Windows 8: Webseiten werden auf Werbung umgeleitet (Firefox)

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 11:24 on 23/07/2015 (Wiebke)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
         

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:20-07-2015
Ran by Wiebke (administrator) on WIEBKE-LAPTOP on 23-07-2015 11:27:42
Running from C:\Users\Wiebke\Desktop
Loaded Profiles: Wiebke (Available Profiles: Wiebke)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(IvoSoft) C:\Program Files\Classic Shell\ClassicStartMenu.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Intel Corporation) C:\Windows\System32\igfxTray.exe
() C:\Program Files (x86)\SPEC\spec.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Sentelic Corporation) C:\Program Files\FSP\FspUip.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\IPC\AdobeIPCBroker.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HEX\Adobe CEF Helper.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\Adobe Desktop Service.exe
() C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\ismagent.exe
() C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\updateui.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Windows\System32\WWAHost.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe\livecomm.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13657304 2014-01-30] (Realtek Semiconductor)
HKLM\...\Run: [fspuip] => C:\Program Files\FSP\fspuip.exe [6358864 2014-01-30] (Sentelic Corporation)
HKLM\...\Run: [spec] => C:\Program Files (x86)\SPEC\spec.exe [405504 2013-09-13] ()
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll",TrayApp
HKLM\...\Run: [Classic Start Menu] => C:\Program Files\Classic Shell\ClassicStartMenu.exe [161984 2014-04-20] (IvoSoft)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [500936 2015-03-30] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284480 2012-05-30] (Intel Corporation)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-05-07] (Oracle Corporation)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [6109776 2015-07-21] (AVAST Software)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-10-11] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2012-10-25] (Apple Inc.)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49976 2014-08-01] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Adobe Creative Cloud] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2584240 2015-04-20] (Adobe Systems Incorporated)
Winlogon\Notify\igfxcui: igfxdev.dll [X]
HKU\S-1-5-21-2994723587-2746384714-1883225562-1001\...\Run: [AdobeBridge] => [X]
ShellIconOverlayIdentifiers: [ AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2015-04-16] ()
ShellIconOverlayIdentifiers: [ AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2015-04-16] ()
ShellIconOverlayIdentifiers: [ AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2015-04-16] ()
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2015-07-21] (AVAST Software)
ShellIconOverlayIdentifiers: [ShareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer64.dll [2014-04-20] (IvoSoft)
ShellIconOverlayIdentifiers-x32: [ShareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer32.dll [2014-04-20] (IvoSoft)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/?pc=AV01
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKU\S-1-5-21-2994723587-2746384714-1883225562-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
HKU\S-1-5-21-2994723587-2746384714-1883225562-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/?pc=AV01
HKU\S-1-5-21-2994723587-2746384714-1883225562-1001\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.msn.com/?pc=AV01
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 -> DefaultScope {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = hxxp://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 -> {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = hxxp://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
SearchScopes: HKU\S-1-5-21-2994723587-2746384714-1883225562-1001 -> DefaultScope {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = hxxp://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
SearchScopes: HKU\S-1-5-21-2994723587-2746384714-1883225562-1001 -> {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = hxxp://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-06-09] (Microsoft Corporation)
BHO: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer64.dll [2014-04-20] (IvoSoft)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2015-07-21] (AVAST Software)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-05-01] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-06-16] (Microsoft Corporation)
BHO: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_64.dll [2014-04-20] (IvoSoft)
BHO: No Name -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} ->  No File
BHO-x32: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer32.dll [2014-04-20] (IvoSoft)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2014-07-09] (Oracle Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-07-21] (AVAST Software)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-05-01] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2014-07-09] (Oracle Corporation)
BHO-x32: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_32.dll [2014-04-20] (IvoSoft)
BHO-x32: No Name -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} ->  No File
Toolbar: HKLM - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll [2014-04-20] (IvoSoft)
Toolbar: HKLM-x32 - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll [2014-04-20] (IvoSoft)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-02-03] (Microsoft Corporation)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-05-01] (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-05-01] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 130.75.1.32 130.75.1.40
Tcpip\..\Interfaces\{1D01DB70-BB08-4435-AA50-6EC65F99563A}: [DhcpNameServer] 172.20.222.11 172.20.222.9
Tcpip\..\Interfaces\{FFE10019-E1F5-4F9E-A8AE-407ACAD77ED4}: [DhcpNameServer] 130.75.1.32 130.75.1.40
StartMenuInternet: IEXPLORE.EXE - iexplore.exe

FireFox:
========
FF ProfilePath: C:\Users\Wiebke\AppData\Roaming\Mozilla\Firefox\Profiles\lwx7fdlw.default
FF DefaultSearchUrl: https://www.google.com/search
FF SearchEngineOrder.1: Google
FF SelectedSearchEngine: Google
FF Homepage: about:home
FF Keyword.URL: https://www.google.com/search
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_18_0_0_209.dll [2015-07-14] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll [2015-04-20] (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_18_0_0_209.dll [2015-07-14] ()
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2013-07-03] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2013-07-03] (Foxit Corporation)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=3.0.72 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-03-12] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-03-12] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.60.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll [2014-07-09] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.60.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2014-07-09] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2014-07-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2013-02-05] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-15] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-15] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2013-12-09] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-06-29] (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll [2015-04-20] (Adobe Systems)
FF user.js: detected! => C:\Users\Wiebke\AppData\Roaming\Mozilla\Firefox\Profiles\lwx7fdlw.default\user.js [2012-06-12]
FF Extension: proxyselectormozillaorg - C:\Users\Wiebke\AppData\Roaming\Mozilla\Firefox\Profiles\lwx7fdlw.default\Extensions\proxyselector@mozilla.org [2015-07-20]
FF Extension: Adblock Plus Pop-up Addon - C:\Users\Wiebke\AppData\Roaming\Mozilla\Firefox\Profiles\lwx7fdlw.default\Extensions\adblockpopups@jessehakanen.net.xpi [2014-07-09]
FF Extension: Adblock Plus - C:\Users\Wiebke\AppData\Roaming\Mozilla\Firefox\Profiles\lwx7fdlw.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-07-09]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-07-09]
FF HKLM-x32\...\Firefox\Extensions: [defsearchp@gmail.com] - C:\Users\Wiebke\AppData\Roaming\Mozilla\Firefox\Profiles\lwx7fdlw.default\extensions\defsearchp@gmail.com
FF HKU\S-1-5-21-2994723587-2746384714-1883225562-1001\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff

Chrome: 
=======
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-07-21]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [146600 2015-07-21] (AVAST Software)
S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-10-29] (Microsoft Corporation)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1394816 2015-05-01] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1772672 2015-05-01] (Microsoft Corporation)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2753720 2015-07-01] (Microsoft Corporation)
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [314696 2014-05-21] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; c:\Program Files\Intel\iCLS Client\HeciServer.exe [731648 2013-02-13] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; c:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [820184 2013-02-13] (Intel(R) Corporation)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-03-12] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-03-12] (Intel Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2015-06-18] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [284912 2013-11-20] ()
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-04] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-04] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3674864 2013-11-20] (Intel® Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [28656 2015-07-21] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [90968 2015-07-21] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-07-21] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65224 2015-07-21] (AVAST Software)
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1048856 2015-07-21] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [447944 2015-07-21] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [150160 2015-07-21] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [274808 2015-07-21] (AVAST Software)
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-03-18] (Microsoft Corporation)
R3 btmaux; C:\Windows\system32\DRIVERS\btmaux.sys [140600 2013-07-22] (Motorola Solutions, Inc.)
R3 btmhsf; C:\Windows\system32\DRIVERS\btmhsf.sys [1408824 2013-10-18] (Motorola Solutions, Inc.)
R3 fspad_win764; C:\Windows\system32\DRIVERS\fspad_win764.sys [134992 2014-01-30] (Sentelic Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [113880 2015-07-23] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2015-06-18] (Malwarebytes Corporation)
R3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew00.sys [3346912 2013-10-31] (Intel Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-04] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-07-23 11:27 - 2015-07-23 11:27 - 00022554 _____ C:\Users\Wiebke\Desktop\FRST.txt
2015-07-23 11:27 - 2015-07-23 11:27 - 00000000 ____D C:\FRST
2015-07-23 11:26 - 2015-07-23 11:26 - 02135552 _____ (Farbar) C:\Users\Wiebke\Desktop\FRST64.exe
2015-07-23 11:24 - 2015-07-23 11:24 - 00000474 _____ C:\Users\Wiebke\Desktop\defogger_disable.log
2015-07-23 11:24 - 2015-07-23 11:24 - 00000000 _____ C:\Users\Wiebke\defogger_reenable
2015-07-23 11:23 - 2015-07-23 11:23 - 00050477 _____ C:\Users\Wiebke\Desktop\Defogger.exe
2015-07-23 11:18 - 2015-07-23 11:19 - 00000174 _____ C:\Users\Wiebke\Desktop\wiebkes kampf gegen den fiesen computer.txt
2015-07-23 11:00 - 2015-07-23 11:00 - 00001182 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-07-23 11:00 - 2015-07-23 11:00 - 00001170 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-07-23 11:00 - 2015-07-23 11:00 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-07-23 11:00 - 2015-07-23 11:00 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-07-23 10:43 - 2015-07-23 10:43 - 00040854 _____ C:\Users\Wiebke\Desktop\bookmarks-2015-07-23.zip
2015-07-23 10:39 - 2015-07-23 10:39 - 00162575 _____ C:\Users\Wiebke\Desktop\bookmarks-2015-07-23.json
2015-07-21 18:09 - 2015-07-21 18:09 - 00000350 ____H C:\Windows\Tasks\avast! Emergency Update.job
2015-07-21 17:48 - 2015-07-21 17:48 - 00001905 _____ C:\Users\Public\Desktop\Avast Free Antivirus.lnk
2015-07-21 17:48 - 2015-07-21 17:48 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2015-07-21 17:47 - 2015-07-21 17:47 - 00378880 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2015-07-21 17:47 - 2015-07-21 17:47 - 00043112 _____ (AVAST Software) C:\Windows\avastSS.scr
2015-07-21 17:30 - 2015-07-23 10:40 - 00113880 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-07-21 17:29 - 2015-07-21 17:29 - 00001125 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-07-21 17:29 - 2015-07-21 17:29 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-07-21 17:29 - 2015-07-21 17:29 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-07-21 17:29 - 2015-07-21 17:29 - 00000000 ____D C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-07-21 17:29 - 2015-06-18 08:42 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-07-21 17:29 - 2015-06-18 08:41 - 00109272 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-07-21 17:29 - 2015-06-18 08:41 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-07-21 10:31 - 2015-07-14 16:14 - 00358912 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-07-21 10:31 - 2015-07-14 16:14 - 00301056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2015-07-21 10:31 - 2015-07-14 16:14 - 00035840 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2015-07-21 10:31 - 2015-07-14 16:13 - 00044032 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-07-20 20:06 - 2015-07-20 20:06 - 00000000 ____D C:\Users\Wiebke\Tracing
2015-07-16 07:41 - 2015-07-16 07:41 - 00003204 _____ C:\Windows\System32\Tasks\avastBCLRestart_firefox.exe
2015-07-16 07:41 - 2015-07-16 07:41 - 00003200 _____ C:\Windows\System32\Tasks\avastBCLRestart_IEXPLORE.EXE
2015-07-16 00:24 - 2015-07-16 00:24 - 00000008 _____ C:\END
2015-07-16 00:24 - 2015-07-16 00:24 - 00000000 ____D C:\Program Files (x86)\predm
2015-07-16 00:02 - 2015-07-16 00:02 - 00003160 _____ C:\Windows\System32\Tasks\{F546073A-99F5-4AD9-8005-03BF89DD0958}
2015-07-15 23:58 - 2015-07-15 23:58 - 00003160 _____ C:\Windows\System32\Tasks\{7B1CC18C-B392-4AE8-838D-7E477E3882C8}
2015-07-15 23:26 - 2015-07-21 17:42 - 00000000 ____D C:\Program Files (x86)\globalUpdate
2015-07-15 23:26 - 2015-07-21 15:46 - 00000004 _____ C:\Windows\SysWOW64\029B560A371F4E00AB32838EBC01B9E7
2015-07-15 23:26 - 2015-07-15 23:26 - 00000000 ____D C:\Users\Wiebke\AppData\Local\globalUpdate
2015-07-15 23:22 - 2015-07-15 23:22 - 00000000 _____ C:\Windows\prleth.sys
2015-07-15 23:22 - 2015-07-15 23:22 - 00000000 _____ C:\Windows\hgfs.sys
2015-07-15 13:01 - 2015-07-15 13:01 - 00002211 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth Pro.lnk
2015-07-15 13:01 - 2015-03-06 13:36 - 00880208 _____ (Google Inc.) C:\Users\Wiebke\Downloads\GoogleEarthProSetup.exe
2015-07-14 22:02 - 2015-07-09 21:51 - 00136904 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-07-14 22:02 - 2015-07-09 20:40 - 00359936 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-07-14 22:02 - 2015-07-09 18:03 - 03701760 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-07-14 22:02 - 2015-07-09 17:54 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-07-14 22:02 - 2015-07-09 17:53 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-07-14 22:02 - 2015-07-09 17:50 - 00409088 _____ (Microsoft Corporation) C:\Windows\system32\WUSettingsProvider.dll
2015-07-14 22:02 - 2015-07-09 17:50 - 00095744 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-07-14 22:02 - 2015-07-09 17:48 - 00891904 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-07-14 22:02 - 2015-07-09 17:46 - 02229248 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-07-14 22:02 - 2015-07-09 17:38 - 00029696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2015-07-14 22:02 - 2015-07-09 17:37 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2015-07-14 22:02 - 2015-07-09 17:35 - 00081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2015-07-14 22:02 - 2015-07-09 17:34 - 00721920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2015-07-14 22:02 - 2015-06-30 00:43 - 00026288 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2015-07-14 22:02 - 2015-06-29 17:07 - 01145856 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-07-14 22:02 - 2015-06-29 17:07 - 01084928 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-07-14 22:02 - 2015-06-29 17:07 - 00764928 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-07-14 22:02 - 2015-06-29 17:07 - 00433152 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-07-14 22:02 - 2015-06-29 17:07 - 00067584 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-07-14 22:02 - 2015-06-28 07:07 - 00442712 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-07-14 22:02 - 2015-06-28 07:07 - 00178008 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-07-14 22:02 - 2015-06-28 07:06 - 01311960 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2015-07-14 22:02 - 2015-06-28 07:06 - 00332120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-07-14 22:02 - 2015-06-27 18:42 - 00747520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2015-07-14 22:02 - 2015-06-27 05:13 - 00202240 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2015-07-14 22:02 - 2015-06-27 05:12 - 00401408 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2015-07-14 22:02 - 2015-06-27 05:12 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2015-07-14 22:02 - 2015-06-27 05:08 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-07-14 22:02 - 2015-06-27 05:08 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-07-14 22:02 - 2015-06-27 04:40 - 00445440 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-07-14 22:02 - 2015-06-27 04:14 - 00027136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2015-07-14 22:02 - 2015-06-27 04:05 - 01441792 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-07-14 22:02 - 2015-06-27 04:00 - 00989184 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-07-14 22:02 - 2015-06-27 03:53 - 00324096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2015-07-14 22:02 - 2015-06-27 03:26 - 00802816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-07-14 22:02 - 2015-06-27 01:21 - 00726528 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-07-14 22:02 - 2015-06-27 01:21 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-07-14 22:02 - 2015-06-25 04:31 - 04177920 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-07-14 22:02 - 2015-06-16 00:41 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\msiexec.exe
2015-07-14 22:02 - 2015-06-16 00:24 - 03320320 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2015-07-14 22:02 - 2015-06-15 23:16 - 00059904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msiexec.exe
2015-07-14 22:02 - 2015-06-15 23:09 - 03607552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2015-07-14 22:02 - 2015-06-15 22:50 - 02774528 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2015-07-14 22:02 - 2015-06-15 21:57 - 02460160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2015-07-14 22:02 - 2015-05-30 21:36 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\AudioEndpointBuilder.dll
2015-07-14 22:02 - 2015-05-11 20:17 - 01201664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\bthport.sys
2015-07-14 22:02 - 2015-05-07 19:50 - 22292672 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2015-07-14 22:02 - 2015-05-07 19:00 - 03109376 _____ (Microsoft Corporation) C:\Windows\system32\ExplorerFrame.dll
2015-07-14 22:02 - 2015-05-07 18:53 - 19734960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2015-07-14 22:02 - 2015-05-07 18:12 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ExplorerFrame.dll
2015-07-14 22:02 - 2015-05-07 17:21 - 00522240 _____ (Microsoft Corporation) C:\Windows\system32\GeofenceMonitorService.dll
2015-07-14 22:02 - 2015-05-07 17:05 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\GeofenceMonitorService.dll
2015-07-14 22:02 - 2015-05-03 17:09 - 00274944 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2015-07-14 22:02 - 2015-05-03 16:58 - 00210944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2015-07-14 22:02 - 2015-05-03 16:55 - 00971776 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll
2015-07-14 22:02 - 2015-05-03 16:49 - 00811008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll
2015-07-14 22:02 - 2015-05-03 02:39 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-07-14 22:02 - 2015-04-30 01:22 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\WiFiDisplay.dll
2015-07-14 22:02 - 2015-04-25 04:25 - 00020992 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usb8023.sys
2015-07-14 22:02 - 2014-11-04 21:25 - 00059712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\kbdclass.sys
2015-07-14 22:02 - 2014-11-04 21:25 - 00051008 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mouclass.sys
2015-07-14 22:02 - 2014-11-04 08:55 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\sermouse.sys
2015-07-14 22:02 - 2014-11-04 08:54 - 00108544 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\i8042prt.sys
2015-07-14 22:02 - 2014-11-04 08:54 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\kbdhid.sys
2015-07-14 22:02 - 2014-11-04 08:54 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mouhid.sys
2015-07-14 22:01 - 2015-07-02 23:21 - 19877376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-07-14 22:01 - 2015-07-02 22:50 - 02279424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-07-14 22:01 - 2015-07-02 22:49 - 25193984 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-07-14 22:01 - 2015-07-02 22:23 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-07-14 22:01 - 2015-07-02 22:19 - 12855296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-07-14 22:01 - 2015-07-02 21:55 - 01310720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-07-14 22:01 - 2015-07-02 21:20 - 14453248 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-07-14 22:01 - 2015-07-02 20:59 - 01545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-07-14 22:01 - 2015-07-02 00:08 - 05923840 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-07-14 22:01 - 2015-07-01 23:14 - 04520448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-07-14 22:01 - 2015-06-16 00:39 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-07-14 22:01 - 2015-06-16 00:38 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-07-14 22:01 - 2015-06-16 00:26 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-07-14 22:01 - 2015-06-16 00:24 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-07-14 22:01 - 2015-06-16 00:02 - 00087552 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2015-07-14 22:01 - 2015-06-15 23:58 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-07-14 22:01 - 2015-06-15 23:57 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-07-14 22:01 - 2015-06-15 23:56 - 00145408 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2015-07-14 22:01 - 2015-06-15 23:55 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-07-14 22:01 - 2015-06-15 23:49 - 01032704 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2015-07-14 22:01 - 2015-06-15 23:41 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2015-07-14 22:01 - 2015-06-15 23:38 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-07-14 22:01 - 2015-06-15 23:36 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-07-14 22:01 - 2015-06-15 23:17 - 02880000 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll
2015-07-14 22:01 - 2015-06-15 23:16 - 02427392 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-07-14 22:01 - 2015-06-15 23:15 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-07-14 22:01 - 2015-06-15 23:13 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-07-14 22:01 - 2015-06-15 23:04 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-07-14 22:01 - 2015-06-15 23:03 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-07-14 22:01 - 2015-06-15 22:52 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-07-14 22:01 - 2015-06-15 22:47 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2015-07-14 22:01 - 2015-06-15 22:44 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-07-14 22:01 - 2015-06-15 22:43 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-07-14 22:01 - 2015-06-15 22:42 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2015-07-14 22:01 - 2015-06-15 22:41 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-07-14 22:01 - 2015-06-15 22:37 - 00880128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2015-07-14 22:01 - 2015-06-15 22:32 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2015-07-14 22:01 - 2015-06-15 22:31 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-07-14 22:01 - 2015-06-15 22:30 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-07-14 22:01 - 2015-06-15 22:30 - 00327168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-07-14 22:01 - 2015-06-15 22:17 - 01048576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\actxprxy.dll
2015-07-14 22:01 - 2015-06-15 22:07 - 01951232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-07-14 22:01 - 2015-06-15 22:02 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-07-14 22:01 - 2015-06-11 05:49 - 01380600 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2015-07-14 22:01 - 2015-06-10 18:13 - 01097216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2015-07-14 22:01 - 2015-05-30 23:18 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\werdiagcontroller.dll
2015-07-14 22:01 - 2015-05-30 21:35 - 00911360 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2015-07-14 22:01 - 2015-05-12 15:19 - 00294912 _____ (Microsoft Corporation) C:\Windows\system32\SystemEventsBrokerServer.dll
2015-07-14 22:01 - 2015-04-28 15:13 - 00513480 _____ C:\Windows\SysWOW64\locale.nls
2015-07-14 22:01 - 2015-04-28 15:13 - 00513480 _____ C:\Windows\system32\locale.nls
2015-07-14 22:00 - 2015-06-16 07:36 - 01661576 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2015-07-14 22:00 - 2015-06-16 07:36 - 01212248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2015-07-14 22:00 - 2015-05-11 18:34 - 00332800 _____ (Microsoft Corporation) C:\Windows\system32\fhcpl.dll
2015-07-14 22:00 - 2015-05-03 17:07 - 07784448 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Data.Pdf.dll
2015-07-14 22:00 - 2015-05-03 16:57 - 05264384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Data.Pdf.dll
2015-07-14 22:00 - 2015-05-02 01:33 - 00410739 _____ C:\Windows\system32\ApnDatabase.xml
2015-07-14 21:59 - 2015-05-07 18:47 - 00564224 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll
2015-07-14 21:59 - 2015-04-23 17:47 - 03084288 _____ (Microsoft Corporation) C:\Windows\system32\msftedit.dll
2015-07-14 21:59 - 2015-04-23 17:16 - 02471424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msftedit.dll
2015-07-08 21:51 - 2015-07-08 21:51 - 11041503 _____ C:\Users\Wiebke\Desktop\Contract.rar
2015-07-08 13:17 - 2015-07-16 18:02 - 00000000 ____D C:\Users\Wiebke\Desktop\Contract
2015-06-25 14:06 - 2015-07-05 02:15 - 00005160 _____ C:\Windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for WIEBKE-LAPTOP-Wiebke WIebke-Laptop

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-07-23 11:26 - 2014-07-09 19:13 - 00000000 ____D C:\Users\Wiebke\AppData\Roaming\ClassicShell
2015-07-23 11:24 - 2014-07-09 13:45 - 00000000 ____D C:\Users\Wiebke
2015-07-23 11:10 - 2014-10-28 16:45 - 00001146 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-07-23 11:07 - 2014-07-09 18:55 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-07-23 11:06 - 2014-07-09 13:50 - 00003598 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2994723587-2746384714-1883225562-1001
2015-07-23 11:00 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\system32\sru
2015-07-23 10:34 - 2014-07-09 13:43 - 01149165 _____ C:\Windows\WindowsUpdate.log
2015-07-22 12:51 - 2014-07-09 19:15 - 00000000 ____D C:\Program Files\Microsoft Office 15
2015-07-22 12:38 - 2014-03-18 12:03 - 01776918 _____ C:\Windows\system32\PerfStringBackup.INI
2015-07-22 12:38 - 2014-03-18 11:25 - 00765582 _____ C:\Windows\system32\perfh007.dat
2015-07-22 12:38 - 2014-03-18 11:25 - 00159366 _____ C:\Windows\system32\perfc007.dat
2015-07-22 12:34 - 2014-10-28 16:45 - 00001142 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-07-22 12:34 - 2014-07-11 16:48 - 00000000 ____D C:\Users\Wiebke\AppData\Local\Adobe
2015-07-22 12:34 - 2014-07-09 13:47 - 00000000 __RDO C:\Users\Wiebke\OneDrive
2015-07-22 12:34 - 2014-05-16 06:54 - 00003524 _____ C:\Windows\System32\Tasks\SPEC
2015-07-21 18:44 - 2013-08-22 16:46 - 00071339 _____ C:\Windows\setupact.log
2015-07-21 18:44 - 2013-08-22 16:45 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-07-21 18:09 - 2014-03-18 03:50 - 00215788 _____ C:\Windows\PFRO.log
2015-07-21 18:08 - 2013-08-22 15:25 - 00262144 ___SH C:\Windows\system32\config\BBI
2015-07-21 17:47 - 2014-07-09 19:05 - 01048856 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2015-07-21 17:47 - 2014-07-09 19:05 - 00447944 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2015-07-21 17:47 - 2014-07-09 19:05 - 00274808 _____ (AVAST Software) C:\Windows\system32\Drivers\aswVmm.sys
2015-07-21 17:47 - 2014-07-09 19:05 - 00150160 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2015-07-21 17:47 - 2014-07-09 19:05 - 00093528 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2015-07-21 17:47 - 2014-07-09 19:05 - 00090968 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2015-07-21 17:47 - 2014-07-09 19:05 - 00065224 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRvrt.sys
2015-07-21 17:47 - 2014-07-09 19:05 - 00028656 _____ (AVAST Software) C:\Windows\system32\Drivers\aswHwid.sys
2015-07-21 17:43 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\Vss
2015-07-21 17:43 - 2013-08-22 16:44 - 05102512 _____ C:\Windows\system32\FNTCACHE.DAT
2015-07-21 15:54 - 2015-03-11 20:37 - 00000000 ____D C:\Users\Wiebke\Desktop\Quatsh
2015-07-21 14:37 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\AppReadiness
2015-07-21 10:38 - 2013-08-22 17:20 - 00000000 ____D C:\Windows\CbsTemp
2015-07-21 09:20 - 2014-08-03 13:43 - 00000000 ____D C:\Users\Wiebke\AppData\Roaming\Skype
2015-07-21 08:48 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\system32\NDF
2015-07-21 08:12 - 2014-07-09 13:45 - 00000000 ____D C:\Users\Wiebke\AppData\Local\Packages
2015-07-21 08:05 - 2014-07-09 19:05 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2015-07-20 20:57 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\rescache
2015-07-20 20:06 - 2014-08-03 13:42 - 00000000 ___RD C:\Program Files (x86)\Skype
2015-07-20 20:06 - 2014-08-03 13:42 - 00000000 ____D C:\ProgramData\Skype
2015-07-17 15:50 - 2015-04-07 19:20 - 00000000 ___SD C:\Windows\SysWOW64\GWX
2015-07-17 15:50 - 2015-04-07 19:20 - 00000000 ___SD C:\Windows\system32\GWX
2015-07-16 18:02 - 2015-04-17 22:27 - 00000000 ____D C:\Users\Wiebke\Documents\SS_15
2015-07-16 18:02 - 2014-07-09 13:45 - 00000000 ____D C:\Users\Wiebke\AppData\Local\VirtualStore
2015-07-16 16:28 - 2014-05-16 07:11 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-07-16 00:20 - 2014-11-17 02:56 - 00001421 _____ C:\Users\Wiebke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-07-16 00:01 - 2014-10-22 16:11 - 00000000 ____D C:\Users\Wiebke\AppData\Roaming\Opera Software
2015-07-16 00:01 - 2014-10-22 16:11 - 00000000 ____D C:\Users\Wiebke\AppData\Local\Opera Software
2015-07-16 00:01 - 2014-10-22 16:11 - 00000000 ____D C:\Program Files (x86)\Opera
2015-07-15 23:51 - 2013-08-22 15:25 - 00000194 _____ C:\Windows\win.ini
2015-07-15 23:32 - 2013-08-22 17:36 - 00000000 ___RD C:\Windows\ToastData
2015-07-15 23:32 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\WinStore
2015-07-15 23:11 - 2015-04-19 22:53 - 00000000 ____D C:\Windows\system32\appraiser
2015-07-15 23:11 - 2015-03-13 01:48 - 00000000 ___SD C:\Windows\system32\CompatTel
2015-07-15 23:11 - 2014-07-09 14:49 - 00000000 ____D C:\Windows\system32\MRT
2015-07-15 23:05 - 2014-10-28 16:45 - 00004118 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-07-15 23:05 - 2014-10-28 16:45 - 00003882 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-07-15 22:57 - 2015-06-01 16:34 - 00000000 ____D C:\Users\Wiebke\Desktop\Landscape
2015-07-15 13:01 - 2014-10-28 16:45 - 00000000 ____D C:\Program Files (x86)\Google
2015-07-15 11:13 - 2014-07-23 19:17 - 00000287 _____ C:\Users\Wiebke\AppData\Local\VersionChecker_19.xml
2015-07-14 19:07 - 2014-07-09 18:55 - 00003772 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-07-14 18:36 - 2014-12-26 21:37 - 00003886 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2015-07-14 07:33 - 2014-12-22 15:15 - 00000000 __SHD C:\Users\Wiebke\AppData\Local\EmieBrowserModeList
2015-07-14 07:33 - 2014-07-09 18:55 - 00000000 __SHD C:\Users\Wiebke\AppData\Local\EmieUserList
2015-07-14 07:33 - 2014-07-09 18:55 - 00000000 __SHD C:\Users\Wiebke\AppData\Local\EmieSiteList
2015-07-13 23:10 - 2013-08-22 17:38 - 00792568 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-07-13 23:10 - 2013-08-22 17:38 - 00178168 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-07-07 14:39 - 2014-07-09 13:45 - 00000000 ____D C:\Users\Wiebke\AppData\Roaming\Adobe
2015-07-05 15:33 - 2014-07-21 21:11 - 00000000 ____D C:\Users\Wiebke\Documents\SpispaStudium
2015-07-05 12:08 - 2014-07-09 14:48 - 00300704 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2015-07-03 08:43 - 2014-07-09 14:49 - 130333168 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-06-25 09:25 - 2015-03-16 10:42 - 00000000 ____D C:\Users\Wiebke\AppData\Local\Audible

==================== Files in the root of some directories =======

2014-07-23 19:17 - 2015-07-15 11:13 - 0000287 _____ () C:\Users\Wiebke\AppData\Local\VersionChecker_19.xml
2014-05-16 06:41 - 2014-05-16 06:41 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2014-09-24 22:30 - 2014-09-24 22:31 - 0000350 _____ () C:\ProgramData\hpzinstall.log

Some files in TEMP:
====================
C:\Users\Wiebke\AppData\Local\Temp\jre-8u40-windows-au.exe
C:\Users\Wiebke\AppData\Local\Temp\jre-8u45-windows-au.exe
C:\Users\Wiebke\AppData\Local\Temp\jre-8u51-windows-au.exe
C:\Users\Wiebke\AppData\Local\Temp\tmd_34011533.exe
C:\Users\Wiebke\AppData\Local\Temp\tmd_34013887.exe
C:\Users\Wiebke\AppData\Local\Temp\tmd_34015321.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-07-16 07:58

==================== End of log ============================
         

scan result of Farbar Recovery Scan Tool (x64) Version:20-07-2015
Ran by Wiebke at 2015-07-23 11:28:10
Running from C:\Users\Wiebke\Desktop
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-2994723587-2746384714-1883225562-500 - Administrator - Disabled)
Gast (S-1-5-21-2994723587-2746384714-1883225562-501 - Limited - Disabled)
Wiebke (S-1-5-21-2994723587-2746384714-1883225562-1001 - Administrator - Enabled) => C:\Users\Wiebke

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 15.0.0.356 - Adobe Systems Incorporated)
Adobe Creative Cloud (HKLM-x32\...\Adobe Creative Cloud) (Version: 3.0.0.74 - Adobe Systems Incorporated)
Adobe Flash Player 18 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 18.0.0.209 - Adobe Systems Incorporated)
Adobe Help Manager (HKLM-x32\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 4.0.244 - Adobe Systems Incorporated)
Adobe Illustrator CS6 (HKLM-x32\...\{4869414E-7AEA-4C8E-BE1C-8D40977FD517}) (Version: 16.0 - Adobe Systems Incorporated)
Adobe InDesign CS6 (HKLM-x32\...\{CFB770D7-8D43-1014-922B-CC2715FADE3F}) (Version: 8.0 - Adobe Systems Incorporated)
Adobe Lightroom (HKLM-x32\...\{8048A5DF-8A70-5BE1-954B-E0FDE1BD0D0D}) (Version: 6.0 - Adobe Systems Incorporated)
Adobe Photoshop CS6 (HKLM-x32\...\{74EB3499-8B95-4B5C-96EB-7B342F3FD0C6}) (Version: 13.0 - Adobe Systems Incorporated)
Adobe Premiere Pro CS6 (HKLM-x32\...\{7176B973-6011-43C1-AEBC-2D73FE7C6982}) (Version: 6.0 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.12)  MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AB0000000001}) (Version: 11.0.12 - Adobe Systems Incorporated)
Apple Application Support (HKLM-x32\...\{F5266D28-E0B2-4130-BFC5-EE155AD514DC}) (Version: 2.3 - Apple Inc.)
AudibleManager (HKLM-x32\...\AudibleManager) (Version: 5898928.1637756.4759644.48 - Audible, Inc.)
Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 10.3.2223 - AVAST Software)
bl (x32 Version: 1.0.0 - Your Company Name) Hidden
BufferChm (x32 Version: 140.0.298.000 - Hewlett-Packard) Hidden
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.3.4746 - CDBurnerXP)
Classic Shell (HKLM\...\{840C85B7-D3D6-4143-9AF9-DAE80FD54CFC}) (Version: 4.1.0 - IvoSoft)
CloudReading (HKLM-x32\...\{41914D8B-9D6E-4764-A1F9-BC43FB6782C1}_is1) (Version: 1.1.47.1220 - Foxit Corporation)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Destinations (x32 Version: 140.0.0.0 - Hewlett-Packard) Hidden
DocProc (x32 Version: 140.0.185.000 - Hewlett-Packard) Hidden
EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version:  - Seiko Epson Corporation)
EPSON Universal Print Driver Printer Uninstall (HKLM\...\EPSON Universal Print Driver) (Version:  - SEIKO EPSON Corporation)
EpsonNet Print (HKLM-x32\...\{3E31400D-274E-4647-916C-2CACC3741799}) (Version: 2.6.0 - SEIKO EPSON CORPORATION)
Finger Sensing Pad Driver (HKLM\...\{E86906FF-C63D-4EAF-ACE7-5F8D55FBEA9A}) (Version: 9.3.8.7 - Sentelic)
Fotogalerie (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Foxit Reader (HKLM-x32\...\Foxit Reader_is1) (Version: 6.1.2.1224 - Foxit Corporation)
Free YouTube to MP3 Converter version 3.12.48.1015 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.48.1015 - DVDVideoSoft Ltd.)
Google Earth Plug-in (HKLM-x32\...\{4AB54F11-2F8C-11E3-B09F-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Earth Pro (HKLM-x32\...\{35DAA04C-1720-4BE3-A920-A03731EC6A1D}) (Version: 7.1.5.1557 - Google)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.28.1 - Google Inc.) Hidden
HP Imaging Device Functions 14.5 (HKLM\...\HP Imaging Device Functions) (Version: 14.5 - HP)
HP Scanjet G4010 (HKLM\...\{7723DE29-7966-4C5E-B909-A469CAF94DE4}) (Version: 14.5 - HP)
HP Update (HKLM-x32\...\{B0069CFA-5BB9-4C03-B1C6-89CE290E5AFE}) (Version: 5.002.006.003 - Hewlett-Packard)
hpg4010 (x32 Version: 140.000.000.000 - Ihr Firmenname) Hidden
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1011 - Intel Corporation)
Intel(R) Manageability Engine Firmware Recovery Agent (HKLM-x32\...\{A6C48A9F-694A-4234-B3AA-62590B668927}) (Version: 1.0.0.36702 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.0.0.1323 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3621 - Intel Corporation)
Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology(patch version 3.0.1342.2) (HKLM\...\{302600C1-6BDF-4FD1-1311-148929CC1385}) (Version: 3.1.1311.0402 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.2.0.1006 - Intel Corporation)
Intel® PROSet/Wireless Software (HKLM-x32\...\{440d014b-4444-4533-b96d-2910e1ca2bcf}) (Version: 16.7.0 - Intel Corporation)
Java 7 Update 60 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217060FF}) (Version: 7.0.600 - Oracle)
Malwarebytes Anti-Malware Version 2.1.8.1057 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.8.1057 - Malwarebytes Corporation)
Microsoft Office 365 - de-de (HKLM\...\O365HomePremRetail - de-de) (Version: 15.0.4737.1003 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-2994723587-2746384714-1883225562-1001\...\OneDriveSetup.exe) (Version: 17.3.5860.0512 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Mozilla Firefox 39.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 39.0 (x86 de)) (Version: 39.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 39.0 - Mozilla)
OCR Software by I.R.I.S. 14.5 (HKLM\...\HPOCR) (Version: 14.5 - HP)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4737.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4737.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4737.1003 - Microsoft Corporation) Hidden
PDF Settings CS6 (x32 Version: 11.0 - Adobe Systems Incorporated) Hidden
ph (x32 Version: 1.0.0 - Your Company Name) Hidden
QuickTime (HKLM-x32\...\{AF0CE7C0-A3E4-4D73-988B-B29187EC6E9A}) (Version: 7.73.80.64 - Apple Inc.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.20.815.2013 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7071 - Realtek Semiconductor Corp.)
Saal Design Software (HKLM-x32\...\SaalDesignSoftware) (Version: 3.2.44 - Saal Digital Fotoservice GmbH)
Saal Design Software (x32 Version: 3.2.44 - Saal Digital Fotoservice GmbH) Hidden
Scan (x32 Version: 14.0.1.0 - Hewlett-Packard) Hidden
Setup (HKLM-x32\...\{7ADF667E-E14D-4D2C-827C-B0108F0D93BC}) (Version:  - )
SketchUp 2014 (HKLM-x32\...\{9E620BD5-AEEC-492D-9065-D71FCD4C52F1}) (Version: 14.1.1282 - Trimble Navigation Limited)
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.4.0.9058 - Microsoft Corporation)
Skype™ 7.5 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.5.102 - Skype Technologies S.A.)
SPEC (HKLM-x32\...\{01558DB8-4080-42BF-87BD-EAD0988616BB}) (Version: 8.0.27.0913.2013 - spec)
Vectorworks 2014 Hilfe (HKLM-x32\...\eu.computerworks.vectorworks.2014.help.deu.07222458214E034A0B494E83FAD6744C17D2B914.1) (Version: 1.1 - UNKNOWN)
Vectorworks 2014 Hilfe (x32 Version: 1.1 - UNKNOWN) Hidden
VLC media player 2.1.2 (HKLM-x32\...\VLC media player) (Version: 2.1.2 - VideoLAN)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3508.0205 - Microsoft Corporation)
WinRAR 5.10 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.10.0 - win.rar GmbH)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-2994723587-2746384714-1883225562-1001_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\Windows\system32\igfxEM.exe (Intel Corporation)
CustomCLSID: HKU\S-1-5-21-2994723587-2746384714-1883225562-1001_Classes\CLSID\{e8c77137-e224-5791-b6e9-ff0305797a13}\InprocServer32 -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll (Adobe Systems)
CustomCLSID: HKU\S-1-5-21-2994723587-2746384714-1883225562-1001_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Wiebke\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncApi64.dll (Microsoft Corporation)

==================== Restore Points =========================

24-06-2015 17:11:10 Windows Update
07-07-2015 18:03:31 Geplanter Prüfpunkt
15-07-2015 23:08:32 Windows Update
21-07-2015 10:38:06 Windows Update

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {1946005E-42B8-4734-B6FC-91030EEE6693} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2015-06-09] (Microsoft Corporation)
Task: {1A8A551A-E5FA-4DCA-ADD1-17621DB9B750} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-28] (Google Inc.)
Task: {24886FC4-391D-49E2-84A9-D6AA7EE98EAD} - System32\Tasks\avastBCLRestart_firefox.exe => Firefox.exe 
Task: {3CE0C631-9F0B-4D39-A2F6-F9F6FCCD4E8D} - System32\Tasks\avastBCLRestart_IEXPLORE.EXE => Iexplore.exe 
Task: {413F8829-3617-4C34-BAA1-C1FB00D374FD} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon => c:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2012-06-14] (Intel Corporation)
Task: {4528280F-3B5A-414A-BA60-5F92334A004A} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-07-01] (Microsoft Corporation)
Task: {615317C7-C1F5-4615-82B0-86EF45E4A870} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-07-07] (Adobe Systems Incorporated)
Task: {66D65BB1-A37A-473E-A61A-D7012EB49BB3} - System32\Tasks\{F546073A-99F5-4AD9-8005-03BF89DD0958} => pcalua.exe -a C:\Users\Wiebke\AppData\Roaming\oursurfing\UninstallManager.exe -c  -ptid=amt
Task: {68BEA82A-47F6-49EF-AFBE-A082BCB9B76D} - System32\Tasks\Microsoft Office 15 Sync Maintenance for WIEBKE-LAPTOP-Wiebke WIebke-Laptop => C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [2015-06-02] (Microsoft Corporation)
Task: {8F2B1F21-F6C3-4CC9-8AEC-FAD6009E4407} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-07-14] (Adobe Systems Incorporated)
Task: {90F06EBE-8568-4397-A15B-61DC6810A8FE} - System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-2994723587-2746384714-1883225562-1001 => %localappdata%\Microsoft\OneDrive\OneDrive.exe
Task: {BD2F73E7-4AC2-4A82-B1DC-FFB3DED4A2BE} - System32\Tasks\SPEC => C:\Program Files (x86)\SPEC\spec.exe [2013-09-13] ()
Task: {C280F55B-69A0-464F-8636-C6AB5B247AE4} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-28] (Google Inc.)
Task: {D168BDC7-0EC0-4BB5-9E21-906FA7A0A9F9} - \Microsoft OneDrive Auto Update Task-S-1-5-21-2994723587-2746384714-1883225562-500 No Task File <==== ATTENTION
Task: {D3DCEC44-5BF4-4DD8-9C0F-5B4617C94874} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d => c:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2012-06-14] (Intel Corporation)
Task: {DCB48826-5B69-4CFA-A2CD-A67F0AB4890F} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-07-01] (Microsoft Corporation)
Task: {E7E5C4A4-669C-4FC1-96B8-32F3D07768EB} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2015-07-03] (Microsoft Corporation)
Task: {E886BFB8-6103-4A8B-920D-CF179C9072C1} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2015-07-21] (AVAST Software)
Task: {EDAE9FF1-CEC7-4D00-BAD4-9E0BD5716969} - System32\Tasks\{7B1CC18C-B392-4AE8-838D-7E477E3882C8} => pcalua.exe -a C:\Users\Wiebke\AppData\Roaming\istartsurf\UninstallManager.exe -c  -ptid=pcs

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\avast! Emergency Update.job => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (Whitelisted) ==============

2015-04-16 17:42 - 2015-04-16 17:42 - 00997536 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll
2014-05-16 06:54 - 2013-09-13 11:14 - 00405504 _____ () C:\Program Files (x86)\SPEC\spec.exe
2015-04-16 17:41 - 2015-04-16 17:41 - 05842080 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe
2014-07-09 19:15 - 2014-05-20 09:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2012-07-24 12:06 - 2012-07-24 12:06 - 00119808 _____ () C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\updateui.exe
2014-04-16 07:21 - 2014-04-16 07:21 - 00012728 _____ () C:\Program Files\WindowsApps\Microsoft.BingNews_3.0.4.336_x64__8wekyb3d8bbwe\Microsoft.PerfTrack.winmd
2013-08-22 09:19 - 2013-08-22 08:54 - 00054784 _____ () C:\Windows\system32\WinMetadata\Windows.Globalization.winmd
2013-08-22 09:19 - 2013-08-22 08:54 - 00030208 _____ () C:\Windows\system32\WinMetadata\Windows.Foundation.winmd
2013-08-22 09:19 - 2013-08-22 08:54 - 00020480 _____ () C:\Windows\system32\WinMetadata\Windows.System.winmd
2013-08-22 09:19 - 2013-08-22 08:54 - 00096256 _____ () C:\Windows\system32\WinMetadata\Windows.Storage.winmd
2013-08-22 09:19 - 2013-08-22 08:54 - 00134144 _____ () C:\Windows\system32\WinMetadata\Windows.ApplicationModel.winmd
2014-04-16 07:21 - 2014-04-16 07:21 - 00551440 _____ () C:\Program Files\WindowsApps\Microsoft.BingNews_3.0.4.336_x64__8wekyb3d8bbwe\SqliteWrapper.dll
2014-04-16 07:21 - 2014-04-16 07:21 - 00660920 _____ () C:\Program Files\WindowsApps\Microsoft.BingNews_3.0.4.336_x64__8wekyb3d8bbwe\Sqlite3.dll
2013-08-22 09:19 - 2013-08-22 08:54 - 00174592 _____ () C:\Windows\system32\WinMetadata\Windows.UI.winmd
2015-07-14 18:36 - 2015-07-14 18:36 - 00280064 _____ () C:\Program Files\WindowsApps\Microsoft.BingNews_3.0.4.336_x64__8wekyb3d8bbwe\Microsoft.Bing.AppEx.Telemetry.winmd
2013-08-22 09:19 - 2013-08-22 08:54 - 00066560 _____ () C:\Windows\system32\WinMetadata\Windows.Security.winmd
2013-08-22 09:19 - 2013-08-22 08:54 - 00112640 _____ () C:\Windows\system32\WinMetadata\Windows.Networking.winmd
2014-04-16 07:21 - 2014-04-16 07:21 - 00016912 _____ () C:\Program Files\WindowsApps\Microsoft.BingNews_3.0.4.336_x64__8wekyb3d8bbwe\SqliteWrapper.winmd
2013-08-22 09:19 - 2013-08-22 08:54 - 00093696 _____ () C:\Windows\system32\WinMetadata\Windows.Web.winmd
2013-08-22 09:19 - 2013-08-22 08:54 - 00049664 _____ () C:\Windows\system32\WinMetadata\Windows.Graphics.winmd
2013-08-22 09:19 - 2013-08-22 08:54 - 00050176 _____ () C:\Windows\system32\WinMetadata\Windows.Data.winmd
2015-07-03 19:33 - 2015-07-03 19:33 - 00183296 _____ () C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe\ErrorReporting.dll
2015-07-21 17:47 - 2015-07-21 17:47 - 00102864 _____ () C:\Program Files\AVAST Software\Avast\log.dll
2015-07-21 17:47 - 2015-07-21 17:47 - 00123976 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
2015-07-21 15:14 - 2015-07-21 15:14 - 02957312 _____ () C:\Program Files\AVAST Software\Avast\defs\15072100\algo.dll
2015-07-22 12:34 - 2015-07-22 12:34 - 02957312 _____ () C:\Program Files\AVAST Software\Avast\defs\15072200\algo.dll
2015-07-23 11:03 - 2015-07-23 11:03 - 02957312 _____ () C:\Program Files\AVAST Software\Avast\defs\15072300\algo.dll
2014-10-18 12:17 - 2014-10-18 12:17 - 00172544 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\f4da956bd76b31d5ee1dd89a36e073b3\IsdiInterop.ni.dll
2014-05-16 06:54 - 2012-05-30 13:55 - 00059904 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2014-05-16 06:54 - 2011-05-06 15:20 - 00034816 _____ () C:\Program Files (x86)\SPEC\PM.dll
2015-07-21 17:47 - 2015-07-21 17:47 - 40540672 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2015-04-20 07:16 - 2015-04-20 07:16 - 36732592 _____ () C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\CEF\libcef.dll
2011-08-15 20:12 - 2011-08-15 20:12 - 02603520 _____ () C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\QtCore4.dll
2012-06-14 11:57 - 2012-06-14 11:57 - 00015872 _____ () C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\featureController.dll
2011-08-15 20:12 - 2011-08-15 20:12 - 01006592 _____ () C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\QtNetwork4.dll
2011-08-15 20:15 - 2011-08-15 20:15 - 00382464 _____ () C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\QtXml4.dll
2011-08-17 16:41 - 2011-08-17 16:41 - 00400384 _____ () C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\sqlite3.dll
2011-08-17 16:48 - 2011-08-17 16:48 - 00322048 _____ () C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\log4cplus.dll
2011-08-17 16:48 - 2011-08-17 16:48 - 00195584 _____ () C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\libgsoap.dll
2011-08-15 19:23 - 2011-08-15 19:23 - 00062464 _____ () C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\zlib1.dll
2012-06-14 11:56 - 2012-06-14 11:56 - 00481792 _____ () C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\DeviceProfile.dll
2012-06-14 12:06 - 2012-06-14 12:06 - 00500064 _____ () C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\plugin\PServerPlugin.dll
2012-06-14 11:55 - 2012-06-14 11:55 - 00013824 _____ () C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\eventsSender.dll
2011-07-19 16:05 - 2011-07-19 16:05 - 14978048 _____ () C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\QtWebKit4.dll
2011-08-15 20:17 - 2011-08-15 20:17 - 09224704 _____ () C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\QtGui4.dll
2011-07-19 16:04 - 2011-07-19 16:04 - 00317952 _____ () C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\phonon4.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\Users\Wiebke\Cookies:cMrbwqh3TcrLxKToRLL
AlternateDataStreams: C:\Users\Wiebke\OneDrive:ms-properties

==================== Safe Mode (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2994723587-2746384714-1883225562-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Wiebke\Desktop\lemuren-151492.jpg
DNS Servers: 130.75.1.32 - 130.75.1.40
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

HKLM\...\StartupApproved\Run32: => "AdobeCS6ServiceManager"
HKLM\...\StartupApproved\Run32: => "APSDaemon"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{BAC6929E-4530-478B-8A45-9BDDA2722A15}] => (Allow) C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
FirewallRules: [{AD06766B-DBE3-4D2D-88CC-56974356C54B}] => (Allow) C:\Users\Administrator\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
FirewallRules: [{D526A42E-DB2A-46B3-B8A6-D263ACAAADFA}] => (Allow) C:\Users\Wiebke\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
FirewallRules: [{4DD2C4B2-A6C3-4F29-A043-396C52499238}] => (Allow) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe
FirewallRules: [TCP Query User{DFCBA429-579E-48C1-882D-8F36FF89C04B}C:\program files (x86)\vectorworks2014\vectorworks2014e.exe] => (Allow) C:\program files (x86)\vectorworks2014\vectorworks2014e.exe
FirewallRules: [UDP Query User{721CD2A7-9766-4F94-A9A6-9303BD867FE4}C:\program files (x86)\vectorworks2014\vectorworks2014e.exe] => (Allow) C:\program files (x86)\vectorworks2014\vectorworks2014e.exe
FirewallRules: [TCP Query User{7638725B-C1B6-486A-A9C3-25631CC5B07F}C:\program files (x86)\vectorworks2014\renderworks\cinerender 64bit.exe] => (Block) C:\program files (x86)\vectorworks2014\renderworks\cinerender 64bit.exe
FirewallRules: [UDP Query User{6EC002B7-F241-4AB7-9CCC-2C884569E12E}C:\program files (x86)\vectorworks2014\renderworks\cinerender 64bit.exe] => (Block) C:\program files (x86)\vectorworks2014\renderworks\cinerender 64bit.exe
FirewallRules: [TCP Query User{8974DF6C-92FD-41E6-8D9A-2F2A88D6F8D7}C:\program files (x86)\skype\phone\skype.exe] => (Block) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [UDP Query User{BE0FF002-8C45-4ED7-8923-096B9864CC3D}C:\program files (x86)\skype\phone\skype.exe] => (Block) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [TCP Query User{21EB67FF-43C6-4FF2-AC7D-97E46EBA84A8}C:\program files (x86)\skype\phone\skype.exe] => (Block) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [UDP Query User{B8B4BCA1-B12E-41E5-9C7D-C468FE684519}C:\program files (x86)\skype\phone\skype.exe] => (Block) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [{63E1C2F4-908C-4B38-B90F-8B159C8D182F}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqkygrp.exe
FirewallRules: [{C415D06B-FE5B-4BC5-B14A-F59BAD111CC7}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpfccopy.exe
FirewallRules: [{88359F99-D35B-43A2-B173-2B3E5F1BF9D9}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpiscnapp.exe
FirewallRules: [{5337476B-099A-4E41-A2A0-047B168EECBD}] => (Allow) C:\Program Files (x86)\HP\hp software update\hpwucli.exe
FirewallRules: [TCP Query User{03C6ADDC-1981-4105-9169-A660A63DA9BA}C:\program files (x86)\vectorworks2014\vectorworks2014e.exe] => (Allow) C:\program files (x86)\vectorworks2014\vectorworks2014e.exe
FirewallRules: [UDP Query User{2C6EC944-692E-4E92-AAC1-72355F47C317}C:\program files (x86)\vectorworks2014\vectorworks2014e.exe] => (Allow) C:\program files (x86)\vectorworks2014\vectorworks2014e.exe
FirewallRules: [TCP Query User{75B306A0-05DF-42A5-8F29-ED2DDAB79ECA}C:\program files (x86)\vectorworks2014\renderworks\cinerender 64bit.exe] => (Allow) C:\program files (x86)\vectorworks2014\renderworks\cinerender 64bit.exe
FirewallRules: [UDP Query User{2205A734-F517-4542-8381-268ADA33AD8D}C:\program files (x86)\vectorworks2014\renderworks\cinerender 64bit.exe] => (Allow) C:\program files (x86)\vectorworks2014\renderworks\cinerender 64bit.exe
FirewallRules: [{1B40700A-963E-452A-B82D-9E086FEF0FC7}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{B839F246-F4E5-4BDA-BBA7-C3353C23C58F}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{3CAA1A04-FC1B-4B56-9F9A-EA6A69FE79E5}] => (Allow) LPort=2869
FirewallRules: [{04676B3F-95E5-4A71-85B6-0ECF037BA1D4}] => (Allow) LPort=1900
FirewallRules: [{B00369DC-F574-45F7-AB0E-3B6A5891C061}] => (Allow) C:\Users\Wiebke\AppData\Local\Temp\EPSON WP-4535 Series_Home\Network\EpsonNetSetup\EpsonNetSetup3_4_1_FC_1_0_WW_Direct\ENEasyApp.exe
FirewallRules: [{B181046E-DD09-4786-95F8-8F67D471C2D1}] => (Allow) C:\Users\Wiebke\AppData\Local\Temp\EPSON WP-4535 Series_Home\Network\EpsonNetSetup\EpsonNetSetup3_4_1_FC_1_0_WW_Direct\ENEasyApp.exe
FirewallRules: [{9647E95F-B004-46DD-88A6-12D5D75D0FBE}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\outlook.exe

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (07/20/2015 12:50:55 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: WIEBKE-LAPTOP)
Description: Bei der Aktivierung der App „microsoft.windowscommunicationsapps_8wekyb3d8bbwe!ppleae38af2e007f4358a809ac99a64a67c1“ ist folgender Fehler aufgetreten: -2144927141. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (07/20/2015 12:50:55 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: WIEBKE-LAPTOP)
Description: Bei der Aktivierung der App „microsoft.windowscommunicationsapps_8wekyb3d8bbwe!ppleae38af2e007f4358a809ac99a64a67c1“ ist folgender Fehler aufgetreten: -2144927141. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (07/20/2015 12:50:50 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: WIEBKE-LAPTOP)
Description: Bei der Aktivierung der App „microsoft.windowscommunicationsapps_8wekyb3d8bbwe!ppleae38af2e007f4358a809ac99a64a67c1“ ist folgender Fehler aufgetreten: -2144927141. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (07/17/2015 03:49:29 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: WIEBKE-LAPTOP)
Description: Bei der Aktivierung der App „microsoft.windowscommunicationsapps_8wekyb3d8bbwe!ppleae38af2e007f4358a809ac99a64a67c1“ ist folgender Fehler aufgetreten: -2144927141. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (07/17/2015 02:34:17 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: WmiApRplC:\Windows\system32\wbem\wmiaprpl.dll4

Error: (07/17/2015 02:34:17 PM) (Source: Perflib) (EventID: 1023) (User: )
Description: rdyboost4

Error: (07/17/2015 02:34:17 PM) (Source: PerfNet) (EventID: 2004) (User: )
Description: 

Error: (07/17/2015 02:34:17 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: MSDTCC:\Windows\system32\msdtcuiu.DLL4

Error: (07/17/2015 02:34:17 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: LsaC:\Windows\System32\Secur32.dll4

Error: (07/17/2015 02:34:17 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: ESENTC:\Windows\system32\esentprf.dll4


System errors:
=============
Error: (07/23/2015 11:03:48 AM) (Source: DCOM) (EventID: 10016) (User: WIEBKE-LAPTOP)
Description: ComputerstandardLokalAktivierung{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}WIebke-LaptopWiebkeS-1-5-21-2994723587-2746384714-1883225562-1001LocalHost (unter Verwendung von LRPC)Microsoft.BingNews_3.0.4.336_x64__8wekyb3d8bbweS-1-15-2-508114518-3340871649-811464485-526616082-4258465299-1774086546-1865468257

Error: (07/21/2015 06:47:02 PM) (Source: cdrom) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\CdRom0 gefunden.

Error: (07/21/2015 06:47:02 PM) (Source: cdrom) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\CdRom0 gefunden.

Error: (07/21/2015 06:47:02 PM) (Source: cdrom) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\CdRom0 gefunden.

Error: (07/21/2015 06:47:02 PM) (Source: cdrom) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\CdRom0 gefunden.

Error: (07/21/2015 06:47:02 PM) (Source: cdrom) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\CdRom0 gefunden.

Error: (07/21/2015 06:42:11 PM) (Source: Microsoft-Windows-Directory-Services-SAM) (EventID: 12291) (User: NT-AUTORITÄT)
Description: Das SAM-Modul konnte den TCP/IP- bzw. SPX/IPX-Listening-Thread nicht starten.

Error: (07/21/2015 06:34:14 PM) (Source: Microsoft-Windows-Directory-Services-SAM) (EventID: 12291) (User: NT-AUTORITÄT)
Description: Das SAM-Modul konnte den TCP/IP- bzw. SPX/IPX-Listening-Thread nicht starten.

Error: (07/21/2015 06:31:33 PM) (Source: Microsoft-Windows-Directory-Services-SAM) (EventID: 12291) (User: NT-AUTORITÄT)
Description: Das SAM-Modul konnte den TCP/IP- bzw. SPX/IPX-Listening-Thread nicht starten.

Error: (07/21/2015 06:31:05 PM) (Source: Service Control Manager) (EventID: 7043) (User: )
Description: Der Dienst Gruppenrichtlinienclient konnte nach dem Empfang eines Preshutdown-Steuerelements nicht richtig heruntergefahren werden.


Microsoft Office:
=========================
Error: (07/20/2015 12:50:55 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: WIEBKE-LAPTOP)
Description: microsoft.windowscommunicationsapps_8wekyb3d8bbwe!ppleae38af2e007f4358a809ac99a64a67c1-2144927141

Error: (07/20/2015 12:50:55 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: WIEBKE-LAPTOP)
Description: microsoft.windowscommunicationsapps_8wekyb3d8bbwe!ppleae38af2e007f4358a809ac99a64a67c1-2144927141

Error: (07/20/2015 12:50:50 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: WIEBKE-LAPTOP)
Description: microsoft.windowscommunicationsapps_8wekyb3d8bbwe!ppleae38af2e007f4358a809ac99a64a67c1-2144927141

Error: (07/17/2015 03:49:29 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: WIEBKE-LAPTOP)
Description: microsoft.windowscommunicationsapps_8wekyb3d8bbwe!ppleae38af2e007f4358a809ac99a64a67c1-2144927141

Error: (07/17/2015 02:34:17 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: WmiApRplC:\Windows\system32\wbem\wmiaprpl.dll4

Error: (07/17/2015 02:34:17 PM) (Source: Perflib) (EventID: 1023) (User: )
Description: rdyboost4

Error: (07/17/2015 02:34:17 PM) (Source: PerfNet) (EventID: 2004) (User: )
Description: 

Error: (07/17/2015 02:34:17 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: MSDTCC:\Windows\system32\msdtcuiu.DLL4

Error: (07/17/2015 02:34:17 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: LsaC:\Windows\System32\Secur32.dll4

Error: (07/17/2015 02:34:17 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: ESENTC:\Windows\system32\esentprf.dll4


CodeIntegrity Errors:
===================================
  Date: 2015-07-21 18:08:30.794
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-07-21 18:08:30.372
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-07-21 18:08:30.029
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-07-21 18:08:29.669
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-07-21 18:08:29.247
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-07-21 18:08:28.419
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-07-21 18:08:28.075
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-07-21 18:08:27.294
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-07-21 18:08:26.529
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-07-21 18:08:26.169
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i5-3337U CPU @ 1.80GHz
Percentage of memory in use: 32%
Total physical RAM: 8082.06 MB
Available physical RAM: 5478.13 MB
Total Virtual: 9362.06 MB
Available Virtual: 6457.49 MB

==================== Drives ================================

Drive c: (Windows) (Fixed) (Total:202.89 GB) (Free:59.5 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 223.6 GB) (Disk ID: D97FD5C1)

Partition: GPT Partition Type.

==================== End of log ============================
         

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-07-23 11:39:00
Windows 6.2.9200  x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 Micron_M rev.MU03 223,57GB
Running: Gmer-19357.exe; Driver: C:\Users\Wiebke\AppData\Local\Temp\pxryrkow.sys


---- User code sections - GMER 2.1 ----

.text    C:\Windows\system32\AUDIODG.EXE[7492] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                                                                        00007ffbed151270 5 bytes JMP 00007ffc6d280460
.text    C:\Windows\system32\AUDIODG.EXE[7492] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                                                                 00007ffbed1512c0 1 byte JMP 00007ffc6d280450
.text    C:\Windows\system32\AUDIODG.EXE[7492] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject + 2                                                                                                             00007ffbed1512c2 3 bytes {JMP 0xffffffff8012f190}
.text    C:\Windows\system32\AUDIODG.EXE[7492] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                                                                 00007ffbed151420 5 bytes JMP 00007ffc6d280370
.text    C:\Windows\system32\AUDIODG.EXE[7492] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                                                                      00007ffbed151470 5 bytes JMP 00007ffc6d280470
.text    C:\Windows\system32\AUDIODG.EXE[7492] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                                                            00007ffbed151480 5 bytes JMP 00007ffc6d2803e0
.text    C:\Windows\system32\AUDIODG.EXE[7492] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                                                                 00007ffbed151530 5 bytes JMP 00007ffc6d280320
.text    C:\Windows\system32\AUDIODG.EXE[7492] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                                                          00007ffbed151560 5 bytes JMP 00007ffc6d2803b0
.text    C:\Windows\system32\AUDIODG.EXE[7492] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                                                             00007ffbed151580 5 bytes JMP 00007ffc6d280390
.text    C:\Windows\system32\AUDIODG.EXE[7492] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                                                                   00007ffbed1515c0 5 bytes JMP 00007ffc6d2802e0
.text    C:\Windows\system32\AUDIODG.EXE[7492] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                                                                 00007ffbed151640 1 byte JMP 00007ffc6d2802d0
.text    C:\Windows\system32\AUDIODG.EXE[7492] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent + 2                                                                                                             00007ffbed151642 3 bytes {JMP 0xffffffff8012ec90}
.text    C:\Windows\system32\AUDIODG.EXE[7492] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                                                               00007ffbed151660 5 bytes JMP 00007ffc6d280310
.text    C:\Windows\system32\AUDIODG.EXE[7492] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                                                                00007ffbed1516a0 5 bytes JMP 00007ffc6d2803c0
.text    C:\Windows\system32\AUDIODG.EXE[7492] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                                                             00007ffbed1516f0 5 bytes JMP 00007ffc6d2803f0
.text    C:\Windows\system32\AUDIODG.EXE[7492] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                                                                00007ffbed151850 5 bytes JMP 00007ffc6d280230
.text    C:\Windows\system32\AUDIODG.EXE[7492] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                                                                     00007ffbed151a40 5 bytes JMP 00007ffc6d280480
.text    C:\Windows\system32\AUDIODG.EXE[7492] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                                                                    00007ffbed151a70 5 bytes JMP 00007ffc6d2803a0
.text    C:\Windows\system32\AUDIODG.EXE[7492] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                                                             00007ffbed151b90 5 bytes JMP 00007ffc6d2802f0
.text    C:\Windows\system32\AUDIODG.EXE[7492] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                                                          00007ffbed151bb0 5 bytes JMP 00007ffc6d280350
.text    C:\Windows\system32\AUDIODG.EXE[7492] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                                                                00007ffbed151c20 5 bytes JMP 00007ffc6d280290
.text    C:\Windows\system32\AUDIODG.EXE[7492] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                                                             00007ffbed151cb0 5 bytes JMP 00007ffc6d2802b0
.text    C:\Windows\system32\AUDIODG.EXE[7492] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                                                              00007ffbed151cd0 5 bytes JMP 00007ffc6d2803d0
.text    C:\Windows\system32\AUDIODG.EXE[7492] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                                                                 00007ffbed151ce0 5 bytes JMP 00007ffc6d280330
.text    C:\Windows\system32\AUDIODG.EXE[7492] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                                                          00007ffbed151d90 5 bytes JMP 00007ffc6d280410
.text    C:\Windows\system32\AUDIODG.EXE[7492] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                                                             00007ffbed151dc0 5 bytes JMP 00007ffc6d280240
.text    C:\Windows\system32\AUDIODG.EXE[7492] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                                                                  00007ffbed1520e0 5 bytes JMP 00007ffc6d2801e0
.text    C:\Windows\system32\AUDIODG.EXE[7492] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                                                             00007ffbed1521a0 5 bytes JMP 00007ffc6d280250
.text    C:\Windows\system32\AUDIODG.EXE[7492] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                                                             00007ffbed1521d0 5 bytes JMP 00007ffc6d280490
.text    C:\Windows\system32\AUDIODG.EXE[7492] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                                                                    00007ffbed1521e0 5 bytes JMP 00007ffc6d2804a0
.text    C:\Windows\system32\AUDIODG.EXE[7492] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                                                               00007ffbed152210 5 bytes JMP 00007ffc6d280300
.text    C:\Windows\system32\AUDIODG.EXE[7492] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                                                            00007ffbed152220 5 bytes JMP 00007ffc6d280360
.text    C:\Windows\system32\AUDIODG.EXE[7492] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                                                                  00007ffbed152280 5 bytes JMP 00007ffc6d2802a0
.text    C:\Windows\system32\AUDIODG.EXE[7492] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                                                               00007ffbed1522d0 5 bytes JMP 00007ffc6d2802c0
.text    C:\Windows\system32\AUDIODG.EXE[7492] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                                                                  00007ffbed152300 5 bytes JMP 00007ffc6d280380
.text    C:\Windows\system32\AUDIODG.EXE[7492] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                                                                   00007ffbed152310 5 bytes JMP 00007ffc6d280340
.text    C:\Windows\system32\AUDIODG.EXE[7492] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                                                            00007ffbed152620 5 bytes JMP 00007ffc6d280440
.text    C:\Windows\system32\AUDIODG.EXE[7492] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                                                           00007ffbed152820 5 bytes JMP 00007ffc6d280260
.text    C:\Windows\system32\AUDIODG.EXE[7492] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                                                              00007ffbed152830 5 bytes JMP 00007ffc6d280270
.text    C:\Windows\system32\AUDIODG.EXE[7492] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                                            00007ffbed152850 5 bytes JMP 00007ffc6d280400
.text    C:\Windows\system32\AUDIODG.EXE[7492] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                                                        00007ffbed152a30 5 bytes JMP 00007ffc6d2801f0
.text    C:\Windows\system32\AUDIODG.EXE[7492] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                                                                         00007ffbed152a40 5 bytes JMP 00007ffc6d280210
.text    C:\Windows\system32\AUDIODG.EXE[7492] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                                                              00007ffbed152ad0 5 bytes JMP 00007ffc6d280200
.text    C:\Windows\system32\AUDIODG.EXE[7492] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                                                              00007ffbed152b40 5 bytes JMP 00007ffc6d280420
.text    C:\Windows\system32\AUDIODG.EXE[7492] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                                                               00007ffbed152b50 5 bytes JMP 00007ffc6d280430
.text    C:\Windows\system32\AUDIODG.EXE[7492] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                                                          00007ffbed152b60 5 bytes JMP 00007ffc6d280220
.text    C:\Windows\system32\AUDIODG.EXE[7492] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                                                                  00007ffbed152c70 5 bytes JMP 00007ffc6d280280

---- Threads - GMER 2.1 ----

Thread   C:\Windows\system32\csrss.exe [3560:3628]                                                                                                                                                         fffff960009172d0
---- Processes - GMER 2.1 ----

Library  C:\Program Files\WindowsApps\Microsoft.BingNews_3.0.4.336_x64__8wekyb3d8bbwe\Microsoft.PerfTrack.winmd (*** suspicious ***) @ C:\Windows\system32\wwahost.exe [1000] (FILE NOT FOUND)             000000bd098a0000
Library  C:\Program Files\WindowsApps\Microsoft.BingNews_3.0.4.336_x64__8wekyb3d8bbwe\Microsoft.Bing.AppEx.Telemetry.winmd (*** suspicious ***) @ C:\Windows\system32\wwahost.exe [1000] (FILE NOT FOUND)  000000bd251c0000
Library  C:\Program Files\WindowsApps\Microsoft.BingNews_3.0.4.336_x64__8wekyb3d8bbwe\SqliteWrapper.winmd (*** suspicious ***) @ C:\Windows\system32\wwahost.exe [1000] (FILE NOT FOUND)                   000000bd22400000
Library  C:\Program Files\WindowsApps\Microsoft.BingNews_3.0.4.336_x64__8wekyb3d8bbwe\Newtonsoft.Json.DLL (*** suspicious ***) @ C:\Windows\system32\wwahost.exe [1000] (FILE NOT FOUND)                   000000bd284d0000

---- Disk sectors - GMER 2.1 ----

Disk     \Device\Harddisk0\DR0                                                                                                                                                                             unknown MBR code

---- EOF - GMER 2.1 ----