Problem beim Starten von .dll - Das angebene Modul wurde nicht gefunden

akakesios · 02.01.2016, 19:54

Nein, die Fehlermeldungen kommen nicht mehr!
Der Link:

https://www.virustotal.com/de/file/2...is/1451760755/

M-K-D-B · 03.01.2016, 09:49

Servus,

Wir entfernen die letzten Reste und kontrollieren nochmal alles.

Hinweis: Der Suchlauf mit ESET kann länger dauern.

Schritt 1
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

start
CloseProcesses:
C:\WINDOWS\system32\Drivers\sdfhgdf.sys
C:\Users\Imre\AppData\Local\Omrkics
AlternateDataStreams: C:\WINDOWS\system32\Drivers\sdfhgdf.sys:{6289c87f-ae25-11e5-8292-20256487a424}
AlternateDataStreams: C:\WINDOWS\system32\Drivers\sdfhgdf.sys:{6289c880-ae25-11e5-8292-20256487a424}
AlternateDataStreams: C:\WINDOWS\system32\Drivers\sdfhgdf.sys:{6289ca6b-ae25-11e5-8292-20256487a424}
AlternateDataStreams: C:\WINDOWS\system32\Drivers\sdfhgdf.sys:{6289ca6c-ae25-11e5-8292-20256487a424}
AlternateDataStreams: C:\ProgramData\TEMP:157E1AD3
Unlock: C:\WINDOWS\system32\Drivers\etc\hosts
C:\WINDOWS\system32\Drivers\etc\hosts
Hosts: 
RemoveProxy:
Reboot:
end

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Schritt 2
Downloade dir die passende Version von HitmanPro auf deinen Desktop: HitmanPro - 32 Bit | HitmanPro - 64 Bit.

Starte die HitmanPro.exe
Klicke auf
Entferne den Haken bei
Klicke auf
und
Akzeptiere die Lizenzbedingungen und klicke auf
Klicke auf

und auf
Wenn der Scan beendet wurde, nichts löschen lassen etc. sondern wähle unten links auf der Button-Leiste
und speichere die Logdatei auf Deinem Desktop.
Schließe HitmanPro und poste mir das Log.

Schritt 3

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Schritt 4

Starte die FRST.exe erneut. Setze einen Haken vor Addition.txt und drücke auf Untersuchen.
FRST erstellt wieder zwei Logdateien (FRST.txt und Addition.txt).
Poste mir beide Logdateien mit deiner nächsten Antwort.

Bitte poste mit deiner nächsten Antwort

die Logdatei des FRST-Fix,
die Logdatei von HitmanPro,
die Logdatei von ESET,
die beiden neuen Logdateien von FRST.

akakesios · 03.01.2016, 18:47

Code:

ATTFilter

Fix result of Farbar Recovery Scan Tool (x64) Version:31-12-2015
Ran by Imre (2016-01-03 12:52:05) Run:3
Running from C:\Users\Imre\Desktop
Loaded Profiles: Imre & UpdatusUser (Available Profiles: Imre & UpdatusUser)
Boot Mode: Normal
==============================================

fixlist content:
*****************
start
CloseProcesses:
C:\WINDOWS\system32\Drivers\sdfhgdf.sys
C:\Users\Imre\AppData\Local\Omrkics
AlternateDataStreams: C:\WINDOWS\system32\Drivers\sdfhgdf.sys:{6289c87f-ae25-11e5-8292-20256487a424}
AlternateDataStreams: C:\WINDOWS\system32\Drivers\sdfhgdf.sys:{6289c880-ae25-11e5-8292-20256487a424}
AlternateDataStreams: C:\WINDOWS\system32\Drivers\sdfhgdf.sys:{6289ca6b-ae25-11e5-8292-20256487a424}
AlternateDataStreams: C:\WINDOWS\system32\Drivers\sdfhgdf.sys:{6289ca6c-ae25-11e5-8292-20256487a424}
AlternateDataStreams: C:\ProgramData\TEMP:157E1AD3
Unlock: C:\WINDOWS\system32\Drivers\etc\hosts
C:\WINDOWS\system32\Drivers\etc\hosts
Hosts: 
RemoveProxy:
Reboot:
end
*****************

Processes closed successfully.
C:\WINDOWS\system32\Drivers\sdfhgdf.sys => moved successfully
C:\Users\Imre\AppData\Local\Omrkics => moved successfully
"C:\WINDOWS\system32\Drivers\sdfhgdf.sys" => ":{6289c87f-ae25-11e5-8292-20256487a424}" ADS not found.
"C:\WINDOWS\system32\Drivers\sdfhgdf.sys" => ":{6289c880-ae25-11e5-8292-20256487a424}" ADS not found.
"C:\WINDOWS\system32\Drivers\sdfhgdf.sys" => ":{6289ca6b-ae25-11e5-8292-20256487a424}" ADS not found.
"C:\WINDOWS\system32\Drivers\sdfhgdf.sys" => ":{6289ca6c-ae25-11e5-8292-20256487a424}" ADS not found.
C:\ProgramData\TEMP => ":157E1AD3" ADS removed successfully.
"C:\WINDOWS\system32\Drivers\etc\hosts" => was unlocked
C:\WINDOWS\system32\Drivers\etc\hosts => moved successfully
Hosts restored successfully.

========= RemoveProxy: =========

HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully
HKU\S-1-5-21-253609680-664229831-636946120-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully
HKU\S-1-5-21-253609680-664229831-636946120-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully


========= End of RemoveProxy: =========



The system needed a reboot.

==== End of Fixlog 12:52:07 ====

Code:

ATTFilter


	Code: 

 ATTFilter

  
	HitmanPro 3.7.12.253
www.hitmanpro.com

   Computer name . . . . : LENOVO-G710
   Windows . . . . . . . : 10.0.0.10586.X64/4
   User name . . . . . . : LENOVO-G710\Imre
   UAC . . . . . . . . . : Enabled
   License . . . . . . . : Free

   Scan date . . . . . . : 2016-01-03 12:55:10
   Scan mode . . . . . . : Normal
   Scan duration . . . . : 10m 33s
   Disk access mode  . . : Direct disk access (SRB)
   Cloud . . . . . . . . : Internet
   Reboot  . . . . . . . : No

   Threats . . . . . . . : 3
   Traces  . . . . . . . : 7

   Objects scanned . . . : 2.335.093
   Files scanned . . . . : 107.765
   Remnants scanned  . . : 875.166 files / 1.352.162 keys

Malware _____________________________________________________________________

   C:\Users\Imre\AppData\Local\Temp\f9626892-7a78-3199-abd2-97bbce96297b\adv_64.exe
      Size . . . . . . . : 903.796 bytes
      Age  . . . . . . . : 3.9 days (2015-12-30 14:26:36)
      Entropy  . . . . . : 8.0
      SHA-256  . . . . . : 9597E5A6FA7F5CC439F8509964E36AB3AFFE38D218AEE81DA86A05D4AE6CF67F
    > Bitdefender  . . . : Gen:Variant.Adware.Graftor.262556
    > Kaspersky  . . . . : not-a-virus:AdWare.Win32.Vopak.atcm
      Fuzzy  . . . . . . : 116.0
      Forensic Cluster
         -132.0s C:\Windows\System32\drivers\etc\hp.bak
         -131.6s C:\Users\Imre\AppData\Local\Temp\nst8472.tmp
         -116.2s C:\Users\Imre\AppData\Local\Temp\nscC082.tmp
         -106.0s C:\Users\Imre\AppData\Local\Temp\nsxE833.tmp
         -104.5s C:\Windows\Prefetch\AU_.EXE-D9533DF9.pf
         -104.2s C:\Windows\Prefetch\BU_.EXE-5A52CD2E.pf
         -97.6s C:\Windows\Prefetch\NSXAE.TMP-64F4E553.pf
         -90.0s C:\Users\Imre\AppData\Local\Temp\is-0RB8R.tmp\
         -90.0s C:\Users\Imre\AppData\Local\Temp\is-0RB8R.tmp\dm.tmp
         -89.9s C:\Users\Imre\AppData\Local\Temp\is-1840V.tmp\
         -89.9s C:\Users\Imre\AppData\Local\Temp\is-1840V.tmp\_isetup\
         -89.9s C:\Users\Imre\AppData\Local\Temp\is-1840V.tmp\_isetup\_setup64.tmp
         -89.9s C:\Users\Imre\AppData\Local\Temp\is-1840V.tmp\_isetup\_shfoldr.dll
         -89.9s C:\Users\Imre\AppData\Local\Temp\is-1840V.tmp\ittray.dll
         -89.8s C:\Users\Imre\AppData\Local\Temp\is-1840V.tmp\itdownload.dll
         -89.8s C:\Users\Imre\AppData\Local\Temp\is-1840V.tmp\SysInfo.dll
         -81.7s C:\Users\Imre\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\FD82AA2A7A17815C43EADDE2B759169D_3AA68C9E33C8EF946DA997B7D70B528C
         -81.7s C:\Users\Imre\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\FD82AA2A7A17815C43EADDE2B759169D_3AA68C9E33C8EF946DA997B7D70B528C
         -81.6s C:\Users\Imre\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\2C8B0568ACDEB574122D9DD255908CFF_106BFE31A213D41B5BF734F641526F07
         -81.6s C:\Users\Imre\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\2C8B0568ACDEB574122D9DD255908CFF_106BFE31A213D41B5BF734F641526F07
         -80.2s C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_Microsoft.Micros_b7ce8aab4f84d2ccc8a36e2fdaf0676f971466_0210d7ec_25ad4d44\
         -80.2s C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_Microsoft.Micros_b7ce8aab4f84d2ccc8a36e2fdaf0676f971466_0210d7ec_25ad4d44\Report.wer
         -79.9s C:\Windows\Prefetch\DM.TMP-EE1FB5FF.pf
         -77.8s C:\Users\Imre\AppData\Local\Temp\is-MDNGE.tmp\
         -77.8s C:\Users\Imre\AppData\Local\Temp\is-MDNGE.tmp\myoffergroup_de.tmp
         -77.7s C:\Users\Imre\AppData\Local\Temp\is-5O7SA.tmp\
         -77.7s C:\Users\Imre\AppData\Local\Temp\is-5O7SA.tmp\_isetup\
         -77.7s C:\Users\Imre\AppData\Local\Temp\is-5O7SA.tmp\_isetup\_setup64.tmp
         -77.7s C:\Users\Imre\AppData\Local\Temp\is-5O7SA.tmp\_isetup\_shfoldr.dll
         -75.6s C:\Users\Imre\AppData\Local\Temp\is-1840V.tmp\adisplayoffers.xml
         -71.4s C:\Users\Imre\AppData\Local\Temp\is-5O7SA.tmp\gentlemjmp_ieu.exe
         -69.3s C:\Users\Imre\AppData\Local\Temp\avg77A0.tmp
         -67.7s C:\Windows\Prefetch\MYOFFERGROUP_DE.TMP-F5D20E7C.pf
         -67.7s C:\Users\Imre\AppData\Local\Temp\is-5O7SA.tmp\cmd.bat
         -67.7s C:\Users\Imre\AppData\Local\Temp\f9626892-7a78-3199-abd2-97bbce96297b\
         -66.4s C:\Users\Imre\AppData\Local\Temp\is-9UA7D.tmp\
         -66.4s C:\Users\Imre\AppData\Local\Temp\is-9UA7D.tmp\gentlemjmp_ieu.tmp
         -66.3s C:\Users\Imre\AppData\Local\Temp\is-P8QJ8.tmp\
         -66.3s C:\Users\Imre\AppData\Local\Temp\is-P8QJ8.tmp\_isetup\
         -66.3s C:\Users\Imre\AppData\Local\Temp\is-P8QJ8.tmp\_isetup\_setup64.tmp
         -66.3s C:\Users\Imre\AppData\Local\Temp\is-P8QJ8.tmp\_isetup\_shfoldr.dll
         -66.3s C:\Users\Imre\AppData\Local\Temp\is-P8QJ8.tmp\isskin.dll
         -66.2s C:\Users\Imre\AppData\Local\Temp\is-P8QJ8.tmp\itdownload.dll
         -66.2s C:\Users\Imre\AppData\Local\Temp\is-P8QJ8.tmp\innocallback.dll
         -65.5s C:\Windows\Installer\SourceHash{9C0F80FF-8C45-466C-83E1-09AA7ED1CE34}
         -63.2s C:\FRST\Quarantine\C\Program Files (x86)\mozilla firefox\432D46648BB2740E3F334A083E170B17432D.xBAD
         -63.1s C:\FRST\Quarantine\C\WINDOWS\System32\Tasks\Video Call.xBAD
         -63.1s C:\FRST\Quarantine\C\WINDOWS\System32\Tasks\Video Call2.xBAD
         -60.2s C:\Users\Imre\AppData\Local\Temp\is-P8QJ8.tmp\itd_en.ini
         -56.3s C:\Windows\Prefetch\GENTLEMJMP_IEU.TMP-512E8D67.pf
         -38.4s C:\Users\Imre\AppData\Local\Temp\is-P8QJ8.tmp\myxmlconffile.xml
         -38.1s C:\Users\Imre\AppData\Local\Temp\is-P8QJ8.tmp\res_0_1.bin
         -37.5s C:\Users\Imre\AppData\Local\Temp\is-P8QJ8.tmp\res_0_7.bin
         -36.4s C:\Windows\Prefetch\UNINSTALLMANAGER.EXE-BDECD37E.pf
         -35.5s C:\Users\Imre\AppData\Local\Temp\is-P8QJ8.tmp\res_0_9.bin
         -35.2s C:\Users\Imre\AppData\Local\Temp\is-P8QJ8.tmp\res_0_10.bin
         -35.0s C:\Users\Imre\AppData\Local\Temp\is-P8QJ8.tmp\res_0_11.bin
         -34.0s C:\Users\Imre\AppData\Local\Temp\is-P8QJ8.tmp\res_0_19.bin
         -32.4s C:\Users\Imre\AppData\Local\Temp\is-P8QJ8.tmp\res_0_24.bin
         -32.2s C:\Users\Imre\AppData\Local\Temp\is-P8QJ8.tmp\res_1_24.bin
         -31.4s C:\Users\Imre\AppData\Local\Temp\is-492SA.tmp\
         -31.4s C:\Users\Imre\AppData\Local\Temp\is-492SA.tmp\predm.tmp
         -31.3s C:\Users\Imre\AppData\Local\Temp\is-8MCLE.tmp\
         -31.3s C:\Users\Imre\AppData\Local\Temp\is-8MCLE.tmp\_isetup\
         -31.3s C:\Users\Imre\AppData\Local\Temp\is-8MCLE.tmp\_isetup\_setup64.tmp
         -31.3s C:\Users\Imre\AppData\Local\Temp\is-8MCLE.tmp\_isetup\_shfoldr.dll
         -31.3s C:\Users\Imre\AppData\Local\Temp\is-8MCLE.tmp\itdownload.dll
         -31.2s C:\Users\Imre\AppData\Local\Temp\is-P8QJ8.tmp\ShowModalImage2.bmp
         -31.2s C:\Users\Imre\AppData\Local\Temp\is-P8QJ8.tmp\ShowModalImagebuttonok.bmp
         -30.3s C:\Users\Imre\AppData\Local\Temp\is-S4SQG.tmp\
         -30.3s C:\Users\Imre\AppData\Local\Temp\is-S4SQG.tmp\dm.tmp
         -30.2s C:\Users\Imre\AppData\Local\Temp\is-0I6JK.tmp\
         -30.2s C:\Users\Imre\AppData\Local\Temp\is-0I6JK.tmp\_isetup\
         -30.2s C:\Users\Imre\AppData\Local\Temp\is-0I6JK.tmp\_isetup\_setup64.tmp
         -30.2s C:\Users\Imre\AppData\Local\Temp\is-0I6JK.tmp\_isetup\_shfoldr.dll
         -30.1s C:\Users\Imre\AppData\Local\Temp\is-0I6JK.tmp\itdownload.dll
         -23.2s C:\Windows\Prefetch\MBOT_DE_014010192 - UNINSTALL-F1480BB5.pf
         -21.3s C:\Windows\Prefetch\PREDM.TMP-730F46A3.pf
         -20.5s C:\Users\Imre\AppData\Local\Temp\is-3ND65.tmp\
         -20.5s C:\Users\Imre\AppData\Local\Temp\is-3ND65.tmp\TUTOBUN.tmp
         -20.4s C:\Users\Imre\AppData\Local\Temp\is-O2IR8.tmp\
         -20.4s C:\Users\Imre\AppData\Local\Temp\is-O2IR8.tmp\_isetup\
         -20.4s C:\Users\Imre\AppData\Local\Temp\is-O2IR8.tmp\_isetup\_setup64.tmp
         -20.4s C:\Users\Imre\AppData\Local\Temp\is-O2IR8.tmp\_isetup\_shfoldr.dll
         -20.4s C:\Users\Imre\AppData\Local\Temp\is-O2IR8.tmp\isskin.dll
         -20.3s C:\Users\Imre\AppData\Local\Temp\is-O2IR8.tmp\itdownload.dll
         -20.3s C:\Users\Imre\AppData\Local\Temp\is-O2IR8.tmp\innocallback.dll
         -20.2s C:\Windows\Prefetch\DM.TMP-A1EBFC2B.pf
         -18.4s C:\FRST\Quarantine\C\Users\Public\Documents\Baidu\
         -18.4s C:\FRST\Quarantine\C\Users\Public\Documents\Baidu\Common\I18N\
         -18.4s C:\FRST\Quarantine\C\Users\Public\Documents\Baidu\Common\
         -18.4s C:\FRST\Quarantine\C\Users\Public\Documents\Baidu\Common\I18N\conf.db
         -18.4s C:\FRST\Quarantine\C\Users\Public\Documents\Baidu\Common\I18N\IPCSUpdateCache\
         -18.4s C:\FRST\Quarantine\C\Users\Public\Documents\Baidu\Common\I18N\IPCSUpdateCache\pariente_desktoptool_soft_partner\
         -18.4s C:\Users\Imre\AppData\Local\Temp\{386C8B8D-E939-4fbc-9658-18521092C408}\
         -18.3s C:\Users\Imre\AppData\Local\Temp\{386C8B8D-E939-4fbc-9658-18521092C408}\Tool.exe.info
         -13.4s C:\Windows\Prefetch\INSTALLHELPER.EXE-E6AA0562.pf
         -10.4s C:\Windows\Prefetch\TUTOBUN.TMP-2F9979A9.pf
         -8.6s C:\Users\Imre\AppData\Local\Temp\san679E.tmp
         -8.4s C:\Users\Imre\AppData\Local\Temp\sange
         -8.0s C:\Users\Imre\AppData\Local\Temp\pee69E2.tmp
         -7.8s C:\Users\Imre\AppData\Local\Temp\peedg
         -7.4s C:\Users\Imre\AppData\Local\Temp\leg6C15.tmp
         -7.3s C:\Windows\rsrcs.dll
         -7.3s C:\Users\Imre\AppData\Local\Temp\Search.lnk
         -7.3s C:\Users\Imre\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{CD661C90-0D60-455B-85AE-F668BB2CF98D}.ico
         -6.2s C:\Users\Imre\AppData\Local\Temp\Bro70E4.tmp
         -5.7s C:\Users\Imre\AppData\Local\Temp\Microsoft Edge.lnk
         -4.8s C:\Windows\Prefetch\7ZG.EXE-2A7D43BC.pf
         -4.7s C:\Windows\Prefetch\BRAKIETUT_TUTBL_SETUP.EXE-DE3735CA.pf
         -3.0s C:\FRST\Quarantine\C\WINDOWS\System32\Drivers\sdfhgdf.sys.xBAD
         -2.6s C:\Windows\Prefetch\SCHTASKS.EXE-7E9C9BE3.pf
         -1.3s C:\Users\Imre\AppData\Local\Temp\avg840F.tmp
          0.0s C:\Users\Imre\AppData\Local\Temp\f9626892-7a78-3199-abd2-97bbce96297b\adv_64.exe
          8.7s C:\Windows\Prefetch\DESKBAR.EXE-03DEB2E5.pf
         11.7s C:\Users\Imre\AppData\Local\Temp\is-O2IR8.tmp\myxmlconffile.xml
         12.0s C:\Users\Imre\AppData\Local\Temp\setB82F.tmp
         16.6s C:\Users\Imre\AppData\Local\Temp\is-O2IR8.tmp\res_0_7.bin
         18.6s C:\Windows\Prefetch\BROWSERAIRINST.TMP-66ECE558.pf
         19.4s C:\Users\Imre\AppData\Local\Temp\is-O2IR8.tmp\res_0_10.bin
         20.1s C:\Windows\Prefetch\NSL93F2.TMP-31ED713D.pf
         21.2s C:\Users\Imre\AppData\Local\Temp\chrome_installer.log
         21.8s C:\Users\Imre\AppData\Local\Temp\1451482018ico\
         21.8s C:\Users\Imre\AppData\Local\Temp\1451482018ico\facebook.ico
         21.8s C:\Users\Imre\AppData\Local\Temp\1451482018ico\gmail.ico
         21.8s C:\Users\Imre\AppData\Local\Temp\1451482018ico\hotmail.ico
         21.8s C:\Users\Imre\AppData\Local\Temp\1451482018ico\vk.ico
         21.8s C:\Users\Imre\AppData\Local\Temp\1451482018ico\yahoo.ico
         26.7s C:\Users\Imre\AppData\Local\Temp\is-O2IR8.tmp\res_0_24.bin
         26.8s C:\Users\Imre\AppData\Local\Temp\is-O2IR8.tmp\res_1_24.bin
         32.6s C:\Users\Imre\AppData\Local\Temp\is-VJ9UO.tmp\
         32.7s C:\Users\Imre\AppData\Local\Temp\is-KUJS3.tmp\
         32.7s C:\Users\Imre\AppData\Local\Temp\is-KUJS3.tmp\_isetup\
         32.7s C:\Users\Imre\AppData\Local\Temp\is-KUJS3.tmp\_isetup\_setup64.tmp
         32.7s C:\Users\Imre\AppData\Local\Temp\is-KUJS3.tmp\_isetup\_shfoldr.dll
         32.8s C:\Users\Imre\AppData\Local\Temp\is-KUJS3.tmp\itdownload.dll
         34.1s C:\Windows\Prefetch\BROWSERAIR.EXE-DD12EBF7.pf
         37.6s C:\Users\Imre\AppData\Local\Temp\{DB8793DB-6A67-49CA-9B12-846BE2A6B36E}.png
         37.7s C:\Users\Imre\AppData\Local\Temp\Microsoft.Explorer.Notification.{809EC1CA-1C66-58FC-D869-2B0D9DBD111A}.png
         40.0s C:\Users\Imre\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A34B45DD28A5DAEFDA3E0BA2FCE7DE24_EFCD2A3033637D394903AA5E7C807735
         40.0s C:\Users\Imre\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A34B45DD28A5DAEFDA3E0BA2FCE7DE24_EFCD2A3033637D394903AA5E7C807735
         42.8s C:\Windows\Prefetch\465.TMP-517E53B0.pf
         43.8s C:\Users\Imre\AppData\Local\Temp\is-8SC33.tmp\
         43.8s C:\Users\Imre\AppData\Local\Temp\is-8SC33.tmp\_isetup\
         43.8s C:\Users\Imre\AppData\Local\Temp\is-8SC33.tmp\_isetup\_setup64.tmp
         43.8s C:\Users\Imre\AppData\Local\Temp\is-8SC33.tmp\_isetup\_shfoldr.dll
         43.8s C:\Users\Imre\AppData\Local\Temp\is-8SC33.tmp\7za.exe
         43.8s C:\Users\Imre\AppData\Local\Temp\is-8SC33.tmp\437_.exe
         56.8s C:\Users\Imre\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E7EC0C85688F4738F3BE49B104BA67
         56.8s C:\Users\Imre\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E7EC0C85688F4738F3BE49B104BA67
         56.9s C:\Users\Imre\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3B179347615B32FE859CEABBE50C3EE6_7D69DE49F08EF5F5DF090781785AAD6C
         56.9s C:\Users\Imre\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3B179347615B32FE859CEABBE50C3EE6_7D69DE49F08EF5F5DF090781785AAD6C
         58.2s C:\Windows\Prefetch\PACKAGE_BUBBLESOUND_INSTALLER-D64CAAA2.pf
         58.4s C:\Users\Imre\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\
         58.4s C:\Users\Imre\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\SwiftSearchAutoUpdateClient.exe.log
         64.3s C:\Users\Imre\Desktop\Hörspiele\Takimo.-.21.-.Xyphon\3D BubbleSound.lnk
         65.6s C:\Windows\Prefetch\SILENTINSTALLER.EXE-4A8F647B.pf

   C:\Users\Imre\AppData\Local\Temp\nscC082.tmp
      Size . . . . . . . : 433.778 bytes
      Age  . . . . . . . : 3.9 days (2015-12-30 14:24:40)
      Entropy  . . . . . : 8.0
      SHA-256  . . . . . : B580F398C4037971824A8C7C75D9F08BEDA83E980BB89C3C3173662B80C0DE27
    > Kaspersky  . . . . : Trojan-Downloader.Win32.Genome.wvhd
      Fuzzy  . . . . . . : 120.0
      Forensic Cluster
         -15.7s C:\Windows\System32\drivers\etc\hp.bak
         -15.4s C:\Users\Imre\AppData\Local\Temp\nst8472.tmp
          0.0s C:\Users\Imre\AppData\Local\Temp\nscC082.tmp
         10.2s C:\Users\Imre\AppData\Local\Temp\nsxE833.tmp
         11.7s C:\Windows\Prefetch\AU_.EXE-D9533DF9.pf
         12.1s C:\Windows\Prefetch\BU_.EXE-5A52CD2E.pf
         18.7s C:\Windows\Prefetch\NSXAE.TMP-64F4E553.pf
         26.3s C:\Users\Imre\AppData\Local\Temp\is-0RB8R.tmp\
         26.3s C:\Users\Imre\AppData\Local\Temp\is-0RB8R.tmp\dm.tmp
         26.4s C:\Users\Imre\AppData\Local\Temp\is-1840V.tmp\
         26.4s C:\Users\Imre\AppData\Local\Temp\is-1840V.tmp\_isetup\
         26.4s C:\Users\Imre\AppData\Local\Temp\is-1840V.tmp\_isetup\_setup64.tmp
         26.4s C:\Users\Imre\AppData\Local\Temp\is-1840V.tmp\_isetup\_shfoldr.dll
         26.4s C:\Users\Imre\AppData\Local\Temp\is-1840V.tmp\ittray.dll
         26.4s C:\Users\Imre\AppData\Local\Temp\is-1840V.tmp\itdownload.dll
         26.5s C:\Users\Imre\AppData\Local\Temp\is-1840V.tmp\SysInfo.dll
         34.5s C:\Users\Imre\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\FD82AA2A7A17815C43EADDE2B759169D_3AA68C9E33C8EF946DA997B7D70B528C
         34.5s C:\Users\Imre\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\FD82AA2A7A17815C43EADDE2B759169D_3AA68C9E33C8EF946DA997B7D70B528C
         34.6s C:\Users\Imre\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\2C8B0568ACDEB574122D9DD255908CFF_106BFE31A213D41B5BF734F641526F07
         34.6s C:\Users\Imre\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\2C8B0568ACDEB574122D9DD255908CFF_106BFE31A213D41B5BF734F641526F07
         36.1s C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_Microsoft.Micros_b7ce8aab4f84d2ccc8a36e2fdaf0676f971466_0210d7ec_25ad4d44\
         36.1s C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_Microsoft.Micros_b7ce8aab4f84d2ccc8a36e2fdaf0676f971466_0210d7ec_25ad4d44\Report.wer
         36.4s C:\Windows\Prefetch\DM.TMP-EE1FB5FF.pf
         38.4s C:\Users\Imre\AppData\Local\Temp\is-MDNGE.tmp\
         38.4s C:\Users\Imre\AppData\Local\Temp\is-MDNGE.tmp\myoffergroup_de.tmp
         38.5s C:\Users\Imre\AppData\Local\Temp\is-5O7SA.tmp\
         38.5s C:\Users\Imre\AppData\Local\Temp\is-5O7SA.tmp\_isetup\
         38.5s C:\Users\Imre\AppData\Local\Temp\is-5O7SA.tmp\_isetup\_setup64.tmp
         38.5s C:\Users\Imre\AppData\Local\Temp\is-5O7SA.tmp\_isetup\_shfoldr.dll
         40.7s C:\Users\Imre\AppData\Local\Temp\is-1840V.tmp\adisplayoffers.xml
         44.8s C:\Users\Imre\AppData\Local\Temp\is-5O7SA.tmp\gentlemjmp_ieu.exe
         46.9s C:\Users\Imre\AppData\Local\Temp\avg77A0.tmp
         48.5s C:\Windows\Prefetch\MYOFFERGROUP_DE.TMP-F5D20E7C.pf
         48.5s C:\Users\Imre\AppData\Local\Temp\is-5O7SA.tmp\cmd.bat
         48.6s C:\Users\Imre\AppData\Local\Temp\f9626892-7a78-3199-abd2-97bbce96297b\
         49.9s C:\Users\Imre\AppData\Local\Temp\is-9UA7D.tmp\
         49.9s C:\Users\Imre\AppData\Local\Temp\is-9UA7D.tmp\gentlemjmp_ieu.tmp
         50.0s C:\Users\Imre\AppData\Local\Temp\is-P8QJ8.tmp\
         50.0s C:\Users\Imre\AppData\Local\Temp\is-P8QJ8.tmp\_isetup\
         50.0s C:\Users\Imre\AppData\Local\Temp\is-P8QJ8.tmp\_isetup\_setup64.tmp
         50.0s C:\Users\Imre\AppData\Local\Temp\is-P8QJ8.tmp\_isetup\_shfoldr.dll
         50.0s C:\Users\Imre\AppData\Local\Temp\is-P8QJ8.tmp\isskin.dll
         50.0s C:\Users\Imre\AppData\Local\Temp\is-P8QJ8.tmp\itdownload.dll
         50.0s C:\Users\Imre\AppData\Local\Temp\is-P8QJ8.tmp\innocallback.dll
         50.7s C:\Windows\Installer\SourceHash{9C0F80FF-8C45-466C-83E1-09AA7ED1CE34}
         53.1s C:\FRST\Quarantine\C\Program Files (x86)\mozilla firefox\432D46648BB2740E3F334A083E170B17432D.xBAD
         53.1s C:\FRST\Quarantine\C\WINDOWS\System32\Tasks\Video Call.xBAD
         53.1s C:\FRST\Quarantine\C\WINDOWS\System32\Tasks\Video Call2.xBAD
         56.0s C:\Users\Imre\AppData\Local\Temp\is-P8QJ8.tmp\itd_en.ini
         59.9s C:\Windows\Prefetch\GENTLEMJMP_IEU.TMP-512E8D67.pf
         77.8s C:\Users\Imre\AppData\Local\Temp\is-P8QJ8.tmp\myxmlconffile.xml
         78.1s C:\Users\Imre\AppData\Local\Temp\is-P8QJ8.tmp\res_0_1.bin
         78.8s C:\Users\Imre\AppData\Local\Temp\is-P8QJ8.tmp\res_0_7.bin
         79.9s C:\Windows\Prefetch\UNINSTALLMANAGER.EXE-BDECD37E.pf
         80.8s C:\Users\Imre\AppData\Local\Temp\is-P8QJ8.tmp\res_0_9.bin
         81.0s C:\Users\Imre\AppData\Local\Temp\is-P8QJ8.tmp\res_0_10.bin
         81.2s C:\Users\Imre\AppData\Local\Temp\is-P8QJ8.tmp\res_0_11.bin
         82.2s C:\Users\Imre\AppData\Local\Temp\is-P8QJ8.tmp\res_0_19.bin
         83.9s C:\Users\Imre\AppData\Local\Temp\is-P8QJ8.tmp\res_0_24.bin
         84.0s C:\Users\Imre\AppData\Local\Temp\is-P8QJ8.tmp\res_1_24.bin
         84.8s C:\Users\Imre\AppData\Local\Temp\is-492SA.tmp\
         84.8s C:\Users\Imre\AppData\Local\Temp\is-492SA.tmp\predm.tmp
         84.9s C:\Users\Imre\AppData\Local\Temp\is-8MCLE.tmp\
         84.9s C:\Users\Imre\AppData\Local\Temp\is-8MCLE.tmp\_isetup\
         84.9s C:\Users\Imre\AppData\Local\Temp\is-8MCLE.tmp\_isetup\_setup64.tmp
         84.9s C:\Users\Imre\AppData\Local\Temp\is-8MCLE.tmp\_isetup\_shfoldr.dll
         84.9s C:\Users\Imre\AppData\Local\Temp\is-8MCLE.tmp\itdownload.dll
         85.0s C:\Users\Imre\AppData\Local\Temp\is-P8QJ8.tmp\ShowModalImage2.bmp
         85.0s C:\Users\Imre\AppData\Local\Temp\is-P8QJ8.tmp\ShowModalImagebuttonok.bmp
         86.0s C:\Users\Imre\AppData\Local\Temp\is-S4SQG.tmp\
         86.0s C:\Users\Imre\AppData\Local\Temp\is-S4SQG.tmp\dm.tmp
         86.1s C:\Users\Imre\AppData\Local\Temp\is-0I6JK.tmp\
         86.1s C:\Users\Imre\AppData\Local\Temp\is-0I6JK.tmp\_isetup\
         86.1s C:\Users\Imre\AppData\Local\Temp\is-0I6JK.tmp\_isetup\_setup64.tmp
         86.1s C:\Users\Imre\AppData\Local\Temp\is-0I6JK.tmp\_isetup\_shfoldr.dll
         86.1s C:\Users\Imre\AppData\Local\Temp\is-0I6JK.tmp\itdownload.dll
         93.0s C:\Windows\Prefetch\MBOT_DE_014010192 - UNINSTALL-F1480BB5.pf
         94.9s C:\Windows\Prefetch\PREDM.TMP-730F46A3.pf
         95.7s C:\Users\Imre\AppData\Local\Temp\is-3ND65.tmp\
         95.7s C:\Users\Imre\AppData\Local\Temp\is-3ND65.tmp\TUTOBUN.tmp
         95.8s C:\Users\Imre\AppData\Local\Temp\is-O2IR8.tmp\
         95.8s C:\Users\Imre\AppData\Local\Temp\is-O2IR8.tmp\_isetup\
         95.8s C:\Users\Imre\AppData\Local\Temp\is-O2IR8.tmp\_isetup\_setup64.tmp
         95.8s C:\Users\Imre\AppData\Local\Temp\is-O2IR8.tmp\_isetup\_shfoldr.dll
         95.9s C:\Users\Imre\AppData\Local\Temp\is-O2IR8.tmp\isskin.dll
         95.9s C:\Users\Imre\AppData\Local\Temp\is-O2IR8.tmp\itdownload.dll
         96.0s C:\Users\Imre\AppData\Local\Temp\is-O2IR8.tmp\innocallback.dll
         96.1s C:\Windows\Prefetch\DM.TMP-A1EBFC2B.pf
         97.8s C:\FRST\Quarantine\C\Users\Public\Documents\Baidu\
         97.8s C:\FRST\Quarantine\C\Users\Public\Documents\Baidu\Common\I18N\
         97.8s C:\FRST\Quarantine\C\Users\Public\Documents\Baidu\Common\
         97.8s C:\FRST\Quarantine\C\Users\Public\Documents\Baidu\Common\I18N\conf.db
         97.8s C:\FRST\Quarantine\C\Users\Public\Documents\Baidu\Common\I18N\IPCSUpdateCache\
         97.8s C:\FRST\Quarantine\C\Users\Public\Documents\Baidu\Common\I18N\IPCSUpdateCache\pariente_desktoptool_soft_partner\
         97.8s C:\Users\Imre\AppData\Local\Temp\{386C8B8D-E939-4fbc-9658-18521092C408}\
         97.9s C:\Users\Imre\AppData\Local\Temp\{386C8B8D-E939-4fbc-9658-18521092C408}\Tool.exe.info
         102.8s C:\Windows\Prefetch\INSTALLHELPER.EXE-E6AA0562.pf
         105.8s C:\Windows\Prefetch\TUTOBUN.TMP-2F9979A9.pf
         107.7s C:\Users\Imre\AppData\Local\Temp\san679E.tmp
         107.8s C:\Users\Imre\AppData\Local\Temp\sange
         108.2s C:\Users\Imre\AppData\Local\Temp\pee69E2.tmp
         108.4s C:\Users\Imre\AppData\Local\Temp\peedg
         108.8s C:\Users\Imre\AppData\Local\Temp\leg6C15.tmp
         108.9s C:\Windows\rsrcs.dll
         108.9s C:\Users\Imre\AppData\Local\Temp\Search.lnk
         109.0s C:\Users\Imre\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{CD661C90-0D60-455B-85AE-F668BB2CF98D}.ico
         110.0s C:\Users\Imre\AppData\Local\Temp\Bro70E4.tmp
         110.5s C:\Users\Imre\AppData\Local\Temp\Microsoft Edge.lnk
         111.4s C:\Windows\Prefetch\7ZG.EXE-2A7D43BC.pf
         111.5s C:\Windows\Prefetch\BRAKIETUT_TUTBL_SETUP.EXE-DE3735CA.pf
         113.2s C:\FRST\Quarantine\C\WINDOWS\System32\Drivers\sdfhgdf.sys.xBAD
         113.6s C:\Windows\Prefetch\SCHTASKS.EXE-7E9C9BE3.pf
         114.9s C:\Users\Imre\AppData\Local\Temp\avg840F.tmp
         116.2s C:\Users\Imre\AppData\Local\Temp\f9626892-7a78-3199-abd2-97bbce96297b\adv_64.exe
         125.0s C:\Windows\Prefetch\DESKBAR.EXE-03DEB2E5.pf
         128.0s C:\Users\Imre\AppData\Local\Temp\is-O2IR8.tmp\myxmlconffile.xml
         128.3s C:\Users\Imre\AppData\Local\Temp\setB82F.tmp
         132.9s C:\Users\Imre\AppData\Local\Temp\is-O2IR8.tmp\res_0_7.bin
         134.9s C:\Windows\Prefetch\BROWSERAIRINST.TMP-66ECE558.pf
         135.7s C:\Users\Imre\AppData\Local\Temp\is-O2IR8.tmp\res_0_10.bin
         136.4s C:\Windows\Prefetch\NSL93F2.TMP-31ED713D.pf
         137.5s C:\Users\Imre\AppData\Local\Temp\chrome_installer.log
         138.1s C:\Users\Imre\AppData\Local\Temp\1451482018ico\
         138.1s C:\Users\Imre\AppData\Local\Temp\1451482018ico\facebook.ico
         138.1s C:\Users\Imre\AppData\Local\Temp\1451482018ico\gmail.ico
         138.1s C:\Users\Imre\AppData\Local\Temp\1451482018ico\hotmail.ico
         138.1s C:\Users\Imre\AppData\Local\Temp\1451482018ico\vk.ico
         138.1s C:\Users\Imre\AppData\Local\Temp\1451482018ico\yahoo.ico
         142.9s C:\Users\Imre\AppData\Local\Temp\is-O2IR8.tmp\res_0_24.bin
         143.0s C:\Users\Imre\AppData\Local\Temp\is-O2IR8.tmp\res_1_24.bin
         148.9s C:\Users\Imre\AppData\Local\Temp\is-VJ9UO.tmp\
         149.0s C:\Users\Imre\AppData\Local\Temp\is-KUJS3.tmp\
         149.0s C:\Users\Imre\AppData\Local\Temp\is-KUJS3.tmp\_isetup\
         149.0s C:\Users\Imre\AppData\Local\Temp\is-KUJS3.tmp\_isetup\_setup64.tmp
         149.0s C:\Users\Imre\AppData\Local\Temp\is-KUJS3.tmp\_isetup\_shfoldr.dll
         149.0s C:\Users\Imre\AppData\Local\Temp\is-KUJS3.tmp\itdownload.dll
         150.3s C:\Windows\Prefetch\BROWSERAIR.EXE-DD12EBF7.pf
         153.8s C:\Users\Imre\AppData\Local\Temp\{DB8793DB-6A67-49CA-9B12-846BE2A6B36E}.png
         154.0s C:\Users\Imre\AppData\Local\Temp\Microsoft.Explorer.Notification.{809EC1CA-1C66-58FC-D869-2B0D9DBD111A}.png
         156.2s C:\Users\Imre\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A34B45DD28A5DAEFDA3E0BA2FCE7DE24_EFCD2A3033637D394903AA5E7C807735
         156.2s C:\Users\Imre\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A34B45DD28A5DAEFDA3E0BA2FCE7DE24_EFCD2A3033637D394903AA5E7C807735
         159.0s C:\Windows\Prefetch\465.TMP-517E53B0.pf
         160.0s C:\Users\Imre\AppData\Local\Temp\is-8SC33.tmp\
         160.0s C:\Users\Imre\AppData\Local\Temp\is-8SC33.tmp\_isetup\
         160.0s C:\Users\Imre\AppData\Local\Temp\is-8SC33.tmp\_isetup\_setup64.tmp
         160.0s C:\Users\Imre\AppData\Local\Temp\is-8SC33.tmp\_isetup\_shfoldr.dll
         160.0s C:\Users\Imre\AppData\Local\Temp\is-8SC33.tmp\7za.exe
         160.1s C:\Users\Imre\AppData\Local\Temp\is-8SC33.tmp\437_.exe
         173.0s C:\Users\Imre\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E7EC0C85688F4738F3BE49B104BA67
         173.0s C:\Users\Imre\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E7EC0C85688F4738F3BE49B104BA67
         173.2s C:\Users\Imre\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3B179347615B32FE859CEABBE50C3EE6_7D69DE49F08EF5F5DF090781785AAD6C
         173.2s C:\Users\Imre\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3B179347615B32FE859CEABBE50C3EE6_7D69DE49F08EF5F5DF090781785AAD6C
         174.5s C:\Windows\Prefetch\PACKAGE_BUBBLESOUND_INSTALLER-D64CAAA2.pf
         174.6s C:\Users\Imre\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\
         174.6s C:\Users\Imre\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\SwiftSearchAutoUpdateClient.exe.log
         180.5s C:\Users\Imre\Desktop\Hörspiele\Takimo.-.21.-.Xyphon\3D BubbleSound.lnk
         181.9s C:\Windows\Prefetch\SILENTINSTALLER.EXE-4A8F647B.pf

   C:\Users\Imre\AppData\Local\Temp\nsl1AA6.tmp
      Size . . . . . . . : 952.307 bytes
      Age  . . . . . . . : 3.9 days (2015-12-30 14:22:52)
      Entropy  . . . . . : 8.0
      SHA-256  . . . . . : DDB4FEFB785DF2896532399215239A421FFAEB31BF766BE344B8DC91E21BAC3F
    > Bitdefender  . . . : Gen:Variant.Adware.Symmi.59207
    > Kaspersky  . . . . : not-a-virus:AdWare.Win32.Vopak.atcc
      Fuzzy  . . . . . . : 120.0
      Forensic Cluster
         -61.7s C:\Windows\Prefetch\SETUP.TMP-C49B4D2D.pf
         -49.5s C:\Windows\Prefetch\SETUP_MBOT_DE.TMP-B07FA203.pf
         -46.9s C:\Users\Imre\AppData\Local\Microsoft\Windows\PowerShell\
         -46.9s C:\Users\Imre\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\
         -46.9s C:\Users\Imre\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_745266ba-f2c0-45ed-abbb-634d7dedbfaa
         -46.9s C:\Users\Imre\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
         -46.8s C:\Users\Imre\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_08128d32-8d94-4ad9-91e0-ff0e0da99b02
         -46.7s C:\Users\Imre\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_4c480aa6-d5d9-4c0f-985d-f4c1e0888e82
         -46.6s C:\Users\Imre\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_d8b5d519-25ce-4e6b-88e2-265bb0fbb88d
         -46.5s C:\Users\Imre\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_2df2aec7-b65c-4949-942b-77c1ff90cad3
         -46.5s C:\Users\Imre\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_ccbfe154-8646-4e92-9c0b-d35f087fcf9f
         -46.5s C:\Users\Imre\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_ded7dca4-a1f2-4256-9d49-3668485b5ae7
         -41.4s C:\Users\Imre\AppData\Local\Temp\mfi78C7.tmp
         -41.4s C:\Users\Imre\AppData\Local\Temp\gch78C8.tmp
         -41.4s C:\Users\Imre\AppData\Local\Temp\mfi78C9.tmp
         -41.4s C:\Users\Imre\AppData\Local\Temp\gch78CA.tmp
         -40.6s C:\Windows\Prefetch\SETUP.TMP-F0B515F9.pf
         -34.9s C:\Users\Imre\AppData\Local\Temp\is-UBM9J.tmp\
         -32.0s C:\Windows\Prefetch\UPMBOT_DE_014010192.EXE-25BB891E.pf
         -29.7s C:\Users\Imre\AppData\Local\Temp\is-84CCV.tmp\
         -27.1s C:\Windows\Prefetch\EASYDRIVERPRO.TMP-0D59FCD9.pf
         -20.9s C:\Users\Imre\Desktop\Fachliteratur\Theologie\Jürgen Roloff - Jesus.pdf
         -19.7s C:\Windows\Prefetch\COMPONENT.TMP-135ED297.pf
         -16.7s C:\Windows\Prefetch\EASYDRIVERPRO.EXE-A88978E4.pf
         -5.8s C:\Users\Imre\AppData\Local\Temp\is-SNGMF.tmp\
         -5.8s C:\Users\Imre\AppData\Local\Temp\is-SNGMF.tmp\cibtdmbf1.0.tmp
         -5.7s C:\Users\Imre\AppData\Local\Temp\is-H6UJJ.tmp\
         -5.7s C:\Users\Imre\AppData\Local\Temp\is-H6UJJ.tmp\_isetup\
         -5.7s C:\Users\Imre\AppData\Local\Temp\is-H6UJJ.tmp\_isetup\_setup64.tmp
         -5.7s C:\Users\Imre\AppData\Local\Temp\is-H6UJJ.tmp\_isetup\_shfoldr.dll
         -5.1s C:\Users\Imre\AppData\Local\Temp\is-H6UJJ.tmp\dm.exe
         -4.7s C:\Users\Imre\AppData\Local\Temp\is-H6UJJ.tmp\binst.exe
          0.0s C:\Users\Imre\AppData\Local\Temp\nsl1AA6.tmp
          2.5s C:\Users\Imre\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FE0DA2326A35120037F66779D450C7D6_66B73976FEDAFCACE3A0E7181A7412E3
          2.5s C:\Users\Imre\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FE0DA2326A35120037F66779D450C7D6_66B73976FEDAFCACE3A0E7181A7412E3
          4.3s C:\Windows\Prefetch\CIBTDMBF1.0.TMP-CDB54E5D.pf
          5.6s C:\Windows\Prefetch\BINST.TMP-646454EE.pf
          7.4s C:\Windows\Prefetch\SETUPOFFER1.EXE-8245AEEB.pf
         16.9s C:\Users\Imre\AppData\Local\Temp\Uninstall.exe
         18.8s C:\Windows\Prefetch\NSS1EC1.TMP-2EF2DF96.pf
         24.8s C:\Windows\Prefetch\NSO2EAF.TMP-7315F8DE.pf
         52.3s C:\Users\Imre\AppData\Local\Temp\heu39T.nss


Suspicious files ____________________________________________________________

   C:\Users\Imre\AppData\Local\Temp\DDLHZGAE.exe
      Size . . . . . . . : 449.408 bytes
      Age  . . . . . . . : 2.7 days (2015-12-31 18:57:26)
      Entropy  . . . . . : 5.3
      SHA-256  . . . . . : BA101506AB742A29CBAA8E3C508BE0A161D4D8320EDFC2DA27ADA30300702F22
      Product  . . . . . : Sysinternals Rootkitrevealer
      Publisher  . . . . : Sysinternals - www.sysinternals.com
      Description  . . . : Rootkit detection utility
      Version  . . . . . : 1.70
      Copyright  . . . . : Copyright (C) 2005-2006 Bryce Cogswell and Mark Russinovich
      RSA Key Size . . . : 2048
      LanguageID . . . . : 1033
      Authenticode . . . : Invalid
      Fuzzy  . . . . . . : 22.0
         Program is altered or corrupted since it was code signed by its author. This is typical for malware and pirated software.
         Time indicates that the file appeared recently on this computer.
      Forensic Cluster
          0.0s C:\Users\Imre\AppData\Local\Temp\DDLHZGAE.exe
          1.1s C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_RootkitRevealer._e7d9ce9f3cfbd6328ea5d4d079e8381d4e9fa9_f8404051_1b3dab92\
          1.1s C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_RootkitRevealer._e7d9ce9f3cfbd6328ea5d4d079e8381d4e9fa9_f8404051_1b3dab92\Report.wer
          1.1s C:\Windows\Prefetch\ROOTKITREVEALER.EXE-574CD786.pf
         23.7s C:\Windows\Prefetch\DESKTOPS.EXE-B92D49A5.pf
         32.9s C:\Windows\Prefetch\DBGVIEW.EXE-17F9428C.pf

   C:\Users\Imre\Desktop\FRST64.exe
      Size . . . . . . . : 2.370.560 bytes
      Age  . . . . . . . : 1.9 days (2016-01-01 14:28:25)
      Entropy  . . . . . : 7.6
      SHA-256  . . . . . : 8C07FFF0D998FC8CDF4700AC2E2B8E131D74289713F41BF35FEC4F9A8B6CF6DE
      Needs elevation  . : Yes
      Fuzzy  . . . . . . : 24.0
         Program has no publisher information but prompts the user for permission elevation.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Time indicates that the file appeared recently on this computer.


Potential Unwanted Programs _________________________________________________

   HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{A2C98B47-B5F4-94AA-281D-4135416774CF}\ (CutThePrice)
   HKU\S-1-5-21-253609680-664229831-636946120-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{460C3D19-B3D4-4964-A550-77D263B0CCCB}\ (Iminent)

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=30c8a6623a9160498afd531407d1685c
# end=init
# utc_time=2016-01-03 12:07:32
# local_time=2016-01-03 01:07:32 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# osver=6.2.9200 NT 
Update Init
Update Download
Update Finalize
Updated modules version: 27468
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=30c8a6623a9160498afd531407d1685c
# end=updated
# utc_time=2016-01-03 12:22:02
# local_time=2016-01-03 01:22:02 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# osver=6.2.9200 NT 
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7777
# api_version=3.1.1
# EOSSerial=30c8a6623a9160498afd531407d1685c
# engine=27468
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2016-01-03 04:48:47
# local_time=2016-01-03 05:48:47 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.2.9200 NT 
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 20713 5653870 0 0
# scanned=486545
# found=11
# cleaned=0
# scan_time=16004
sh=83573054CBB884A814BD563DEB05ED55B85F212B ft=1 fh=a9108847733c8723 vn="Variante von Win32/Adware.ConvertAd.AER.gen Anwendung" ac=I fn="C:\Users\Imre\AppData\Local\Temp\nscC082.tmp"
sh=77764CDAB85D758B8548B12094D827329DCAC158 ft=1 fh=257fccf1d386fa93 vn="Mehrere Bedrohungen" ac=I fn="C:\Users\Imre\AppData\Local\Temp\nsl1AA6.tmp"
sh=FF062ACE02DA814A630F922A69113F72A931D1D7 ft=1 fh=41d8f50bfd528790 vn="Mehrere Bedrohungen" ac=I fn="C:\Users\Imre\AppData\Local\Temp\f9626892-7a78-3199-abd2-97bbce96297b\adv_64.exe"
sh=72F57455FCBE20E264336F6B985C3C504EF17662 ft=1 fh=fd26318bc8cb0bdf vn="Mehrere Bedrohungen" ac=I fn="C:\Users\Imre\AppData\Local\Temp\is-5O7SA.tmp\gentlemjmp_ieu.exe"
sh=7C24BC7F0260A1AC49EE6E2151171B97DDE40411 ft=1 fh=9776102de1a65fe6 vn="Variante von Win32/Adware.RVplatform.D Anwendung" ac=I fn="C:\Users\Imre\AppData\Local\Temp\is-H6UJJ.tmp\binst.exe"
sh=6C6E5E189E6AC9E374A6D84068AFF52E10762F84 ft=1 fh=9776102db5c5a13a vn="Variante von Win32/Adware.RVplatform.C Anwendung" ac=I fn="C:\Users\Imre\AppData\Local\Temp\is-H6UJJ.tmp\dm.exe"
sh=46FE0931B77DCC61928F740FC5734821BFCBC473 ft=1 fh=aff6bee8d35a73ee vn="Variante von Win32/Toolbar.Iminent.K evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\9bafd911-36d2-4703-993a-74e79b2e3c69[1].exe"
sh=0B8FFC8A3CAA229ED9B0A6815DF7F1B30C81A4D8 ft=1 fh=4771a8d51f507e42 vn="Variante von Win32/ClientConnect.A evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\Windows.old\Users\Imre\AppData\Local\Temp\dlLogic.exe"
sh=3C91A665AC0C2617192DE4A6CB4D1992C390E4FB ft=1 fh=4f836e1b197d8029 vn="Variante von Win32/ClientConnect.A evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\Windows.old\Users\Imre\AppData\Local\Temp\offer-9F72F7CE-45EC-4CF0-9A04-166910B29058.exe"
sh=119E149747A552877117A6D91EFD3BE4B26418AE ft=1 fh=d60c8402287380a1 vn="Win32/Conduit.SearchProtect.N evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\Windows.old\Users\Imre\AppData\Local\Temp\spstub.exe"
sh=A901074F923EFA09A7E4413D55EF30C8FCBD0322 ft=1 fh=eb841dc825cb1c22 vn="Variante von Win32/DownloadSponsor.C evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\Windows.old\Users\Imre\AppData\Local\Temp\DMR\dmr_72.exe"

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:31-12-2015
Ran by Imre (administrator) on LENOVO-G710 (03-01-2016 18:15:55)
Running from C:\Users\Imre\Desktop
Loaded Profiles: Imre & UpdatusUser (Available Profiles: Imre & UpdatusUser)
Platform: Windows 10 Pro Version 1511 (X64) Language: Englisch (Vereinigte Staaten)
Internet Explorer Version 11 (Default browser: Edge)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Intel Corporation) C:\Windows\SysWOW64\IntelCpHeciSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
(Broadcom Corporation.) C:\Windows\System32\BtwRSupportService.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(IvoSoft) C:\Program Files\Classic Shell\ClassicStartMenu.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
() C:\Windows\System32\igfxTray.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Microsoft Corporation) C:\Windows\System32\StikyNot.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\acrotray.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
(Microsoft Corporation) C:\Windows\System32\browser_broker.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
(Microsoft Corporation) C:\Windows\System32\DataExchangeHost.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe
() C:\Program Files\WindowsApps\Microsoft.Messaging_2.12.15004.0_x86__8wekyb3d8bbwe\SkypeHost.exe
(Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
() C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1512.54020.0_x64__8wekyb3d8bbwe\Calculator.exe
() C:\Program Files\WindowsApps\Microsoft.Windows.Photos_15.1208.10480.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
(Oracle Corporation) C:\Program Files (x86)\Java\jre1.8.0_66\bin\javaw.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office15\OUTLOOK.EXE
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
(Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.10586.0_none_95e4f9a171a1ad95\TiWorker.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtsFT] => C:\WINDOWS\RTFTrack.exe [6340312 2013-09-03] (Realtek semiconductor)
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [286056 2013-09-24] (Intel Corporation)
HKLM\...\Run: [Classic Start Menu] => C:\Program Files\Classic Shell\ClassicStartMenu.exe [161728 2015-08-09] (IvoSoft)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [500936 2015-03-30] (Adobe Systems Incorporated)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1703424 2013-08-12] (IDT, Inc.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [3944136 2015-06-03] (Synaptics Incorporated)
HKLM-x32\...\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] => C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe [707984 2014-11-19] (Cisco Systems, Inc.)
HKLM-x32\...\Run: [Acrobat Assistant 8.0] => C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\Acrotray.exe [1856184 2015-09-30] (Adobe Systems Inc.)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [596528 2015-11-09] (Oracle Corporation)
HKU\S-1-5-21-253609680-664229831-636946120-1001\...\Run: [Lync] => C:\Program Files\Microsoft Office\Office15\lync.exe [27888296 2015-11-18] (Microsoft Corporation)
HKU\S-1-5-21-253609680-664229831-636946120-1001\...\Run: [RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [465920 2015-10-30] (Microsoft Corporation)
HKU\S-1-5-21-253609680-664229831-636946120-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8590760 2015-12-08] (Piriform Ltd)
HKU\S-1-5-21-253609680-664229831-636946120-1002\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [517632 2015-10-30] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ShareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer64.dll [2015-08-09] (IvoSoft)
ShellIconOverlayIdentifiers-x32: [ShareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer32.dll [2015-08-09] (IvoSoft)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\..\Interfaces\{8a330995-3d46-434b-845d-143a4014b084}: [NameServer] 134.95.127.1,134.95.9.74
Tcpip\..\Interfaces\{e4711dd0-76b8-4f0d-9a42-dbf93871a84c}: [DhcpNameServer] 80.69.100.108 80.69.100.204

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKU\S-1-5-21-253609680-664229831-636946120-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.google.de/?gws_rd=ssl
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2015-11-18] (Microsoft Corporation)
BHO: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer64.dll [2015-08-09] (IvoSoft)
BHO: Adobe Acrobat Create PDF Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\x64\AcroIEFavStub.dll [2015-09-30] (Adobe Systems Incorporated)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2015-11-10] (Microsoft Corporation)
BHO: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_64.dll [2015-08-09] (IvoSoft)
BHO: Adobe Acrobat Create PDF from Selection -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\x64\AcroIEFavStub.dll [2015-09-30] (Adobe Systems Incorporated)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2015-11-18] (Microsoft Corporation)
BHO-x32: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer32.dll [2015-08-09] (IvoSoft)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\ssv.dll [2015-11-27] (Oracle Corporation)
BHO-x32: Adobe Acrobat Create PDF Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\AcroIEFavStub.dll [2015-09-30] (Adobe Systems Incorporated)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2015-11-10] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\jp2ssv.dll [2015-11-27] (Oracle Corporation)
BHO-x32: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_32.dll [2015-08-09] (IvoSoft)
BHO-x32: Adobe Acrobat Create PDF from Selection -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\AcroIEFavStub.dll [2015-09-30] (Adobe Systems Incorporated)
Toolbar: HKLM - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll [2015-08-09] (IvoSoft)
Toolbar: HKLM - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\x64\AcroIEFavStub.dll [2015-09-30] (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll [2015-08-09] (IvoSoft)
Toolbar: HKLM-x32 - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\AcroIEFavStub.dll [2015-09-30] (Adobe Systems Incorporated)
DPF: HKLM-x32 {538793D5-659C-4639-A56C-A179AD87ED44} hxxps://vpngate.uni-koeln.de/CACHE/stc/1/binaries/vpnweb.cab
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2015-02-17] (Microsoft Corporation)
StartMenuInternet: IEXPLORE.EXE - iexplore.exe

FireFox:
========
FF ProfilePath: C:\Users\Imre\AppData\Roaming\Mozilla\Firefox\Profiles\civ9thwh.default
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_20_0_0_267.dll [2015-12-29] ()
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.2.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-04-16] (VideoLAN)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll [2015-03-09] (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_20_0_0_267.dll [2015-12-29] ()
FF Plugin-x32: @java.com/DTPlugin,version=11.66.2 -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\dtplugin\npDeployJava1.dll [2015-11-27] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.66.2 -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\plugin2\npjp2.dll [2015-11-27] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2015-11-18] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-22] (Microsoft Corporation)
FF Plugin-x32: Adobe Acrobat -> C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\Air\nppdf32.dll [2015-09-30] (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll [2015-03-09] (Adobe Systems)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2015-11-18] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2015-09-30] (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat DC - Create PDF - C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\Browser\WCFirefoxExtn [2015-09-13] [not signed]
StartMenuInternet: FIREFOX.EXE - firefox.exe

Chrome: 
=======
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 BcmBtRSupport; C:\Windows\system32\BtwRSupportService.exe [2251992 2015-03-27] (Broadcom Corporation.)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [14696 2013-09-24] (Intel Corporation)
R2 igfxCUIService2.0.0.0; C:\Windows\system32\igfxCUIService.exe [351120 2015-07-17] (Intel Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1135416 2015-10-05] (Malwarebytes)
R2 STacSV; C:\Program Files\IDT\WDM\STacSV64.exe [338944 2013-08-12] (IDT, Inc.) [File not signed]
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
R2 SynTPEnhService; C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe [249032 2015-06-03] (Synaptics Incorporated)
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [364464 2015-10-30] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [24864 2015-10-30] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 bcbtums; C:\Windows\system32\drivers\bcbtums.sys [173312 2015-03-27] (Broadcom Corporation.)
R3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [7585280 2015-10-30] (Broadcom Corporation)
S3 dtlitescsibus; C:\Windows\System32\drivers\dtlitescsibus.sys [30264 2015-08-16] (Disc Soft Ltd)
R0 IntelHSWPcc; C:\Windows\System32\drivers\IntelPcc.sys [74344 2013-07-03] (Intel Corporation)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2015-10-05] (Malwarebytes)
S3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [192216 2016-01-01] (Malwarebytes)
S3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2015-10-05] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\System32\drivers\TeeDriverW8x64.sys [193336 2015-09-04] (Intel Corporation)
R3 rtsuvc; C:\Windows\system32\DRIVERS\rtsuvc.sys [8874712 2013-09-03] (Realtek Semiconductor Corp.)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [42696 2015-06-03] (Synaptics Incorporated)
R3 vpnva; C:\Windows\System32\drivers\vpnva64-6.sys [52592 2014-11-19] (Cisco Systems, Inc.)
S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [44568 2015-10-30] (Microsoft Corporation)
R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [293216 2015-10-30] (Microsoft Corporation)
R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [118112 2015-10-30] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-01-03 18:15 - 2016-01-03 18:16 - 00016969 _____ C:\Users\Imre\Desktop\FRST.txt
2016-01-03 17:44 - 2016-01-03 18:17 - 00000000 ____D C:\Users\Imre\Desktop\Klassiker auslegen - G. W. F. Hegel – Grundlinien der Philosophie des Rechts
2016-01-03 12:54 - 2016-01-03 13:06 - 00000000 ____D C:\ProgramData\HitmanPro
2016-01-03 12:48 - 2016-01-03 12:54 - 11323704 _____ (SurfRight B.V.) C:\Users\Imre\Desktop\HitmanPro_x64.exe
2016-01-02 21:39 - 2016-01-02 21:42 - 00000000 ____D C:\Users\Imre\Desktop\Mp3Player
2016-01-02 16:39 - 2016-01-02 16:40 - 00000000 ____D C:\Users\Imre\Desktop\Mündliche Prüfung
2016-01-02 16:39 - 2016-01-02 16:38 - 02910188 _____ C:\Users\Imre\Desktop\Thomas Szanto - Bewusstsein, Intentionalität und mentale Repräsentation.pdf
2016-01-02 16:25 - 2016-01-02 22:14 - 00000000 ____D C:\Users\Imre\Desktop\Hörspiele
2016-01-02 13:10 - 2016-01-02 13:10 - 00165376 _____ C:\Users\Imre\Desktop\SystemLook_x64.exe
2016-01-02 12:56 - 2016-01-03 12:52 - 00002457 _____ C:\Users\Imre\Desktop\Fixlog.txt
2016-01-01 15:51 - 2016-01-01 15:51 - 11454792 _____ (Gillmeister Software ) C:\Users\Imre\Desktop\rename_expert-setup.exe
2016-01-01 15:28 - 2016-01-01 15:28 - 00001167 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2016-01-01 15:09 - 2016-01-01 15:09 - 01599336 _____ (Malwarebytes) C:\Users\Imre\Desktop\JRT.exe
2016-01-01 15:06 - 2016-01-01 15:06 - 01745920 _____ C:\Users\Imre\Desktop\AdwCleaner_5.027.exe
2016-01-01 14:30 - 2016-01-03 18:15 - 00000000 ____D C:\FRST
2016-01-01 14:29 - 2016-01-01 14:29 - 04727984 _____ (Kaspersky Lab ZAO) C:\Users\Imre\Desktop\tdsskiller.exe
2016-01-01 14:28 - 2016-01-01 14:28 - 02370560 _____ (Farbar) C:\Users\Imre\Desktop\FRST64.exe
2015-12-31 18:17 - 2016-01-01 15:24 - 00000000 ____D C:\AdwCleaner
2015-12-30 14:38 - 2015-12-30 14:38 - 00002860 _____ C:\WINDOWS\System32\Tasks\CCleanerSkipUAC
2015-12-30 14:38 - 2015-12-30 14:38 - 00000000 ____D C:\Program Files\CCleaner
2015-12-30 14:26 - 2015-12-30 14:26 - 00187904 _____ C:\WINDOWS\rsrcs.dll
2015-12-30 14:24 - 2015-12-30 14:23 - 00001886 _____ C:\WINDOWS\system32\Drivers\etc\hp.bak
2015-12-30 14:16 - 2015-12-30 20:43 - 00000000 ____D C:\Program Files (x86)\Microsoft Toolkit Final
2015-12-29 14:06 - 2015-12-29 14:06 - 00026058 _____ C:\Users\Imre\Desktop\Schreiben Vermieter.pdf
2015-12-29 13:12 - 2015-12-30 14:48 - 00000000 ____D C:\WINDOWS\Minidump
2015-12-18 16:24 - 2015-12-07 05:57 - 00973664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LicenseManager.dll
2015-12-18 16:24 - 2015-12-07 05:55 - 01281376 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicenseManager.dll
2015-12-18 16:24 - 2015-12-07 05:48 - 02544256 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll
2015-12-18 16:24 - 2015-12-07 05:48 - 02180136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll
2015-12-18 16:24 - 2015-12-07 05:48 - 01299504 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfnetsrc.dll
2015-12-18 16:24 - 2015-12-07 05:48 - 01155944 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfasfsrcsnk.dll
2015-12-18 16:24 - 2015-12-07 05:48 - 01118208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfnetsrc.dll
2015-12-18 16:24 - 2015-12-07 05:48 - 01092456 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfplat.dll
2015-12-18 16:24 - 2015-12-07 05:48 - 01065080 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmp4srcsnk.dll
2015-12-18 16:24 - 2015-12-07 05:48 - 01020096 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsrcsnk.dll
2015-12-18 16:24 - 2015-12-07 05:48 - 00983464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfasfsrcsnk.dll
2015-12-18 16:24 - 2015-12-07 05:48 - 00884256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll
2015-12-18 16:24 - 2015-12-07 05:48 - 00823264 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmpeg2srcsnk.dll
2015-12-18 16:24 - 2015-12-07 05:48 - 00794888 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfds.dll
2015-12-18 16:24 - 2015-12-07 05:48 - 00696160 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupEngine.dll
2015-12-18 16:24 - 2015-12-07 05:48 - 00670928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfds.dll
2015-12-18 16:24 - 2015-12-07 05:48 - 00526856 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfreadwrite.dll
2015-12-18 16:24 - 2015-12-07 05:48 - 00502112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NetSetupEngine.dll
2015-12-18 16:24 - 2015-12-07 05:48 - 00498448 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFCaptureEngine.dll
2015-12-18 16:24 - 2015-12-07 05:48 - 00462760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfreadwrite.dll
2015-12-18 16:24 - 2015-12-07 05:48 - 00450904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFCaptureEngine.dll
2015-12-18 16:24 - 2015-12-07 05:48 - 00337840 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFPlay.dll
2015-12-18 16:24 - 2015-12-07 05:48 - 00289248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFPlay.dll
2015-12-18 16:24 - 2015-12-07 05:48 - 00245848 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfps.dll
2015-12-18 16:24 - 2015-12-07 05:47 - 00925064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfplat.dll
2015-12-18 16:24 - 2015-12-07 05:47 - 00898184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsrcsnk.dll
2015-12-18 16:24 - 2015-12-07 05:47 - 00716928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmpeg2srcsnk.dll
2015-12-18 16:24 - 2015-12-07 05:46 - 03671888 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2015-12-18 16:24 - 2015-12-07 05:46 - 02919320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2015-12-18 16:24 - 2015-12-07 05:45 - 00264544 _____ (Microsoft Corporation) C:\WINDOWS\system32\ContentDeliveryManager.Utilities.dll
2015-12-18 16:24 - 2015-12-07 05:15 - 01035776 _____ (Microsoft Corporation) C:\WINDOWS\system32\XboxNetApiSvc.dll
2015-12-18 16:24 - 2015-12-07 05:10 - 00824320 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcWebFilter.dll
2015-12-18 16:24 - 2015-12-07 05:07 - 16984064 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll
2015-12-18 16:24 - 2015-12-07 05:06 - 00572928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WpcWebFilter.dll
2015-12-18 16:24 - 2015-12-07 05:06 - 00199168 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallAgent.exe
2015-12-18 16:24 - 2015-12-07 05:03 - 13017600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll
2015-12-18 16:24 - 2015-12-07 05:02 - 00161280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallAgent.exe
2015-12-18 16:24 - 2015-12-07 05:01 - 00543232 _____ (Microsoft Corporation) C:\WINDOWS\system32\StoreAgent.dll
2015-12-18 16:24 - 2015-12-07 05:00 - 00323072 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSFlacDecoder.dll
2015-12-18 16:24 - 2015-12-07 05:00 - 00210432 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmcsp.dll
2015-12-18 16:24 - 2015-12-07 04:59 - 00558080 _____ (Microsoft Corporation) C:\WINDOWS\system32\MBMediaManager.dll
2015-12-18 16:24 - 2015-12-07 04:59 - 00292352 _____ (Microsoft Corporation) C:\WINDOWS\system32\provengine.dll
2015-12-18 16:24 - 2015-12-07 04:59 - 00286208 _____ (Microsoft Corporation) C:\WINDOWS\system32\provhandlers.dll
2015-12-18 16:24 - 2015-12-07 04:58 - 24601600 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2015-12-18 16:24 - 2015-12-07 04:58 - 00459776 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapConfiguration.dll
2015-12-18 16:24 - 2015-12-07 04:56 - 00607232 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmsvc.dll
2015-12-18 16:24 - 2015-12-07 04:56 - 00497152 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmkvsrcsnk.dll
2015-12-18 16:24 - 2015-12-07 04:53 - 19339264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2015-12-18 16:24 - 2015-12-07 04:53 - 00381952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmkvsrcsnk.dll
2015-12-18 16:24 - 2015-12-07 04:51 - 01318912 _____ (Microsoft Corporation) C:\WINDOWS\system32\wifinetworkmanager.dll
2015-12-18 16:24 - 2015-12-07 04:50 - 01131520 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Audio.dll
2015-12-18 16:24 - 2015-12-07 04:49 - 01105920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Audio.dll
2015-12-18 16:24 - 2015-12-07 04:47 - 03428864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll
2015-12-18 16:24 - 2015-12-07 04:45 - 02582016 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll
2015-12-18 16:24 - 2015-12-07 04:45 - 00900608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.BackgroundTransfer.dll
2015-12-18 16:24 - 2015-12-07 04:45 - 00683008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.BackgroundTransfer.dll
2015-12-18 16:24 - 2015-12-07 04:44 - 02796032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.dll
2015-12-18 16:24 - 2015-12-07 04:43 - 02598400 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetworkMobileSettings.dll
2015-12-18 16:24 - 2015-12-07 04:43 - 00931328 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSMPEG2ENC.DLL
2015-12-18 16:24 - 2015-12-07 04:41 - 02061824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll
2015-12-18 16:24 - 2015-12-07 04:40 - 01995776 _____ (Microsoft Corporation) C:\WINDOWS\system32\ActiveSyncProvider.dll
2015-12-18 16:24 - 2015-12-07 04:40 - 01706496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ActiveSyncProvider.dll
2015-12-18 16:23 - 2015-12-07 05:49 - 00412512 _____ (Microsoft Corporation) C:\WINDOWS\system32\wifitask.exe
2015-12-18 16:23 - 2015-12-07 05:48 - 00115040 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupApi.dll
2015-12-18 16:23 - 2015-12-07 05:48 - 00084832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NetSetupApi.dll
2015-12-18 16:23 - 2015-12-07 05:47 - 00116720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfps.dll
2015-12-18 16:23 - 2015-12-07 05:15 - 00075776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.XboxLive.ProxyStub.dll
2015-12-18 16:23 - 2015-12-07 05:09 - 00133120 _____ (Microsoft Corporation) C:\WINDOWS\system32\flvprophandler.dll
2015-12-18 16:23 - 2015-12-07 05:09 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\policymanagerprecheck.dll
2015-12-18 16:23 - 2015-12-07 05:09 - 00030208 _____ (Microsoft Corporation) C:\WINDOWS\system32\StorageUsage.dll
2015-12-18 16:23 - 2015-12-07 05:07 - 00134656 _____ (Microsoft Corporation) C:\WINDOWS\system32\wificonnapi.dll
2015-12-18 16:23 - 2015-12-07 05:07 - 00077312 _____ (Microsoft Corporation) C:\WINDOWS\system32\ProvPluginEng.dll
2015-12-18 16:23 - 2015-12-07 05:06 - 00231936 _____ (Microsoft Corporation) C:\WINDOWS\system32\KnobsCore.dll
2015-12-18 16:23 - 2015-12-07 05:05 - 00192000 _____ (Microsoft Corporation) C:\WINDOWS\system32\provisioningcsp.dll
2015-12-18 16:23 - 2015-12-07 05:05 - 00036864 _____ (Microsoft Corporation) C:\WINDOWS\system32\BackgroundTransferHost.exe
2015-12-18 16:23 - 2015-12-07 05:04 - 00066560 _____ (Microsoft Corporation) C:\WINDOWS\system32\moshost.dll
2015-12-18 16:23 - 2015-12-07 05:04 - 00056320 _____ (Microsoft Corporation) C:\WINDOWS\system32\provtool.exe
2015-12-18 16:23 - 2015-12-07 05:02 - 00269824 _____ (Microsoft Corporation) C:\WINDOWS\system32\moshostcore.dll
2015-12-18 16:23 - 2015-12-07 05:01 - 00034304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BackgroundTransferHost.exe
2015-12-18 16:23 - 2015-12-07 05:00 - 00618496 _____ (Microsoft Corporation) C:\WINDOWS\system32\StorSvc.dll
2015-12-18 16:23 - 2015-12-07 05:00 - 00203776 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupSvc.dll
2015-12-18 16:23 - 2015-12-07 04:59 - 00165376 _____ (Microsoft Corporation) C:\WINDOWS\system32\provdatastore.dll
2015-12-18 16:23 - 2015-12-07 04:57 - 00409088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\StoreAgent.dll
2015-12-18 16:23 - 2015-12-07 04:57 - 00387072 _____ (Microsoft Corporation) C:\WINDOWS\system32\qdvd.dll
2015-12-18 16:23 - 2015-12-07 04:57 - 00270848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSFlacDecoder.dll
2015-12-18 16:23 - 2015-12-07 04:55 - 07979008 _____ (Microsoft Corporation) C:\WINDOWS\system32\mos.dll
2015-12-18 16:23 - 2015-12-07 04:55 - 00346112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapConfiguration.dll
2015-12-18 16:23 - 2015-12-07 04:54 - 00850432 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapsStore.dll
2015-12-18 16:23 - 2015-12-07 04:54 - 00569856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\qdvd.dll
2015-12-18 16:23 - 2015-12-07 04:51 - 00223232 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveapibase.dll
2015-12-18 16:23 - 2015-12-07 04:48 - 06297088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mos.dll
2015-12-18 16:23 - 2015-12-07 04:40 - 03593216 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2015-12-18 16:23 - 2015-12-07 04:39 - 00764928 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveapi.dll
2015-12-18 16:23 - 2015-12-07 04:38 - 00871936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSMPEG2ENC.DLL
2015-12-18 16:23 - 2015-12-07 04:33 - 00375296 _____ (Microsoft Corporation) C:\WINDOWS\system32\MDEServer.exe
2015-12-18 16:23 - 2015-12-07 04:32 - 00126464 _____ (Microsoft Corporation) C:\WINDOWS\system32\dialserver.dll
2015-12-15 23:06 - 2015-12-15 23:06 - 00000000 ____D C:\Users\Imre\AppData\Roaming\IDT
2015-12-15 22:59 - 2015-12-15 22:59 - 00000000 ____D C:\Users\Imre\AppData\Local\ElevatedDiagnostics
2015-12-15 21:03 - 2016-01-02 12:56 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-12-12 14:25 - 2015-12-12 14:38 - 00000000 ____D C:\Users\Imre\Desktop\Bloch Wörterbuch
2015-12-09 22:48 - 2015-12-09 22:48 - 00899384 _____ C:\Users\Imre\Desktop\[Dan_Zahavi]_The_Oxford_Handbook_of_Contemporary_P(BookZZ.org).zip
2015-12-08 20:19 - 2015-12-31 19:03 - 00000000 ____D C:\WINDOWS\PCHEALTH
2015-12-08 19:42 - 2015-12-08 19:42 - 00000000 ____D C:\WINDOWS\system32\SleepStudy
2015-12-08 19:30 - 2015-12-01 08:12 - 02152800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys
2015-12-08 19:30 - 2015-11-24 13:07 - 01817160 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2015-12-08 19:30 - 2015-11-24 12:06 - 01540768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2015-12-08 19:30 - 2015-11-24 11:26 - 01399224 _____ (Microsoft Corporation) C:\WINDOWS\system32\user32.dll
2015-12-08 19:30 - 2015-11-24 11:01 - 02756096 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.tlb
2015-12-08 19:30 - 2015-11-24 10:54 - 00007680 _____ (Microsoft Corporation) C:\WINDOWS\system32\readingviewresources.dll
2015-12-08 19:30 - 2015-11-24 10:53 - 00115200 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2015-12-08 19:30 - 2015-11-24 10:45 - 00018944 _____ (Microsoft Corporation) C:\WINDOWS\system32\wshrm.dll
2015-12-08 19:30 - 2015-11-24 10:37 - 00147968 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rmcast.sys
2015-12-08 19:30 - 2015-11-24 10:26 - 01337240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\user32.dll
2015-12-08 19:30 - 2015-11-24 10:19 - 00182784 _____ (Microsoft Corporation) C:\WINDOWS\system32\shutdownux.dll
2015-12-08 19:30 - 2015-11-24 10:12 - 00523776 _____ (Microsoft Corporation) C:\WINDOWS\system32\catsrvut.dll
2015-12-08 19:30 - 2015-11-24 09:58 - 00604672 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2015-12-08 19:30 - 2015-11-24 09:55 - 01393664 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2015-12-08 19:30 - 2015-11-24 09:54 - 02756096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.tlb
2015-12-08 19:30 - 2015-11-24 09:52 - 01717248 _____ (Microsoft Corporation) C:\WINDOWS\system32\GdiPlus.dll
2015-12-08 19:30 - 2015-11-24 09:49 - 01648640 _____ (Microsoft Corporation) C:\WINDOWS\system32\comsvcs.dll
2015-12-08 19:30 - 2015-11-24 09:14 - 00415744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\catsrvut.dll
2015-12-08 19:30 - 2015-11-24 09:03 - 00503296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2015-12-08 19:30 - 2015-11-24 08:59 - 01467392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GdiPlus.dll
2015-12-08 19:30 - 2015-11-24 08:57 - 01328128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\comsvcs.dll
2015-12-08 19:30 - 2015-11-24 08:35 - 22393856 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2015-12-08 19:30 - 2015-11-24 08:29 - 02352128 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll
2015-12-08 19:30 - 2015-11-24 08:23 - 13381120 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2015-12-08 19:30 - 2015-11-24 08:11 - 18678272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2015-12-08 19:30 - 2015-11-24 08:08 - 12125184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2015-12-08 19:30 - 2015-11-24 08:04 - 02155008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-01-03 18:16 - 2015-07-24 09:32 - 00000000 ____D C:\Users\Imre\AppData\Local\ClassicShell
2016-01-03 17:43 - 2015-10-16 23:35 - 00000000 ____D C:\Users\Imre\Desktop\Klassiker auslegen
2016-01-03 17:29 - 2015-08-16 00:33 - 00000884 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2016-01-03 17:14 - 2015-11-27 19:13 - 00000000 ____D C:\Users\Imre\Documents\Calibre Library
2016-01-03 16:49 - 2015-07-23 15:15 - 00000000 ___RD C:\Users\Imre\Desktop\Fachliteratur
2016-01-03 16:36 - 2015-08-16 00:10 - 00000000 ____D C:\Users\Imre\.mediathek3
2016-01-03 16:30 - 2015-09-13 17:49 - 00000000 ____D C:\ProgramData\regid.1986-12.com.adobe
2016-01-03 15:18 - 2015-10-06 21:28 - 00000000 ____D C:\Users\Imre\Desktop\Tusculum
2016-01-03 15:17 - 2015-07-23 15:04 - 00000000 ___RD C:\Users\Imre\Desktop\Uni Köln
2016-01-03 13:35 - 2015-07-24 16:21 - 00000000 ____D C:\Users\Imre\AppData\Roaming\vlc
2016-01-03 12:57 - 2015-12-03 13:04 - 00775644 _____ C:\WINDOWS\system32\perfh007.dat
2016-01-03 12:57 - 2015-12-03 13:04 - 00155748 _____ C:\WINDOWS\system32\perfc007.dat
2016-01-03 12:57 - 2015-10-30 08:21 - 00000000 ____D C:\WINDOWS\INF
2016-01-03 12:57 - 2015-08-16 21:52 - 01802588 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2016-01-03 12:53 - 2015-12-03 04:21 - 00000180 _____ C:\WINDOWS\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
2016-01-03 12:53 - 2015-07-24 01:12 - 00000000 __SHD C:\Users\Imre\IntelGraphicsProfiles
2016-01-03 12:52 - 2015-12-03 04:44 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2016-01-03 12:52 - 2015-12-03 04:26 - 00000000 ____D C:\Users\UpdatusUser
2016-01-03 12:52 - 2015-10-30 07:28 - 00262144 ___SH C:\WINDOWS\system32\config\BBI
2016-01-03 12:46 - 2015-07-24 01:29 - 00004152 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{8F7F6C12-9793-4221-8796-83E53881D2F5}
2016-01-02 17:03 - 2015-10-30 07:28 - 00000000 ____D C:\Windows
2016-01-02 16:50 - 2015-11-15 00:09 - 00000000 ____D C:\Users\Imre\Desktop\Husserls Einstellungsbegriff
2016-01-02 16:29 - 2015-07-23 12:39 - 00000000 ___RD C:\Users\Imre\Desktop\Dokumente
2016-01-01 22:53 - 2015-07-23 15:46 - 00000000 ___RD C:\Users\Imre\Desktop\De Gruyter Studienbuch
2016-01-01 22:35 - 2015-10-30 08:24 - 00000000 ____D C:\WINDOWS\AppReadiness
2016-01-01 15:28 - 2015-08-09 14:31 - 00192216 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2016-01-01 15:28 - 2015-08-09 14:31 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2016-01-01 15:28 - 2015-08-09 14:31 - 00000000 ____D C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-12-31 18:24 - 2015-10-30 08:24 - 00000000 ___HD C:\Program Files\WindowsApps
2015-12-31 18:11 - 2015-12-03 04:26 - 00000000 ____D C:\Users\Imre
2015-12-30 20:47 - 2015-12-03 04:33 - 00001540 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2015-12-30 20:47 - 2015-11-15 16:04 - 00001152 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CS6 (64 Bit).lnk
2015-12-30 20:47 - 2015-11-15 16:03 - 00001264 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CS6.lnk
2015-12-30 20:47 - 2015-11-15 16:02 - 00001114 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Bridge CS6 (64bit).lnk
2015-12-30 20:47 - 2015-11-15 16:01 - 00001226 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Bridge CS6.lnk
2015-12-30 20:47 - 2015-11-15 15:59 - 00001580 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe ExtendScript Toolkit CS6.lnk
2015-12-30 20:47 - 2015-11-15 15:59 - 00001410 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Extension Manager CS6.lnk
2015-12-30 20:47 - 2015-11-15 15:56 - 00001393 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Application Manager.lnk
2015-12-30 20:47 - 2015-11-10 16:05 - 00002239 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Digital Editions 4.5.lnk
2015-12-30 20:47 - 2015-09-17 10:54 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat DC.lnk
2015-12-30 20:47 - 2015-09-17 10:54 - 00002102 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat Distiller DC.lnk
2015-12-30 20:47 - 2015-07-24 09:32 - 00002248 _____ C:\Users\Imre\AppData\Roaming\Microsoft\Windows\Start Menu\startscreen.lnk
2015-12-30 20:45 - 2015-10-30 08:24 - 00000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2015-12-30 14:51 - 2015-12-03 04:14 - 04957184 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2015-12-30 14:49 - 2015-11-27 17:24 - 00000000 ____D C:\Users\Imre\AppData\Roaming\BitTorrent
2015-12-30 14:48 - 2015-12-03 13:12 - 00000000 ___DC C:\WINDOWS\Panther
2015-12-30 14:38 - 2015-07-24 01:02 - 00000000 ____D C:\Users\Imre\AppData\Local\Packages
2015-12-30 14:37 - 2015-07-24 15:37 - 00001034 _____ C:\Users\UpdatusUser\Desktop\Digitale Bibliothek 5.lnk
2015-12-30 14:29 - 2015-07-24 01:05 - 00000000 __RHD C:\Users\Public\AccountPictures
2015-12-30 14:01 - 2015-10-30 08:11 - 00000000 ____D C:\WINDOWS\CbsTemp
2015-12-29 14:13 - 2015-10-30 08:24 - 00000000 ____D C:\WINDOWS\LiveKernelReports
2015-12-27 22:10 - 2015-10-30 08:26 - 00826872 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2015-12-27 22:10 - 2015-10-30 08:26 - 00176632 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2015-12-22 03:30 - 2015-10-30 08:24 - 00000000 ____D C:\WINDOWS\system32\appraiser
2015-12-22 03:30 - 2015-10-30 08:24 - 00000000 ____D C:\WINDOWS\Provisioning
2015-12-22 03:30 - 2015-10-30 08:24 - 00000000 ____D C:\WINDOWS\bcastdvr
2015-12-15 23:04 - 2015-10-30 08:24 - 00000000 ____D C:\WINDOWS\system32\NDF
2015-12-15 22:54 - 2015-09-12 14:52 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-12-15 08:23 - 2015-08-16 22:13 - 00000000 ___RD C:\Users\Imre\3D Objects
2015-12-14 08:28 - 2015-08-16 22:02 - 00000000 ___RD C:\Users\Imre\OneDrive
2015-12-12 13:13 - 2015-10-30 10:03 - 00000000 ____D C:\WINDOWS\OCR
2015-12-12 01:04 - 2015-11-27 19:20 - 00000000 ____D C:\Users\Imre\Desktop\epub
2015-12-11 22:32 - 2015-10-07 21:36 - 00000000 ____D C:\Users\Imre\Desktop\Zeitschrift für philosophische Forschung
2015-12-11 14:37 - 2015-11-30 17:36 - 00000000 ____D C:\Users\Imre\Desktop\Phänomenologische Forschungen
2015-12-11 00:35 - 2015-07-24 16:54 - 00000000 ____D C:\Users\Imre\.Zettelkasten
2015-12-09 20:29 - 2015-08-16 00:33 - 00003870 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2015-12-09 04:39 - 2015-07-24 01:44 - 00301728 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2015-12-08 21:29 - 2015-10-30 08:24 - 00000000 ____D C:\WINDOWS\system32\oobe
2015-12-08 20:20 - 2015-07-24 14:24 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2015-12-08 20:20 - 2015-07-24 01:11 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-12-08 20:19 - 2013-08-22 14:25 - 00000167 _____ C:\WINDOWS\win.ini
2015-12-08 20:15 - 2015-07-24 01:23 - 00000000 ____D C:\WINDOWS\system32\MRT
2015-12-08 20:14 - 2015-07-24 01:23 - 140158008 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2015-12-08 19:45 - 2015-10-30 08:24 - 00000000 ____D C:\WINDOWS\rescache
2015-12-04 15:36 - 2015-10-30 08:24 - 00000000 ____D C:\WINDOWS\system32\SystemResetPlatform
2015-12-04 08:20 - 2015-10-30 08:24 - 00000000 ____D C:\WINDOWS\appcompat

==================== Files in the root of some directories =======

2015-07-24 15:08 - 2015-07-24 15:08 - 0000000 _____ () C:\ProgramData\DP45977C.lfl

Some files in TEMP:
====================
C:\Users\Imre\AppData\Local\Temp\DDLHZGAE.exe
C:\Users\Imre\AppData\Local\Temp\sqlite3.dll
C:\Users\Imre\AppData\Local\Temp\Uninstall.exe


==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-12-31 18:52

==================== End of FRST.txt ============================

--- --- ---

--- --- ---

--- --- ---

[CODE]Additional
FRST Logfile:

Code:

ATTFilter

scan result of Farbar Recovery Scan Tool (x64) Version:31-12-2015
Ran by Imre (2016-01-03 18:17:18)
Running from C:\Users\Imre\Desktop
Windows 10 Pro (X64) (2015-12-03 03:52:15)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-253609680-664229831-636946120-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-253609680-664229831-636946120-503 - Limited - Disabled)
Guest (S-1-5-21-253609680-664229831-636946120-501 - Limited - Disabled)
Imre (S-1-5-21-253609680-664229831-636946120-1001 - Administrator - Enabled) => C:\Users\Imre
UpdatusUser (S-1-5-21-253609680-664229831-636946120-1002 - Limited - Enabled) => C:\Users\UpdatusUser

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 15.06 beta (x64) (HKLM\...\7-Zip) (Version: 15.06 - Igor Pavlov)
Adobe Acrobat DC (HKLM-x32\...\{AC76BA86-1033-FFFF-7760-0C0F074E4100}) (Version: 15.009.20079 - Adobe Systems Incorporated)
Adobe Digital Editions 4.5 (HKLM-x32\...\Adobe Digital Editions 4.5) (Version: 4.5.0 - Adobe Systems Incorporated)
Adobe Flash Player 20 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 20.0.0.267 - Adobe Systems Incorporated)
Adobe Photoshop CS6 (HKLM-x32\...\{74EB3499-8B95-4B5C-96EB-7B342F3FD0C6}) (Version: 13.0 - Adobe Systems Incorporated)
Alcor Micro USB Card Reader (HKLM-x32\...\AmUStor) (Version: 20.2.1245.53580 - Alcor Micro Corp.)
Alcor Micro USB Card Reader (x32 Version: 20.2.1245.53580 - Alcor Micro Corp.) Hidden
BitTorrent (HKU\S-1-5-21-253609680-664229831-636946120-1001\...\BitTorrent) (Version: 7.9.5.41373 - BitTorrent Inc.)
calibre 64bit (HKLM\...\{54EFBCD2-A4FB-4C37-A720-9A8195EFC7B4}) (Version: 2.45.0 - Kovid Goyal)
CCleaner (HKLM\...\CCleaner) (Version: 5.13 - Piriform)
Cisco AnyConnect Secure Mobility Client  (HKLM-x32\...\Cisco AnyConnect Secure Mobility Client) (Version: 3.1.06073 - Cisco Systems, Inc.)
Cisco AnyConnect Secure Mobility Client (x32 Version: 3.1.06073 - Cisco Systems, Inc.) Hidden
Classic Shell (HKLM\...\{E289B7DD-6732-4333-A47A-75A145D23EE3}) (Version: 4.2.4 - IvoSoft)
Digitale Bibliothek 5 (HKLM-x32\...\Digitale Bibliothek 5) (Version:  - )
Dolby Digital Plus Advanced Audio (HKLM\...\{B0BFC63F-EA07-419E-960B-3FB2ED5DD0B2}) (Version: 7.3.2.2 - Dolby Laboratories Inc)
IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6490.0 - IDT)
Intel Collaborative Processor Performance Control (HKLM-x32\...\0E7DAF70-FB54-4B91-B192-7E771C25AEEB) (Version: 1.0.0.1013 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.14.4170 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.8.5.1000 - Intel Corporation)
Java 8 Update 66 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218066F0}) (Version: 8.0.660.18 - Oracle Corporation)
Lenovo Bluetooth with Enhanced Data Rate Software (HKLM\...\{C6D9ED03-6FCF-4410-9CB7-45CA285F9E11}) (Version: 12.0.0.7850 - Broadcom Corporation)
Lenovo EasyCamera (HKLM-x32\...\{E0A7ED39-8CD6-4351-93C3-69CCA00D12B4}) (Version: 6.2.9200.10245 - Realtek Semiconductor Corp.)
Malwarebytes Anti-Malware Version 2.2.0.1024 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.0.1024 - Malwarebytes)
Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUS) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Mozilla Firefox 41.0.2 (x86 de) (HKLM-x32\...\Mozilla Firefox 41.0.2 (x86 de)) (Version: 41.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 41.0.2.5765 - Mozilla)
Nero 11 v11.2.4.100 (x64) (HKLM\...\Nero 11 v11.2.4.100 (x64)11.2.4.100) (Version: 11.2.4.100 - Friends in War)
Neuro-Programmer 3.3.1 (HKLM-x32\...\Neuro-Programmer 3_is1) (Version:  - Transparent Corporation)
NVIDIA PhysX-Systemsoftware 9.13.0725 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.0725 - NVIDIA Corporation)
NVIDIA Update 1.14.17 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.14.17 - NVIDIA Corporation)
Outils de vérification linguistique 2013 de Microsoft Office*- Français (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
PDF Settings CS6 (x32 Version: 11.0 - Adobe Systems Incorporated) Hidden
Qualcomm Atheros Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 2.1.0.21 - Qualcomm Atheros Inc.)
Reason 5.0 (HKLM-x32\...\Reason5_is1) (Version: 5.0 - Propellerhead Software AB)
Rosetta Stone Version 3 (HKLM-x32\...\{99011A6E-5200-11DE-BDB8-7ACD56D89593}) (Version: 3.4.5.0 - Rosetta Stone Ltd.)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{D82063A8-7C8C-4C3B-A9BB-95138CA55D26}) (Version:  - Microsoft)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (Version:  - Microsoft) Hidden
SoulseekQt (HKLM-x32\...\SoulseekQt) (Version:  - )
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 19.0.9.5 - Synaptics Incorporated)
Update for Skype for Business 2015 (KB3039776) 64-Bit Edition (HKLM\...\{90150000-012B-0407-1000-0000000FF1CE}_Office15.PROPLUS_{5D2260D6-DB16-41DC-915B-A39BF4F66362}) (Version:  - Microsoft)
VLC media player (HKLM\...\VLC media player) (Version: 2.2.1 - VideoLAN)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-253609680-664229831-636946120-1001_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\localserver32 -> C:\Users\Imre\AppData\Local\Microsoft\OneDrive\17.3.6281.1202\FileCoAuth.exe (Microsoft Corporation)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {0CFE2E40-6A97-48C5-9F38-DE82315CF1B0} - System32\Tasks\Microsoft\Windows\UPnP\UPnPHostConfig => config upnphost start= auto
Task: {1B3341E4-54FE-47F6-AFC1-6C219695C6ED} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2014-01-23] (Microsoft Corporation)
Task: {5764B183-AA5D-4C32-B20A-B7FA940E6750} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)
Task: {944EC87C-BFB0-4159-935C-0D7CD9320BD2} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-12-29] (Adobe Systems Incorporated)
Task: {9C0C1A11-F24A-4B95-8B34-AF4F2CA4048B} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)
Task: {A3880DBE-2741-4C96-A495-D0E52E503E5E} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-10-28] (Adobe Systems Incorporated)
Task: {CCFB1218-4B9A-4E30-9D3B-3325C040A8D0} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-12-08] (Microsoft Corporation)
Task: {F1D4B828-0A02-4D6F-B391-8A75D263D78B} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-12-08] (Piriform Ltd)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

==================== Loaded Modules (Whitelisted) ==============

2015-10-30 08:18 - 2015-10-30 08:18 - 00185856 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll
2015-12-03 04:22 - 2015-07-23 02:10 - 00116552 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2015-12-03 14:01 - 2015-11-22 11:47 - 02653816 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
2015-07-17 23:35 - 2015-07-17 23:35 - 00396688 _____ () C:\WINDOWS\system32\igfxTray.exe
2015-12-08 20:25 - 2015-12-08 20:25 - 00057344 _____ () C:\Program Files\CCleaner\lang\lang-1031.dll
2015-12-17 15:22 - 2015-12-17 15:23 - 00144384 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.12.15004.0_x86__8wekyb3d8bbwe\SkypeHost.exe
2015-12-31 18:23 - 2015-12-31 18:23 - 03682816 _____ () C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1512.54020.0_x64__8wekyb3d8bbwe\Calculator.exe
2015-12-10 15:51 - 2015-12-10 15:52 - 00012800 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_15.1208.10480.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
2015-12-10 15:51 - 2015-12-10 15:52 - 11542016 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_15.1208.10480.0_x64__8wekyb3d8bbwe\Microsoft.Photos.dll
2015-11-20 13:28 - 2015-11-20 13:28 - 00258560 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_15.1208.10480.0_x64__8wekyb3d8bbwe\StoreRatingPromotion.dll
2015-12-03 14:01 - 2015-11-22 11:47 - 02653816 _____ () C:\WINDOWS\System32\CoreUIComponents.dll
2015-12-18 16:23 - 2015-12-07 05:14 - 00093696 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\Windows.UI.Shell.SharedUtilities.dll
2015-12-18 16:23 - 2015-12-07 05:00 - 00472064 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\QuickActions.dll
2015-12-18 16:24 - 2015-12-07 04:37 - 07992832 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2015-12-18 16:24 - 2015-12-07 04:33 - 00591360 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2015-12-18 16:24 - 2015-12-07 04:34 - 02483200 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2015-12-18 16:24 - 2015-12-07 04:36 - 04089856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2015-02-10 13:12 - 2015-02-10 13:12 - 02210480 _____ () C:\Program Files\Microsoft Office\Office15\tmpod.dll
2015-10-13 15:10 - 2015-10-13 15:10 - 01428648 _____ () C:\Program Files\Microsoft Office\Office15\ADDINS\UmOutlookAddin.dll
2014-11-19 16:36 - 2014-11-19 16:36 - 00063376 _____ () C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\zlib1.dll
2015-03-17 00:34 - 2015-03-17 00:34 - 00010240 _____ () C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\locale\de_de\acrotray.deu
2015-12-17 15:22 - 2015-12-17 15:23 - 00141312 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.12.15004.0_x86__8wekyb3d8bbwe\SkypeBackgroundTasks.dll
2015-12-17 15:22 - 2015-12-17 15:23 - 21845504 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.12.15004.0_x86__8wekyb3d8bbwe\SkyWrap.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE trusted site: HKU\S-1-5-21-253609680-664229831-636946120-1001\...\uni-koeln.de -> hxxps://vpngate.uni-koeln.de

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 14:25 - 2016-01-03 12:52 - 00000027 ____A C:\WINDOWS\system32\Drivers\etc\hosts

127.0.0.1       localhost

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-253609680-664229831-636946120-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Imre\AppData\Local\Microsoft\Windows\Themes\RoamedThemeFiles\DesktopBackground\windows 8.png
HKU\S-1-5-21-253609680-664229831-636946120-1002\Control Panel\Desktop\\Wallpaper -> 
DNS Servers: 134.95.127.1 - 134.95.9.74
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

HKLM\...\StartupApproved\Run: => "IAStorIcon"
HKLM\...\StartupApproved\Run: => "RtsFT"
HKU\S-1-5-21-253609680-664229831-636946120-1001\...\StartupApproved\StartupFolder: => "An OneNote senden.lnk"
HKU\S-1-5-21-253609680-664229831-636946120-1001\...\StartupApproved\Run: => "Lync"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{8D4E7D3F-05DD-4E72-82E2-9AB888D95DF7}] => (Allow) C:\Users\Imre\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{E8E684B2-3F54-4BFF-B7E3-5F68FB3A23DB}] => (Allow) C:\Users\Imre\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{FEFBD5C7-9158-49BA-B5C6-B96A547E668C}] => (Allow) C:\Users\Imre\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{09F494C0-0C80-4C54-91F3-CB9EC1038AF1}] => (Allow) C:\Users\Imre\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{5E13F8A6-6651-4244-B49D-D60B74281DFA}] => (Allow) C:\Users\Imre\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{E3203284-7FC1-4CA1-9A45-1D10CD6DD051}] => (Allow) C:\Users\Imre\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [UDP Query User{5162E3C3-82F3-4C28-AD34-8A650ADC1FDE}C:\program files (x86)\soulseekqt\soulseekqt.exe] => (Allow) C:\program files (x86)\soulseekqt\soulseekqt.exe
FirewallRules: [TCP Query User{14DEBD76-4677-42CC-A290-EE342B7440F1}C:\program files (x86)\soulseekqt\soulseekqt.exe] => (Allow) C:\program files (x86)\soulseekqt\soulseekqt.exe
FirewallRules: [{C8719EC4-11FA-470D-9048-CA0F956A5CAF}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{36F7EDBC-9FD3-4FE7-B257-2502042DC8DB}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{D77488F8-6FF2-4856-9DE6-774A3A38812C}] => (Allow) C:\Program Files (x86)\Rosetta Stone\Rosetta Stone Version 3\support\bin\win\RosettaStoneLtdServices.exe
FirewallRules: [{F873506A-477B-4025-AAD5-061AE3A27D46}] => (Allow) C:\Program Files (x86)\Rosetta Stone\Rosetta Stone Version 3\support\bin\win\RosettaStoneLtdServices.exe
FirewallRules: [{C5E16228-5EFC-4313-AC67-212D9A363BD6}] => (Allow) C:\Program Files (x86)\Rosetta Stone\Rosetta Stone Version 3\RosettaStoneVersion3.exe
FirewallRules: [{A74A5CA6-053B-47DD-9186-94605A9F25A1}] => (Allow) C:\Program Files (x86)\Rosetta Stone\Rosetta Stone Version 3\RosettaStoneVersion3.exe
FirewallRules: [{FA470FA1-30BB-4B01-8545-99847B8AE539}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{D0B97454-4D39-46F3-8917-71C7F33144BB}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{D1F0B3E2-E728-4A09-81A8-FE3ABC5E3D8D}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{29EB162D-CA76-496A-91DC-1D3A49BC0746}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{110267F7-B12F-4D70-9FDA-F317C8CC7406}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [{61B2B2A9-B4B1-4018-B3AB-4B48FF694695}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [{6BBE8B66-8029-4ED3-B96E-52F1FC9B78B3}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{E35EB8AB-5ACD-41EB-BE8F-61919F4EDF48}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{8FCE982D-4992-4C49-AE13-75F68F256EEB}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{17314852-0735-4947-BA6A-E2785055737B}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe

==================== Restore Points =========================

21-12-2015 15:35:05 Windows Update
30-12-2015 14:00:37 Windows Update
31-12-2015 18:26:23 JRT Pre-Junkware Removal
01-01-2016 15:36:31 JRT Pre-Junkware Removal

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (01/03/2016 06:15:12 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_d3c2e4e965da4528.manifest.

Error: (01/03/2016 05:07:50 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm explorer.exe, Version 10.0.10586.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Systemsteuerung "Sicherheit und Wartung", um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: cd8

Startzeit: 01d1461d49e02454

Beendigungszeit: 0

Anwendungspfad: C:\Windows\explorer.exe

Berichts-ID: 0c496a65-b233-11e5-829f-20256487a424

Vollständiger Name des fehlerhaften Pakets: 

Auf das fehlerhafte Paket bezogene Anwendungs-ID:

Error: (01/03/2016 05:00:12 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_d3c2e4e965da4528.manifest.

Error: (01/03/2016 04:08:16 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Acrobat.exe, Version: 15.9.20069.28170, Zeitstempel: 0x560c3bd3
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 10.0.10586.0, Zeitstempel: 0x5632da1c
Ausnahmecode: 0xe06d7363
Fehleroffset: 0x000bd8a8
ID des fehlerhaften Prozesses: 0x137c
Startzeit der fehlerhaften Anwendung: 0xAcrobat.exe0
Pfad der fehlerhaften Anwendung: Acrobat.exe1
Pfad des fehlerhaften Moduls: Acrobat.exe2
Berichtskennung: Acrobat.exe3
Vollständiger Name des fehlerhaften Pakets: Acrobat.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Acrobat.exe5

Error: (01/03/2016 01:07:00 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_d3c2e4e965da4528.manifest.

Error: (01/03/2016 01:06:59 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_d3c2e4e965da4528.manifest.

Error: (01/03/2016 01:06:58 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_d3c2e4e965da4528.manifest.

Error: (01/03/2016 12:56:04 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_d3c2e4e965da4528.manifest.

Error: (01/03/2016 12:56:00 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_d3c2e4e965da4528.manifest.

Error: (01/03/2016 12:52:10 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: LENOVO-G710)
Description: Bei der Aktivierung der App „Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI“ ist folgender Fehler aufgetreten: -2144927141. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.


System errors:
=============
Error: (01/03/2016 01:21:59 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1275

Error: (01/03/2016 01:21:59 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Users\Imre\AppData\Local\Temp\ehdrv.sys

Error: (01/03/2016 01:21:58 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1275

Error: (01/03/2016 01:21:58 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Users\Imre\AppData\Local\Temp\ehdrv.sys

Error: (01/03/2016 01:21:58 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1275

Error: (01/03/2016 01:21:58 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Users\Imre\AppData\Local\Temp\ehdrv.sys

Error: (01/03/2016 01:08:39 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1275

Error: (01/03/2016 01:08:39 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Users\Imre\AppData\Local\Temp\ehdrv.sys

Error: (01/03/2016 01:08:38 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1275

Error: (01/03/2016 01:08:38 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Users\Imre\AppData\Local\Temp\ehdrv.sys


CodeIntegrity:
===================================
  Date: 2016-01-03 17:57:53.717
  Description: Code Integrity determined that a process (\Device\HarddiskVolume1\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume1\Windows\System32\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2016-01-03 17:57:53.589
  Description: Code Integrity determined that a process (\Device\HarddiskVolume1\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume1\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2016-01-02 16:44:53.215
  Description: Code Integrity determined that a process (\Device\HarddiskVolume1\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume1\Windows\System32\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2016-01-02 16:44:53.181
  Description: Code Integrity determined that a process (\Device\HarddiskVolume1\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume1\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2016-01-01 13:29:43.278
  Description: Code Integrity determined that a process (\Device\HarddiskVolume1\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume1\Windows\System32\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2016-01-01 13:29:43.235
  Description: Code Integrity determined that a process (\Device\HarddiskVolume1\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume1\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-12-31 18:53:20.491
  Description: Code Integrity determined that a process (\Device\HarddiskVolume1\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume1\Windows\System32\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-12-31 18:53:20.358
  Description: Code Integrity determined that a process (\Device\HarddiskVolume1\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume1\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-12-31 18:34:16.643
  Description: Code Integrity determined that a process (\Device\HarddiskVolume1\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume1\Windows\System32\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-12-31 18:34:16.540
  Description: Code Integrity determined that a process (\Device\HarddiskVolume1\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume1\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i5-4200M CPU @ 2.50GHz
Percentage of memory in use: 37%
Total physical RAM: 8116.36 MB
Available physical RAM: 5089.81 MB
Total Virtual: 9396.36 MB
Available Virtual: 5644.2 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:465.32 GB) (Free:262.56 GB) NTFS ==>[drive with boot components (obtained from BCD)]
Drive d: () (Fixed) (Total:465.76 GB) (Free:465.6 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: D9FA2484)
Partition 1: (Active) - (Size=465.3 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=450 MB) - (Type=27)
Partition 3: (Not Active) - (Size=465.8 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================

--- --- ---

M-K-D-B · 03.01.2016, 20:24

Servus,

Reste entfernen
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

start
CloseProcesses:
DeleteKey: HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{A2C98B47-B5F4-94AA-281D-4135416774CF}
DeleteKey: HKU\S-1-5-21-253609680-664229831-636946120-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{460C3D19-B3D4-4964-A550-77D263B0CCCB}
RemoveProxy:
CMD: ipconfig /flushdns
CMD: netsh winsock reset
EmptyTemp:
end

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Die Fixlog von FRST gleich posten, da diese sonst mit DelFix (siehe weiter unten) automatisch entfernt wird!

Wenn du keine Probleme mehr mit Malware hast, dann sind wir hier fertig. Deine Logdateien sind sauber.

Zum Schluss müssen wir noch ein paar abschließende Schritte unternehmen, um deinen Pc aufzuräumen und abzusichern.

Cleanup:
Alle Logs gepostet? Dann lade Dir bitte

DelFix herunter.

Schließe alle offenen Programme.
Starte die delfix.exe mit einem Doppelklick.
Setze vor jede Funktion ein Häkchen.
Klicke auf Start.

Hinweis:
DelFix entfernt u.a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
Starte Deinen Rechner anschließend neu. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein, kannst Du diese bedenkenlos löschen.

Absicherung:
Beim Betriebsystem Windows die automatischen Updates aktivieren. Auch die sicherheitsrelevante Software sollte immer nur in der aktuellsten Version vorliegen:
Browser
Java
Flash-Player
PDF-Reader

Sicherheitslücken in deren alten Versionen werden dazu ausgenutzt, um beim einfachen Besuch einer manipulierten Website per "Drive-by" Malware zu installieren.
Ich empfehle z.B. die Verwendung von Mozilla Firefox statt des Internet Explorers. Zudem lassen sich mit dem Firefox auch PDF-Dokumente öffnen.

Aktiviere eine Firewall. Die in Windows integrierte genügt im Normalfall völlig.

Sofern du noch unentschieden bist, verwende ein einziges der folgenden Antivirusprogramme mit Echtzeitscanner und stets aktueller Signaturendatenbank:

	Emsisoft	MSE

Zusätzlich kannst Du Deinen PC regelmäßig mit Malwarebytes Anti-Malware und ESET scannen.

Optional:

Adblock Plus Kann Banner, Pop-ups, Videowerbung, Tracking und Malware-Seiten blockieren.

NoScript Verhindert das Ausführen von aktiven Inhalten (Java, JavaScript, Flash,...) für sämtliche Websites. Man kann aber nach dem Prinzip einer Whitelist festlegen, auf welchen Seiten Scripts erlaubt werden sollen.

Malwarebytes Anti Exploit: Schützt die Anwendungen des Computers vor der Ausnutzung bekannter Schwachstellen.

Lade Software von einem sauberen Portal wie

.
Wähle beim Installieren von Software immer die benutzerdefinierte Option und entferne den Haken bei allen optional angebotenen Toolbars oder sonstigen, fürs Programm, irrelevanten Ergänzungen.
Um Adware wieder los zu werden, empfiehlt sich zunächst die Deinstallation sowie die anschließende Resteentfernung mit Adwcleaner .

Abschließend noch ein paar grundsätzliche Bemerkungen:

Ändere regelmäßig Deine wichtigen Online-Passwörter und erstelle regelmäßig Backups Deiner wichtigen Dateien oder des Systems.
Lade keine Software von Chip, Softonic oder SourceForge. Die dort angebotene Software wird häufig mit einem sog. "Installer" verteilt, mit dem man sich nur unerwünschte Software oder Adware installiert.
Der Nutzen von Registry-Cleanern, Optimizern usw. zur Performancesteigerung ist umstritten. Selbst Microsoft unterstützt sog. Registry-Cleaner nicht. Ich empfehle deshalb, die Finger von der Registry zu lassen und lieber die windowseigene Datenträgerbereinigung zu verwenden.

Wenn Du möchtest, kannst Du hier sagen, ob Du mit mir und meiner Hilfe zufrieden warst...

und/oder das Forum mit einer kleinen Spende unterstützen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so dass ich dieses Thema aus meinen Abos löschen kann.

akakesios · 04.01.2016, 15:58

Code:

ATTFilter

EmptyTemp: => 335.8 MB temporary data Removed.


The system needed a reboot.

==== End of Fixlog 21:16:37 ====

M-K-D-B · 04.01.2016, 22:57

Ich bin froh, dass wir helfen konnten

In diesem Forum kannst du eine kurze Rückmeldung zur Bereinigung abgeben, sofern du das möchtest:
Lob, Kritik und Wünsche
Klicke dazu auf den Button "NEUES THEMA" und poste ein kleines Feedback. Vielen Dank!

Dieses Thema scheint erledigt und wird aus meinen Abos gelöscht. Solltest Du das Thema erneut brauchen, schicke mir bitte eine PM.

Jeder andere bitte hier klicken und einen eigenen Thread erstellen.

Problem beim Starten von .dll - Das angebene Modul wurde nicht gefunden

Plagegeister aller Art und deren Bekämpfung: Problem beim Starten von .dll - Das angebene Modul wurde nicht gefunden