti-Malware mbamscheduler.exe   
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  % 
````````````````````End of Log``````````````````````

cosinus · 26.06.2015, 08:35

FRST-Fix

Virenscanner jetzt bitte komplett deaktivieren, damit sichergestellt ist, dass der Fix sauber durchläuft!

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

C:\Users\Saskia\Downloads\Install\FreeFileViewerSetup.exe


EmptyTemp:

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

SasslP · 26.06.2015, 10:00

Sieht gut aus, oder?

Code:

ATTFilter

Fix result of Farbar Recovery Scan Tool (x64) Version:24-06-2015
Ran by Saskia at 2015-06-26 10:54:38 Run:3
Running from C:\Users\Saskia\Desktop
Loaded Profiles: Saskia (Available Profiles: Saskia & Administrator)
Boot Mode: Normal
==============================================

fixlist content:
*****************
C:\Users\Saskia\Downloads\Install\FreeFileViewerSetup.exe


EmptyTemp:
*****************

C:\Users\Saskia\Downloads\Install\FreeFileViewerSetup.exe => moved successfully.
EmptyTemp: => 9.8 MB temporary data Removed.


The system needed a reboot.. 

==== End of Fixlog 10:55:01 ====

25.06.2015, 18:49	#4
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Windows 8.1 (64-Bit): Zombie Invasion kann nicht deinstalliert werden Nein, steht doch da. Keine neuen Scans machen. Von Virenscannern nur vorhandene Logs posten, ansonsten siehe weietere Instruktionen. Außerdem fehlt das andere Log von FRST (addition.txt) __________________ Logfiles bitte immer in CODE-Tags posten

Windows 8.1 (64-Bit): Zombie Invasion kann nicht deinstalliert werden

Plagegeister aller Art und deren Bekämpfung: Windows 8.1 (64-Bit): Zombie Invasion kann nicht deinstalliert werden