Trojaner-Board - mein Computer wird von "outbound" aufgesucht

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - mein Computer wird von "outbound" aufgesucht (https://www.trojaner-board.de/162288-computer-outbound-aufgesucht.html)

mein Computer wird von "outbound" aufgesucht

Liebe Helfer,
die ganze Zeit muss mal malwarebytes Seiten von "outbound" blockieren. Was muss ich dagegen tun, um "outbound" zu beseitigen?
Gruß
Gusti

hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 28-12-2014

Ran by Hans Desktop PC (administrator) on HANSDESKTOPPC on 31-12-2014 11:04:01

Running from C:\Users\Hans Desktop PC\Downloads

Loaded Profile: Hans Desktop PC (Available profiles: Hans Desktop PC & Hans)

Platform: Windows 7 Professional N Service Pack 1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11 (Default browser: Chrome)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(Logitech Inc.) C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe

(SEIKO EPSON CORPORATION) C:\Program Files (x86)\Common Files\EPSON\eEBAPI\eEBSvc.exe

(Samsung) C:\Program Files\SAMSUNG\AllShare Framework DMS\1.3.23\AllShareFrameworkManagerDMS.exe

(Samsung) C:\Program Files\SAMSUNG\AllShare Framework DMS\1.3.23\AllShareFrameworkDMS.exe

(AVM GmbH) C:\Program Files (x86)\FRITZ!Powerline\PowerlineService.exe

(CHENGDU YIWO Tech Development Co., Ltd) C:\Program Files (x86)\EaseUS\Todo Backup\bin\Agent.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe

(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\21.6.0.32\nis.exe

(Copyright 2013 SAMSUNG) C:\Program Files\SAMSUNG\Samsung Link\Samsung Link.exe

(Copyright 2013 SAMSUNG) C:\Program Files\SAMSUNG\Samsung Link\Samsung Link.exe

(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe

() C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe

(Microsoft Corporation) C:\Windows\System32\vds.exe

(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe

(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\21.6.0.32\nis.exe

(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesApp64.exe

() C:\Program Files\pia_manager\pia_manager.exe

(hxxp://www.ruby-lang.org/) C:\Users\Hans Desktop PC\AppData\Local\Temp\ocrEDC7.tmp\bin\rubyw.exe

() C:\Program Files\pia_manager\pia_manager.exe

(hxxp://www.ruby-lang.org/) C:\Users\Hans Desktop PC\AppData\Local\Temp\ocrFB8D.tmp\bin\rubyw.exe

(Realtek Semiconductor) C:\Windows\RAVCpl64.exe

(Copyright 2013 SAMSUNG) C:\Program Files\SAMSUNG\Samsung Link\Samsung Link Tray Agent.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe

(Microsoft Corporation) C:\Program Files (x86)\Windows Sidebar\sidebar.exe

(BTOWS) C:\Program Files\Toolwiz BHORM\BHORM.exe

(RemoteMouse.net) C:\Program Files (x86)\Remote Mouse\RemoteMouse.exe

(Toolwiz) C:\Program Files\Toolwiz Time Freeze 2014\ToolwizTimeFreeze.exe

() C:\Users\Hans Desktop PC\AppData\Local\Amazon Music\Amazon Music Helper.exe

() D:\Program Files (x86)\WISO\Steuersoftware 2014\mshaktuell.exe

( ) C:\Program Files\Copy Handler\ch64.exe

(Disc Soft Ltd) C:\Program Files (x86)\DAEMON Tools Lite\DTShellHlp.exe

(Samsung Electronics Co., Ltd.) D:\Program Files (x86)\Kies\KiesTrayAgent.exe

() C:\Program Files\pia_manager\pia_tray\pia_tray.exe

() C:\Program Files\pia_manager\openvpn.exe

(OldTimer Tools) C:\Users\Hans Desktop PC\Downloads\OTL.exe

(Microsoft Corporation) C:\Windows\SysWOW64\SearchProtocolHost.exe

(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe

(Google Inc.) C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe

(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil64_16_0_0_235_ActiveX.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [RtHDVCpl] => C:\Windows\RAVCpl64.exe [6495264 2014-01-12] (Realtek Semiconductor)

HKLM\...\Run: [Samsung Link] => C:\Program Files\Samsung\Samsung Link\Samsung Link Tray Agent.exe [600928 2014-01-17] (Copyright 2013 SAMSUNG)

HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)

HKLM-x32\...\Run: [NBAgent] => C:\Program Files (x86)\Nero\Nero 11\Nero BackItUp\NBAgent.exe [1493288 2012-01-13] (Nero AG)

HKLM-x32\...\Run: [KiesTrayAgent] => D:\Program Files (x86)\Kies\KiesTrayAgent.exe [311616 2014-02-07] (Samsung Electronics Co., Ltd.)

HKU\S-1-5-21-2081905457-2083805786-3871413059-1001\...\Run: [] => D:\Program Files (x86)\Kies\External\FirmwareUpdate\KiesPDLR.exe [845120 2014-02-07] (Samsung)

HKU\S-1-5-21-2081905457-2083805786-3871413059-1001\...\Run: [LightScribe Control Panel] => C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2741616 2011-03-04] (Hewlett-Packard Company)

HKU\S-1-5-21-2081905457-2083805786-3871413059-1001\...\Run: [swg] => C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2013-11-03] (Google Inc.)

HKU\S-1-5-21-2081905457-2083805786-3871413059-1001\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3696912 2014-03-04] (Disc Soft Ltd)

HKU\S-1-5-21-2081905457-2083805786-3871413059-1001\...\Run: [Toolwiz BHORM] => C:\Program files\Toolwiz BHORM\BHORM.exe [1517848 2014-07-20] (BTOWS)

HKU\S-1-5-21-2081905457-2083805786-3871413059-1001\...\Run: [Remote Mouse] => C:\Program Files (x86)\Remote Mouse\RemoteMouse.exe [1238528 2014-04-28] (RemoteMouse.net)

HKU\S-1-5-21-2081905457-2083805786-3871413059-1001\...\Run: [ToolwizTimeFreeze] => C:\Program Files\Toolwiz Time Freeze 2014\ToolwizTimeFreeze.exe [1660216 2014-10-19] (Toolwiz)

HKU\S-1-5-21-2081905457-2083805786-3871413059-1001\...\Run: [Amazon Music] => C:\Users\Hans Desktop PC\AppData\Local\Amazon Music\Amazon Music Helper.exe [6277952 2014-11-19] ()

HKU\S-1-5-21-2081905457-2083805786-3871413059-1001\...\MountPoints2: {a93bb857-425a-11e3-9c97-806e6f6e6963} - I:\autorunmenu.exe

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WISO Mein Steuer-Sparbuch heute.lnk

ShortcutTarget: WISO Mein Steuer-Sparbuch heute.lnk -> D:\Program Files (x86)\WISO\Steuersoftware 2014\mshaktuell.exe ()

Startup: C:\Users\Hans Desktop PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Copy Handler.lnk

ShortcutTarget: Copy Handler.lnk -> C:\Program Files\Copy Handler\ch64.exe ( )
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com

HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com

HKU\S-1-5-21-2081905457-2083805786-3871413059-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.tagesschau.de/

HKU\S-1-5-21-2081905457-2083805786-3871413059-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

SearchScopes: HKU\S-1-5-21-2081905457-2083805786-3871413059-1001 -> DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = https://www.google.com/search?q={searchTerms}

SearchScopes: HKU\S-1-5-21-2081905457-2083805786-3871413059-1001 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = https://www.google.com/search?q={searchTerms}

BHO: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Internet Security\Engine64\21.6.0.32\coIEPlg.dll (Symantec Corporation)

BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

BHO-x32: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Internet Security\Engine\21.6.0.32\coIEPlg.dll (Symantec Corporation)

BHO-x32: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files (x86)\Norton Internet Security\Engine\21.6.0.32\IPS\IPSBHO.DLL (Symantec Corporation)

BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)

BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine64\21.6.0.32\coIEPlg.dll (Symantec Corporation)

Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\21.6.0.32\coIEPlg.dll (Symantec Corporation)

Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

Toolbar: HKU\S-1-5-21-2081905457-2083805786-3871413059-1001 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

Toolbar: HKU\S-1-5-21-2081905457-2083805786-3871413059-1001 -> Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine64\21.6.0.32\coIEPlg.dll (Symantec Corporation)

DPF: HKLM-x32 {15BE8BEE-4105-4A79-B385-25068AA967DB} hxxp://dizun95pzobbc.cloudfront.net/VBIMDPlayer.CAB

DPF: HKLM-x32 {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab

DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

Tcpip\Parameters: [DhcpNameServer] 209.222.18.222 209.222.18.218

Tcpip\..\Interfaces\{B9747868-8A56-4C77-9451-119E3E1C704C}: [NameServer] 192.168.178.1
 

FireFox:

========

FF Plugin: @microsoft.com/GENUINE -> disabled No File

FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File

FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF Plugin-x32: @Nero.com/KM -> C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\coFFPlgn

FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\coFFPlgn [2014-12-30]

FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\IPSFF

FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\IPSFF [2013-11-15]
 

Chrome: 

=======

CHR HomePage: Default -> hxxp://www.tagesschau.de/

CHR StartupUrls: Default -> "", "https://www.google.de/search?q=www&rlz=1C1OPRB_enDE561DE562&oq=www&aqs=chrome..69i60l3j69i57j69i60l2.4336j0j4&sourceid=chrome&es_sm=122&ie=UTF-8"

CHR Profile: C:\Users\Hans Desktop PC\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Google Docs) - C:\Users\Hans Desktop PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-11-03]

CHR Extension: (Google Drive) - C:\Users\Hans Desktop PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-11-03]

CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Hans Desktop PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-28]

CHR Extension: (YouTube) - C:\Users\Hans Desktop PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-11-03]

CHR Extension: (Google-Suche) - C:\Users\Hans Desktop PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-11-03]

CHR Extension: (Norton Identity Safe) - C:\Users\Hans Desktop PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\iikflkcanblccfahdhdonehdalibjnif [2014-09-01]

CHR Extension: (Norton Security Toolbar) - C:\Users\Hans Desktop PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk [2013-11-03]

CHR Extension: (Google Wallet) - C:\Users\Hans Desktop PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-11-03]

CHR Extension: (Google Mail) - C:\Users\Hans Desktop PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-11-03]

CHR HKLM\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - No Path

CHR HKLM\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton Internet Security\Engine\21.6.0.32\Exts\Chrome.crx [2014-10-04]

CHR HKLM-x32\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - No Path

CHR HKLM-x32\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton Internet Security\Engine\21.6.0.32\Exts\Chrome.crx [2014-10-04]
 

==================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 AllShare Framework DMS; C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\AllShareFrameworkManagerDMS.exe [404360 2013-12-21] (Samsung) [File not signed]

R2 AVMPowerlineService; C:\Program Files (x86)\FRITZ!Powerline\PowerlineService.exe [139264 2014-05-21] (AVM GmbH) [File not signed]

R2 EaseUS Agent; C:\Program Files (x86)\EaseUS\Todo Backup\bin\Agent.exe [37384 2014-10-14] (CHENGDU YIWO Tech Development Co., Ltd)

R2 EpsonBidirectionalService; C:\Program Files (x86)\Common Files\EPSON\eEBAPI\eEBSVC.exe [90112 2004-11-17] (SEIKO EPSON CORPORATION) [File not signed]

R2 LightScribeService; C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2011-03-04] (Hewlett-Packard Company) [File not signed]

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)

R2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\21.6.0.32\NIS.exe [276376 2014-09-21] (Symantec Corporation)

R2 Samsung Link Service; C:\Program Files\Samsung\Samsung Link\Samsung Link.exe [609632 2014-01-17] (Copyright 2013 SAMSUNG)

S3 SandraAgentSrv; C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2014.RTM\RpcAgentSrv.exe [72344 2008-11-25] (SiSoftware) [File not signed]

R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe [2143072 2012-07-04] (TuneUp Software)

R2 UsbClientService; C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe [248704 2013-08-14] () [File not signed]
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R3 AnyDVD; C:\Windows\System32\Drivers\AnyDVD.sys [138664 2014-04-24] (SlySoft, Inc.)

R3 AnyDVD; C:\Windows\SysWOW64\Drivers\AnyDVD.sys [138664 2014-04-24] (SlySoft, Inc.)

R1 BHDrvx64; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\BASHDefs\20141209.001\BHDrvx64.sys [1587416 2014-10-03] (Symantec Corporation)

R0 BTHORM; C:\Windows\System32\Drivers\BTHORM.sys [27928 2014-07-20] (Toolwiz.com)

R1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1506000.020\ccSetx64.sys [162392 2013-09-26] (Symantec Corporation)

R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-04-06] (Disc Soft Ltd)

R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [487216 2014-12-14] (Symantec Corporation)

R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [142640 2014-12-14] (Symantec Corporation)

R0 EUBKMON; C:\Windows\System32\drivers\EUBKMON.sys [48136 2014-10-14] ()

R3 gwfilt64; C:\Windows\System32\drivers\gwfilt64.sys [28160 2014-01-12] (Creative Technology Ltd.)

R1 IDSVia64; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\IPSDefs\20141230.001\IDSvia64.sys [637656 2014-11-19] (Symantec Corporation)

S3 libusb0; C:\Windows\System32\DRIVERS\libusb0.sys [52320 2013-12-20] (hxxp://libusb-win32.sourceforge.net)

R2 mbamchameleon; C:\Windows\system32\drivers\mbamchameleon.sys [93400 2014-11-21] (Malwarebytes Corporation)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)

R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2014-12-31] (Malwarebytes Corporation)

R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation)

R3 NAVENG; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\VirusDefs\20141230.020\ENG64.SYS [129752 2014-12-09] (Symantec Corporation)

R3 NAVEX15; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\VirusDefs\20141230.020\EX64.SYS [2137304 2014-12-09] (Symantec Corporation)

R2 npf; C:\Windows\System32\drivers\npf.sys [35344 2011-02-11] (CACE Technologies, Inc.)

S3 SANDRA; C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2014.RTM\WNt500x64\Sandra.sys [23112 2009-08-07] (SiSoftware)

R1 SRTSP; C:\Windows\System32\Drivers\NISx64\1506000.020\SRTSP64.SYS [876248 2014-08-26] (Symantec Corporation)

R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1506000.020\SRTSPX64.SYS [37592 2014-08-26] (Symantec Corporation)

R0 SymDS; C:\Windows\System32\drivers\NISx64\1506000.020\SYMDS64.SYS [493656 2013-09-10] (Symantec Corporation)

R0 SymEFA; C:\Windows\System32\drivers\NISx64\1506000.020\SYMEFA64.SYS [1148120 2014-03-04] (Symantec Corporation)

R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [177752 2013-11-14] (Symantec Corporation)

R1 SymIM; C:\Windows\System32\DRIVERS\SymIMv.sys [78936 2013-09-10] (Symantec Corporation)

R1 SymIRON; C:\Windows\system32\drivers\NISx64\1506000.020\Ironx64.SYS [266968 2014-08-06] (Symantec Corporation)

R1 SymNetS; C:\Windows\System32\Drivers\NISx64\1506000.020\SYMNETS.SYS [593112 2014-02-18] (Symantec Corporation)

R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesDriver64.sys [11856 2012-05-03] (TuneUp Software)

R0 TWZDISK; C:\Windows\System32\Drivers\TWZDISK.sys [74512 2014-10-19] (Toolwiz.com)

R1 TWZFILE; C:\Windows\System32\Drivers\TWZFILE.sys [44304 2014-10-19] (Toolwiz.com)
 

==================== NetSvcs (Whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-12-31 11:04 - 2014-12-31 11:04 - 00020557 _____ () C:\Users\Hans Desktop PC\Downloads\FRST.txt

2014-12-31 11:04 - 2014-12-31 11:04 - 00000000 ____D () C:\FRST

2014-12-31 11:03 - 2014-12-31 11:03 - 02123264 _____ (Farbar) C:\Users\Hans Desktop PC\Downloads\FRST64.exe

2014-12-30 12:19 - 2014-12-30 12:19 - 00081148 _____ () C:\Users\Hans Desktop PC\Downloads\Extras.Txt

2014-12-30 12:18 - 2014-12-30 12:18 - 00121498 _____ () C:\Users\Hans Desktop PC\Downloads\OTL.Txt

2014-12-30 12:12 - 2014-12-30 12:12 - 00602112 _____ (OldTimer Tools) C:\Users\Hans Desktop PC\Downloads\OTL.exe

2014-12-28 17:09 - 2014-12-28 17:09 - 00000000 ____D () C:\Users\Hans Desktop PC\Downloads\PIAopenvpn

2014-12-28 17:08 - 2014-12-28 17:08 - 00008242 _____ () C:\Users\Hans Desktop PC\Downloads\PIAopenvpn.zip

2014-12-28 17:06 - 2014-12-28 17:06 - 00000414 _____ () C:\Users\Hans Desktop PC\Desktop\LAN-Verbindung - Verknüpfung.lnk

2014-12-28 11:27 - 2014-12-28 14:24 - 00000047 _____ () C:\Users\Hans Desktop PC\Desktop\PIA.txt

2014-12-27 19:30 - 2014-12-27 19:30 - 00002770 _____ () C:\Windows\System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2012

2014-12-27 17:39 - 2014-12-27 17:39 - 00000000 ____D () C:\Users\Hans\AppData\Local\SAMSUNG

2014-12-27 17:39 - 2014-12-27 17:39 - 00000000 ____D () C:\Users\Hans\.swt

2014-12-26 11:29 - 2014-12-26 11:29 - 00000000 ____D () C:\Users\Hans Desktop PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Samsung

2014-12-26 11:29 - 2014-12-26 11:29 - 00000000 ____D () C:\Users\Hans Desktop PC\.swt

2014-12-26 11:29 - 2014-12-26 11:29 - 00000000 ____D () C:\Upload

2014-12-26 11:26 - 2014-12-26 11:28 - 90627424 _____ (Copyright 2013 SAMSUNG) C:\Users\Hans Desktop PC\Downloads\SamsungLink18_Installer64.exe

2014-12-26 11:09 - 2014-12-26 11:09 - 00012244 _____ () C:\Users\Hans Desktop PC\Desktop\pia_tray.exe - Verknüpfung.lnk

2014-12-26 10:33 - 2014-12-26 10:33 - 00002213 _____ () C:\Users\Public\Desktop\TuneUp 1-Klick-Wartung.lnk

2014-12-26 10:33 - 2014-12-26 10:33 - 00002205 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2012.lnk

2014-12-26 10:33 - 2014-12-26 10:33 - 00002193 _____ () C:\Users\Public\Desktop\TuneUp Utilities 2012.lnk

2014-12-26 10:33 - 2014-12-26 10:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2012

2014-12-26 10:33 - 2014-12-26 10:33 - 00000000 ____D () C:\Program Files (x86)\TuneUp Utilities 2012

2014-12-26 10:33 - 2012-07-04 10:49 - 00034656 _____ (TuneUp Software) C:\Windows\system32\TURegOpt.exe

2014-12-26 10:33 - 2012-07-04 10:49 - 00025952 _____ (TuneUp Software) C:\Windows\system32\authuitu.dll

2014-12-26 10:33 - 2012-07-04 10:49 - 00021344 _____ (TuneUp Software) C:\Windows\SysWOW64\authuitu.dll

2014-12-26 10:32 - 2012-08-09 19:03 - 53588376 _____ (TuneUp Software) C:\Users\Hans Desktop PC\Downloads\TuneUpUtilities2012-multilingual.exe

2014-12-26 10:20 - 2014-12-26 10:20 - 00003886 _____ () C:\Windows\System32\Tasks\Adobe Acrobat Update Task

2014-12-24 19:58 - 2014-12-24 19:58 - 31104920 _____ () C:\Users\Hans Desktop PC\Documents\Protokoll 141224.pcapng

2014-12-24 17:28 - 2014-12-30 12:06 - 00065536 _____ () C:\Windows\system32\Ikeext.etl

2014-12-24 17:19 - 2014-12-24 17:19 - 00000000 ____D () C:\Users\Hans Desktop PC\AppData\Roaming\Wireshark

2014-12-24 17:17 - 2014-12-24 17:17 - 00001563 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wireshark.lnk

2014-12-24 17:17 - 2014-12-24 17:17 - 00001551 _____ () C:\Users\Public\Desktop\Wireshark.lnk

2014-12-24 17:16 - 2014-12-24 17:18 - 00000000 ____D () C:\Program Files\Wireshark

2014-12-24 16:17 - 2014-12-24 16:17 - 00008242 _____ () C:\Users\Hans Desktop PC\Downloads\openvpn.zip

2014-12-24 15:13 - 2014-12-24 15:13 - 00000000 ____D () C:\Users\Hans Desktop PC\Documents\openvpn

2014-12-24 14:58 - 2014-12-24 09:29 - 00008242 _____ () C:\Users\Hans Desktop PC\Documents\openvpn.zip

2014-12-24 14:10 - 2014-12-24 14:10 - 00713216 _____ () C:\Users\Hans Desktop PC\Downloads\F4EG.exe

2014-12-24 14:01 - 2014-12-24 18:38 - 00000130 _____ () C:\Users\Hans Desktop PC\Desktop\DiskStation_2.url

2014-12-22 20:18 - 2014-12-22 20:18 - 00000000 ____D () C:\Users\Hans\AppData\Roaming\Portforward.com

2014-12-22 19:21 - 2014-12-28 17:20 - 00000000 ____D () C:\Users\Hans Desktop PC\AppData\Roaming\PortForward.com

2014-12-22 18:53 - 2013-09-10 03:47 - 00078936 ____R (Symantec Corporation) C:\Windows\system32\Drivers\SymIMV.sys

2014-12-22 16:56 - 2014-12-22 16:56 - 00000020 _____ () C:\Users\Hans Desktop PC\Desktop\passwort mtoorennt.txt

2014-12-22 16:23 - 2014-12-22 16:23 - 00000000 ____D () C:\Users\Hans Desktop PC\AppData\Roaming\Titanium

2014-12-22 16:23 - 2014-12-22 16:23 - 00000000 ____D () C:\Users\Hans Desktop PC\AppData\Roaming\Apple Computer

2014-12-22 16:23 - 2014-12-22 16:23 - 00000000 ____D () C:\Users\Hans Desktop PC\AppData\Local\Apple Computer

2014-12-22 16:22 - 2014-12-31 06:39 - 00000000 ____D () C:\Program Files\pia_manager

2014-12-22 16:22 - 2014-12-24 20:04 - 00003188 _____ () C:\Windows\System32\Tasks\Private Internet Access Startup

2014-12-22 16:22 - 2014-12-22 16:22 - 00031232 _____ (The OpenVPN Project) C:\Windows\system32\Drivers\tap0901.sys

2014-12-21 19:57 - 2014-12-28 17:20 - 00000000 ____D () C:\Users\Hans Desktop PC\AppData\Roaming\uTorrent

2014-12-21 19:56 - 2014-12-21 19:56 - 01688656 _____ (BitTorrent Inc.) C:\Users\Hans Desktop PC\Downloads\uTorrent.exe

2014-12-17 20:35 - 2014-12-13 06:09 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-12-17 20:35 - 2014-12-13 04:33 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-12-15 03:20 - 2014-12-15 03:20 - 00000000 ____D () C:\Windows\system32\appraiser

2014-12-15 03:01 - 2014-10-18 03:05 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll

2014-12-15 03:01 - 2014-10-18 02:33 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll

2014-12-14 13:52 - 2014-12-14 13:53 - 02427744 _____ () C:\Users\Hans Desktop PC\Downloads\altbinzpu03914beta.zip

2014-12-14 10:37 - 2014-12-04 03:50 - 00830976 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll

2014-12-14 10:37 - 2014-12-04 03:50 - 00741376 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll

2014-12-14 10:37 - 2014-12-04 03:50 - 00413184 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll

2014-12-14 10:37 - 2014-12-04 03:50 - 00396800 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll

2014-12-14 10:37 - 2014-12-04 03:50 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-12-14 10:37 - 2014-12-04 03:50 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll

2014-12-14 10:37 - 2014-12-04 03:44 - 01083392 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-12-14 10:37 - 2014-12-02 00:28 - 01232040 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe

2014-12-14 10:37 - 2014-11-27 02:43 - 00389296 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2014-12-14 10:37 - 2014-11-27 02:10 - 00342200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

2014-12-14 10:37 - 2014-11-22 04:13 - 25059840 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-12-14 10:37 - 2014-11-22 04:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-12-14 10:37 - 2014-11-22 04:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-12-14 10:37 - 2014-11-22 03:50 - 00580096 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-12-14 10:37 - 2014-11-22 03:50 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-12-14 10:37 - 2014-11-22 03:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-12-14 10:37 - 2014-11-22 03:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-12-14 10:37 - 2014-11-22 03:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2014-12-14 10:37 - 2014-11-22 03:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-12-14 10:37 - 2014-11-22 03:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-12-14 10:37 - 2014-11-22 03:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-12-14 10:37 - 2014-11-22 03:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-12-14 10:37 - 2014-11-22 03:34 - 06039552 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-12-14 10:37 - 2014-11-22 03:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-12-14 10:37 - 2014-11-22 03:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-12-14 10:37 - 2014-11-22 03:22 - 19749376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-12-14 10:37 - 2014-11-22 03:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-12-14 10:37 - 2014-11-22 03:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-12-14 10:37 - 2014-11-22 03:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2014-12-14 10:37 - 2014-11-22 03:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-12-14 10:37 - 2014-11-22 03:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-12-14 10:37 - 2014-11-22 03:07 - 00501248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-12-14 10:37 - 2014-11-22 03:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-12-14 10:37 - 2014-11-22 03:06 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2014-12-14 10:37 - 2014-11-22 03:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-12-14 10:37 - 2014-11-22 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll

2014-12-14 10:37 - 2014-11-22 03:01 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-12-14 10:37 - 2014-11-22 02:59 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-12-14 10:37 - 2014-11-22 02:58 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-12-14 10:37 - 2014-11-22 02:56 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-12-14 10:37 - 2014-11-22 02:54 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2014-12-14 10:37 - 2014-11-22 02:49 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-12-14 10:37 - 2014-11-22 02:49 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-12-14 10:37 - 2014-11-22 02:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2014-12-14 10:37 - 2014-11-22 02:46 - 02125312 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-12-14 10:37 - 2014-11-22 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2014-12-14 10:37 - 2014-11-22 02:43 - 14412800 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-12-14 10:37 - 2014-11-22 02:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2014-12-14 10:37 - 2014-11-22 02:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-12-14 10:37 - 2014-11-22 02:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2014-12-14 10:37 - 2014-11-22 02:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2014-12-14 10:37 - 2014-11-22 02:29 - 04299264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-12-14 10:37 - 2014-11-22 02:28 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-12-14 10:37 - 2014-11-22 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-12-14 10:37 - 2014-11-22 02:22 - 02052096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-12-14 10:37 - 2014-11-22 02:21 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll

2014-12-14 10:37 - 2014-11-22 02:15 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-12-14 10:37 - 2014-11-22 02:13 - 12836864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-12-14 10:37 - 2014-11-22 02:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-12-14 10:37 - 2014-11-22 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-12-14 10:37 - 2014-11-22 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-12-14 10:37 - 2014-11-22 01:54 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-12-14 10:37 - 2014-11-11 04:09 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll

2014-12-14 10:37 - 2014-11-11 03:44 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll

2014-12-14 10:37 - 2014-11-11 02:46 - 00119296 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys

2014-12-14 10:35 - 2014-11-08 04:16 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll

2014-12-14 10:35 - 2014-11-08 03:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll

2014-12-14 10:35 - 2014-10-30 03:03 - 00165888 _____ (Microsoft Corporation) C:\Windows\system32\charmap.exe

2014-12-14 10:35 - 2014-10-30 02:45 - 00155136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\charmap.exe

2014-12-14 10:35 - 2014-10-03 03:12 - 02020352 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll

2014-12-14 10:35 - 2014-10-03 03:12 - 00346624 _____ (Microsoft Corporation) C:\Windows\system32\WSManMigrationPlugin.dll

2014-12-14 10:35 - 2014-10-03 03:12 - 00310272 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll

2014-12-14 10:35 - 2014-10-03 03:12 - 00181248 _____ (Microsoft Corporation) C:\Windows\system32\WsmAuto.dll

2014-12-14 10:35 - 2014-10-03 03:11 - 00266240 _____ (Microsoft Corporation) C:\Windows\system32\WSManHTTPConfig.exe

2014-12-14 10:35 - 2014-10-03 02:45 - 01177088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmSvc.dll

2014-12-14 10:35 - 2014-10-03 02:45 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManMigrationPlugin.dll

2014-12-14 10:35 - 2014-10-03 02:45 - 00214016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmWmiPl.dll

2014-12-14 10:35 - 2014-10-03 02:45 - 00145920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmAuto.dll

2014-12-14 10:35 - 2014-10-03 02:44 - 00198656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManHTTPConfig.exe

2014-12-08 19:51 - 2014-12-08 19:51 - 00001245 _____ () C:\Users\Hans Desktop PC\Desktop\Amazon Music.lnk

2014-12-08 17:21 - 2014-12-16 19:40 - 00030106 _____ () C:\Users\Hans Desktop PC\Documents\Adressliste Gartenverein.xlsx

2014-12-03 15:43 - 2014-12-03 15:43 - 00001053 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hyperion Download Manager.lnk

2014-12-03 15:43 - 2014-12-03 15:43 - 00001041 _____ () C:\Users\Public\Desktop\Hyperion Download Manager.lnk

2014-12-03 15:43 - 2014-12-03 15:43 - 00000000 ____D () C:\Users\Hans Desktop PC\AppData\Roaming\co.uk.Hyperion.downloader

2014-12-03 15:43 - 2014-12-03 15:43 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Macromedia

2014-12-03 15:43 - 2014-12-03 15:43 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Macromedia

2014-12-03 15:43 - 2014-12-03 15:43 - 00000000 ____D () C:\Program Files (x86)\Hyperion Download Manager
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-12-31 10:38 - 2013-11-03 19:48 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-12-31 10:28 - 2013-11-01 18:59 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-12-31 10:24 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\tracing

2014-12-31 08:12 - 2009-07-14 05:50 - 00028384 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-12-31 08:12 - 2009-07-14 05:50 - 00028384 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-12-31 08:08 - 2013-10-31 19:36 - 01484555 _____ () C:\Windows\WindowsUpdate.log

2014-12-31 07:15 - 2014-01-02 11:32 - 00003990 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{8C789A6B-65A8-4A76-A311-F27A13C4B32B}

2014-12-31 06:48 - 2014-06-29 15:39 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-12-31 06:39 - 2014-07-20 11:55 - 00000000 ____D () C:\Program Files (x86)\Remote Mouse

2014-12-30 14:38 - 2013-11-03 19:48 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-12-30 12:12 - 2011-04-12 09:14 - 00699092 _____ () C:\Windows\system32\perfh007.dat

2014-12-30 12:12 - 2011-04-12 09:14 - 00149232 _____ () C:\Windows\system32\perfc007.dat

2014-12-30 12:12 - 2009-07-14 06:12 - 01619284 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-12-30 12:06 - 2013-10-31 19:44 - 00000000 _____ () C:\Windows\system32\Drivers\lvuvc.hs

2014-12-30 12:06 - 2010-11-21 04:47 - 00356284 _____ () C:\Windows\PFRO.log

2014-12-30 12:06 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-12-30 12:06 - 2009-07-14 05:56 - 00077621 _____ () C:\Windows\setupact.log

2014-12-28 12:36 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF

2014-12-28 00:30 - 2014-03-30 12:53 - 00000000 ____D () C:\Users\Hans Desktop PC\AppData\Local\NPE

2014-12-28 00:29 - 2013-12-18 16:56 - 00000000 ____D () C:\Users\Hans Desktop PC\Documents\Mein Steuer-Sparbuch Heute

2014-12-28 00:23 - 2014-05-01 11:14 - 00000000 ____D () C:\NPE

2014-12-27 18:45 - 2009-07-14 06:38 - 00000000 ____D () C:\Program Files (x86)\Windows Sidebar

2014-12-27 17:39 - 2014-07-27 11:13 - 00000000 ____D () C:\Users\Hans

2014-12-26 14:25 - 2013-11-01 19:24 - 00598016 _____ () C:\Users\Hans Desktop PC\Documents\Hans.wlt

2014-12-26 11:29 - 2014-08-27 14:00 - 00000000 ____D () C:\Program Files\SAMSUNG

2014-12-26 11:29 - 2013-11-01 19:08 - 00000000 ____D () C:\Users\Hans Desktop PC\AppData\Local\Samsung

2014-12-26 11:29 - 2013-11-01 19:04 - 00000000 ____D () C:\ProgramData\Samsung

2014-12-26 11:29 - 2013-11-01 19:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung

2014-12-26 11:29 - 2013-10-31 19:40 - 00000000 ____D () C:\Users\Hans Desktop PC

2014-12-24 18:37 - 2014-05-01 09:51 - 00000186 _____ () C:\Users\Hans Desktop PC\Desktop\DiskStation.url

2014-12-23 01:00 - 2014-06-29 15:39 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-12-22 20:24 - 2014-01-01 11:16 - 00000000 ____D () C:\Users\Hans Desktop PC\AppData\Local\CrashDumps

2014-12-22 19:21 - 2013-11-01 19:01 - 00000000 ____D () C:\Users\Hans Desktop PC\AppData\Local\Downloaded Installations

2014-12-21 18:17 - 2014-01-01 15:12 - 00000000 ____D () C:\Users\Hans Desktop PC\AppData\Roaming\Mp3tag

2014-12-16 06:52 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache

2014-12-15 03:20 - 2014-05-07 19:24 - 00000000 ___SD () C:\Windows\system32\CompatTel

2014-12-15 03:20 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions

2014-12-15 03:20 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\AppCompat

2014-12-15 03:05 - 2013-10-31 20:26 - 00000000 ____D () C:\ProgramData\Microsoft Help

2014-12-15 03:04 - 2014-01-11 18:50 - 00000000 ____D () C:\Windows\system32\MRT

2014-12-15 03:02 - 2014-01-11 18:49 - 112710672 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-12-14 16:55 - 2014-01-01 14:44 - 00000000 ____D () C:\Users\Hans Desktop PC\AppData\Local\Nero

2014-12-14 13:27 - 2013-11-03 19:47 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk

2014-12-14 10:47 - 2014-08-18 13:52 - 00000000 ____D () C:\Users\Hans Desktop PC\AppData\Local\Adobe

2014-12-14 10:46 - 2013-11-01 18:59 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-12-14 10:46 - 2013-11-01 18:59 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-12-14 10:46 - 2013-11-01 18:59 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2014-12-14 10:40 - 2013-11-03 19:48 - 00002175 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

2014-12-10 16:42 - 2014-06-29 15:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-12-10 16:42 - 2014-01-03 13:56 - 00001106 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-12-08 14:58 - 2014-11-10 17:04 - 00000000 ____D () C:\Program Files (x86)\FRITZ!Powerline

2014-12-03 15:43 - 2013-11-03 19:47 - 00000000 ____D () C:\ProgramData\Adobe

2014-12-03 15:43 - 2013-11-03 19:47 - 00000000 ____D () C:\Program Files (x86)\Adobe

2014-12-03 15:43 - 2013-11-01 18:59 - 00000000 ____D () C:\Users\Hans Desktop PC\AppData\Roaming\Adobe
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-12-26 12:48
 

==================== End Of Log ============================

--- --- ---

[/CODE]

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 28-12-2014

Ran by Hans Desktop PC at 2014-12-31 11:04:29

Running from C:\Users\Hans Desktop PC\Downloads

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

(If an entry is included in the fixlist, it will be removed.)
 

AV: Norton Internet Security (Enabled - Up to date) {D87FA2C0-F526-77B1-D6EC-0EDF3936CEDB}

AS: Norton Internet Security (Enabled - Up to date) {631E4324-D31C-783F-EC5C-35AD42B18466}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

FW: Norton Internet Security (Enabled) {E04423E5-BF49-76E9-FDB3-A7EAC7E589A0}
 

==================== Installed Programs ======================
 

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 

7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version:  - )

Acer System Information (HKLM-x32\...\{72199E33-4F2A-4B7F-8E25-95DDDD50A678}) (Version: 1.0.0 - Acer)

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 15.0.0.356 - Adobe Systems Incorporated)

Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.235 - Adobe Systems Incorporated)

Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)

Age of Empires II: HD Edition (HKLM-x32\...\Steam App 221380) (Version:  - Hidden Path Entertainment, Ensemble Studios)

AllShare Framework DMS (HKLM\...\{83232C27-8C3F-44A5-9EB2-BB7161228ADD}) (Version: 1.3.23 - Samsung)

Alt.Binz Prepaid Usenet edition Version 0.39.14 (HKLM-x32\...\{6B87C531-F762-46BA-AC33-C88B1CC7D83B}_is1) (Version: 0.39.14 - Prepaid usenet)

ALTools Update (HKLM-x32\...\ALUpdate_is1) (Version: v11.4 - ESTsoft Corp.)

ALZip 8.51 (HKLM-x32\...\ALZip_is1) (Version: v8.51 - ESTsoft Corp.)

Amazon Music (HKU\S-1-5-21-2081905457-2083805786-3871413059-1001\...\Amazon Amazon Music) (Version: 3.7.0.693 - Amazon Services LLC)

AnyDVD (HKLM-x32\...\AnyDVD) (Version: 7.5.1.0 - SlySoft)

ChessBase 12 64-bit (HKLM\...\{26C8EF65-314F-4353-8329-69093AD325C6}) (Version: 12.0.0.0 - ChessBase)

Cinergy XS Series V5.09.0304.00a (HKLM-x32\...\Cinergy XS Series) (Version: 5.09.0304.00a - )

Copy Handler 1.32Final (HKLM\...\{9CF6A157-F0E8-4216-B229-C0CA8204BE2C}_is1) (Version: 1.32Final - Józef Starosczyk)

DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.49.1.0356 - Disc Soft Ltd)

DRAGON 1.7 (HKLM-x32\...\DRAGON) (Version: 1.7 - PREPAID-USENET LIMITED)

DVBViewer TERRATEC Edition (HKLM-x32\...\DVBViewer TERRATEC Edition_is1) (Version:  - CM&V)

EaseUS Todo Backup Workstation 7.5 (HKLM-x32\...\EaseUS Todo Backup_is1) (Version: 7.5 - CHENGDU YIWO Tech Development Co., Ltd)

EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version:  - )

EPSON Speed Dial Utility (HKLM-x32\...\{F5576DA8-9F41-4FFD-8647-BAE877F08E28}) (Version: 3.0.202 - SEIKO EPSON CORP.)

Epson Universal Laser P6 (HKLM\...\Epson Universal Laser P6) (Version:  - )

EPSON-Drucker-Software (HKLM\...\EPSON Printer and Utilities) (Version:  - )

EpsonNet Config V2 (HKLM-x32\...\{221DBED3-CAF7-4D16-B968-76B66430868A}) (Version: 2.2b - SEIKO EPSON CORPORATION)

EpsonNet SetupManager (HKLM-x32\...\InstallShield_{DFAF5B6C-47F6-4D1E-BFC8-247659A8056D}) (Version: 1.5.dE - SEIKO EPSON CORPORATION)

EpsonNet SetupManager (x32 Version: 1.5.dE - SEIKO EPSON CORPORATION) Hidden

eWallet 7.4.3 for Windows PCs (HKLM-x32\...\Ilium Software eWallet_is1) (Version: 7.4.3 - Ilium Software)

Fritz 13 (HKLM-x32\...\{85EB0F56-3DB3-42CC-9384-A665C5FC5D08}) (Version: 13.0.0.0 - ChessBase)

FRITZ!Powerline (HKLM-x32\...\{F9C9378B-78D5-4CC0-8683-B7915DFEA9C5}) (Version: 01.00.65 - AVM Berlin)

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 39.0.2171.95 - Google Inc.)

Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.5111.1712 - Google Inc.)

Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden

Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden

Houdini 3 Pro (HKLM-x32\...\{E4724E9E-D338-4D86-B9F9-810F825DCDAF}) (Version: 13.12.0.0 - ChessBase)

Hyperion Download Manager (HKLM-x32\...\co.uk.Hyperion.downloader) (Version: v1.23 - Hyperion Records Limited)

Hyperion Download Manager (x32 Version: 1.23 - Hyperion Records Limited) Hidden

Jawbone Updater (HKLM-x32\...\Jawbone Updater) (Version: 0.1 - Jawbone)

K-Lite Codec Pack 10.1.0 Full (HKLM-x32\...\KLiteCodecPack_is1) (Version: 10.1.0 - )

LightScribe System Software (HKLM-x32\...\{E0E55FC1-C53D-4F8D-B14B-B59C312747C8}) (Version: 1.18.22.2 - LightScribe)

Magic DVD Copier Version 4.9 build 5 (HKLM-x32\...\Magic DVD Copier_is1) (Version:  - Magic DVD Software, Inc.)

MAGIX Video easy TERRATEC Edition (HKLM-x32\...\MAGIX_{2FA06473-23F0-4372-8DD5-1EAE42503D93}) (Version: 3.0.1.50 - MAGIX AG)

MAGIX Video easy TERRATEC Edition (Version: 3.0.1.50 - MAGIX AG) Hidden

Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)

Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)

Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISER) (Version: 12.0.6612.1000 - Microsoft Corporation)

Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)

Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)

Microsoft Sync Framework 2.0 Core Components (x86) ENU  (HKLM-x32\...\{FF63121D-91C6-42CC-B341-F1AA729728E7}) (Version: 2.0.1578.0 - Microsoft Corporation)

Microsoft Sync Framework 2.0 Provider Services (x86) ENU  (HKLM-x32\...\{D3A80508-CD83-4CA3-8671-914A1BC78B61}) (Version: 2.0.1578.0 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)

Mp3tag v2.65 (HKLM-x32\...\Mp3tag) (Version: v2.65 - Florian Heidenreich)

MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)

MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)

MyFreeCodec (HKU\S-1-5-21-2081905457-2083805786-3871413059-1001\...\MyFreeCodec) (Version:  - )

MyPhoneExplorer (HKLM-x32\...\MPE) (Version: 1.8.5 - F.J. Wechselberger)

Nero 11 Platinum (HKLM-x32\...\{79B3E8EE-35F2-4CCD-82D9-4A57F408E449}) (Version: 11.2.00700 - Nero AG)

Nero 2014 (HKLM-x32\...\{B7D4C429-9CAB-4B97-A879-AFD1F922DD27}) (Version: 15.0.06800 - Nero AG)

Nero Backup Drivers (HKLM\...\{D600D357-5CB9-4DE9-8FD4-14E208BD1970}) (Version: 12.0.4000 - Nero AG)

Nero Info (HKLM-x32\...\{B791E0AB-87A9-41A4-8D98-D13C2E37D928}) (Version: 15.1.0030 - Nero AG)

Nero Prerequisite Installer 1.0 (HKLM-x32\...\{AFD1BFF3-FE02-47BB-8F45-739D46AEA2BC}) (Version: 11.0.12700 - Nero AG)

Norton Internet Security (HKLM-x32\...\NIS) (Version: 21.6.0.32 - Symantec Corporation)

PDF Creator (HKLM\...\PDF Creator) (Version:  - )

PDF Creator Packages (HKU\S-1-5-21-2081905457-2083805786-3871413059-1001\...\PDF Creator Packages) (Version:  - ) <==== ATTENTION

Prerequisite installer (x32 Version: 15.0.0005 - Nero AG) Hidden

Private Internet Access Support Files (HKLM-x32\...\{7D72DAFF-DCB2-437B-BC22-4B2ABF21462B}) (Version: 1.0.0.0 - Private Internet Access)

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5704 - Realtek Semiconductor Corp.)

Remote Mouse version 2.54 (HKLM-x32\...\{01E4BC6D-3ACC-45E1-8928-C2FF626F63F3}_is1) (Version: 2.54 - Remote Mouse)

RPG Maker VX Ace (HKLM-x32\...\Steam App 220700) (Version:  - Enterbrain)

Samsung Kies (HKLM-x32\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.6.1.13105_7 - Samsung Electronics Co., Ltd.)

Samsung Kies (x32 Version: 2.6.1.13105_7 - Samsung Electronics Co., Ltd.) Hidden

Samsung Kies3 (HKLM-x32\...\InstallShield_{88547073-C566-4895-9005-EBE98EA3F7C7}) (Version: 3.2.14083.17 - Samsung Electronics Co., Ltd.)

Samsung Kies3 (x32 Version: 3.2.14083.17 - Samsung Electronics Co., Ltd.) Hidden

Samsung Link 1.8.0.1401171024 (HKLM\...\8474-7877-9059-0204) (Version: 1.8.0.1401171024 - Copyright 2013 SAMSUNG)

SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.45.0 - SAMSUNG Electronics Co., Ltd.)

SiSoftware Sandra Lite 2014.RTM (HKLM\...\{C3113E55-7BCB-4de3-8EBF-60E6CE6B2396}_is1) (Version: 20.10.2014.2 - SiSoftware)

Steam (HKLM-x32\...\Steam) (Version:  - Valve Corporation)

SyncToy 2.1 (x86) (HKLM-x32\...\{A066194B-DC8F-449A-8E0F-B57BDD3A2072}) (Version: 2.1.0 - Microsoft)

Synology Assistant (remove only) (HKLM-x32\...\Synology Assistant) (Version:  - )

TERRATEC CINERGY HTC Stick HD (64Bit) (HKLM-x32\...\{3C540F9B-0AD9-411B-A8BB-BFA63C9F7DC0}) (Version: 7.0.122.90 - TERRATEC)

TERRATEC CINERGY HTC Stick HD (HKLM-x32\...\{F3379143-B396-49E7-BE36-46B5651BFCC1}) (Version: 7.0.122.90 - TERRATEC)

TERRATEC Cinergy HTC USB XS HD (64 Bit) (HKLM-x32\...\{D4DC2182-41B4-4623-81A7-2A69AB169E6B}) (Version: 5.09.1202.00 - TERRATEC)

Toolwiz BHORM FREE (HKLM-x32\...\Toolwiz BHORM) (Version: 1.3.0.0 - Toolwiz BHORM Installer)

Toolwiz Time Freeze 2014 (HKLM-x32\...\{3A74D01E-3AEF-4DF4-8404-0056150C97A3}) (Version: 2.2.0.6000 - Toolwiz)

TuneUp Utilities 2012 (HKLM-x32\...\TuneUp Utilities 2012) (Version: 12.0.3600.114 - TuneUp Software)

TuneUp Utilities 2012 (x32 Version: 12.0.3600.114 - TuneUp Software) Hidden

TuneUp Utilities Language Pack (de-DE) (x32 Version: 12.0.3600.114 - TuneUp Software) Hidden

Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)

Update for PDF Creator (HKU\S-1-5-21-2081905457-2083805786-3871413059-1001\...\DigitalSite) (Version:  - ) <==== ATTENTION

Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISER_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)

Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISER_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)

Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISER_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)

Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISER_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)

Welcome App (Start-up experience) (x32 Version: 11.0.23500.0.0 - Nero AG) Hidden

Windows-Treiberpaket - TerraTec  (USB28xxBGA) Media  (12/02/2009 5.09.1202.00) (HKLM\...\65164506FD435CC3986FDA4C94F3FFBAE17E7F97) (Version: 12/02/2009 5.09.1202.00 - TerraTec )

Windows-Treiberpaket - TERRATEC (CXIR) HIDClass  (06/04/2013 7.0.122.9) (HKLM\...\72D3DC17AEF4FF562A1A6DC91649D923F4F13D22) (Version: 06/04/2013 7.0.122.9 - TERRATEC)

Windows-Treiberpaket - TERRATEC (CXPOLARIS) Media  (06/04/2013 7.0.122.9) (HKLM\...\5C806C6AF50EE53D0B94B36E4B6E1E91AA7FDF3C) (Version: 06/04/2013 7.0.122.9 - TERRATEC)

WinPcap 4.1.2 (HKLM-x32\...\WinPcapInst) (Version: 4.1.0.2001 - CACE Technologies)

Wireshark 1.12.2 (64-bit) (HKLM-x32\...\Wireshark) (Version: 1.12.2 - The Wireshark developer community, hxxp://www.wireshark.org)

WISO Hausverwalter 2014 (HKLM-x32\...\{F7DA791F-5149-4520-92F9-69379E72436F}) (Version: 8.00.8332 - Buhl Data Service GmbH)

WISO Steuer-Sparbuch 2014 (HKLM-x32\...\{318EB991-761F-4C0E-BED6-91D1D3FC223C}) (Version: 21.00.8480 - Buhl Data Service GmbH)
 

==================== Custom CLSID (selected items): ==========================
 

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
 
 

==================== Restore Points  =========================
 

22-12-2014 16:22:45 Gerätetreiber-Paketinstallation: TAP-Win32 Provider V9 Netzwerkadapter

25-12-2014 22:04:37 Windows Update

26-12-2014 10:31:15 TuneUp Utilities 2012 wird entfernt

26-12-2014 10:31:28 TuneUp Utilities Language Pack (de-DE) wird entfernt

26-12-2014 10:33:10 TuneUp Utilities 2012 wird installiert

28-12-2014 19:00:47 Windows-Sicherung
 

==================== Hosts content: ==========================
 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts
 

==================== Scheduled Tasks (whitelisted) =============
 

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
 

Task: {0B8525F4-32F2-40CD-A9A7-E6125DF17EE5} - System32\Tasks\Norton Internet Security\Norton Error Processor => C:\Program Files (x86)\Norton Internet Security\Engine\21.6.0.32\SymErr.exe [2014-01-30] (Symantec Corporation)

Task: {42926C80-5756-4BC0-B43B-84C1D7B75D96} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-11-03] (Google Inc.)

Task: {559DC91C-0DB2-43B2-8E45-F13144461F9E} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)

Task: {AD3516DE-A407-4723-9697-36A1F9E93AB0} - \DigitalSite No Task File <==== ATTENTION

Task: {C5C94D19-5421-4B9B-8B21-788D065F45B2} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-12-14] (Adobe Systems Incorporated)

Task: {CC5DB143-623B-4CDC-8348-61DBC9DA3BBA} - System32\Tasks\Nero\Nero Info => C:\Program Files (x86)\Common Files\Nero\Nero Info\NeroInfo.exe [2013-10-16] (Nero AG)

Task: {DADCCC07-3937-41CB-9C00-16E86CCC31E4} - System32\Tasks\Private Internet Access Startup => C:\Program Files\pia_manager\pia_manager.exe [2014-12-24] ()

Task: {DDC67A09-8DBD-4EBB-8228-6276F6EA96B7} - System32\Tasks\Norton Internet Security\Norton Error Analyzer => C:\Program Files (x86)\Norton Internet Security\Engine\21.6.0.32\SymErr.exe [2014-01-30] (Symantec Corporation)

Task: {E10E2AC9-C728-4D72-9F56-18F5C499E0D3} - System32\Tasks\{721768B1-8EC5-42C1-926B-B96A848DA9F0} => pcalua.exe -a "C:\Program Files (x86)\EpsonNet\EpsonNet SetupManager\IManager.exe" -d "C:\Program Files (x86)\EpsonNet\EpsonNet SetupManager\"

Task: {E3B687E7-6B87-4064-B2FC-FD3B55EC102E} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)

Task: {E666C32A-9E5C-4F5C-AFFC-002E80FAFEE7} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-11-03] (Google Inc.)

Task: {F2DEE82C-D7B8-4EFE-9D63-255CA716AF84} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton Internet Security\Engine\21.6.0.32\WSCStub.exe [2014-09-21] (Symantec Corporation)

Task: {F3527D0B-84B5-4698-83FA-A313CC715AA2} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2012 => C:\Program Files (x86)\TuneUp Utilities 2012\OneClick.exe [2012-07-04] (TuneUp Software)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
 

==================== Loaded Modules (whitelisted) =============
 

2013-12-03 12:13 - 2011-10-04 22:43 - 00087552 _____ () C:\Windows\System32\custmon64i.dll

2014-12-26 11:29 - 2014-01-17 10:24 - 00013824 _____ () C:\Program Files\SAMSUNG\Samsung Link\JniSys.dll

2014-12-26 11:29 - 2014-12-26 11:29 - 00515584 _____ () C:\Windows\Temp\sqlite-3.7.2-sqlitejdbc.dll

2014-12-26 11:29 - 2014-01-17 10:24 - 01394176 _____ () C:\Program Files\SAMSUNG\Samsung Link\scone_proxy.dll

2014-12-26 11:29 - 2014-01-17 10:24 - 01435648 _____ () C:\Program Files\SAMSUNG\Samsung Link\scone_stub.dll

2013-12-21 11:25 - 2013-12-21 11:25 - 00036864 _____ () C:\Program Files\SAMSUNG\AllShare Framework DMS\1.3.23\64bit\JNIInterface.dll

2013-12-21 11:26 - 2013-12-21 11:26 - 00144384 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\64bit\ASFAPI.dll

2013-12-21 11:27 - 2013-12-21 11:27 - 00018944 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\64bit\MediaDB_Manager.dll

2013-10-22 09:52 - 2013-10-22 09:52 - 00030720 _____ () C:\Windows\system32\MediaDB64.dll

2013-10-22 09:52 - 2013-10-22 09:52 - 00908800 _____ () C:\Windows\system32\ContentDirectoryPresenter64.dll

2013-12-21 11:27 - 2013-12-21 11:27 - 00521728 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\64bit\DMS_Manager.dll

2013-07-23 19:19 - 2013-07-23 19:19 - 00049152 _____ () C:\Windows\system32\boost_date_time-vc90-mt-1_47.dll

2013-07-23 19:19 - 2013-07-23 19:19 - 00016896 _____ () C:\Windows\system32\boost_system-vc90-mt-1_47.dll

2013-07-23 19:19 - 2013-07-23 19:19 - 00058880 _____ () C:\Windows\system32\boost_thread-vc90-mt-1_47.dll

2013-07-23 19:19 - 2013-07-23 19:19 - 00299520 _____ () C:\Windows\system32\boost_serialization-vc90-mt-1_47.dll

2013-08-14 08:52 - 2013-08-14 08:52 - 00248704 _____ () C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe

2014-12-22 16:22 - 2014-12-24 20:04 - 08817658 _____ () C:\Program Files\pia_manager\pia_manager.exe

2014-04-22 19:23 - 2010-03-07 18:05 - 00290816 _____ () C:\Program Files\Copy Handler\chext64.dll

2014-12-26 11:29 - 2014-01-17 10:24 - 00048640 _____ () C:\Program Files\SAMSUNG\Samsung Link\JniIO.dll

2014-12-08 19:51 - 2014-11-19 01:55 - 06277952 _____ () C:\Users\Hans Desktop PC\AppData\Local\Amazon Music\Amazon Music Helper.exe

2013-12-15 12:14 - 2014-02-28 17:49 - 01429808 _____ () D:\Program Files (x86)\WISO\Steuersoftware 2014\mshaktuell.exe

2014-04-22 19:23 - 2010-03-07 18:04 - 00318976 _____ () C:\Program Files\Copy Handler\libicpf64u.dll

2014-04-22 19:23 - 2010-03-07 18:05 - 00037376 _____ () C:\Program Files\Copy Handler\libchcore64u.dll

2014-12-22 16:22 - 2014-12-24 20:04 - 00184320 _____ () C:\Program Files\pia_manager\pia_tray\pia_tray.exe

2014-12-22 16:22 - 2014-12-24 20:04 - 00690176 _____ () C:\Program Files\pia_manager\openvpn.exe

2014-12-22 16:22 - 2014-12-24 20:04 - 00190317 _____ () C:\Program Files\pia_manager\liblzo2-2.dll

2014-12-22 16:22 - 2014-12-24 20:04 - 00108441 _____ () C:\Program Files\pia_manager\libpkcs11-helper-1.dll

2013-12-11 16:46 - 2013-12-11 16:46 - 01114624 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\DMSManager.dll

2013-10-22 09:48 - 2013-10-22 09:48 - 00707072 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\ContentDirectoryPresenter.dll

2013-10-24 16:53 - 2013-10-24 16:53 - 00107008 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\DCMCDP.dll

2013-12-11 16:46 - 2013-12-11 16:46 - 00102400 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\FolderCDP.dll

2013-12-11 16:46 - 2013-12-11 16:46 - 00077312 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\MetadataFramework.dll

2013-02-14 19:42 - 2013-02-14 19:42 - 00520234 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\sqlite3.dll

2013-02-14 19:42 - 2013-02-14 19:42 - 00450560 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\MoodExtractor.dll

2013-02-14 19:42 - 2013-02-14 19:42 - 05717504 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\DCMImgExtractor.dll

2013-10-25 19:48 - 2013-10-25 19:48 - 00028672 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\AutoChaptering.dll

2013-02-14 19:42 - 2013-02-14 19:42 - 00147456 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\libexpat.dll

2013-10-25 19:48 - 2013-10-25 19:48 - 00012288 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\VideoThumb.dll

2013-02-14 19:42 - 2013-02-14 19:42 - 04671488 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\avcodec-52.dll

2013-02-14 19:42 - 2013-02-14 19:42 - 00070656 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\avutil-50.dll

2013-02-14 19:42 - 2013-02-14 19:42 - 00686080 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\avformat-52.dll

2013-02-14 19:42 - 2013-02-14 19:42 - 00152064 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\swscale-0.dll

2013-10-25 19:49 - 2013-10-25 19:49 - 00028160 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\AudioExtractor.dll

2013-10-25 19:48 - 2013-10-25 19:48 - 00064000 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\ID3Driver.dll

2013-02-14 19:42 - 2013-02-14 19:42 - 00366592 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\tag.dll

2013-10-25 19:48 - 2013-10-25 19:48 - 00289792 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\libThumbnail.dll

2013-10-25 19:48 - 2013-10-25 19:48 - 00023040 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\RichInfoDriver.dll

2013-12-11 16:45 - 2013-12-11 16:45 - 00017920 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\VideoExtractor.dll

2013-10-25 19:53 - 2013-10-25 19:53 - 00117248 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\ThumbnailMaker.dll

2013-10-25 19:53 - 2013-10-25 19:53 - 01033728 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\ImageMagickWrapper.dll

2013-12-11 16:45 - 2013-12-11 16:45 - 00134144 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\VideoMetadataDriver.dll

2013-10-25 19:48 - 2013-10-25 19:48 - 00290816 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\libKeyFrame.dll

2013-10-25 19:48 - 2013-10-25 19:48 - 00024064 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\SECMetaDriver.dll

2013-10-25 19:53 - 2013-10-25 19:53 - 00012288 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\ImageExtractor.dll

2013-10-25 19:48 - 2013-10-25 19:48 - 00024064 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\photoDriver.dll

2013-02-14 19:42 - 2013-02-14 19:42 - 00399826 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\libexif-12.dll.dll

2013-10-25 19:48 - 2013-10-25 19:48 - 00013824 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\TextExtractor.dll

2013-10-24 16:53 - 2013-10-24 16:53 - 00032768 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\Autobackup.dll

2013-04-19 16:38 - 2013-04-19 16:38 - 00055808 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\RosettaAllShare.dll

2013-07-23 19:18 - 2013-07-23 19:18 - 00227840 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\boost_serialization-vc90-mt-1_47.dll

2013-07-23 19:18 - 2013-07-23 19:18 - 00038912 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\boost_date_time-vc90-mt-1_47.dll

2013-07-23 19:18 - 2013-07-23 19:18 - 00012800 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\boost_system-vc90-mt-1_47.dll

2013-07-23 19:18 - 2013-07-23 19:18 - 00046592 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\boost_thread-vc90-mt-1_47.dll

2013-02-14 19:42 - 2013-02-14 19:42 - 00044032 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\us.dll

2014-11-02 10:29 - 2014-10-14 09:42 - 00098824 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\CodeLog.dll

2014-11-02 10:29 - 2014-10-14 09:41 - 00031240 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\CheckTool.dll

2014-11-02 10:29 - 2014-10-14 10:01 - 01296392 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\libxml2.dll

2014-11-02 10:29 - 2014-10-14 10:19 - 00060936 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\zlib1.dll

2014-11-02 10:29 - 2014-10-14 09:42 - 00017416 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\CompressFile.dll

2014-11-02 10:29 - 2014-10-14 10:13 - 00088584 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\TBGetRemoteNetInfo.dll

2014-11-02 10:29 - 2014-10-14 09:36 - 00107528 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\ActivationOnline.dll

2014-11-02 10:29 - 2014-10-14 10:02 - 00075784 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\logsys.dll

2014-11-02 10:29 - 2014-10-14 09:44 - 00030216 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\DiskSearchImg.dll

2014-11-02 10:29 - 2014-10-14 10:05 - 00068104 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\MountImg.dll

2014-11-02 10:29 - 2014-10-14 09:55 - 00158216 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\ImgFile.dll

2014-11-02 10:29 - 2014-10-14 09:45 - 00275976 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\DsImgFile.dll

2014-11-02 10:29 - 2014-10-14 09:40 - 00072200 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\CheckImg.dll

2014-11-02 10:29 - 2014-10-14 10:17 - 00139784 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\vhdvmdk.dll

2014-11-02 10:29 - 2014-10-14 09:39 - 00037384 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\BootDriver.dll

2014-11-02 10:29 - 2014-10-20 16:46 - 00743976 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\ExImage.dll

2014-11-02 10:29 - 2014-10-14 09:46 - 00193032 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\EmailBackupSize.dll

2014-11-02 10:29 - 2014-10-14 09:37 - 00255496 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\AndroidImage.dll

2014-11-02 10:29 - 2014-10-14 09:47 - 00145928 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\EnumDisk.dll

2014-11-02 10:29 - 2014-10-14 09:50 - 00076808 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\FatLib.dll

2014-11-02 10:29 - 2014-10-14 10:08 - 00207880 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\NTFSLib.dll

2014-11-02 10:29 - 2014-10-14 09:54 - 00024584 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\GetDriverInfo.dll

2014-11-02 10:29 - 2014-10-14 09:42 - 00020488 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\CorrectMbr.dll

2014-11-02 10:29 - 2014-10-14 09:47 - 00032264 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\EnumTapeDevice.dll

2014-11-02 10:29 - 2014-10-14 10:14 - 00034824 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\TbTapeBrowse.dll

2014-11-02 10:29 - 2014-10-14 10:10 - 00064008 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\RegLib.dll

2014-11-02 10:29 - 2014-10-14 09:36 - 00022536 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\AccountManager.dll

2014-11-02 10:29 - 2014-10-14 10:06 - 00115720 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\NasOperator.dll

2014-11-02 10:29 - 2014-10-14 09:46 - 00194056 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\EmailBrowser.dll

2014-11-02 10:29 - 2014-10-14 09:41 - 00135688 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\CloudOperator.dll

2014-11-02 10:29 - 2014-10-14 09:36 - 00037896 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\ActiveOnline.dll

2014-11-02 10:29 - 2014-10-14 10:18 - 00135688 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\VMConfig.dll

2014-11-02 10:29 - 2014-10-14 09:37 - 00019976 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\AndroidDeviceManager.dll

2014-11-02 10:29 - 2014-10-14 10:12 - 00043016 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\TbDataSwap.dll

2014-11-02 10:29 - 2014-10-14 10:12 - 00096776 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\TBFireWall.dll

2014-11-02 10:29 - 2014-10-14 09:44 - 00353800 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\DeviceManager.dll

2014-11-02 10:29 - 2014-10-14 09:44 - 00027144 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\DeviceAdapter.dll

2014-11-02 10:29 - 2014-10-14 09:43 - 00137224 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\Device.dll

2014-11-02 10:29 - 2014-10-14 10:08 - 00146952 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\Partition.dll

2014-11-02 10:29 - 2014-10-14 09:51 - 00050184 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\FileSystemAnalyser.dll

2014-11-02 10:29 - 2014-10-14 09:50 - 00061960 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\FATFileSystemAnalyser.dll

2014-11-02 10:29 - 2014-10-14 09:42 - 00089608 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\Common.dll

2014-11-02 10:29 - 2014-10-14 10:07 - 00056328 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\NTFSFileSystemAnalyser.dll

2014-12-30 12:09 - 2014-12-30 12:09 - 00012800 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocrEDC7.tmp\lib\ruby\1.9.1\i386-mingw32\enc\encdb.so

2014-12-30 12:09 - 2014-12-30 12:09 - 00009728 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocrEDC7.tmp\lib\ruby\1.9.1\i386-mingw32\enc\iso_8859_1.so

2014-12-30 12:09 - 2014-12-30 12:09 - 00014848 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocrEDC7.tmp\lib\ruby\1.9.1\i386-mingw32\enc\trans\transdb.so

2014-12-30 12:09 - 2014-12-30 12:09 - 00094208 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocrEDC7.tmp\src\rgloader\rgloader193.mswin.so

2014-12-30 12:09 - 2014-12-30 12:09 - 00009216 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocrEDC7.tmp\lib\ruby\1.9.1\i386-mingw32\etc.so

2014-12-30 12:09 - 2014-12-30 12:09 - 00094208 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocrEDC7.tmp\lib\ruby\site_ruby\1.9.1\rgloader\rgloader193.mswin.so

2014-12-30 12:09 - 2014-12-30 12:09 - 00126976 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocrEDC7.tmp\lib\ruby\1.9.1\i386-mingw32\win32ole.so

2014-12-30 12:09 - 2014-12-30 12:09 - 00087552 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocrEDC7.tmp\lib\ruby\1.9.1\i386-mingw32\dl.so

2014-12-30 12:09 - 2014-12-30 12:09 - 00016384 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocrEDC7.tmp\lib\ruby\1.9.1\i386-mingw32\fiddle.so

2014-12-30 12:09 - 2014-12-30 12:09 - 00127316 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocrEDC7.tmp\bin\libffi-6.dll

2014-12-30 12:09 - 2014-12-30 12:09 - 00008704 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocrEDC7.tmp\lib\ruby\1.9.1\i386-mingw32\enc\utf_16le.so

2014-12-30 12:09 - 2014-12-30 12:09 - 00013312 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocrEDC7.tmp\lib\ruby\1.9.1\i386-mingw32\enc\trans\utf_16_32.so

2014-12-30 12:09 - 2014-12-30 12:09 - 00095744 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocrEDC7.tmp\lib\ruby\1.9.1\i386-mingw32\enc\trans\single_byte.so

2014-12-30 12:09 - 2014-12-30 12:09 - 00026624 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocrEDC7.tmp\lib\ruby\gems\1.9.1\gems\win32-api-1.5.0-universal-mingw32\lib\win32\ruby19\win32\api.so

2014-12-30 12:09 - 2014-12-30 12:09 - 00012800 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocrFB8D.tmp\lib\ruby\1.9.1\i386-mingw32\enc\encdb.so

2014-12-30 12:09 - 2014-12-30 12:09 - 00009728 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocrFB8D.tmp\lib\ruby\1.9.1\i386-mingw32\enc\iso_8859_1.so

2014-12-30 12:09 - 2014-12-30 12:09 - 00014848 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocrFB8D.tmp\lib\ruby\1.9.1\i386-mingw32\enc\trans\transdb.so

2014-12-30 12:09 - 2014-12-30 12:09 - 00094208 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocrFB8D.tmp\src\rgloader\rgloader193.mswin.so

2014-12-30 12:09 - 2014-12-30 12:09 - 00094208 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocrFB8D.tmp\lib\ruby\site_ruby\1.9.1\rgloader\rgloader193.mswin.so

2014-12-30 12:09 - 2014-12-30 12:09 - 00118784 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocrFB8D.tmp\lib\ruby\1.9.1\i386-mingw32\socket.so

2014-12-30 12:09 - 2014-12-30 12:09 - 00069120 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocrFB8D.tmp\lib\ruby\1.9.1\i386-mingw32\zlib.so

2014-12-30 12:09 - 2014-12-30 12:09 - 00083968 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocrFB8D.tmp\bin\zlib1.dll

2014-12-30 12:09 - 2014-12-30 12:09 - 00026624 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocrFB8D.tmp\lib\ruby\1.9.1\i386-mingw32\stringio.so

2014-12-30 12:09 - 2014-12-30 12:09 - 00275968 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocrFB8D.tmp\lib\ruby\1.9.1\i386-mingw32\openssl.so

2014-12-30 12:09 - 2014-12-30 12:09 - 00015360 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocrFB8D.tmp\lib\ruby\1.9.1\i386-mingw32\digest.so

2014-12-30 12:09 - 2014-12-30 12:09 - 00008192 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocrFB8D.tmp\lib\ruby\1.9.1\i386-mingw32\fcntl.so

2014-12-30 12:09 - 2014-12-30 12:09 - 00009216 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocrFB8D.tmp\lib\ruby\1.9.1\i386-mingw32\etc.so

2014-12-30 12:09 - 2014-12-30 12:09 - 00023552 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocrFB8D.tmp\lib\ruby\1.9.1\i386-mingw32\json\ext\parser.so

2014-12-30 12:09 - 2014-12-30 12:09 - 00008704 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocrFB8D.tmp\lib\ruby\1.9.1\i386-mingw32\enc\utf_16be.so

2014-12-30 12:09 - 2014-12-30 12:09 - 00008704 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocrFB8D.tmp\lib\ruby\1.9.1\i386-mingw32\enc\utf_16le.so

2014-12-30 12:09 - 2014-12-30 12:09 - 00008704 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocrFB8D.tmp\lib\ruby\1.9.1\i386-mingw32\enc\utf_32be.so

2014-12-30 12:09 - 2014-12-30 12:09 - 00008704 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocrFB8D.tmp\lib\ruby\1.9.1\i386-mingw32\enc\utf_32le.so

2014-12-30 12:09 - 2014-12-30 12:09 - 00036352 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocrFB8D.tmp\lib\ruby\1.9.1\i386-mingw32\json\ext\generator.so

2014-12-30 12:09 - 2014-12-30 12:09 - 00126976 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocrFB8D.tmp\lib\ruby\1.9.1\i386-mingw32\win32ole.so

2014-12-30 12:09 - 2014-12-30 12:09 - 00087552 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocrFB8D.tmp\lib\ruby\1.9.1\i386-mingw32\dl.so

2014-12-30 12:09 - 2014-12-30 12:09 - 00016384 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocrFB8D.tmp\lib\ruby\1.9.1\i386-mingw32\fiddle.so

2014-12-30 12:09 - 2014-12-30 12:09 - 00127316 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocrFB8D.tmp\bin\libffi-6.dll

2014-12-30 12:09 - 2014-12-30 12:09 - 00013312 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocrFB8D.tmp\lib\ruby\1.9.1\i386-mingw32\enc\trans\utf_16_32.so

2014-12-30 12:09 - 2014-12-30 12:09 - 00095744 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocrFB8D.tmp\lib\ruby\1.9.1\i386-mingw32\enc\trans\single_byte.so

2014-12-30 12:09 - 2014-12-30 12:09 - 00026624 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocrFB8D.tmp\lib\ruby\gems\1.9.1\gems\win32-api-1.5.0-universal-mingw32\lib\win32\ruby19\win32\api.so

2011-03-04 12:02 - 2011-03-04 12:02 - 02121728 _____ () C:\Program Files (x86)\Common Files\LightScribe\QtCore4.dll

2011-03-04 12:02 - 2011-03-04 12:02 - 07745536 _____ () C:\Program Files (x86)\Common Files\LightScribe\QtGui4.dll

2011-03-04 12:02 - 2011-03-04 12:02 - 00135168 _____ () C:\Program Files (x86)\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll

2014-07-20 11:55 - 2013-11-19 21:34 - 00152576 _____ () C:\Program Files (x86)\Remote Mouse\FileS.dll

2013-12-15 12:12 - 2014-02-28 17:49 - 09666864 _____ () D:\Program Files (x86)\WISO\Steuersoftware 2014\wgui14.dll

2013-12-15 12:12 - 2014-02-28 17:48 - 00035120 _____ () D:\Program Files (x86)\WISO\Steuersoftware 2014\rsdcom48.dll

2013-12-15 12:12 - 2014-02-28 17:48 - 00309040 _____ () D:\Program Files (x86)\WISO\Steuersoftware 2014\rscorewinapi48.dll

2013-12-15 12:12 - 2014-02-28 17:48 - 00321840 _____ () D:\Program Files (x86)\WISO\Steuersoftware 2014\rsguiwinapi48.dll

2013-12-15 12:12 - 2014-02-28 17:48 - 03786544 _____ () D:\Program Files (x86)\WISO\Steuersoftware 2014\wcore14.dll

2013-12-15 12:12 - 2014-02-28 17:48 - 00136496 _____ () D:\Program Files (x86)\WISO\Steuersoftware 2014\rsodbc48.dll

2013-12-15 12:12 - 2014-02-28 17:49 - 02674480 _____ () D:\Program Files (x86)\WISO\Steuersoftware 2014\wfvie14.dll

2013-12-15 12:12 - 2014-02-28 17:48 - 01982256 _____ () D:\Program Files (x86)\WISO\Steuersoftware 2014\wsteu14.dll

2013-12-15 12:12 - 2014-02-28 17:48 - 01915184 _____ () D:\Program Files (x86)\WISO\Steuersoftware 2014\wreli14.dll

2013-12-15 12:12 - 2014-03-03 10:46 - 04329776 _____ () D:\Program Files (x86)\WISO\Steuersoftware 2014\wauff14.dll

2013-12-15 12:12 - 2014-02-11 11:53 - 01043456 _____ () D:\Program Files (x86)\WISO\Steuersoftware 2014\clucene-core.dll

2013-12-15 12:12 - 2014-02-11 11:53 - 00094720 _____ () D:\Program Files (x86)\WISO\Steuersoftware 2014\clucene-shared.dll

2013-12-15 12:12 - 2014-02-11 11:53 - 00250368 _____ () D:\Program Files (x86)\WISO\Steuersoftware 2014\clucene-contribs-lib.dll

2013-12-15 12:12 - 2014-03-03 10:46 - 01512752 _____ () D:\Program Files (x86)\WISO\Steuersoftware 2014\wmain14.dll

2013-12-15 12:12 - 2014-02-28 17:49 - 05099312 _____ () D:\Program Files (x86)\WISO\Steuersoftware 2014\wbae114.dll

2013-12-15 12:12 - 2014-02-28 17:49 - 01690416 _____ () D:\Program Files (x86)\WISO\Steuersoftware 2014\wbae214.dll

2013-12-15 12:12 - 2014-02-28 17:49 - 01801008 _____ () D:\Program Files (x86)\WISO\Steuersoftware 2014\wbae314.dll

2013-12-15 12:12 - 2014-02-28 17:49 - 01627952 _____ () D:\Program Files (x86)\WISO\Steuersoftware 2014\wbae414.dll

2013-12-15 12:12 - 2014-02-28 17:49 - 01115440 _____ () D:\Program Files (x86)\WISO\Steuersoftware 2014\whau114.dll

2013-12-15 12:12 - 2014-02-28 17:49 - 01322288 _____ () D:\Program Files (x86)\WISO\Steuersoftware 2014\whau214.dll

2013-12-15 12:12 - 2014-02-28 17:49 - 01245488 _____ () D:\Program Files (x86)\WISO\Steuersoftware 2014\wwerb14.dll

2013-12-15 12:12 - 2014-02-28 17:50 - 07319344 _____ () D:\Program Files (x86)\WISO\Steuersoftware 2014\wkont14.dll

2013-12-15 12:12 - 2014-02-28 17:49 - 01277232 _____ () D:\Program Files (x86)\WISO\Steuersoftware 2014\wimp14.dll

2013-12-15 12:12 - 2014-02-28 17:49 - 01330480 _____ () D:\Program Files (x86)\WISO\Steuersoftware 2014\wfabu14.dll

2014-12-22 16:22 - 2014-12-24 20:04 - 00815104 _____ () C:\Program Files\pia_manager\pia_tray\runtime\1.2.0.RC6d\khost.dll

2014-12-22 16:22 - 2014-12-24 20:04 - 01198592 _____ () C:\Program Files\pia_manager\pia_tray\runtime\1.2.0.RC6d\PocoFoundation.dll

2014-12-22 16:22 - 2014-12-24 20:04 - 00745472 _____ () C:\Program Files\pia_manager\pia_tray\runtime\1.2.0.RC6d\CFLite.dll

2014-12-22 16:22 - 2014-12-24 20:04 - 00059904 _____ () C:\Program Files\pia_manager\pia_tray\runtime\1.2.0.RC6d\zlib1.dll

2014-12-22 16:22 - 2014-12-24 20:04 - 01234944 _____ () C:\Program Files\pia_manager\pia_tray\runtime\1.2.0.RC6d\libxml2.dll

2014-12-22 16:22 - 2014-12-24 20:04 - 00200704 _____ () C:\Program Files\pia_manager\pia_tray\modules\tiapp\1.2.0.RC6d\tiappmodule.dll

2014-12-22 16:22 - 2014-12-24 20:04 - 00290816 _____ () C:\Program Files\pia_manager\pia_tray\runtime\1.2.0.RC6d\PocoUtil.dll

2014-12-22 16:22 - 2014-12-24 20:04 - 00511488 _____ () C:\Program Files\pia_manager\pia_tray\runtime\1.2.0.RC6d\PocoXML.dll

2014-12-22 16:22 - 2014-12-24 20:04 - 00180224 _____ () C:\Program Files\pia_manager\pia_tray\modules\tifilesystem\1.2.0.RC6d\tifilesystemmodule.dll

2014-12-22 16:22 - 2014-12-24 20:04 - 00344064 _____ () C:\Program Files\pia_manager\pia_tray\modules\tiui\1.2.0.RC6d\tiuimodule.dll

2014-12-22 16:22 - 2014-12-24 20:04 - 00368640 _____ () C:\Program Files\pia_manager\pia_tray\modules\tinetwork\1.2.0.RC6d\tinetworkmodule.dll

2014-12-22 16:22 - 2014-12-24 20:04 - 00642048 _____ () C:\Program Files\pia_manager\pia_tray\runtime\1.2.0.RC6d\PocoNet.dll

2014-12-22 16:22 - 2014-12-24 20:04 - 00217088 _____ () C:\Program Files\pia_manager\pia_tray\modules\tiprocess\1.2.0.RC6d\tiprocessmodule.dll

2009-02-26 13:46 - 2009-02-26 13:46 - 00064344 _____ () C:\Program Files (x86)\Microsoft Office\Office12\ADDINS\ColleagueImport.dll

2011-06-22 11:46 - 2011-06-22 11:46 - 00434016 _____ () C:\Program Files (x86)\Microsoft Office\Office12\ADDINS\UmOutlookAddin.dll

2013-07-10 18:07 - 2013-07-10 18:07 - 00756888 _____ () C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\MSPTLS.DLL
 

==================== Alternate Data Streams (whitelisted) =========
 

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
 
 

==================== Safe Mode (whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
 

==================== EXE Association (whitelisted) =============
 

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
 
 

==================== MSCONFIG/TASK MANAGER disabled items =========
 

(Currently there is no automatic fix for this section.)
 
 

========================= Accounts: ==========================
 

Administrator (S-1-5-21-2081905457-2083805786-3871413059-500 - Administrator - Disabled)

ETB User (S-1-5-21-2081905457-2083805786-3871413059-1004 - Administrator - Enabled)

Gast (S-1-5-21-2081905457-2083805786-3871413059-501 - Limited - Disabled)

Hans (S-1-5-21-2081905457-2083805786-3871413059-1003 - Limited - Enabled) => C:\Users\Hans

Hans Desktop PC (S-1-5-21-2081905457-2083805786-3871413059-1001 - Administrator - Enabled) => C:\Users\Hans Desktop PC

HomeGroupUser$ (S-1-5-21-2081905457-2083805786-3871413059-1002 - Limited - Enabled)
 

==================== Faulty Device Manager Devices =============
 

Name: Standardtastatur (PS/2)

Description: Standardtastatur (PS/2)

Class Guid: {4d36e96b-e325-11ce-bfc1-08002be10318}

Manufacturer: (Standardtastaturen)

Service: i8042prt

Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)

Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.

Devices stay in this state if they have been prepared for removal.

After you remove the device, this error disappears.Remove the device, and this error should be resolved.
 

Name: Microsoft PS/2-Maus

Description: Microsoft PS/2-Maus

Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318}

Manufacturer: Microsoft

Service: i8042prt

Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)

Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.

Devices stay in this state if they have been prepared for removal.

After you remove the device, this error disappears.Remove the device, and this error should be resolved.
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (12/30/2014 00:08:17 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (12/29/2014 07:23:14 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: IEXPLORE.EXE, Version: 11.0.9600.17496, Zeitstempel: 0x546fddcc

Name des fehlerhaften Moduls: nvwgf2um.dll, Version: 8.15.11.8593, Zeitstempel: 0x4a5be117

Ausnahmecode: 0xc0000005

Fehleroffset: 0x0004ee61

ID des fehlerhaften Prozesses: 0x1b20

Startzeit der fehlerhaften Anwendung: 0xIEXPLORE.EXE0

Pfad der fehlerhaften Anwendung: IEXPLORE.EXE1

Pfad des fehlerhaften Moduls: IEXPLORE.EXE2

Berichtskennung: IEXPLORE.EXE3
 

Error: (12/29/2014 04:03:07 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (12/28/2014 06:29:08 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (12/28/2014 00:40:48 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (12/28/2014 00:28:59 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (12/28/2014 00:24:57 AM) (Source: System Restore) (EventID: 8193) (User: )

Description: Fehler beim Erstellen des Wiederherstellungspunkts (Prozess = C:\Users\Hans Desktop PC\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y1MUPOF3\NPE.exe Desktop PC\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y1MUPOF3\NPE.exe" /POSTADVSCAN /SERVICEPOSTADVSCAN; Beschreibung = Norton_Power_Eraser_20141228002455359; Fehler = 0x80070514).
 

Error: (12/28/2014 00:24:07 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (12/27/2014 05:41:12 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (12/26/2014 11:14:57 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
 

System errors:

=============

Error: (12/30/2014 01:46:20 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)

Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.
 

Error: (12/30/2014 00:10:24 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)

Description: Es wurde eine schwerwiegende Warnung generiert: 70. Der interne Fehlerstatus lautet: 105.
 

Error: (12/30/2014 00:06:42 PM) (Source: volmgr) (EventID: 45) (User: )

Description: Das System konnte den Treiber für das Speicherabbild nicht laden.
 

Error: (12/30/2014 00:06:43 PM) (Source: EventLog) (EventID: 6008) (User: )

Description: Das System wurde zuvor am ‎29.‎12.‎2014 um 19:49:15 unerwartet heruntergefahren.
 

Error: (12/30/2014 00:06:24 PM) (Source: volmgr) (EventID: 46) (User: )

Description: Die Initialisierung des Speicherabbildes ist fehlgeschlagen.
 

Error: (12/30/2014 00:06:24 PM) (Source: volmgr) (EventID: 45) (User: )

Description: Das System konnte den Treiber für das Speicherabbild nicht laden.
 

Error: (12/29/2014 07:30:26 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)

Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.
 

Error: (12/29/2014 07:30:24 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)

Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.
 

Error: (12/29/2014 07:30:22 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)

Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.
 

Error: (12/29/2014 07:30:18 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)

Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.
 
 

Microsoft Office Sessions:

=========================
 

==================== Memory info =========================== 
 

Processor: Intel(R) Core(TM) i7 CPU 920 @ 2.67GHz

Percentage of memory in use: 55%

Total physical RAM: 6135.17 MB

Available physical RAM: 2756.02 MB

Total Pagefile: 12268.52 MB

Available Pagefile: 8306.28 MB

Total Virtual: 8192 MB

Available Virtual: 8191.83 MB
 

==================== Drives ================================
 

Drive c: () (Fixed) (Total:119.14 GB) (Free:34.43 GB) NTFS ==>[Drive with boot components (obtained from BCD)]

Drive d: (Volume) (Fixed) (Total:1863.01 GB) (Free:149.61 GB) NTFS

Drive e: (SYSTEM RESERVED) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]

Drive f: (Volume) (Fixed) (Total:2794.39 GB) (Free:1413.24 GB) NTFS

Drive g: (Acer) (Fixed) (Total:691.95 GB) (Free:374.16 GB) NTFS

Drive h: (DATA) (Fixed) (Total:692.21 GB) (Free:440.81 GB) NTFS

Drive i: (Disc) (CDROM) (Total:1.34 GB) (Free:0 GB) UDF
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (Size: 119.2 GB) (Disk ID: 42BEBAC4)

Partition 1: (Not Active) - (Size=100 MB) - (Type=27)

Partition 2: (Active) - (Size=119.1 GB) - (Type=07 NTFS)
 

========================================================

Disk: 1 (Size: 1397.3 GB) (Disk ID: F41CCCF5)

Partition 1: (Not Active) - (Size=13 GB) - (Type=27)

Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=692 GB) - (Type=07 NTFS)

Partition 4: (Not Active) - (Size=692.2 GB) - (Type=07 NTFS)
 

========================================================

Disk: 2 (Size: 2794.5 GB) (Disk ID: 1100DA85)
 

Partition: GPT Partition Type.
 

========================================================

Disk: 3 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: 02F717BE)

Partition 1: (Not Active) - (Size=1863 GB) - (Type=07 NTFS)
 

==================== End Of Log ============================

Lade Dir bitte von hier

Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.

Installiere und starte das Programm. (Bebilderte Anleitung zu Revo Uninstaller)
Klicke auf Optionen und wähle als Sprache Deutsch.
Suche im Uninstallerfeld nach den Programmen:

PDF Creator Packages

Update for PDF Creator
Wähle die Programme nacheinander aus und klicke jedes Mal auf Uninstall.
Wähle anschließend den Modus "Moderat" aus.
Reste löschen:
Klicke auf dann auf und dann auf .

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Hier der Inhalt von ComboFix:

Code:

ComboFix 14-12-30.01 - Hans Desktop PC 31.12.2014  17:22:33.1.8 - x64

Microsoft Windows 7 Professional N   6.1.7601.1.1252.49.1031.18.6135.3626 [GMT 1:00]

ausgeführt von:: c:\users\Hans Desktop PC\Desktop\ComboFix.exe

AV: Norton Internet Security *Disabled/Updated* {D87FA2C0-F526-77B1-D6EC-0EDF3936CEDB}

FW: Norton Internet Security *Enabled* {E04423E5-BF49-76E9-FDB3-A7EAC7E589A0}

SP: Norton Internet Security *Enabled/Updated* {631E4324-D31C-783F-EC5C-35AD42B18466}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\windows\SysWow64\Packet.dll

c:\windows\SysWow64\pthreadVC.dll

c:\windows\SysWow64\wpcap.dll

c:\windows\TEMP\sqlite-3.7.2-sqlitejdbc.dll

D:\install.exe

H:\install.exe

.

.

(((((((((((((((((((((((((((((((((((((((   Treiber/Dienste   )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

-------\Legacy_NPF

-------\Service_npf

.

.

(((((((((((((((((((((((   Dateien erstellt von 2014-11-28 bis 2014-12-31  ))))))))))))))))))))))))))))))

.

.

2014-12-31 16:10 . 2014-12-31 16:10        --------        d-----w-        c:\program files (x86)\VS Revo Group

2014-12-31 10:04 . 2014-12-31 10:05        --------        d-----w-        C:\FRST

2014-12-27 16:39 . 2014-12-27 16:39        --------        d-----w-        c:\users\Hans\AppData\Local\SAMSUNG

2014-12-27 16:39 . 2014-12-27 16:39        --------        d-----w-        c:\users\Hans\.swt

2014-12-26 10:29 . 2014-12-26 10:29        --------        d-----w-        C:\Upload

2014-12-26 10:29 . 2014-12-26 10:29        --------        d-----w-        c:\users\Hans Desktop PC\.swt

2014-12-26 09:33 . 2012-07-04 09:49        34656        ----a-w-        c:\windows\system32\TURegOpt.exe

2014-12-26 09:33 . 2012-07-04 09:49        25952        ----a-w-        c:\windows\system32\authuitu.dll

2014-12-26 09:33 . 2012-07-04 09:49        21344        ----a-w-        c:\windows\SysWow64\authuitu.dll

2014-12-26 09:33 . 2014-12-26 09:33        --------        d-----w-        c:\program files (x86)\TuneUp Utilities 2012

2014-12-25 21:04 . 2014-12-25 21:04        --------        d-----w-        c:\windows\SysWow64\Wat

2014-12-25 21:04 . 2014-12-25 21:04        --------        d-----w-        c:\windows\system32\Wat

2014-12-24 16:19 . 2014-12-24 16:19        --------        d-----w-        c:\users\Hans Desktop PC\AppData\Roaming\Wireshark

2014-12-24 16:16 . 2014-12-24 16:18        --------        d-----w-        c:\program files\Wireshark

2014-12-22 19:18 . 2014-12-22 19:18        --------        d-----w-        c:\users\Hans\AppData\Roaming\Portforward.com

2014-12-22 18:21 . 2014-12-28 16:20        --------        d-----w-        c:\users\Hans Desktop PC\AppData\Roaming\PortForward.com

2014-12-22 17:53 . 2013-09-10 02:47        78936        ----a-r-        c:\windows\system32\drivers\SymIMV.sys

2014-12-22 15:23 . 2014-12-22 15:23        --------        d-----w-        c:\users\Hans Desktop PC\AppData\Roaming\Apple Computer

2014-12-22 15:23 . 2014-12-22 15:23        --------        d-----w-        c:\users\Hans Desktop PC\AppData\Local\Apple Computer

2014-12-22 15:23 . 2014-12-22 15:23        --------        d-----w-        c:\users\Hans Desktop PC\AppData\Roaming\Titanium

2014-12-22 15:22 . 2014-12-22 15:22        31232        ----a-w-        c:\windows\system32\drivers\tap0901.sys

2014-12-22 15:22 . 2014-12-31 11:45        --------        d-----w-        c:\program files\pia_manager

2014-12-21 18:57 . 2014-12-28 16:20        --------        d-----w-        c:\users\Hans Desktop PC\AppData\Roaming\uTorrent

2014-12-17 19:35 . 2014-12-13 05:09        144384        ----a-w-        c:\windows\system32\ieUnatt.exe

2014-12-17 19:35 . 2014-12-13 03:33        115712        ----a-w-        c:\windows\SysWow64\ieUnatt.exe

2014-12-15 02:20 . 2014-12-15 02:20        --------        d-----w-        c:\windows\system32\appraiser

2014-12-15 02:01 . 2014-10-18 02:05        4121600        ----a-w-        c:\windows\system32\mf.dll

2014-12-15 02:01 . 2014-10-18 01:33        3209728        ----a-w-        c:\windows\SysWow64\mf.dll

2014-12-14 09:35 . 2014-10-30 02:03        165888        ----a-w-        c:\windows\system32\charmap.exe

2014-12-08 18:51 . 2014-12-08 18:51        --------        d-----w-        c:\users\Hans Desktop PC\AppData\Local\Amazon Music

2014-12-03 14:43 . 2014-12-03 14:43        --------        d-----w-        c:\users\Hans Desktop PC\AppData\Roaming\co.uk.Hyperion.downloader

2014-12-03 14:43 . 2014-12-03 14:43        --------        d-----w-        c:\program files (x86)\Hyperion Download Manager

2014-12-03 14:43 . 2014-12-03 14:43        --------        d-----w-        c:\program files (x86)\Common Files\Adobe AIR

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2014-12-31 16:47 . 2014-06-29 14:39        129752        ----a-w-        c:\windows\system32\drivers\MBAMSwissArmy.sys

2014-12-15 02:02 . 2014-01-11 17:49        112710672        ----a-w-        c:\windows\system32\MRT.exe

2014-12-14 09:46 . 2013-11-01 17:59        71344        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2014-12-14 09:46 . 2013-11-01 17:59        701616        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe

2014-11-21 05:14 . 2014-06-29 14:39        63704        ----a-w-        c:\windows\system32\drivers\mwac.sys

2014-11-21 05:14 . 2014-06-29 14:39        93400        ----a-w-        c:\windows\system32\drivers\mbamchameleon.sys

2014-11-21 05:14 . 2014-01-03 12:56        25816        ----a-w-        c:\windows\system32\drivers\mbam.sys

2014-11-18 13:56 . 2014-11-18 13:56        1202848        ----a-w-        c:\windows\SysWow64\FM20.DLL

2014-11-11 03:08 . 2014-11-19 15:37        241152        ----a-w-        c:\windows\system32\pku2u.dll

2014-11-11 03:08 . 2014-11-19 15:37        728064        ----a-w-        c:\windows\system32\kerberos.dll

2014-11-11 02:44 . 2014-11-19 15:37        186880        ----a-w-        c:\windows\SysWow64\pku2u.dll

2014-11-11 02:44 . 2014-11-19 15:37        550912        ----a-w-        c:\windows\SysWow64\kerberos.dll

2014-10-25 01:57 . 2014-11-12 17:35        77824        ----a-w-        c:\windows\system32\packager.dll

2014-10-25 01:32 . 2014-11-12 17:35        67584        ----a-w-        c:\windows\SysWow64\packager.dll

2014-10-19 17:00 . 2014-10-19 17:00        74512        ----a-w-        c:\windows\system32\drivers\TWZDISK.sys

2014-10-19 17:00 . 2014-10-19 17:00        44304        ----a-w-        c:\windows\system32\drivers\TWZFILE.sys

2014-10-18 02:05 . 2014-11-12 17:35        861696        ----a-w-        c:\windows\system32\oleaut32.dll

2014-10-18 01:33 . 2014-11-12 17:35        571904        ----a-w-        c:\windows\SysWow64\oleaut32.dll

2014-10-14 10:14 . 2014-11-02 09:31        188936        ----a-w-        c:\windows\system32\drivers\EuFdDisk.sys

2014-10-14 10:14 . 2014-11-02 09:31        18440        ----a-w-        c:\windows\system32\drivers\eudskacs.sys

2014-10-14 10:14 . 2014-11-02 09:31        48136        ----a-w-        c:\windows\system32\drivers\EUBKMON.sys

2014-10-14 10:13 . 2014-11-02 09:31        60936        ----a-w-        c:\windows\system32\drivers\eubakup.sys

2014-10-14 09:44 . 2014-11-02 09:29        24072        ----a-w-        c:\windows\system32\fbnative.exe

2014-10-14 02:16 . 2014-11-12 17:47        155064        ----a-w-        c:\windows\system32\drivers\ksecpkg.sys

2014-10-14 02:13 . 2014-11-12 17:47        683520        ----a-w-        c:\windows\system32\termsrv.dll

2014-10-14 02:13 . 2014-11-12 17:35        3241984        ----a-w-        c:\windows\system32\msi.dll

2014-10-14 02:12 . 2014-11-12 17:47        1460736        ----a-w-        c:\windows\system32\lsasrv.dll

2014-10-14 02:09 . 2014-11-12 17:47        146432        ----a-w-        c:\windows\system32\msaudite.dll

2014-10-14 02:07 . 2014-11-12 17:47        681984        ----a-w-        c:\windows\system32\adtschema.dll

2014-10-14 01:50 . 2014-11-12 17:47        22016        ----a-w-        c:\windows\SysWow64\secur32.dll

2014-10-14 01:50 . 2014-11-12 17:35        2363904        ----a-w-        c:\windows\SysWow64\msi.dll

2014-10-14 01:49 . 2014-11-12 17:47        96768        ----a-w-        c:\windows\SysWow64\sspicli.dll

2014-10-14 01:47 . 2014-11-12 17:47        146432        ----a-w-        c:\windows\SysWow64\msaudite.dll

2014-10-14 01:46 . 2014-11-12 17:47        681984        ----a-w-        c:\windows\SysWow64\adtschema.dll

2014-10-10 00:57 . 2014-11-12 17:35        3198976        ----a-w-        c:\windows\system32\win32k.sys

2014-10-03 02:12 . 2014-11-12 17:37        500224        ----a-w-        c:\windows\system32\AUDIOKSE.dll

2014-10-03 02:11 . 2014-11-12 17:37        284672        ----a-w-        c:\windows\system32\EncDump.dll

2014-10-03 02:11 . 2014-11-12 17:37        680960        ----a-w-        c:\windows\system32\audiosrv.dll

2014-10-03 02:11 . 2014-11-12 17:37        440832        ----a-w-        c:\windows\system32\AudioEng.dll

2014-10-03 02:11 . 2014-11-12 17:37        296448        ----a-w-        c:\windows\system32\AudioSes.dll

2014-10-03 01:44 . 2014-11-12 17:37        442880        ----a-w-        c:\windows\SysWow64\AUDIOKSE.dll

2014-10-03 01:44 . 2014-11-12 17:37        374784        ----a-w-        c:\windows\SysWow64\AudioEng.dll

2014-10-03 01:44 . 2014-11-12 17:37        195584        ----a-w-        c:\windows\SysWow64\AudioSes.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"LightScribe Control Panel"="c:\program files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe" [2011-03-04 2741616]

"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2013-11-03 39408]

"DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2014-03-04 3696912]

"Sidebar"="c:\program files (x86)\Windows Sidebar\sidebar.exe" [2010-11-21 1174016]

"Toolwiz BHORM"="c:\program files\Toolwiz BHORM\BHORM.exe" [2014-07-20 1517848]

"Remote Mouse"="c:\program files (x86)\Remote Mouse\RemoteMouse.exe" [2014-04-28 1238528]

"ToolwizTimeFreeze"="c:\program files\Toolwiz Time Freeze 2014\ToolwizTimeFreeze.exe" [2014-10-19 1660216]

"Amazon Music"="c:\users\Hans Desktop PC\AppData\Local\Amazon Music\Amazon Music Helper.exe" [2014-11-19 6277952]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]

"NBAgent"="c:\program files (x86)\Nero\Nero 11\Nero BackItUp\NBAgent.exe" [2012-01-13 1493288]

"KiesTrayAgent"="d:\program files (x86)\Kies\KiesTrayAgent.exe" [2014-02-07 311616]

.

c:\users\Hans Desktop PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Copy Handler.lnk - c:\program files\Copy Handler\ch64.exe [2014-4-22 756736]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

WISO Mein Steuer-Sparbuch heute.lnk - d:\program files (x86)\WISO\Steuersoftware 2014\mshaktuell.exe [2013-12-15 1429808]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

"EnableLinkedConnections"= 1 (0x1)

"EnableSecureUIAPath"= 1 (0x1)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]

"LoadAppInit_DLLs"=1 (0x1)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

.

R2 AVMPowerlineService;AVM FRITZ!Powerline Service;c:\program files (x86)\FRITZ!Powerline\PowerlineService.exe;c:\program files (x86)\FRITZ!Powerline\PowerlineService.exe [x]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]

R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x]

R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]

R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]

R3 libusb0;Jawbone LibUsb-Win32 - Kernel Driver 09/04/2013,1.2.6.2;c:\windows\system32\DRIVERS\libusb0.sys;c:\windows\SYSNATIVE\DRIVERS\libusb0.sys [x]

R3 SandraAgentSrv;SiSoftware Deployment Agent Service;c:\program files\SiSoftware\SiSoftware Sandra Lite 2014.RTM\RpcAgentSrv.exe;c:\program files\SiSoftware\SiSoftware Sandra Lite 2014.RTM\RpcAgentSrv.exe [x]

R3 ssudmdm;SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]

R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]

R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]

S0 BTHORM;BTHORM;c:\windows\System32\Drivers\BTHORM.sys;c:\windows\SYSNATIVE\Drivers\BTHORM.sys [x]

S0 EUBAKUP;EUBAKUP;c:\windows\system32\drivers\eubakup.sys;c:\windows\SYSNATIVE\drivers\eubakup.sys [x]

S0 EUBKMON;EUBKMON;c:\windows\system32\drivers\EUBKMON.sys;c:\windows\SYSNATIVE\drivers\EUBKMON.sys [x]

S0 NBVol;Nero Backup Volume Filter Driver;c:\windows\system32\DRIVERS\NBVol.sys;c:\windows\SYSNATIVE\DRIVERS\NBVol.sys [x]

S0 NBVolUp;Nero Backup Volume Upper Filter Driver;c:\windows\system32\DRIVERS\NBVolUp.sys;c:\windows\SYSNATIVE\DRIVERS\NBVolUp.sys [x]

S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NISx64\1506000.020\SYMDS64.SYS;c:\windows\SYSNATIVE\drivers\NISx64\1506000.020\SYMDS64.SYS [x]

S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NISx64\1506000.020\SYMEFA64.SYS;c:\windows\SYSNATIVE\drivers\NISx64\1506000.020\SYMEFA64.SYS [x]

S0 TWZDISK;TWZDISK;c:\windows\System32\Drivers\TWZDISK.sys;c:\windows\SYSNATIVE\Drivers\TWZDISK.sys [x]

S1 BHDrvx64;BHDrvx64;c:\program files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\BASHDefs\20141209.001\BHDrvx64.sys;c:\program files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\BASHDefs\20141209.001\BHDrvx64.sys [x]

S1 ccSet_NIS;NIS Settings Manager;c:\windows\system32\drivers\NISx64\1506000.020\ccSetx64.sys;c:\windows\SYSNATIVE\drivers\NISx64\1506000.020\ccSetx64.sys [x]

S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]

S1 EUDSKACS;EUDSKACS;c:\windows\system32\drivers\eudskacs.sys;c:\windows\SYSNATIVE\drivers\eudskacs.sys [x]

S1 EUFDDISK;EUFDDISK;c:\windows\system32\drivers\EuFdDisk.sys;c:\windows\SYSNATIVE\drivers\EuFdDisk.sys [x]

S1 IDSVia64;IDSVia64;c:\program files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\IPSDefs\20141230.001\IDSvia64.sys;c:\program files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\IPSDefs\20141230.001\IDSvia64.sys [x]

S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NISx64\1506000.020\Ironx64.SYS;c:\windows\SYSNATIVE\drivers\NISx64\1506000.020\Ironx64.SYS [x]

S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\NISx64\1506000.020\SYMNETS.SYS;c:\windows\SYSNATIVE\Drivers\NISx64\1506000.020\SYMNETS.SYS [x]

S1 TWZFILE;TWZFILE;c:\windows\System32\Drivers\TWZFILE.sys;c:\windows\SYSNATIVE\Drivers\TWZFILE.sys [x]

S2 AllShare Framework DMS;AllShare Framework DMS;c:\program files\Samsung\AllShare Framework DMS\1.3.23\AllShareFrameworkManagerDMS.exe;c:\program files\Samsung\AllShare Framework DMS\1.3.23\AllShareFrameworkManagerDMS.exe [x]

S2 EaseUS Agent;EaseUS Agent Service;c:\program files (x86)\EaseUS\Todo Backup\bin\Agent.exe;c:\program files (x86)\EaseUS\Todo Backup\bin\Agent.exe [x]

S2 mbamchameleon;mbamchameleon;c:\windows\system32\drivers\mbamchameleon.sys;c:\windows\SYSNATIVE\drivers\mbamchameleon.sys [x]

S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe;c:\program files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [x]

S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [x]

S2 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe;c:\program files (x86)\Nero\Update\NASvc.exe [x]

S2 NIS;Norton Internet Security;c:\program files (x86)\Norton Internet Security\Engine\21.6.0.32\NIS.exe;c:\program files (x86)\Norton Internet Security\Engine\21.6.0.32\NIS.exe [x]

S2 Samsung Link Service;Samsung Link Service;c:\program files\Samsung\Samsung Link\Samsung Link.exe;c:\program files\Samsung\Samsung Link\Samsung Link.exe [x]

S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe;c:\program files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe [x]

S2 UMVPFSrv;UMVPFSrv;c:\program files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe;c:\program files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [x]

S2 UsbClientService;UsbClientService;c:\program files (x86)\Synology\Assistant\UsbClientService.exe;c:\program files (x86)\Synology\Assistant\UsbClientService.exe [x]

S3 busenum;Synology Virtual USB Hub;c:\windows\system32\DRIVERS\busenum.sys;c:\windows\SYSNATIVE\DRIVERS\busenum.sys [x]

S3 e1yexpress;Intel(R) Gigabit-Netzwerkverbindungstreiber;c:\windows\system32\DRIVERS\e1y60x64.sys;c:\windows\SYSNATIVE\DRIVERS\e1y60x64.sys [x]

S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [x]

S3 gwfilt64;gwfilt64;c:\windows\system32\drivers\gwfilt64.sys;c:\windows\SYSNATIVE\drivers\gwfilt64.sys [x]

S3 LVUVC64;Logitech Webcam 250(UVC);c:\windows\system32\DRIVERS\lvuvc64.sys;c:\windows\SYSNATIVE\DRIVERS\lvuvc64.sys [x]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]

S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys;c:\windows\SYSNATIVE\drivers\MBAMSwissArmy.sys [x]

S3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys;c:\windows\SYSNATIVE\drivers\mwac.sys [x]

S3 pcouffin;VSO Software pcouffin;c:\windows\system32\Drivers\pcouffin.sys;c:\windows\SYSNATIVE\Drivers\pcouffin.sys [x]

S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesDriver64.sys;c:\program files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesDriver64.sys [x]

.

.

--- Andere Dienste/Treiber im Speicher ---

.

*NewlyCreated* - MBAMSWISSARMY

*NewlyCreated* - WS2IFSL

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]

2011-03-04 11:29        451872        ----a-w-        c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]

2014-12-14 09:39        1087816        ----a-w-        c:\program files (x86)\Google\Chrome\Application\39.0.2171.95\Installer\chrmstp.exe

.

Inhalt des "geplante Tasks" Ordners

.

2014-12-31 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-11-01 09:46]

.

2014-12-31 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-11-03 18:48]

.

2014-12-31 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-11-03 18:48]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RtHDVCpl"="RAVCpl64.exe" [2014-01-12 6495264]

"Samsung Link"="c:\program files\Samsung\Samsung Link\Samsung Link Tray Agent.exe" [2014-01-17 600928]

.

------- Zusätzlicher Suchlauf -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://www.tagesschau.de/

mStart Page = hxxp://www.google.com

mDefault_Search_URL = hxxp://www.google.com

mDefault_Page_URL = hxxp://www.google.com

mLocal Page = c:\windows\SysWOW64\blank.htm

mSearch Page = hxxp://www.google.com

IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000

TCP: DhcpNameServer = 192.168.178.1

TCP: Interfaces\{B9747868-8A56-4C77-9451-119E3E1C704C}: NameServer = 192.168.178.1

DPF: {15BE8BEE-4105-4A79-B385-25068AA967DB} - hxxp://dizun95pzobbc.cloudfront.net/VBIMDPlayer.CAB

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start

.

.

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\NIS]

"ImagePath"="\"c:\program files (x86)\Norton Internet Security\Engine\21.6.0.32\NIS.exe\" /s \"NIS\" /m \"c:\program files (x86)\Norton Internet Security\Engine\21.6.0.32\diMaster.dll\" /prefetch:1"

"ImagePath"="\SystemRoot\System32\Drivers\NISx64\1506000.020\SYMNETS.SYS"

"TrustedImagePaths"="c:\program files (x86)\Norton Internet Security\Engine\21.6.0.32;c:\program files (x86)\Norton Internet Security\Engine64\21.6.0.32"

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\program files (x86)\Common Files\EPSON\eEBAPI\eEBSVC.exe

c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

c:\program files\Samsung\AllShare Framework DMS\1.3.23\AllShareFrameworkDMS.exe

c:\program files (x86)\Common Files\LightScribe\LSSrvc.exe

c:\program files (x86)\Malwarebytes Anti-Malware\mbam.exe

c:\program files\pia_manager\pia_manager.exe

c:\users\HANSDE~1\AppData\Local\Temp\ocrDA28.tmp\bin\rubyw.exe

c:\program files\pia_manager\pia_manager.exe

c:\users\HANSDE~1\AppData\Local\Temp\ocrEA00.tmp\bin\rubyw.exe

c:\program files\pia_manager\pia_tray\pia_tray.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2014-12-31  17:49:56 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2014-12-31 16:49

.

Vor Suchlauf: 18 Verzeichnis(se), 38.384.521.216 Bytes frei

Nach Suchlauf: 25 Verzeichnis(se), 38.166.564.864 Bytes frei

.

- - End Of File - - 2C5BA9FA63E6E61710E2C8EF45BAD817

5A77EC553A2E0404ED9D28319A416A4D

Gruß und Danke, sowie einen guten Rutsch ins neue Jahr!
Gusti

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

Malwarebytes brachte keinen Fund, die Datei mbam.txt finde ich nicht.

Code:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.4.1 (12.28.2014:1)

OS: Windows 7 Professional N x64

Ran by Hans Desktop PC on 31.12.2014 at 20:53:50,42

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 

~~~ Services
 
 
 

~~~ Registry Values
 
 
 

~~~ Registry Keys
 

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{D928C32F-A5A6-4EF2-A827-E483C739EE17}
 
 
 

~~~ Files
 

Successfully deleted: [File] C:\Windows\prefetch\GOOGLETOOLBARMANAGER_8CA8B414-8A88BD82.pf

Successfully deleted: [File] C:\Windows\prefetch\GOOGLETOOLBARNOTIFIER.EXE-7AE0A20E.pf

Successfully deleted: [File] C:\Windows\prefetch\GOOGLETOOLBARUSER_32.EXE-34B1B1C5.pf
 
 
 

~~~ Folders
 

Successfully deleted: [Folder] "C:\Program Files (x86)\myfree codec"
 
 
 

~~~ Event Viewer Logs were cleared
 
 
 
 
 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 31.12.2014 at 20:57:35,12

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Code:

# AdwCleaner v4.106 - Bericht erstellt am 31/12/2014 um 20:33:36

# Aktualisiert 21/12/2014 von Xplode

# Database : 2014-12-30.1 [Live]

# Betriebssystem : Windows 7 Professional N Service Pack 1 (64 bits)

# Benutzername : Hans Desktop PC - HANSDESKTOPPC

# Gestartet von : C:\Users\Hans Desktop PC\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IDU4ZRCR\AdwCleaner_4.106.exe

# Option : Löschen
 

***** [ Dienste ] *****
 
 

***** [ Dateien / Ordner ] *****
 

Ordner Gelöscht : C:\ProgramData\WPM

Ordner Gelöscht : C:\Users\Hans Desktop PC\AppData\Roaming\0D0S1L2Z1P1B

Ordner Gelöscht : C:\Users\wangzhisong\AppData\Local\Mobogenie

Ordner Gelöscht : C:\Users\Hans\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk

Ordner Gelöscht : C:\Users\Hans Desktop PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk

Datei Gelöscht : C:\END

Datei Gelöscht : C:\Users\Hans Desktop PC\daemonprocess.txt
 

***** [ Tasks ] *****
 

Task Gelöscht : DigitalSite
 

***** [ Verknüpfungen ] *****
 
 

***** [ Registrierungsdatenbank ] *****
 

Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Google\Chrome\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\DOMStorage\www.superfish.com

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\secman.DLL

Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Wpm

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}

Schlüssel Gelöscht : HKCU\Software\Myfree Codec

Schlüssel Gelöscht : HKLM\SOFTWARE\Myfree Codec

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\ask.com

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\nationzoom.com

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\nortonsafe.search.ask.com
 

***** [ Browser ] *****
 

-\\ Internet Explorer v11.0.9600.17496
 
 

-\\ Google Chrome v39.0.2171.95
 

[C:\Users\Hans Desktop PC\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://search.conduit.com/Results.aspx?gd=&ctid=CT3318522&octid=EB_ORIGINAL_CTID&ISID=MBC025D0A-EF85-4894-A45E-76D655D661A1&SearchSource=58&CUI=&UM=5&UP=SPDF4A8B1A-85FD-4CB7-ADB5-8E883401A524&q={searchTerms}&SSPV=

[C:\Users\Hans Desktop PC\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://search.conduit.com/Results.aspx?gd=&ctid=CT3318522&octid=EB_ORIGINAL_CTID&ISID=MBC025D0A-EF85-4894-A45E-76D655D661A1&SearchSource=58&CUI=&UM=5&UP=SPDF4A8B1A-85FD-4CB7-ADB5-8E883401A524&q={searchTerms}&SSPV=

[C:\Users\Hans Desktop PC\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://www.qone8.com/web/?type=ds&ts=1398152761&from=adks&uid=M4-CT128M4SSD2_00000000112603133F2B&q={searchTerms}
 

*************************
 

AdwCleaner[R0].txt - [3852 octets] - [31/12/2014 20:06:30]

AdwCleaner[S0].txt - [3706 octets] - [31/12/2014 20:33:36]
 

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [3766 octets] ##########

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 28-12-2014

Ran by Hans Desktop PC (administrator) on HANSDESKTOPPC on 31-12-2014 21:18:29

Running from C:\Users\Hans Desktop PC\Downloads

Loaded Profile: Hans Desktop PC (Available profiles: Hans Desktop PC & Hans)

Platform: Windows 7 Professional N Service Pack 1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11 (Default browser: IE)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(Logitech Inc.) C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe

(SEIKO EPSON CORPORATION) C:\Program Files (x86)\Common Files\EPSON\eEBAPI\eEBSvc.exe

(Samsung) C:\Program Files\SAMSUNG\AllShare Framework DMS\1.3.23\AllShareFrameworkManagerDMS.exe

(Samsung) C:\Program Files\SAMSUNG\AllShare Framework DMS\1.3.23\AllShareFrameworkDMS.exe

(CHENGDU YIWO Tech Development Co., Ltd) C:\Program Files (x86)\EaseUS\Todo Backup\bin\Agent.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe

(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\21.6.0.32\nis.exe

(Copyright 2013 SAMSUNG) C:\Program Files\SAMSUNG\Samsung Link\Samsung Link.exe

(Copyright 2013 SAMSUNG) C:\Program Files\SAMSUNG\Samsung Link\Samsung Link.exe

(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe

() C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe

(Microsoft Corporation) C:\Windows\System32\vds.exe

(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe

(Realtek Semiconductor) C:\Windows\RAVCpl64.exe

(Copyright 2013 SAMSUNG) C:\Program Files\SAMSUNG\Samsung Link\Samsung Link Tray Agent.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe

(Microsoft Corporation) C:\Program Files (x86)\Windows Sidebar\sidebar.exe

(BTOWS) C:\Program Files\Toolwiz BHORM\BHORM.exe

(RemoteMouse.net) C:\Program Files (x86)\Remote Mouse\RemoteMouse.exe

(Toolwiz) C:\Program Files\Toolwiz Time Freeze 2014\ToolwizTimeFreeze.exe

() C:\Users\Hans Desktop PC\AppData\Local\Amazon Music\Amazon Music Helper.exe

() D:\Program Files (x86)\WISO\Steuersoftware 2014\mshaktuell.exe

( ) C:\Program Files\Copy Handler\ch64.exe

(Disc Soft Ltd) C:\Program Files (x86)\DAEMON Tools Lite\DTShellHlp.exe

(Samsung Electronics Co., Ltd.) D:\Program Files (x86)\Kies\KiesTrayAgent.exe

(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\21.6.0.32\nis.exe

(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesApp64.exe

() C:\Program Files\pia_manager\pia_manager.exe

(hxxp://www.ruby-lang.org/) C:\Users\Hans Desktop PC\AppData\Local\Temp\ocr2AC7.tmp\bin\rubyw.exe

() C:\Program Files\pia_manager\pia_manager.exe

(hxxp://www.ruby-lang.org/) C:\Users\Hans Desktop PC\AppData\Local\Temp\ocr338D.tmp\bin\rubyw.exe

() C:\Program Files\pia_manager\pia_tray\pia_tray.exe

() C:\Program Files\pia_manager\openvpn.exe

(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe

(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe

(Google Inc.) C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe

(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe

(Google Inc.) C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe

(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil64_16_0_0_235_ActiveX.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [RtHDVCpl] => C:\Windows\RAVCpl64.exe [6495264 2014-01-12] (Realtek Semiconductor)

HKLM\...\Run: [Samsung Link] => C:\Program Files\Samsung\Samsung Link\Samsung Link Tray Agent.exe [600928 2014-01-17] (Copyright 2013 SAMSUNG)

HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)

HKLM-x32\...\Run: [NBAgent] => C:\Program Files (x86)\Nero\Nero 11\Nero BackItUp\NBAgent.exe [1493288 2012-01-13] (Nero AG)

HKLM-x32\...\Run: [KiesTrayAgent] => D:\Program Files (x86)\Kies\KiesTrayAgent.exe [311616 2014-02-07] (Samsung Electronics Co., Ltd.)

HKU\S-1-5-21-2081905457-2083805786-3871413059-1001\...\Run: [LightScribe Control Panel] => C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2741616 2011-03-04] (Hewlett-Packard Company)

HKU\S-1-5-21-2081905457-2083805786-3871413059-1001\...\Run: [swg] => C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2013-11-03] (Google Inc.)

HKU\S-1-5-21-2081905457-2083805786-3871413059-1001\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3696912 2014-03-04] (Disc Soft Ltd)

HKU\S-1-5-21-2081905457-2083805786-3871413059-1001\...\Run: [Toolwiz BHORM] => C:\Program files\Toolwiz BHORM\BHORM.exe [1517848 2014-07-20] (BTOWS)

HKU\S-1-5-21-2081905457-2083805786-3871413059-1001\...\Run: [Remote Mouse] => C:\Program Files (x86)\Remote Mouse\RemoteMouse.exe [1238528 2014-04-28] (RemoteMouse.net)

HKU\S-1-5-21-2081905457-2083805786-3871413059-1001\...\Run: [ToolwizTimeFreeze] => C:\Program Files\Toolwiz Time Freeze 2014\ToolwizTimeFreeze.exe [1660216 2014-10-19] (Toolwiz)

HKU\S-1-5-21-2081905457-2083805786-3871413059-1001\...\Run: [Amazon Music] => C:\Users\Hans Desktop PC\AppData\Local\Amazon Music\Amazon Music Helper.exe [6277952 2014-11-19] ()

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WISO Mein Steuer-Sparbuch heute.lnk

ShortcutTarget: WISO Mein Steuer-Sparbuch heute.lnk -> D:\Program Files (x86)\WISO\Steuersoftware 2014\mshaktuell.exe ()

Startup: C:\Users\Hans Desktop PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Copy Handler.lnk

ShortcutTarget: Copy Handler.lnk -> C:\Program Files\Copy Handler\ch64.exe ( )
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKU\S-1-5-21-2081905457-2083805786-3871413059-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome

HKU\S-1-5-21-2081905457-2083805786-3871413059-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKU\S-1-5-21-2081905457-2083805786-3871413059-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.tagesschau.de/

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-21-2081905457-2083805786-3871413059-1001 -> DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = https://www.google.com/search?q={searchTerms}

SearchScopes: HKU\S-1-5-21-2081905457-2083805786-3871413059-1001 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = https://www.google.com/search?q={searchTerms}

BHO: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Internet Security\Engine64\21.6.0.32\coIEPlg.dll (Symantec Corporation)

BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

BHO-x32: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Internet Security\Engine\21.6.0.32\coIEPlg.dll (Symantec Corporation)

BHO-x32: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files (x86)\Norton Internet Security\Engine\21.6.0.32\IPS\IPSBHO.DLL (Symantec Corporation)

BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)

BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine64\21.6.0.32\coIEPlg.dll (Symantec Corporation)

Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\21.6.0.32\coIEPlg.dll (Symantec Corporation)

Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

Toolbar: HKU\S-1-5-21-2081905457-2083805786-3871413059-1001 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

Toolbar: HKU\S-1-5-21-2081905457-2083805786-3871413059-1001 -> Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine64\21.6.0.32\coIEPlg.dll (Symantec Corporation)

DPF: HKLM-x32 {15BE8BEE-4105-4A79-B385-25068AA967DB} hxxp://dizun95pzobbc.cloudfront.net/VBIMDPlayer.CAB

DPF: HKLM-x32 {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab

DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

Tcpip\..\Interfaces\{B9747868-8A56-4C77-9451-119E3E1C704C}: [NameServer] 192.168.178.1
 

FireFox:

========

FF Plugin: @microsoft.com/GENUINE -> disabled No File

FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File

FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF Plugin-x32: @Nero.com/KM -> C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\coFFPlgn

FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\coFFPlgn [2014-12-31]
 

Chrome: 

=======

CHR HomePage: Default -> hxxp://www.tagesschau.de/

CHR StartupUrls: Default -> "", "https://www.google.de/search?q=www&rlz=1C1OPRB_enDE561DE562&oq=www&aqs=chrome..69i60l3j69i57j69i60l2.4336j0j4&sourceid=chrome&es_sm=122&ie=UTF-8"

CHR Profile: C:\Users\Hans Desktop PC\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Google Docs) - C:\Users\Hans Desktop PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-11-03]

CHR Extension: (Google Drive) - C:\Users\Hans Desktop PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-11-03]

CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Hans Desktop PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-28]

CHR Extension: (YouTube) - C:\Users\Hans Desktop PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-11-03]

CHR Extension: (Google-Suche) - C:\Users\Hans Desktop PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-11-03]

CHR Extension: (Norton Identity Safe) - C:\Users\Hans Desktop PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\iikflkcanblccfahdhdonehdalibjnif [2014-09-01]

CHR Extension: (Google Wallet) - C:\Users\Hans Desktop PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-11-03]

CHR Extension: (Google Mail) - C:\Users\Hans Desktop PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-11-03]

CHR HKLM\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - No Path

CHR HKLM-x32\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - No Path
 

==================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 AllShare Framework DMS; C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\AllShareFrameworkManagerDMS.exe [404360 2013-12-21] (Samsung) [File not signed]

S2 AVMPowerlineService; C:\Program Files (x86)\FRITZ!Powerline\PowerlineService.exe [139264 2014-05-21] (AVM GmbH) [File not signed]

R2 EaseUS Agent; C:\Program Files (x86)\EaseUS\Todo Backup\bin\Agent.exe [37384 2014-10-14] (CHENGDU YIWO Tech Development Co., Ltd)

R2 EpsonBidirectionalService; C:\Program Files (x86)\Common Files\EPSON\eEBAPI\eEBSVC.exe [90112 2004-11-17] (SEIKO EPSON CORPORATION) [File not signed]

R2 LightScribeService; C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2011-03-04] (Hewlett-Packard Company) [File not signed]

S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)

S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)

R2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\21.6.0.32\NIS.exe [276376 2014-09-21] (Symantec Corporation)

R2 Samsung Link Service; C:\Program Files\Samsung\Samsung Link\Samsung Link.exe [609632 2014-01-17] (Copyright 2013 SAMSUNG)

S3 SandraAgentSrv; C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2014.RTM\RpcAgentSrv.exe [72344 2008-11-25] (SiSoftware) [File not signed]

R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe [2143072 2012-07-04] (TuneUp Software)

R2 UsbClientService; C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe [248704 2013-08-14] () [File not signed]
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R3 AnyDVD; C:\Windows\System32\Drivers\AnyDVD.sys [138664 2014-04-24] (SlySoft, Inc.)

R3 AnyDVD; C:\Windows\SysWOW64\Drivers\AnyDVD.sys [138664 2014-04-24] (SlySoft, Inc.)

R1 BHDrvx64; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\BASHDefs\20141209.001\BHDrvx64.sys [1587416 2014-10-03] (Symantec Corporation)

R0 BTHORM; C:\Windows\System32\Drivers\BTHORM.sys [27928 2014-07-20] (Toolwiz.com)

R1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1506000.020\ccSetx64.sys [162392 2013-09-26] (Symantec Corporation)

R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-04-06] (Disc Soft Ltd)

R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [487216 2014-12-14] (Symantec Corporation)

R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [142640 2014-12-14] (Symantec Corporation)

R0 EUBKMON; C:\Windows\System32\drivers\EUBKMON.sys [48136 2014-10-14] ()

R3 gwfilt64; C:\Windows\System32\drivers\gwfilt64.sys [28160 2014-01-12] (Creative Technology Ltd.)

R1 IDSVia64; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\IPSDefs\20141230.001\IDSvia64.sys [637656 2014-11-19] (Symantec Corporation)

S3 libusb0; C:\Windows\System32\DRIVERS\libusb0.sys [52320 2013-12-20] (hxxp://libusb-win32.sourceforge.net)

R2 mbamchameleon; C:\Windows\system32\drivers\mbamchameleon.sys [93400 2014-11-21] (Malwarebytes Corporation)

S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)

S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation)

R3 NAVENG; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\VirusDefs\20141230.054\ENG64.SYS [129752 2014-12-09] (Symantec Corporation)

R3 NAVEX15; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\VirusDefs\20141230.054\EX64.SYS [2137304 2014-12-09] (Symantec Corporation)

S3 SANDRA; C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2014.RTM\WNt500x64\Sandra.sys [23112 2009-08-07] (SiSoftware)

R3 SRTSP; C:\Windows\System32\Drivers\NISx64\1506000.020\SRTSP64.SYS [876248 2014-08-26] (Symantec Corporation)

R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1506000.020\SRTSPX64.SYS [37592 2014-08-26] (Symantec Corporation)

R0 SymDS; C:\Windows\System32\drivers\NISx64\1506000.020\SYMDS64.SYS [493656 2013-09-10] (Symantec Corporation)

R0 SymEFA; C:\Windows\System32\drivers\NISx64\1506000.020\SYMEFA64.SYS [1148120 2014-03-04] (Symantec Corporation)

R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [177752 2013-11-14] (Symantec Corporation)

R1 SymIM; C:\Windows\System32\DRIVERS\SymIMv.sys [78936 2013-09-10] (Symantec Corporation)

R1 SymIRON; C:\Windows\system32\drivers\NISx64\1506000.020\Ironx64.SYS [266968 2014-08-06] (Symantec Corporation)

R1 SymNetS; C:\Windows\System32\Drivers\NISx64\1506000.020\SYMNETS.SYS [593112 2014-02-18] (Symantec Corporation)

R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesDriver64.sys [11856 2012-05-03] (TuneUp Software)

R0 TWZDISK; C:\Windows\System32\Drivers\TWZDISK.sys [74512 2014-10-19] (Toolwiz.com)

R1 TWZFILE; C:\Windows\System32\Drivers\TWZFILE.sys [44304 2014-10-19] (Toolwiz.com)

S3 catchme; \??\C:\ComboFix\catchme.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-12-31 20:57 - 2014-12-31 20:57 - 00001125 _____ () C:\Users\Hans Desktop PC\Desktop\JRT.txt

2014-12-31 20:51 - 2014-12-31 20:51 - 01707939 _____ (Thisisu) C:\Users\Hans Desktop PC\Desktop\JRT.exe

2014-12-31 20:06 - 2014-12-31 20:33 - 00000000 ____D () C:\AdwCleaner

2014-12-31 17:49 - 2014-12-31 17:49 - 00021873 _____ () C:\ComboFix.txt

2014-12-31 17:21 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe

2014-12-31 17:21 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe

2014-12-31 17:21 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2014-12-31 17:21 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2014-12-31 17:21 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2014-12-31 17:21 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe

2014-12-31 17:21 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe

2014-12-31 17:21 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe

2014-12-31 17:20 - 2014-12-31 17:50 - 00000000 ____D () C:\Qoobox

2014-12-31 17:19 - 2014-12-31 17:48 - 00000000 ____D () C:\Windows\erdnt

2014-12-31 17:16 - 2014-12-31 17:16 - 05604036 ____R (Swearware) C:\Users\Hans Desktop PC\Desktop\ComboFix.exe

2014-12-31 17:10 - 2014-12-31 17:10 - 00001268 _____ () C:\Users\Hans Desktop PC\Desktop\Revo Uninstaller.lnk

2014-12-31 17:10 - 2014-12-31 17:10 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group

2014-12-31 15:43 - 2014-12-31 15:43 - 00000000 ____D () C:\Users\Hans Desktop PC\Downloads\Sicherung Diskstation

2014-12-31 11:04 - 2014-12-31 21:18 - 00019643 _____ () C:\Users\Hans Desktop PC\Downloads\FRST.txt

2014-12-31 11:04 - 2014-12-31 21:18 - 00000000 ____D () C:\FRST

2014-12-31 11:04 - 2014-12-31 11:05 - 00051674 _____ () C:\Users\Hans Desktop PC\Downloads\Addition.txt

2014-12-31 11:03 - 2014-12-31 11:03 - 02123264 _____ (Farbar) C:\Users\Hans Desktop PC\Downloads\FRST64.exe

2014-12-30 12:19 - 2014-12-30 12:19 - 00081148 _____ () C:\Users\Hans Desktop PC\Downloads\Extras.Txt

2014-12-30 12:18 - 2014-12-30 12:18 - 00121498 _____ () C:\Users\Hans Desktop PC\Downloads\OTL.Txt

2014-12-30 12:12 - 2014-12-30 12:12 - 00602112 _____ (OldTimer Tools) C:\Users\Hans Desktop PC\Downloads\OTL.exe

2014-12-28 17:09 - 2014-12-28 17:09 - 00000000 ____D () C:\Users\Hans Desktop PC\Downloads\PIAopenvpn

2014-12-28 17:08 - 2014-12-28 17:08 - 00008242 _____ () C:\Users\Hans Desktop PC\Downloads\PIAopenvpn.zip

2014-12-28 17:06 - 2014-12-28 17:06 - 00000414 _____ () C:\Users\Hans Desktop PC\Desktop\LAN-Verbindung - Verknüpfung.lnk

2014-12-28 11:27 - 2014-12-28 14:24 - 00000047 _____ () C:\Users\Hans Desktop PC\Desktop\PIA.txt

2014-12-27 19:30 - 2014-12-27 19:30 - 00002770 _____ () C:\Windows\System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2012

2014-12-27 17:39 - 2014-12-27 17:39 - 00000000 ____D () C:\Users\Hans\AppData\Local\SAMSUNG

2014-12-27 17:39 - 2014-12-27 17:39 - 00000000 ____D () C:\Users\Hans\.swt

2014-12-26 11:29 - 2014-12-26 11:29 - 00000000 ____D () C:\Users\Hans Desktop PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Samsung

2014-12-26 11:29 - 2014-12-26 11:29 - 00000000 ____D () C:\Users\Hans Desktop PC\.swt

2014-12-26 11:29 - 2014-12-26 11:29 - 00000000 ____D () C:\Upload

2014-12-26 11:26 - 2014-12-26 11:28 - 90627424 _____ (Copyright 2013 SAMSUNG) C:\Users\Hans Desktop PC\Downloads\SamsungLink18_Installer64.exe

2014-12-26 11:09 - 2014-12-26 11:09 - 00012244 _____ () C:\Users\Hans Desktop PC\Desktop\pia_tray.exe - Verknüpfung.lnk

2014-12-26 10:33 - 2014-12-26 10:33 - 00002213 _____ () C:\Users\Public\Desktop\TuneUp 1-Klick-Wartung.lnk

2014-12-26 10:33 - 2014-12-26 10:33 - 00002205 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2012.lnk

2014-12-26 10:33 - 2014-12-26 10:33 - 00002193 _____ () C:\Users\Public\Desktop\TuneUp Utilities 2012.lnk

2014-12-26 10:33 - 2014-12-26 10:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2012

2014-12-26 10:33 - 2014-12-26 10:33 - 00000000 ____D () C:\Program Files (x86)\TuneUp Utilities 2012

2014-12-26 10:33 - 2012-07-04 10:49 - 00034656 _____ (TuneUp Software) C:\Windows\system32\TURegOpt.exe

2014-12-26 10:33 - 2012-07-04 10:49 - 00025952 _____ (TuneUp Software) C:\Windows\system32\authuitu.dll

2014-12-26 10:33 - 2012-07-04 10:49 - 00021344 _____ (TuneUp Software) C:\Windows\SysWOW64\authuitu.dll

2014-12-26 10:32 - 2012-08-09 19:03 - 53588376 _____ (TuneUp Software) C:\Users\Hans Desktop PC\Downloads\TuneUpUtilities2012-multilingual.exe

2014-12-26 10:20 - 2014-12-26 10:20 - 00003886 _____ () C:\Windows\System32\Tasks\Adobe Acrobat Update Task

2014-12-24 19:58 - 2014-12-24 19:58 - 31104920 _____ () C:\Users\Hans Desktop PC\Documents\Protokoll 141224.pcapng

2014-12-24 17:28 - 2014-12-31 20:35 - 00065536 _____ () C:\Windows\system32\Ikeext.etl

2014-12-24 17:19 - 2014-12-24 17:19 - 00000000 ____D () C:\Users\Hans Desktop PC\AppData\Roaming\Wireshark

2014-12-24 17:17 - 2014-12-24 17:17 - 00001563 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wireshark.lnk

2014-12-24 17:17 - 2014-12-24 17:17 - 00001551 _____ () C:\Users\Public\Desktop\Wireshark.lnk

2014-12-24 17:16 - 2014-12-24 17:18 - 00000000 ____D () C:\Program Files\Wireshark

2014-12-24 16:17 - 2014-12-24 16:17 - 00008242 _____ () C:\Users\Hans Desktop PC\Downloads\openvpn.zip

2014-12-24 15:13 - 2014-12-24 15:13 - 00000000 ____D () C:\Users\Hans Desktop PC\Documents\openvpn

2014-12-24 14:58 - 2014-12-24 09:29 - 00008242 _____ () C:\Users\Hans Desktop PC\Documents\openvpn.zip

2014-12-24 14:10 - 2014-12-24 14:10 - 00713216 _____ () C:\Users\Hans Desktop PC\Downloads\F4EG.exe

2014-12-24 14:01 - 2014-12-24 18:38 - 00000130 _____ () C:\Users\Hans Desktop PC\Desktop\DiskStation_2.url

2014-12-22 20:18 - 2014-12-22 20:18 - 00000000 ____D () C:\Users\Hans\AppData\Roaming\Portforward.com

2014-12-22 19:21 - 2014-12-28 17:20 - 00000000 ____D () C:\Users\Hans Desktop PC\AppData\Roaming\PortForward.com

2014-12-22 18:53 - 2013-09-10 03:47 - 00078936 ____R (Symantec Corporation) C:\Windows\system32\Drivers\SymIMV.sys

2014-12-22 16:56 - 2014-12-22 16:56 - 00000020 _____ () C:\Users\Hans Desktop PC\Desktop\passwort mtoorennt.txt

2014-12-22 16:23 - 2014-12-22 16:23 - 00000000 ____D () C:\Users\Hans Desktop PC\AppData\Roaming\Titanium

2014-12-22 16:23 - 2014-12-22 16:23 - 00000000 ____D () C:\Users\Hans Desktop PC\AppData\Roaming\Apple Computer

2014-12-22 16:23 - 2014-12-22 16:23 - 00000000 ____D () C:\Users\Hans Desktop PC\AppData\Local\Apple Computer

2014-12-22 16:22 - 2014-12-31 12:45 - 00000000 ____D () C:\Program Files\pia_manager

2014-12-22 16:22 - 2014-12-24 20:04 - 00003188 _____ () C:\Windows\System32\Tasks\Private Internet Access Startup

2014-12-22 16:22 - 2014-12-22 16:22 - 00031232 _____ (The OpenVPN Project) C:\Windows\system32\Drivers\tap0901.sys

2014-12-21 19:57 - 2014-12-28 17:20 - 00000000 ____D () C:\Users\Hans Desktop PC\AppData\Roaming\uTorrent

2014-12-21 19:56 - 2014-12-21 19:56 - 01688656 _____ (BitTorrent Inc.) C:\Users\Hans Desktop PC\Downloads\uTorrent.exe

2014-12-17 20:35 - 2014-12-13 06:09 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-12-17 20:35 - 2014-12-13 04:33 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-12-15 03:20 - 2014-12-15 03:20 - 00000000 ____D () C:\Windows\system32\appraiser

2014-12-15 03:01 - 2014-10-18 03:05 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll

2014-12-15 03:01 - 2014-10-18 02:33 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll

2014-12-14 13:52 - 2014-12-14 13:53 - 02427744 _____ () C:\Users\Hans Desktop PC\Downloads\altbinzpu03914beta.zip

2014-12-14 10:37 - 2014-12-04 03:50 - 00830976 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll

2014-12-14 10:37 - 2014-12-04 03:50 - 00741376 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll

2014-12-14 10:37 - 2014-12-04 03:50 - 00413184 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll

2014-12-14 10:37 - 2014-12-04 03:50 - 00396800 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll

2014-12-14 10:37 - 2014-12-04 03:50 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-12-14 10:37 - 2014-12-04 03:50 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll

2014-12-14 10:37 - 2014-12-04 03:44 - 01083392 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-12-14 10:37 - 2014-12-02 00:28 - 01232040 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe

2014-12-14 10:37 - 2014-11-27 02:43 - 00389296 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2014-12-14 10:37 - 2014-11-27 02:10 - 00342200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

2014-12-14 10:37 - 2014-11-22 04:13 - 25059840 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-12-14 10:37 - 2014-11-22 04:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-12-14 10:37 - 2014-11-22 04:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-12-14 10:37 - 2014-11-22 03:50 - 00580096 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-12-14 10:37 - 2014-11-22 03:50 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-12-14 10:37 - 2014-11-22 03:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-12-14 10:37 - 2014-11-22 03:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-12-14 10:37 - 2014-11-22 03:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2014-12-14 10:37 - 2014-11-22 03:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-12-14 10:37 - 2014-11-22 03:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-12-14 10:37 - 2014-11-22 03:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-12-14 10:37 - 2014-11-22 03:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-12-14 10:37 - 2014-11-22 03:34 - 06039552 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-12-14 10:37 - 2014-11-22 03:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-12-14 10:37 - 2014-11-22 03:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-12-14 10:37 - 2014-11-22 03:22 - 19749376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-12-14 10:37 - 2014-11-22 03:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-12-14 10:37 - 2014-11-22 03:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-12-14 10:37 - 2014-11-22 03:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2014-12-14 10:37 - 2014-11-22 03:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-12-14 10:37 - 2014-11-22 03:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-12-14 10:37 - 2014-11-22 03:07 - 00501248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-12-14 10:37 - 2014-11-22 03:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-12-14 10:37 - 2014-11-22 03:06 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2014-12-14 10:37 - 2014-11-22 03:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-12-14 10:37 - 2014-11-22 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll

2014-12-14 10:37 - 2014-11-22 03:01 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-12-14 10:37 - 2014-11-22 02:59 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-12-14 10:37 - 2014-11-22 02:58 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-12-14 10:37 - 2014-11-22 02:56 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-12-14 10:37 - 2014-11-22 02:54 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2014-12-14 10:37 - 2014-11-22 02:49 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-12-14 10:37 - 2014-11-22 02:49 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-12-14 10:37 - 2014-11-22 02:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2014-12-14 10:37 - 2014-11-22 02:46 - 02125312 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-12-14 10:37 - 2014-11-22 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2014-12-14 10:37 - 2014-11-22 02:43 - 14412800 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-12-14 10:37 - 2014-11-22 02:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2014-12-14 10:37 - 2014-11-22 02:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-12-14 10:37 - 2014-11-22 02:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2014-12-14 10:37 - 2014-11-22 02:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2014-12-14 10:37 - 2014-11-22 02:29 - 04299264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-12-14 10:37 - 2014-11-22 02:28 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-12-14 10:37 - 2014-11-22 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-12-14 10:37 - 2014-11-22 02:22 - 02052096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-12-14 10:37 - 2014-11-22 02:21 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll

2014-12-14 10:37 - 2014-11-22 02:15 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-12-14 10:37 - 2014-11-22 02:13 - 12836864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-12-14 10:37 - 2014-11-22 02:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-12-14 10:37 - 2014-11-22 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-12-14 10:37 - 2014-11-22 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-12-14 10:37 - 2014-11-22 01:54 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-12-14 10:37 - 2014-11-11 04:09 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll

2014-12-14 10:37 - 2014-11-11 03:44 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll

2014-12-14 10:37 - 2014-11-11 02:46 - 00119296 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys

2014-12-14 10:35 - 2014-11-08 04:16 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll

2014-12-14 10:35 - 2014-11-08 03:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll

2014-12-14 10:35 - 2014-10-30 03:03 - 00165888 _____ (Microsoft Corporation) C:\Windows\system32\charmap.exe

2014-12-14 10:35 - 2014-10-30 02:45 - 00155136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\charmap.exe

2014-12-14 10:35 - 2014-10-03 03:12 - 02020352 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll

2014-12-14 10:35 - 2014-10-03 03:12 - 00346624 _____ (Microsoft Corporation) C:\Windows\system32\WSManMigrationPlugin.dll

2014-12-14 10:35 - 2014-10-03 03:12 - 00310272 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll

2014-12-14 10:35 - 2014-10-03 03:12 - 00181248 _____ (Microsoft Corporation) C:\Windows\system32\WsmAuto.dll

2014-12-14 10:35 - 2014-10-03 03:11 - 00266240 _____ (Microsoft Corporation) C:\Windows\system32\WSManHTTPConfig.exe

2014-12-14 10:35 - 2014-10-03 02:45 - 01177088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmSvc.dll

2014-12-14 10:35 - 2014-10-03 02:45 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManMigrationPlugin.dll

2014-12-14 10:35 - 2014-10-03 02:45 - 00214016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmWmiPl.dll

2014-12-14 10:35 - 2014-10-03 02:45 - 00145920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmAuto.dll

2014-12-14 10:35 - 2014-10-03 02:44 - 00198656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManHTTPConfig.exe

2014-12-08 19:51 - 2014-12-08 19:51 - 00001245 _____ () C:\Users\Hans Desktop PC\Desktop\Amazon Music.lnk

2014-12-08 17:21 - 2014-12-16 19:40 - 00030106 _____ () C:\Users\Hans Desktop PC\Documents\Adressliste Gartenverein.xlsx

2014-12-03 15:43 - 2014-12-03 15:43 - 00001053 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hyperion Download Manager.lnk

2014-12-03 15:43 - 2014-12-03 15:43 - 00001041 _____ () C:\Users\Public\Desktop\Hyperion Download Manager.lnk

2014-12-03 15:43 - 2014-12-03 15:43 - 00000000 ____D () C:\Users\Hans Desktop PC\AppData\Roaming\co.uk.Hyperion.downloader

2014-12-03 15:43 - 2014-12-03 15:43 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Macromedia

2014-12-03 15:43 - 2014-12-03 15:43 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Macromedia

2014-12-03 15:43 - 2014-12-03 15:43 - 00000000 ____D () C:\Program Files (x86)\Hyperion Download Manager
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-12-31 20:53 - 2014-01-07 21:20 - 00000000 ____D () C:\Windows\ERUNT

2014-12-31 20:49 - 2014-06-29 15:39 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-12-31 20:49 - 2013-11-03 19:48 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-12-31 20:42 - 2009-07-14 05:50 - 00028384 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-12-31 20:42 - 2009-07-14 05:50 - 00028384 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-12-31 20:39 - 2011-04-12 09:14 - 00702640 _____ () C:\Windows\system32\perfh007.dat

2014-12-31 20:39 - 2011-04-12 09:14 - 00150280 _____ () C:\Windows\system32\perfc007.dat

2014-12-31 20:39 - 2009-07-14 06:12 - 01628044 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-12-31 20:38 - 2013-11-03 19:48 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-12-31 20:35 - 2013-10-31 19:44 - 00000000 _____ () C:\Windows\system32\Drivers\lvuvc.hs

2014-12-31 20:35 - 2010-11-21 04:47 - 00357150 _____ () C:\Windows\PFRO.log

2014-12-31 20:35 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-12-31 20:35 - 2009-07-14 05:56 - 00077845 _____ () C:\Windows\setupact.log

2014-12-31 20:33 - 2013-10-31 19:40 - 00000000 ____D () C:\Users\Hans Desktop PC

2014-12-31 20:33 - 2013-10-31 19:36 - 01507659 _____ () C:\Windows\WindowsUpdate.log

2014-12-31 20:28 - 2013-11-01 18:59 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-12-31 20:20 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\tracing

2014-12-31 19:53 - 2014-01-02 11:32 - 00003990 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{8C789A6B-65A8-4A76-A311-F27A13C4B32B}

2014-12-31 17:51 - 2014-02-26 21:35 - 01647518 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI

2014-12-31 17:50 - 2014-04-22 20:42 - 00000000 ____D () C:\Users\dub_cm_auto

2014-12-31 17:50 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Default

2014-12-31 17:48 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini

2014-12-31 17:30 - 2009-07-14 03:34 - 74973184 _____ () C:\Windows\system32\config\software.bak

2014-12-31 17:30 - 2009-07-14 03:34 - 19136512 _____ () C:\Windows\system32\config\system.bak

2014-12-31 17:30 - 2009-07-14 03:34 - 00524288 _____ () C:\Windows\system32\config\default.bak

2014-12-31 17:30 - 2009-07-14 03:34 - 00262144 _____ () C:\Windows\system32\config\security.bak

2014-12-31 17:30 - 2009-07-14 03:34 - 00262144 _____ () C:\Windows\system32\config\sam.bak

2014-12-31 14:49 - 2014-03-30 12:53 - 00000000 ____D () C:\Users\Hans Desktop PC\AppData\Local\NPE

2014-12-31 14:47 - 2014-05-01 11:14 - 00000000 ____D () C:\NPE

2014-12-31 14:31 - 2013-11-01 19:24 - 00598528 _____ () C:\Users\Hans Desktop PC\Documents\Hans.wlt

2014-12-31 12:45 - 2014-07-20 11:55 - 00000000 ____D () C:\Program Files (x86)\Remote Mouse

2014-12-28 12:36 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF

2014-12-28 00:29 - 2013-12-18 16:56 - 00000000 ____D () C:\Users\Hans Desktop PC\Documents\Mein Steuer-Sparbuch Heute

2014-12-27 18:45 - 2009-07-14 06:38 - 00000000 ____D () C:\Program Files (x86)\Windows Sidebar

2014-12-27 17:39 - 2014-07-27 11:13 - 00000000 ____D () C:\Users\Hans

2014-12-26 11:29 - 2014-08-27 14:00 - 00000000 ____D () C:\Program Files\SAMSUNG

2014-12-26 11:29 - 2013-11-01 19:08 - 00000000 ____D () C:\Users\Hans Desktop PC\AppData\Local\Samsung

2014-12-26 11:29 - 2013-11-01 19:04 - 00000000 ____D () C:\ProgramData\Samsung

2014-12-26 11:29 - 2013-11-01 19:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung

2014-12-24 18:37 - 2014-05-01 09:51 - 00000186 _____ () C:\Users\Hans Desktop PC\Desktop\DiskStation.url

2014-12-23 01:00 - 2014-06-29 15:39 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-12-22 20:24 - 2014-01-01 11:16 - 00000000 ____D () C:\Users\Hans Desktop PC\AppData\Local\CrashDumps

2014-12-22 19:21 - 2013-11-01 19:01 - 00000000 ____D () C:\Users\Hans Desktop PC\AppData\Local\Downloaded Installations

2014-12-21 18:17 - 2014-01-01 15:12 - 00000000 ____D () C:\Users\Hans Desktop PC\AppData\Roaming\Mp3tag

2014-12-16 06:52 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache

2014-12-15 03:20 - 2014-05-07 19:24 - 00000000 ___SD () C:\Windows\system32\CompatTel

2014-12-15 03:20 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions

2014-12-15 03:20 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\AppCompat

2014-12-15 03:05 - 2013-10-31 20:26 - 00000000 ____D () C:\ProgramData\Microsoft Help

2014-12-15 03:04 - 2014-01-11 18:50 - 00000000 ____D () C:\Windows\system32\MRT

2014-12-15 03:02 - 2014-01-11 18:49 - 112710672 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-12-14 16:55 - 2014-01-01 14:44 - 00000000 ____D () C:\Users\Hans Desktop PC\AppData\Local\Nero

2014-12-14 13:27 - 2013-11-03 19:47 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk

2014-12-14 10:47 - 2014-08-18 13:52 - 00000000 ____D () C:\Users\Hans Desktop PC\AppData\Local\Adobe

2014-12-14 10:46 - 2013-11-01 18:59 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-12-14 10:46 - 2013-11-01 18:59 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-12-14 10:46 - 2013-11-01 18:59 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2014-12-14 10:40 - 2013-11-03 19:48 - 00002175 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

2014-12-10 16:42 - 2014-06-29 15:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-12-10 16:42 - 2014-01-03 13:56 - 00001106 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-12-08 14:58 - 2014-11-10 17:04 - 00000000 ____D () C:\Program Files (x86)\FRITZ!Powerline

2014-12-03 15:43 - 2013-11-03 19:47 - 00000000 ____D () C:\ProgramData\Adobe

2014-12-03 15:43 - 2013-11-03 19:47 - 00000000 ____D () C:\Program Files (x86)\Adobe

2014-12-03 15:43 - 2013-11-01 18:59 - 00000000 ____D () C:\Users\Hans Desktop PC\AppData\Roaming\Adobe
 

Some content of TEMP:

====================

C:\Users\Hans Desktop PC\AppData\Local\Temp\Quarantine.exe

C:\Users\Hans Desktop PC\AppData\Local\Temp\sqlite3.dll
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-12-26 12:48
 

==================== End Of Log ============================

--- --- ---

--- --- ---

Puh, das war aber jetzt viel!

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

HKU\S-1-5-21-2081905457-2083805786-3871413059-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

FF Plugin: @microsoft.com/GENUINE -> disabled No File

FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File

CHR HKLM\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - No Path

CHR HKLM-x32\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - No Path

Emptytemp:

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)

Hier erst mal der Logfile von Frist:

Code:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 28-12-2014

Ran by Hans Desktop PC at 2014-12-31 23:07:16 Run:1

Running from C:\Users\Hans Desktop PC\Desktop

Loaded Profile: Hans Desktop PC (Available profiles: Hans Desktop PC & Hans)

Boot Mode: Normal

==============================================
 

Content of fixlist:

*****************

HKU\S-1-5-21-2081905457-2083805786-3871413059-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

FF Plugin: @microsoft.com/GENUINE -> disabled No File

FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File

CHR HKLM\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - No Path

CHR HKLM-x32\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - No Path

Emptytemp:
 

*****************
 

"HKU\S-1-5-21-2081905457-2083805786-3871413059-1001\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully.

"HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE" => Key deleted successfully.

"HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE" => Key deleted successfully.

"HKLM\SOFTWARE\Google\Chrome\Extensions\iikflkcanblccfahdhdonehdalibjnif" => Key deleted successfully.

"HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\iikflkcanblccfahdhdonehdalibjnif" => Key deleted successfully.

EmptyTemp: => Removed 1.1 GB temporary data.
 
 

The system needed a reboot. 
 

==== End of Fixlog 23:09:36 ====

Den Rest später....

So nun das Logfile der 76 Bedrohungen von Eset Online(!)

Code:

ESETSmartInstaller@High as downloader log:

all ok

# product=EOS

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.7623

# api_version=3.0.2

# EOSSerial=37fc8403c6af0544bec01a346c9274ca

# engine=21773

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2015-01-01 10:01:43

# local_time=2015-01-01 11:01:43 (+0100, Mitteleuropäische Zeit)

# country="Germany"

# lang=1031

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode_1='Norton Internet Security'

# compatibility_mode=3597 16777213 100 100 1362727 182703088 0 0

# compatibility_mode_1=''

# compatibility_mode=5893 16776574 100 94 36000594 171736353 0 0

# scanned=950960

# found=76

# cleaned=0

# scan_time=40705

sh=EAE2784C9115FE9CFA44A116B74E72C1BCCFA7F6 ft=1 fh=2e79e77116fe19c4 vn="Win32/DownWare.L evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Hans Desktop PC\Downloads\MyPhoneExplorer_1.8.5.exe"

sh=C7268B41BF6BD7463B91F1194F56FAC143F133E0 ft=1 fh=c71c0011a1dd5f06 vn="Win32/InstallCore.GY evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Hans Desktop PC\Downloads\PDFCreatorSetup.exe"

sh=25D2D351D1F97779DF2D9B8A61BA7EB1B9AAA230 ft=0 fh=0000000000000000 vn="Variante von Win32/Hao123.A evtl. unerwünschte Anwendung" ac=I fn="D:\downloads\FFSetup295.zip"

sh=E482AD834AA2F21ADC0140FE4ECC2BFDAF3FAA22 ft=1 fh=4bd4252d18724ebe vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="D:\downloads\HSS-2.67-install-chip-389-conduit.exe"

sh=8EFEA2CC4B37C6BD4E49FF95283B895F51B7C649 ft=1 fh=24bb063c1eea8356 vn="Variante von Win32/KBM.A evtl. unerwünschte Anwendung" ac=I fn="D:\downloads\PageRage.exe"

sh=D44E52386CADB5905418C3B8F5927DA677B34E9E ft=0 fh=0000000000000000 vn="Variante von Android/Exploit.Lotoor.EF Trojaner" ac=I fn="D:\downloads\Android\Framaroot.apk"

sh=E49BBD255CED4B0B99183AF50285504AD71CA437 ft=0 fh=0000000000000000 vn="Android/Exploit.Lotoor.EP Trojaner" ac=I fn="D:\downloads\Android\motochopper.zip"

sh=74FACDDF0E4BDB1BDDD53B66488B29C568EF836A ft=0 fh=0000000000000000 vn="Android/Exploit.Lotoor.EP Trojaner" ac=I fn="D:\downloads\Android\motochopper\motochopper\pwn"

sh=875CD1A49E41E87C7600236230FE1ED97AA6FEDA ft=1 fh=c71c0011c0cf0adc vn="Variante von Win32/Injector.AMIX Trojaner" ac=I fn="D:\downloads\complete\Ass.Cleavage.9.XXX.WEBRIP.1080p.X264-TBP.rar\Ass.Cleavage.9.XXX.WEBRIP.1080p.X264-TBP.exe"

sh=E482AD834AA2F21ADC0140FE4ECC2BFDAF3FAA22 ft=1 fh=4bd4252d18724ebe vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="D:\Eigene Dateien\HSS-2.67-install-chip-389-conduit.exe"

sh=8EFEA2CC4B37C6BD4E49FF95283B895F51B7C649 ft=1 fh=24bb063c1eea8356 vn="Variante von Win32/KBM.A evtl. unerwünschte Anwendung" ac=I fn="D:\Eigene Dateien\PageRage.exe"

sh=4CCF41471D43B31B61C0EB541DA299457FB15AAA ft=1 fh=398a74cddf74ff93 vn="Win32/Toolbar.Conduit.A evtl. unerwünschte Anwendung" ac=I fn="D:\Eigene Musik\music\GinasMusik\Lectures\FreeStudio.exe"

sh=A46E75DE1B3124B727DF181FEF23DB81A4441BE3 ft=0 fh=0000000000000000 vn="Win32/Toolbar.Conduit.Q evtl. unerwünschte Anwendung" ac=I fn="D:\HG-PC\Backup Set 2012-10-15 175933\Backup Files 2012-10-15 175933\Backup files 2.zip"

sh=89BAE9B6BDEB14123A9F943852200FDED7C69C11 ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Conduit.P evtl. unerwünschte Anwendung" ac=I fn="D:\HG-PC\Backup Set 2012-10-15 175933\Backup Files 2012-10-15 175933\Backup files 5.zip"

sh=9032E2953264EF4FFFEAC613DF947C431FC4755B ft=0 fh=0000000000000000 vn="Win32/Toolbar.Widgi evtl. unerwünschte Anwendung" ac=I fn="D:\HG-PC\Backup Set 2012-10-15 175933\Backup Files 2012-10-15 175933\Backup files 6.zip"

sh=CCBDC1E8608641C1125D69F4A26283DD344AC7BD ft=0 fh=0000000000000000 vn="Variante von Win32/Hao123.A evtl. unerwünschte Anwendung" ac=I fn="D:\HG-PC\Backup Set 2012-10-15 175933\Backup Files 2012-10-15 175933\Backup files 96.zip"

sh=F7EAA26375D35D1D3ACB3FC520D7CD1363EECD1E ft=0 fh=0000000000000000 vn="Win32/Toolbar.Conduit.A evtl. unerwünschte Anwendung" ac=I fn="D:\MC Addi's Music @ Mr. OVOXO\Samy Deleuxe\A.2011.07.30-332 REUP\Samy Deluxe - Studioalben - 2011 - SchwarzWeiss (Limited Deluxe Edition)\www.brothers-of-usenet.org\Brothers Bar Community Toolbar für Firefox.xpi"

sh=303754A4FA23B9DB2A4B16EBF11185620655C6CF ft=1 fh=78a191b07b4b8f54 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="D:\MC Addi's Music @ Mr. OVOXO\Samy Deleuxe\A.2011.07.30-332 REUP\Samy Deluxe - Studioalben - 2011 - SchwarzWeiss (Limited Deluxe Edition)\www.brothers-of-usenet.org\Brothers Bar Community Toolbar für Internet Explorer.exe"

sh=8C7840BE27259711F11B95E22E38CA225E8909F7 ft=0 fh=0000000000000000 vn="Variante von Android/AdDisplay.AppFlood.A evtl. unerwünschte Anwendung" ac=I fn="D:\SD 64GB\App_Backup_Restore\com.cobra.ibomber-106-v1.0.6.apk"

sh=C5E566B1CADBDEC38CBB223189A03FCA5DE2E250 ft=0 fh=0000000000000000 vn="Variante von Android/AdDisplay.AppFlood.A evtl. unerwünschte Anwendung" ac=I fn="D:\SD 64GB\App_Backup_Restore\mobi.borken.android.brokenscreen-18-v2.8.apk"

sh=090A72E71C635C7F58ADA373B03C364AEA01105C ft=0 fh=0000000000000000 vn="Variante von Android/AdDisplay.AppFlood.A evtl. unerwünschte Anwendung" ac=I fn="D:\SD 64GB\clockworkmod\backup\2013-10-13.16.41.45\data.ext4.tar"

sh=F675EC8094730A7AD64EB42903360312DF744431 ft=0 fh=0000000000000000 vn="Variante von Android/AdDisplay.AppFlood.A evtl. unerwünschte Anwendung" ac=I fn="D:\SD 64GB\clockworkmod\backup\2013-12-25.08.09.27\data.ext4.tar"

sh=E970BBF5E4CF74763D018E7C63D1E55357A5550D ft=0 fh=0000000000000000 vn="Variante von Android/AdDisplay.AppFlood.A evtl. unerwünschte Anwendung" ac=I fn="D:\SD 64GB\titanium\com.cobra.ibomber-d769bb1d8b2b2d3316299e0532758fac.apk.gz"

sh=6E84621DB0C6ECD389DBC529CA5305A37A600EC3 ft=0 fh=0000000000000000 vn="Variante von Android/AdDisplay.AppFlood.A evtl. unerwünschte Anwendung" ac=I fn="D:\SD 64GB\titanium\mobi.borken.android.brokenscreen-7e4da2f6f5af6e17cd4ccd0c551bbb6e.apk.gz"

sh=78ED213B45BBC105EAF89FE106E43A03F1B6886E ft=0 fh=0000000000000000 vn="Variante von Android/AdDisplay.AppFlood.A evtl. unerwünschte Anwendung" ac=I fn="D:\SD 64GB\TitaniumBackup\com.cobra.ibomber-d769bb1d8b2b2d3316299e0532758fac.apk.gz"

sh=41A2425F9B86BA031D3B4AE53FD261EF706EE5A2 ft=0 fh=0000000000000000 vn="Variante von Android/AdDisplay.AppFlood.A evtl. unerwünschte Anwendung" ac=I fn="D:\SD 64GB\TitaniumBackup\mobi.borken.android.brokenscreen-7e4da2f6f5af6e17cd4ccd0c551bbb6e.apk.gz"

sh=4B8CC3EAAB3B147E6E637F61D9ECDEC47BBE045A ft=0 fh=0000000000000000 vn="Variante von Android/AdDisplay.AppFlood.A evtl. unerwünschte Anwendung" ac=I fn="D:\SD 64GB\titanumBackup\com.cobra.ibomber-d769bb1d8b2b2d3316299e0532758fac.apk.gz"

sh=F882A0C9A834599C928768BBA88AE8ED04466423 ft=0 fh=0000000000000000 vn="Variante von Android/AdDisplay.AppFlood.A evtl. unerwünschte Anwendung" ac=I fn="D:\SD 64GB\titanumBackup\mobi.borken.android.brokenscreen-f5cfa3d82f1068748934482954ffa61a.apk.gz"

sh=ADB5F0984946EF0210D3C7AF9955CA526CC7C344 ft=0 fh=0000000000000000 vn="Variante von Android/AdDisplay.AppFlood.A evtl. unerwünschte Anwendung" ac=I fn="D:\SD 64GB\titanumBackup\TitaniumBackup\com.cobra.ibomber-d769bb1d8b2b2d3316299e0532758fac.apk.gz"

sh=D53AC256C30BA5C60985C49412D2E5818EA4A638 ft=0 fh=0000000000000000 vn="Variante von Android/AdDisplay.AppFlood.A evtl. unerwünschte Anwendung" ac=I fn="D:\SD 64GB\titanumBackup\TitaniumBackup\mobi.borken.android.brokenscreen-f5cfa3d82f1068748934482954ffa61a.apk.gz"

sh=FD4DD9605A03F619D09B650452E8C81618578B3A ft=1 fh=4c256b24a244bc05 vn="Win32/Toolbar.AskSBar evtl. unerwünschte Anwendung" ac=I fn="D:\treckstore\Aa\software\Nero 7 Premium Reloaded v7.10.1.0 eng  with kg\Nero-7.10.1.0_eng_trial_3.exe"

sh=D3BEBE43403FE3FC22C042B06460D784EE4CBB33 ft=1 fh=e198fa64f7b4f40c vn="Variante von MSIL/Injector.YJ Trojaner" ac=I fn="F:\Downloads\anydvd\SlySoft.AnyDVD.HD.v7.0.2.0.Final.Multilanguage.WinAll+RES-patch\SetupAnyDVD7020.exe"

sh=D3BEBE43403FE3FC22C042B06460D784EE4CBB33 ft=1 fh=e198fa64f7b4f40c vn="Variante von MSIL/Injector.YJ Trojaner" ac=I fn="F:\Downloads\anydvd.1\SlySoft.AnyDVD.HD.v7.0.2.0.Final.Multilanguage.WinAll+RES-patch\SetupAnyDVD7020.exe"

sh=6E75368491ACB6A1E7D4FFFEBFEC1640DA80D7BD ft=1 fh=c71c001179dacd20 vn="Variante von MSIL/Injector.AWM Trojaner" ac=I fn="F:\Downloads\Chess\Chess-Aquarium-Portable-con-Houdini-3.rar\Chess Aquarium Portable con Houdini 3.exe"

sh=396A4A8FEC2D717055D104DC040D9ACC6307F445 ft=0 fh=0000000000000000 vn="Variante von MSIL/Injector.ALA Trojaner" ac=I fn="F:\Downloads\Chessbase Opening Encyclopedia 2012\Chessbase Opening Encyclopedia 2012  .rar"

sh=0487003AE54739B38E320362E821A7C1A0F275A0 ft=1 fh=c71c001171e510c9 vn="Variante von MSIL/Injector.BKJ Trojaner" ac=I fn="F:\Downloads\DLL2\Anal.Sweetness.XXX.1080p.WEBRIP-x264-TBP.scr.rar\Anal.Sweetness.XXX.1080p.WEBRIP-x264-TBP.scr.exe"

sh=AE13B7396D6F3EDCB59B5F5F31DF6868912A9B35 ft=1 fh=c71c0011262daf0e vn="Variante von MSIL/Injector.BKJ Trojaner" ac=I fn="F:\Downloads\DLL2\Too.Much.Anal.DiSC1.XXX.DVDRip.x264-Pr0nStarS.scr.rar\Too.Much.Anal.DiSC1.XXX.DVDRip.x264-Pr0nStarS.scr.exe"

sh=A744D1AE174DE0B9929E901C23306C40D038D657 ft=1 fh=c71c0011b0d40813 vn="Variante von MSIL/Injector.BKJ Trojaner" ac=I fn="F:\Downloads\DLL2\Too.Much.Anal.DiSC2.XXX.DVDRip.x264-Pr0nStarS.scr.rar\Too.Much.Anal.DiSC2.XXX.DVDRip.x264-Pr0nStarS.scr.exe"

sh=535BAA7B93493093BDA440A43ED864F758128625 ft=0 fh=0000000000000000 vn="Win32/InstallCore.AZ evtl. unerwünschte Anwendung" ac=I fn="F:\HANSDESKTOPPC\Backup Set 2014-08-03 132159\Backup Files 2014-08-03 132159\Backup files 2.zip"

sh=C8B709C56B57BAB5463DFC7292651A0226512CC4 ft=0 fh=0000000000000000 vn="Win32/DownWare.L evtl. unerwünschte Anwendung" ac=I fn="F:\HANSDESKTOPPC\Backup Set 2014-08-03 132159\Backup Files 2014-08-03 132159\Backup files 6.zip"

sh=491A331B82F33BB620F479E87C80C6AC0D00F0DD ft=0 fh=0000000000000000 vn="Win32/InstallCore.AZ evtl. unerwünschte Anwendung" ac=I fn="F:\HANSDESKTOPPC\Backup Set 2014-09-07 190001\Backup Files 2014-09-07 190001\Backup files 2.zip"

sh=934C890E1C32397B1C780FE621BF3C292812E076 ft=0 fh=0000000000000000 vn="Win32/DownWare.L evtl. unerwünschte Anwendung" ac=I fn="F:\HANSDESKTOPPC\Backup Set 2014-09-07 190001\Backup Files 2014-09-07 190001\Backup files 6.zip"

sh=0086BFC92B8DA8290F0D65EF29DAA9A7290311A2 ft=0 fh=0000000000000000 vn="Win32/InstallCore.AZ evtl. unerwünschte Anwendung" ac=I fn="F:\HANSDESKTOPPC\Backup Set 2014-10-15 171716\Backup Files 2014-10-15 171716\Backup files 2.zip"

sh=D9A8DFC93316E07C231C57879A01D76B6B13FED2 ft=0 fh=0000000000000000 vn="Win32/DownWare.L evtl. unerwünschte Anwendung" ac=I fn="F:\HANSDESKTOPPC\Backup Set 2014-10-15 171716\Backup Files 2014-10-15 171716\Backup files 7.zip"

sh=72E3EABB097F9DC1043E8695E407EAC330BD0D50 ft=0 fh=0000000000000000 vn="Win32/TrojanDownloader.Autoit.NUX Trojaner" ac=I fn="F:\HANSDESKTOPPC\Backup Set 2014-10-15 171716\Backup Files 2014-11-17 141916\Backup files 2.zip"

sh=FB4A01A279F1E9E570BF6BA754D98AA1884E3E44 ft=0 fh=0000000000000000 vn="Win32/TrojanDownloader.Autoit.NUX Trojaner" ac=I fn="F:\HANSDESKTOPPC\Backup Set 2014-11-23 190010\Backup Files 2014-11-23 190010\Backup files 19.zip"

sh=4BE1A23706D7F1A389954DCF56205505960311FC ft=0 fh=0000000000000000 vn="Win32/InstallCore.AZ evtl. unerwünschte Anwendung" ac=I fn="F:\HANSDESKTOPPC\Backup Set 2014-11-23 190010\Backup Files 2014-11-23 190010\Backup files 2.zip"

sh=3112ECBB55530797E688BACE275FCC9A8D2E16B6 ft=0 fh=0000000000000000 vn="Win32/DownWare.L evtl. unerwünschte Anwendung" ac=I fn="F:\HANSDESKTOPPC\Backup Set 2014-11-23 190010\Backup Files 2014-11-23 190010\Backup files 7.zip"

sh=A4B28D768E4C675C11DAB5D7D732AC62F34C8C5D ft=0 fh=0000000000000000 vn="Win32/InstallCore.AZ evtl. unerwünschte Anwendung" ac=I fn="F:\HANSDESKTOPPC\Backup Set 2014-12-21 190010\Backup Files 2014-12-21 190010\Backup files 2.zip"

sh=DE4432D6108F49D8A51C74F32C9BAB6D018078C7 ft=0 fh=0000000000000000 vn="Win32/TrojanDownloader.Autoit.NUX Trojaner" ac=I fn="F:\HANSDESKTOPPC\Backup Set 2014-12-21 190010\Backup Files 2014-12-21 190010\Backup files 20.zip"

sh=8F8A5A98CFD6D744670E02766EC686594E1F72B7 ft=0 fh=0000000000000000 vn="Win32/DownWare.L evtl. unerwünschte Anwendung" ac=I fn="F:\HANSDESKTOPPC\Backup Set 2014-12-21 190010\Backup Files 2014-12-21 190010\Backup files 8.zip"

sh=E731DDEEB14901CE5D14A6D9972500C174969F04 ft=0 fh=0000000000000000 vn="Mehrere Bedrohungen" ac=I fn="F:\HG-PC\Backup Set 2013-07-29 192917\Backup Files 2013-07-29 192917\Backup files 1.zip"

sh=4572E1D2974418C974A4F95EDC554F6F9438EA7D ft=0 fh=0000000000000000 vn="Win32/Spy.Agent.NYU Trojaner" ac=I fn="F:\HG-PC\Backup Set 2013-07-29 192917\Backup Files 2013-07-29 192917\Backup files 2.zip"

sh=64772E1EDC2FE8611535EB8CBD6876EFD2E6DEA5 ft=0 fh=0000000000000000 vn="Win32/Toolbar.Conduit.A evtl. unerwünschte Anwendung" ac=I fn="F:\HG-PC\Backup Set 2013-07-29 192917\Backup Files 2013-07-29 192917\Backup files 30.zip"

sh=33F8ED06485EDDE3AA57D1AB0058BF0665B80747 ft=0 fh=0000000000000000 vn="Win32/Toolbar.Conduit.Q evtl. unerwünschte Anwendung" ac=I fn="F:\HG-PC\Backup Set 2013-07-29 192917\Backup Files 2013-07-29 192917\Backup files 4.zip"

sh=F3BCCA4E8031F4BD8564172E99A89A37981FB425 ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Conduit.P evtl. unerwünschte Anwendung" ac=I fn="F:\HG-PC\Backup Set 2013-07-29 192917\Backup Files 2013-07-29 192917\Backup files 6.zip"

sh=4CCF41471D43B31B61C0EB541DA299457FB15AAA ft=1 fh=398a74cddf74ff93 vn="Win32/Toolbar.Conduit.A evtl. unerwünschte Anwendung" ac=I fn="G:\Users\7721\Music\music\GinasMusik\Lectures\FreeStudio.exe"

sh=68568FC54EFEF2BEEA835715E2FA2035C8DDE288 ft=0 fh=0000000000000000 vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="H:\Heinz Becker\Paxl\KFet\Battle Of The Asses # 03\Battle Of The Asses # 03.part1.rar"

sh=D62F8BE1CDDDCB870662CB7486926C1FE48FFD1E ft=0 fh=0000000000000000 vn="Variante von Win32/Injector.BFJX Trojaner" ac=I fn="H:\Heinz Becker\Paxl\KFet\Battle.Of.The.Asses.4.XXX.1080p.WEBRip.x264-PAYiSO\Anal.Students.XXX.1080p.WEBRip.x264-PAYiSO.rar"

sh=CC2B4EC149BE3E15E891A779D34DDF29D6CE72D6 ft=0 fh=0000000000000000 vn="Variante von Win32/Injector.BFJX Trojaner" ac=I fn="H:\Heinz Becker\Paxl\KFet\Battle.Of.The.Asses.4.XXX.1080p.WEBRip.x264-PAYiSO\Battle.Of.The.Asses.4.XXX.1080p.WEBRip.x264-PAYiSO.rar"

sh=E58FB5DEC279F566B6A03CD69DD3AF0186322340 ft=0 fh=0000000000000000 vn="Variante von Win32/Injector.BFJX Trojaner" ac=I fn="H:\Heinz Becker\Paxl\KFet\Battle.Of.The.Asses.4.XXX.1080p.WEBRip.x264-PAYiSO\Big.Wet.Tits.11.XXX.1080p.WEBRip.x264-PAYiSO.rar"

sh=0A876E4DD7DBE9BFB2CBB7ADCE5C89695E8F5C7A ft=0 fh=0000000000000000 vn="Variante von Win32/Injector.BFJX Trojaner" ac=I fn="H:\Heinz Becker\Paxl\KFet\Battle.Of.The.Asses.4.XXX.1080p.WEBRip.x264-PAYiSO\Dark.Meat.Lovers.6.XXX.720p.WEBRip.x264-PAYiSO.rar"

sh=5378402D174D48EA066A6CA852B35AAC213F18FA ft=0 fh=0000000000000000 vn="Win32/TrojanDownloader.Autoit.NUX Trojaner" ac=I fn="H:\Heinz Becker\Paxl\KFet\Mark Wood Misha Cross Anal Young Uns Scene 2 720p -\Mark Wood Misha Cross  Anal Young Uns Scene 2 720p.rar"

sh=35FC9748FC45031E7894098F25796D0A168F25ED ft=0 fh=0000000000000000 vn="Win32/TrojanDownloader.Autoit.NUX Trojaner" ac=I fn="H:\Heinz Becker\Paxl\KFet\Triassathlon Big Wet Butts Krissy Lynn Nikki Delano Rose Monroe\Big Wet Butts  Krissy Lynn Nikki Delano Rose Monroe  Triassathlon.rar"

sh=D3AF5692C540458FA95D868915C66A26699BC345 ft=0 fh=0000000000000000 vn="Win32/TrojanDownloader.Autoit.NUX Trojaner" ac=I fn="H:\Heinz Becker\Paxl\KFet\Triassathlon Big Wet Butts Krissy Lynn Nikki Delano Rose Monroe\David Perry Denise Sky  Watch Me Bitch Scene 2.rar"

sh=41C38FA356B8A82126B899D48F135D5F4A1E8CCD ft=0 fh=0000000000000000 vn="Win32/TrojanDownloader.Autoit.NUX Trojaner" ac=I fn="H:\Heinz Becker\Paxl\KFet\Triassathlon Big Wet Butts Krissy Lynn Nikki Delano Rose Monroe\Lily LaBeau Evan Stone  The Secretary 2 Scene 1.rar"

sh=B15D782305E2C0C855F1280BD883CC7E7CB5603B ft=0 fh=0000000000000000 vn="Win32/TrojanDownloader.Autoit.NUX Trojaner" ac=I fn="H:\Heinz Becker\Paxl\KFet\Triassathlon Big Wet Butts Krissy Lynn Nikki Delano Rose Monroe\Megan Salinas Nilah Summers  Catch Me if You Cunnilingus.rar"

sh=6412FF0E67E1E861AD0732C1F6F0F548839C4F5F ft=0 fh=0000000000000000 vn="Win32/TrojanDownloader.Autoit.NUX Trojaner" ac=I fn="H:\Heinz Becker\Paxl\KFet\Triassathlon Big Wet Butts Krissy Lynn Nikki Delano Rose Monroe\Nacho Vidal Brenda Boop  Suck Ass Scene 2.rar"

sh=4F27659405746B241F8DF35D4504ABBDBAAEC0F0 ft=0 fh=0000000000000000 vn="Win32/TrojanDownloader.Autoit.NUX Trojaner" ac=I fn="H:\Heinz Becker\Paxl\KFet\Triassathlon Big Wet Butts Krissy Lynn Nikki Delano Rose Monroe\Norah  Awesome double penetration sex video.rar"

sh=67253FDA2FA7C71587AD92F22159B47C334B9987 ft=0 fh=0000000000000000 vn="Win32/TrojanDownloader.Autoit.NUX Trojaner" ac=I fn="H:\Heinz Becker\Paxl\KFet\Triassathlon Big Wet Butts Krissy Lynn Nikki Delano Rose Monroe\Roxana  Gets Her Nice Tight Pussy Pounded .rar"

sh=AE0F8D760C04AD38F5216076EEEF3E23D8CAA372 ft=0 fh=0000000000000000 vn="Win32/TrojanDownloader.Autoit.NUX Trojaner" ac=I fn="H:\Heinz Becker\Paxl\KFet\Triassathlon Big Wet Butts Krissy Lynn Nikki Delano Rose Monroe\Tori Avano  Tattooed Goddesses Gets Dpd.rar"

sh=E78456E6D9781E3826CFA98FB7249756FCFFC409 ft=1 fh=c71c0011c6ec6f56 vn="Win32/TrojanDownloader.Autoit.NUX Trojaner" ac=I fn="H:\Heinz Becker\Paxl\KFet\Triassathlon Big Wet Butts Krissy Lynn Nikki Delano Rose Monroe\Big Wet Butts  Krissy Lynn Nikki Delano Rose Monroe  Triassathlon\Big Wet Butts  Krissy Lynn Nikki Delano Rose Monroe  Triassathlon.exe"

sh=8DA43B200F560CE3AAACC6D470E362B50E6FFECE ft=1 fh=c71c0011caa5aac6 vn="Win32/TrojanDownloader.Autoit.NUX Trojaner" ac=I fn="H:\Heinz Becker\Paxl\KFet\Triassathlon Big Wet Butts Krissy Lynn Nikki Delano Rose Monroe\David Perry Denise Sky  Watch Me Bitch Scene 2\David Perry Denise Sky  Watch Me Bitch Scene 2.exe"

sh=9B42886FD19956E6B99BF9C57A0A65CDC9926019 ft=1 fh=c71c0011caac4454 vn="Win32/TrojanDownloader.Autoit.NUX Trojaner" ac=I fn="H:\Heinz Becker\Paxl\KFet\Triassathlon Big Wet Butts Krissy Lynn Nikki Delano Rose Monroe\Lily LaBeau Evan Stone  The Secretary 2 Scene 1\Lily LaBeau Evan Stone  The Secretary 2 Scene 1.exe"

sh=2A8272CFF7A58167F6ADF4872B5626D3423F97D8 ft=1 fh=c71c00110918cc7a vn="Win32/TrojanDownloader.Autoit.NUX Trojaner" ac=I fn="H:\Heinz Becker\Paxl\KFet\Triassathlon Big Wet Butts Krissy Lynn Nikki Delano Rose Monroe\Megan Salinas Nilah Summers  Catch Me if You Cunnilingus\Megan Salinas Nilah Summers  Catch Me if You Cunnilingus.exe"

sh=2E437CE7F7BBD10420FC4571EA935EDBD43BF8D1 ft=1 fh=c71c001134921a62 vn="Win32/TrojanDownloader.Autoit.NUX Trojaner" ac=I fn="H:\Heinz Becker\Paxl\KFet\Triassathlon Big Wet Butts Krissy Lynn Nikki Delano Rose Monroe\Norah  Awesome double penetration sex video\Norah  Awesome double penetration sex video.exe"

Was da alles für ein Kram drauf ist.....
Gruß
Gusti

Security check gab folgendes Logfile:

Code:

 Results of screen317's Security Check version 0.99.93  

 Windows 7 Service Pack 1 x64 (UAC is enabled)  

 Internet Explorer 11  
 ``````````````Antivirus/Firewall Check:`````````````` 

Norton Internet Security   

 WMI entry may not exist for antivirus; attempting automatic update. 
 `````````Anti-malware/Other Utilities Check:````````` 

 TuneUp Utilities 2012   

 TuneUp Utilities Language Pack (de-DE) 

 Adobe Reader XI  

 Google Chrome (39.0.2171.71) 

 Google Chrome (39.0.2171.95) 
 ````````Process Check: objlist.exe by Laurent````````  

 Malwarebytes Anti-Malware mbamservice.exe  

 Malwarebytes Anti-Malware mbam.exe  

 Malwarebytes Anti-Malware mbamscheduler.exe   
 `````````````````System Health check````````````````` 

 Total Fragmentation on Drive C:  
 ````````````````````End of Log``````````````````````

Gruß
Gusti

nun das frische frst:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 28-12-2014

Ran by Hans Desktop PC (administrator) on HANSDESKTOPPC on 01-01-2015 13:05:06

Running from C:\Users\Hans Desktop PC\Desktop

Loaded Profiles: Hans Desktop PC & Hans (Available profiles: Hans Desktop PC & Hans)

Platform: Windows 7 Professional N Service Pack 1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11 (Default browser: IE)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(Logitech Inc.) C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe

(SEIKO EPSON CORPORATION) C:\Program Files (x86)\Common Files\EPSON\eEBAPI\eEBSvc.exe

(Samsung) C:\Program Files\SAMSUNG\AllShare Framework DMS\1.3.23\AllShareFrameworkManagerDMS.exe

(Samsung) C:\Program Files\SAMSUNG\AllShare Framework DMS\1.3.23\AllShareFrameworkDMS.exe

(CHENGDU YIWO Tech Development Co., Ltd) C:\Program Files (x86)\EaseUS\Todo Backup\bin\Agent.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe

(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\21.6.0.32\nis.exe

(Copyright 2013 SAMSUNG) C:\Program Files\SAMSUNG\Samsung Link\Samsung Link.exe

(Copyright 2013 SAMSUNG) C:\Program Files\SAMSUNG\Samsung Link\Samsung Link.exe

(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe

(Realtek Semiconductor) C:\Windows\RAVCpl64.exe

() C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe

(Copyright 2013 SAMSUNG) C:\Program Files\SAMSUNG\Samsung Link\Samsung Link Tray Agent.exe

(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\21.6.0.32\nis.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe

(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesApp64.exe

(Google Inc.) C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

(Samsung Electronics Co., Ltd.) D:\Program Files (x86)\Kies\KiesTrayAgent.exe

() C:\Program Files (x86)\EaseUS\Todo Backup\bin\TodoBackupService.exe

(Microsoft Corporation) C:\Windows\System32\vds.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe

(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\21.6.0.32\nis.exe

(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesApp64.exe

() C:\Program Files\pia_manager\pia_manager.exe

(hxxp://www.ruby-lang.org/) C:\Users\Hans Desktop PC\AppData\Local\Temp\ocr4C3B.tmp\bin\rubyw.exe

(Realtek Semiconductor) C:\Windows\RAVCpl64.exe

(Copyright 2013 SAMSUNG) C:\Program Files\SAMSUNG\Samsung Link\Samsung Link Tray Agent.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe

(Microsoft Corporation) C:\Program Files (x86)\Windows Sidebar\sidebar.exe

(BTOWS) C:\Program Files\Toolwiz BHORM\BHORM.exe

(RemoteMouse.net) C:\Program Files (x86)\Remote Mouse\RemoteMouse.exe

(Toolwiz) C:\Program Files\Toolwiz Time Freeze 2014\ToolwizTimeFreeze.exe

() C:\Users\Hans Desktop PC\AppData\Local\Amazon Music\Amazon Music Helper.exe

() D:\Program Files (x86)\WISO\Steuersoftware 2014\mshaktuell.exe

( ) C:\Program Files\Copy Handler\ch64.exe

() C:\Program Files\pia_manager\pia_manager.exe

(Disc Soft Ltd) C:\Program Files (x86)\DAEMON Tools Lite\DTShellHlp.exe

(Samsung Electronics Co., Ltd.) D:\Program Files (x86)\Kies\KiesTrayAgent.exe

(hxxp://www.ruby-lang.org/) C:\Users\Hans Desktop PC\AppData\Local\Temp\ocr6EA9.tmp\bin\rubyw.exe

() C:\Program Files\pia_manager\pia_tray\pia_tray.exe

() C:\Program Files\pia_manager\openvpn.exe

() C:\Program Files (x86)\Synology\Assistant\DSAssistant.exe

(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe

(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe

(Google Inc.) C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe

(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil64_16_0_0_235_ActiveX.exe

(Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [RtHDVCpl] => C:\Windows\RAVCpl64.exe [6495264 2014-01-12] (Realtek Semiconductor)

HKLM\...\Run: [Samsung Link] => C:\Program Files\Samsung\Samsung Link\Samsung Link Tray Agent.exe [600928 2014-01-17] (Copyright 2013 SAMSUNG)

HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)

HKLM-x32\...\Run: [NBAgent] => C:\Program Files (x86)\Nero\Nero 11\Nero BackItUp\NBAgent.exe [1493288 2012-01-13] (Nero AG)

HKLM-x32\...\Run: [KiesTrayAgent] => D:\Program Files (x86)\Kies\KiesTrayAgent.exe [311616 2014-02-07] (Samsung Electronics Co., Ltd.)

HKU\S-1-5-21-2081905457-2083805786-3871413059-1001\...\Run: [LightScribe Control Panel] => C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2741616 2011-03-04] (Hewlett-Packard Company)

HKU\S-1-5-21-2081905457-2083805786-3871413059-1001\...\Run: [swg] => C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2013-11-03] (Google Inc.)

HKU\S-1-5-21-2081905457-2083805786-3871413059-1001\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3696912 2014-03-04] (Disc Soft Ltd)

HKU\S-1-5-21-2081905457-2083805786-3871413059-1001\...\Run: [Toolwiz BHORM] => C:\Program files\Toolwiz BHORM\BHORM.exe [1517848 2014-07-20] (BTOWS)

HKU\S-1-5-21-2081905457-2083805786-3871413059-1001\...\Run: [Remote Mouse] => C:\Program Files (x86)\Remote Mouse\RemoteMouse.exe [1238528 2014-04-28] (RemoteMouse.net)

HKU\S-1-5-21-2081905457-2083805786-3871413059-1001\...\Run: [ToolwizTimeFreeze] => C:\Program Files\Toolwiz Time Freeze 2014\ToolwizTimeFreeze.exe [1660216 2014-10-19] (Toolwiz)

HKU\S-1-5-21-2081905457-2083805786-3871413059-1001\...\Run: [Amazon Music] => C:\Users\Hans Desktop PC\AppData\Local\Amazon Music\Amazon Music Helper.exe [6277952 2014-11-19] ()

HKU\S-1-5-21-2081905457-2083805786-3871413059-1003\...\Run: [LightScribe Control Panel] => C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2741616 2011-03-04] (Hewlett-Packard Company)

HKU\S-1-5-21-2081905457-2083805786-3871413059-1003\...\Run: [swg] => C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2013-11-03] (Google Inc.)

HKU\S-1-5-21-2081905457-2083805786-3871413059-1003\...\MountPoints2: {a93bb857-425a-11e3-9c97-806e6f6e6963} - I:\autorunmenu.exe

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WISO Mein Steuer-Sparbuch heute.lnk

ShortcutTarget: WISO Mein Steuer-Sparbuch heute.lnk -> D:\Program Files (x86)\WISO\Steuersoftware 2014\mshaktuell.exe ()

Startup: C:\Users\Hans Desktop PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Copy Handler.lnk

ShortcutTarget: Copy Handler.lnk -> C:\Program Files\Copy Handler\ch64.exe ( )
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome

HKU\S-1-5-21-2081905457-2083805786-3871413059-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKU\S-1-5-21-2081905457-2083805786-3871413059-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.tagesschau.de/

HKU\S-1-5-21-2081905457-2083805786-3871413059-1003\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.tagesschau.de/

HKU\S-1-5-21-2081905457-2083805786-3871413059-1003\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-21-2081905457-2083805786-3871413059-1001 -> DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = https://www.google.com/search?q={searchTerms}&rlz=1I7WQIB_deDE560

SearchScopes: HKU\S-1-5-21-2081905457-2083805786-3871413059-1001 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = https://www.google.com/search?q={searchTerms}&rlz=1I7WQIB_deDE560

BHO: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Internet Security\Engine64\21.6.0.32\coIEPlg.dll (Symantec Corporation)

BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

BHO-x32: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Internet Security\Engine\21.6.0.32\coIEPlg.dll (Symantec Corporation)

BHO-x32: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files (x86)\Norton Internet Security\Engine\21.6.0.32\IPS\IPSBHO.DLL (Symantec Corporation)

BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)

BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine64\21.6.0.32\coIEPlg.dll (Symantec Corporation)

Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\21.6.0.32\coIEPlg.dll (Symantec Corporation)

Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

Toolbar: HKU\S-1-5-21-2081905457-2083805786-3871413059-1001 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

Toolbar: HKU\S-1-5-21-2081905457-2083805786-3871413059-1001 -> Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine64\21.6.0.32\coIEPlg.dll (Symantec Corporation)

Toolbar: HKU\S-1-5-21-2081905457-2083805786-3871413059-1003 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

DPF: HKLM-x32 {15BE8BEE-4105-4A79-B385-25068AA967DB} hxxp://dizun95pzobbc.cloudfront.net/VBIMDPlayer.CAB

DPF: HKLM-x32 {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab

DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

Tcpip\Parameters: [DhcpNameServer] 209.222.18.222 209.222.18.218

Tcpip\..\Interfaces\{B9747868-8A56-4C77-9451-119E3E1C704C}: [NameServer] 192.168.178.1
 

FireFox:

========

FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF Plugin-x32: @Nero.com/KM -> C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\coFFPlgn

FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\coFFPlgn [2014-12-31]
 

Chrome: 

=======

CHR HomePage: Default -> hxxp://www.tagesschau.de/

CHR StartupUrls: Default -> "", "https://www.google.de/search?q=www&rlz=1C1OPRB_enDE561DE562&oq=www&aqs=chrome..69i60l3j69i57j69i60l2.4336j0j4&sourceid=chrome&es_sm=122&ie=UTF-8"

CHR Profile: C:\Users\Hans Desktop PC\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Google Docs) - C:\Users\Hans Desktop PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-11-03]

CHR Extension: (Google Drive) - C:\Users\Hans Desktop PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-11-03]

CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Hans Desktop PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-28]

CHR Extension: (YouTube) - C:\Users\Hans Desktop PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-11-03]

CHR Extension: (Google-Suche) - C:\Users\Hans Desktop PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-11-03]

CHR Extension: (Norton Identity Safe) - C:\Users\Hans Desktop PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\iikflkcanblccfahdhdonehdalibjnif [2014-09-01]

CHR Extension: (Google Wallet) - C:\Users\Hans Desktop PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-11-03]

CHR Extension: (Google Mail) - C:\Users\Hans Desktop PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-11-03]

CHR HKLM\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - No Path

CHR HKLM\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton Internet Security\Engine\21.6.0.32\Exts\Chrome.crx [2014-10-04]

CHR HKLM-x32\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - No Path

CHR HKLM-x32\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton Internet Security\Engine\21.6.0.32\Exts\Chrome.crx [2014-10-04]
 

==================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 AllShare Framework DMS; C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\AllShareFrameworkManagerDMS.exe [404360 2013-12-21] (Samsung) [File not signed]

S2 AVMPowerlineService; C:\Program Files (x86)\FRITZ!Powerline\PowerlineService.exe [139264 2014-05-21] (AVM GmbH) [File not signed]

R2 EaseUS Agent; C:\Program Files (x86)\EaseUS\Todo Backup\bin\Agent.exe [37384 2014-10-14] (CHENGDU YIWO Tech Development Co., Ltd)

R2 EpsonBidirectionalService; C:\Program Files (x86)\Common Files\EPSON\eEBAPI\eEBSVC.exe [90112 2004-11-17] (SEIKO EPSON CORPORATION) [File not signed]

R2 LightScribeService; C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2011-03-04] (Hewlett-Packard Company) [File not signed]

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)

R2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\21.6.0.32\NIS.exe [276376 2014-09-21] (Symantec Corporation)

R2 Samsung Link Service; C:\Program Files\Samsung\Samsung Link\Samsung Link.exe [609632 2014-01-17] (Copyright 2013 SAMSUNG)

S3 SandraAgentSrv; C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2014.RTM\RpcAgentSrv.exe [72344 2008-11-25] (SiSoftware) [File not signed]

R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe [2143072 2012-07-04] (TuneUp Software)

R2 UsbClientService; C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe [248704 2013-08-14] () [File not signed]
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R3 AnyDVD; C:\Windows\System32\Drivers\AnyDVD.sys [138664 2014-04-24] (SlySoft, Inc.)

R3 AnyDVD; C:\Windows\SysWOW64\Drivers\AnyDVD.sys [138664 2014-04-24] (SlySoft, Inc.)

R1 BHDrvx64; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\BASHDefs\20141209.001\BHDrvx64.sys [1587416 2014-10-03] (Symantec Corporation)

R0 BTHORM; C:\Windows\System32\Drivers\BTHORM.sys [27928 2014-07-20] (Toolwiz.com)

R1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1506000.020\ccSetx64.sys [162392 2013-09-26] (Symantec Corporation)

R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-04-06] (Disc Soft Ltd)

R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [487216 2014-12-14] (Symantec Corporation)

R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [142640 2014-12-14] (Symantec Corporation)

R0 EUBKMON; C:\Windows\System32\drivers\EUBKMON.sys [48136 2014-10-14] ()

R3 gwfilt64; C:\Windows\System32\drivers\gwfilt64.sys [28160 2014-01-12] (Creative Technology Ltd.)

R1 IDSVia64; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\IPSDefs\20141231.001\IDSvia64.sys [637656 2014-11-19] (Symantec Corporation)

S3 libusb0; C:\Windows\System32\DRIVERS\libusb0.sys [52320 2013-12-20] (hxxp://libusb-win32.sourceforge.net)

R2 mbamchameleon; C:\Windows\system32\drivers\mbamchameleon.sys [93400 2014-11-21] (Malwarebytes Corporation)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)

R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-01-01] (Malwarebytes Corporation)

R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation)

R3 NAVENG; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\VirusDefs\20141231.020\ENG64.SYS [129752 2014-12-09] (Symantec Corporation)

R3 NAVEX15; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\VirusDefs\20141231.020\EX64.SYS [2137304 2014-12-09] (Symantec Corporation)

S3 SANDRA; C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2014.RTM\WNt500x64\Sandra.sys [23112 2009-08-07] (SiSoftware)

R3 SRTSP; C:\Windows\System32\Drivers\NISx64\1506000.020\SRTSP64.SYS [876248 2014-08-26] (Symantec Corporation)

R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1506000.020\SRTSPX64.SYS [37592 2014-08-26] (Symantec Corporation)

R0 SymDS; C:\Windows\System32\drivers\NISx64\1506000.020\SYMDS64.SYS [493656 2013-09-10] (Symantec Corporation)

R0 SymEFA; C:\Windows\System32\drivers\NISx64\1506000.020\SYMEFA64.SYS [1148120 2014-03-04] (Symantec Corporation)

R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [177752 2013-11-14] (Symantec Corporation)

R1 SymIM; C:\Windows\System32\DRIVERS\SymIMv.sys [78936 2013-09-10] (Symantec Corporation)

R1 SymIRON; C:\Windows\system32\drivers\NISx64\1506000.020\Ironx64.SYS [266968 2014-08-06] (Symantec Corporation)

R1 SymNetS; C:\Windows\System32\Drivers\NISx64\1506000.020\SYMNETS.SYS [593112 2014-02-18] (Symantec Corporation)

R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesDriver64.sys [11856 2012-05-03] (TuneUp Software)

R0 TWZDISK; C:\Windows\System32\Drivers\TWZDISK.sys [74512 2014-10-19] (Toolwiz.com)

R1 TWZFILE; C:\Windows\System32\Drivers\TWZFILE.sys [44304 2014-10-19] (Toolwiz.com)

S3 catchme; \??\C:\ComboFix\catchme.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2015-01-01 13:05 - 2015-01-01 13:05 - 00021852 _____ () C:\Users\Hans Desktop PC\Desktop\FRST.txt

2015-01-01 13:00 - 2015-01-01 13:00 - 00852505 _____ () C:\Users\Hans Desktop PC\Desktop\SecurityCheck.exe

2014-12-31 23:40 - 2014-12-31 23:40 - 00000000 ____D () C:\Program Files (x86)\ESET

2014-12-31 23:39 - 2014-12-31 23:40 - 02347384 _____ (ESET) C:\Users\Hans Desktop PC\Desktop\esetsmartinstaller_deu.exe

2014-12-31 23:06 - 2014-12-31 11:03 - 02123264 _____ (Farbar) C:\Users\Hans Desktop PC\Desktop\FRST64.exe

2014-12-31 20:57 - 2014-12-31 20:57 - 00001125 _____ () C:\Users\Hans Desktop PC\Desktop\JRT.txt

2014-12-31 20:51 - 2014-12-31 20:51 - 01707939 _____ (Thisisu) C:\Users\Hans Desktop PC\Desktop\JRT.exe

2014-12-31 20:06 - 2014-12-31 20:33 - 00000000 ____D () C:\AdwCleaner

2014-12-31 17:49 - 2014-12-31 17:49 - 00021873 _____ () C:\ComboFix.txt

2014-12-31 17:21 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe

2014-12-31 17:21 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe

2014-12-31 17:21 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2014-12-31 17:21 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2014-12-31 17:21 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2014-12-31 17:21 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe

2014-12-31 17:21 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe

2014-12-31 17:21 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe

2014-12-31 17:20 - 2014-12-31 17:50 - 00000000 ____D () C:\Qoobox

2014-12-31 17:19 - 2014-12-31 17:48 - 00000000 ____D () C:\Windows\erdnt

2014-12-31 17:16 - 2014-12-31 17:16 - 05604036 ____R (Swearware) C:\Users\Hans Desktop PC\Desktop\ComboFix.exe

2014-12-31 17:10 - 2014-12-31 17:10 - 00001268 _____ () C:\Users\Hans Desktop PC\Desktop\Revo Uninstaller.lnk

2014-12-31 17:10 - 2014-12-31 17:10 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group

2014-12-31 15:43 - 2014-12-31 15:43 - 00000000 ____D () C:\Users\Hans Desktop PC\Downloads\Sicherung Diskstation

2014-12-31 11:04 - 2015-01-01 13:05 - 00000000 ____D () C:\FRST

2014-12-31 11:04 - 2014-12-31 21:25 - 00045045 _____ () C:\Users\Hans Desktop PC\Downloads\FRST.txt

2014-12-31 11:04 - 2014-12-31 11:05 - 00051674 _____ () C:\Users\Hans Desktop PC\Downloads\Addition.txt

2014-12-31 11:03 - 2014-12-31 11:03 - 02123264 _____ (Farbar) C:\Users\Hans Desktop PC\Downloads\FRST64.exe

2014-12-30 12:19 - 2014-12-30 12:19 - 00081148 _____ () C:\Users\Hans Desktop PC\Downloads\Extras.Txt

2014-12-30 12:18 - 2014-12-30 12:18 - 00121498 _____ () C:\Users\Hans Desktop PC\Downloads\OTL.Txt

2014-12-30 12:12 - 2014-12-30 12:12 - 00602112 _____ (OldTimer Tools) C:\Users\Hans Desktop PC\Downloads\OTL.exe

2014-12-28 17:09 - 2014-12-28 17:09 - 00000000 ____D () C:\Users\Hans Desktop PC\Downloads\PIAopenvpn

2014-12-28 17:08 - 2014-12-28 17:08 - 00008242 _____ () C:\Users\Hans Desktop PC\Downloads\PIAopenvpn.zip

2014-12-28 17:06 - 2014-12-28 17:06 - 00000414 _____ () C:\Users\Hans Desktop PC\Desktop\LAN-Verbindung - Verknüpfung.lnk

2014-12-28 11:27 - 2014-12-28 14:24 - 00000047 _____ () C:\Users\Hans Desktop PC\Desktop\PIA.txt

2014-12-27 19:30 - 2014-12-27 19:30 - 00002770 _____ () C:\Windows\System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2012

2014-12-27 17:39 - 2014-12-27 17:39 - 00000000 ____D () C:\Users\Hans\AppData\Local\SAMSUNG

2014-12-27 17:39 - 2014-12-27 17:39 - 00000000 ____D () C:\Users\Hans\.swt

2014-12-26 11:29 - 2014-12-26 11:29 - 00000000 ____D () C:\Users\Hans Desktop PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Samsung

2014-12-26 11:29 - 2014-12-26 11:29 - 00000000 ____D () C:\Users\Hans Desktop PC\.swt

2014-12-26 11:29 - 2014-12-26 11:29 - 00000000 ____D () C:\Upload

2014-12-26 11:26 - 2014-12-26 11:28 - 90627424 _____ (Copyright 2013 SAMSUNG) C:\Users\Hans Desktop PC\Downloads\SamsungLink18_Installer64.exe

2014-12-26 11:09 - 2014-12-26 11:09 - 00012244 _____ () C:\Users\Hans Desktop PC\Desktop\pia_tray.exe - Verknüpfung.lnk

2014-12-26 10:33 - 2014-12-26 10:33 - 00002213 _____ () C:\Users\Public\Desktop\TuneUp 1-Klick-Wartung.lnk

2014-12-26 10:33 - 2014-12-26 10:33 - 00002205 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2012.lnk

2014-12-26 10:33 - 2014-12-26 10:33 - 00002193 _____ () C:\Users\Public\Desktop\TuneUp Utilities 2012.lnk

2014-12-26 10:33 - 2014-12-26 10:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2012

2014-12-26 10:33 - 2014-12-26 10:33 - 00000000 ____D () C:\Program Files (x86)\TuneUp Utilities 2012

2014-12-26 10:33 - 2012-07-04 10:49 - 00034656 _____ (TuneUp Software) C:\Windows\system32\TURegOpt.exe

2014-12-26 10:33 - 2012-07-04 10:49 - 00025952 _____ (TuneUp Software) C:\Windows\system32\authuitu.dll

2014-12-26 10:33 - 2012-07-04 10:49 - 00021344 _____ (TuneUp Software) C:\Windows\SysWOW64\authuitu.dll

2014-12-26 10:32 - 2012-08-09 19:03 - 53588376 _____ (TuneUp Software) C:\Users\Hans Desktop PC\Downloads\TuneUpUtilities2012-multilingual.exe

2014-12-26 10:20 - 2014-12-26 10:20 - 00003886 _____ () C:\Windows\System32\Tasks\Adobe Acrobat Update Task

2014-12-24 19:58 - 2014-12-24 19:58 - 31104920 _____ () C:\Users\Hans Desktop PC\Documents\Protokoll 141224.pcapng

2014-12-24 17:28 - 2014-12-31 23:28 - 00065536 _____ () C:\Windows\system32\Ikeext.etl

2014-12-24 17:19 - 2014-12-24 17:19 - 00000000 ____D () C:\Users\Hans Desktop PC\AppData\Roaming\Wireshark

2014-12-24 17:17 - 2014-12-24 17:17 - 00001563 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wireshark.lnk

2014-12-24 17:17 - 2014-12-24 17:17 - 00001551 _____ () C:\Users\Public\Desktop\Wireshark.lnk

2014-12-24 17:16 - 2014-12-24 17:18 - 00000000 ____D () C:\Program Files\Wireshark

2014-12-24 16:17 - 2014-12-24 16:17 - 00008242 _____ () C:\Users\Hans Desktop PC\Downloads\openvpn.zip

2014-12-24 15:13 - 2014-12-24 15:13 - 00000000 ____D () C:\Users\Hans Desktop PC\Documents\openvpn

2014-12-24 14:58 - 2014-12-24 09:29 - 00008242 _____ () C:\Users\Hans Desktop PC\Documents\openvpn.zip

2014-12-24 14:10 - 2014-12-24 14:10 - 00713216 _____ () C:\Users\Hans Desktop PC\Downloads\F4EG.exe

2014-12-24 14:01 - 2014-12-24 18:38 - 00000130 _____ () C:\Users\Hans Desktop PC\Desktop\DiskStation_2.url

2014-12-22 20:18 - 2014-12-22 20:18 - 00000000 ____D () C:\Users\Hans\AppData\Roaming\Portforward.com

2014-12-22 19:21 - 2014-12-28 17:20 - 00000000 ____D () C:\Users\Hans Desktop PC\AppData\Roaming\PortForward.com

2014-12-22 18:53 - 2013-09-10 03:47 - 00078936 ____R (Symantec Corporation) C:\Windows\system32\Drivers\SymIMV.sys

2014-12-22 16:56 - 2014-12-22 16:56 - 00000020 _____ () C:\Users\Hans Desktop PC\Desktop\passwort mtoorennt.txt

2014-12-22 16:23 - 2014-12-22 16:23 - 00000000 ____D () C:\Users\Hans Desktop PC\AppData\Roaming\Titanium

2014-12-22 16:23 - 2014-12-22 16:23 - 00000000 ____D () C:\Users\Hans Desktop PC\AppData\Roaming\Apple Computer

2014-12-22 16:23 - 2014-12-22 16:23 - 00000000 ____D () C:\Users\Hans Desktop PC\AppData\Local\Apple Computer

2014-12-22 16:22 - 2015-01-01 07:22 - 00000000 ____D () C:\Program Files\pia_manager

2014-12-22 16:22 - 2014-12-24 20:04 - 00003188 _____ () C:\Windows\System32\Tasks\Private Internet Access Startup

2014-12-22 16:22 - 2014-12-22 16:22 - 00031232 _____ (The OpenVPN Project) C:\Windows\system32\Drivers\tap0901.sys

2014-12-21 19:57 - 2014-12-28 17:20 - 00000000 ____D () C:\Users\Hans Desktop PC\AppData\Roaming\uTorrent

2014-12-21 19:56 - 2014-12-21 19:56 - 01688656 _____ (BitTorrent Inc.) C:\Users\Hans Desktop PC\Downloads\uTorrent.exe

2014-12-17 20:35 - 2014-12-13 06:09 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-12-17 20:35 - 2014-12-13 04:33 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-12-15 03:20 - 2014-12-15 03:20 - 00000000 ____D () C:\Windows\system32\appraiser

2014-12-15 03:01 - 2014-10-18 03:05 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll

2014-12-15 03:01 - 2014-10-18 02:33 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll

2014-12-14 13:52 - 2014-12-14 13:53 - 02427744 _____ () C:\Users\Hans Desktop PC\Downloads\altbinzpu03914beta.zip

2014-12-14 10:37 - 2014-12-04 03:50 - 00830976 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll

2014-12-14 10:37 - 2014-12-04 03:50 - 00741376 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll

2014-12-14 10:37 - 2014-12-04 03:50 - 00413184 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll

2014-12-14 10:37 - 2014-12-04 03:50 - 00396800 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll

2014-12-14 10:37 - 2014-12-04 03:50 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-12-14 10:37 - 2014-12-04 03:50 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll

2014-12-14 10:37 - 2014-12-04 03:44 - 01083392 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-12-14 10:37 - 2014-12-02 00:28 - 01232040 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe

2014-12-14 10:37 - 2014-11-27 02:43 - 00389296 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2014-12-14 10:37 - 2014-11-27 02:10 - 00342200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

2014-12-14 10:37 - 2014-11-22 04:13 - 25059840 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-12-14 10:37 - 2014-11-22 04:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-12-14 10:37 - 2014-11-22 04:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-12-14 10:37 - 2014-11-22 03:50 - 00580096 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-12-14 10:37 - 2014-11-22 03:50 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-12-14 10:37 - 2014-11-22 03:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-12-14 10:37 - 2014-11-22 03:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-12-14 10:37 - 2014-11-22 03:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2014-12-14 10:37 - 2014-11-22 03:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-12-14 10:37 - 2014-11-22 03:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-12-14 10:37 - 2014-11-22 03:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-12-14 10:37 - 2014-11-22 03:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-12-14 10:37 - 2014-11-22 03:34 - 06039552 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-12-14 10:37 - 2014-11-22 03:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-12-14 10:37 - 2014-11-22 03:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-12-14 10:37 - 2014-11-22 03:22 - 19749376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-12-14 10:37 - 2014-11-22 03:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-12-14 10:37 - 2014-11-22 03:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-12-14 10:37 - 2014-11-22 03:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2014-12-14 10:37 - 2014-11-22 03:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-12-14 10:37 - 2014-11-22 03:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-12-14 10:37 - 2014-11-22 03:07 - 00501248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-12-14 10:37 - 2014-11-22 03:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-12-14 10:37 - 2014-11-22 03:06 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2014-12-14 10:37 - 2014-11-22 03:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-12-14 10:37 - 2014-11-22 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll

2014-12-14 10:37 - 2014-11-22 03:01 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-12-14 10:37 - 2014-11-22 02:59 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-12-14 10:37 - 2014-11-22 02:58 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-12-14 10:37 - 2014-11-22 02:56 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-12-14 10:37 - 2014-11-22 02:54 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2014-12-14 10:37 - 2014-11-22 02:49 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-12-14 10:37 - 2014-11-22 02:49 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-12-14 10:37 - 2014-11-22 02:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2014-12-14 10:37 - 2014-11-22 02:46 - 02125312 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-12-14 10:37 - 2014-11-22 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2014-12-14 10:37 - 2014-11-22 02:43 - 14412800 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-12-14 10:37 - 2014-11-22 02:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2014-12-14 10:37 - 2014-11-22 02:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-12-14 10:37 - 2014-11-22 02:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2014-12-14 10:37 - 2014-11-22 02:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2014-12-14 10:37 - 2014-11-22 02:29 - 04299264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-12-14 10:37 - 2014-11-22 02:28 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-12-14 10:37 - 2014-11-22 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-12-14 10:37 - 2014-11-22 02:22 - 02052096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-12-14 10:37 - 2014-11-22 02:21 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll

2014-12-14 10:37 - 2014-11-22 02:15 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-12-14 10:37 - 2014-11-22 02:13 - 12836864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-12-14 10:37 - 2014-11-22 02:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-12-14 10:37 - 2014-11-22 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-12-14 10:37 - 2014-11-22 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-12-14 10:37 - 2014-11-22 01:54 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-12-14 10:37 - 2014-11-11 04:09 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll

2014-12-14 10:37 - 2014-11-11 03:44 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll

2014-12-14 10:37 - 2014-11-11 02:46 - 00119296 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys

2014-12-14 10:35 - 2014-11-08 04:16 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll

2014-12-14 10:35 - 2014-11-08 03:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll

2014-12-14 10:35 - 2014-10-30 03:03 - 00165888 _____ (Microsoft Corporation) C:\Windows\system32\charmap.exe

2014-12-14 10:35 - 2014-10-30 02:45 - 00155136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\charmap.exe

2014-12-14 10:35 - 2014-10-03 03:12 - 02020352 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll

2014-12-14 10:35 - 2014-10-03 03:12 - 00346624 _____ (Microsoft Corporation) C:\Windows\system32\WSManMigrationPlugin.dll

2014-12-14 10:35 - 2014-10-03 03:12 - 00310272 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll

2014-12-14 10:35 - 2014-10-03 03:12 - 00181248 _____ (Microsoft Corporation) C:\Windows\system32\WsmAuto.dll

2014-12-14 10:35 - 2014-10-03 03:11 - 00266240 _____ (Microsoft Corporation) C:\Windows\system32\WSManHTTPConfig.exe

2014-12-14 10:35 - 2014-10-03 02:45 - 01177088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmSvc.dll

2014-12-14 10:35 - 2014-10-03 02:45 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManMigrationPlugin.dll

2014-12-14 10:35 - 2014-10-03 02:45 - 00214016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmWmiPl.dll

2014-12-14 10:35 - 2014-10-03 02:45 - 00145920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmAuto.dll

2014-12-14 10:35 - 2014-10-03 02:44 - 00198656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManHTTPConfig.exe

2014-12-08 19:51 - 2014-12-08 19:51 - 00001245 _____ () C:\Users\Hans Desktop PC\Desktop\Amazon Music.lnk

2014-12-08 17:21 - 2014-12-16 19:40 - 00030106 _____ () C:\Users\Hans Desktop PC\Documents\Adressliste Gartenverein.xlsx

2014-12-03 15:43 - 2014-12-03 15:43 - 00001053 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hyperion Download Manager.lnk

2014-12-03 15:43 - 2014-12-03 15:43 - 00001041 _____ () C:\Users\Public\Desktop\Hyperion Download Manager.lnk

2014-12-03 15:43 - 2014-12-03 15:43 - 00000000 ____D () C:\Users\Hans Desktop PC\AppData\Roaming\co.uk.Hyperion.downloader

2014-12-03 15:43 - 2014-12-03 15:43 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Macromedia

2014-12-03 15:43 - 2014-12-03 15:43 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Macromedia

2014-12-03 15:43 - 2014-12-03 15:43 - 00000000 ____D () C:\Program Files (x86)\Hyperion Download Manager
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2015-01-01 12:38 - 2013-11-03 19:48 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2015-01-01 12:28 - 2013-11-01 18:59 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2015-01-01 08:57 - 2014-06-29 15:39 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2015-01-01 08:12 - 2014-01-02 11:32 - 00003990 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{8C789A6B-65A8-4A76-A311-F27A13C4B32B}

2015-01-01 07:22 - 2014-07-20 11:55 - 00000000 ____D () C:\Program Files (x86)\Remote Mouse

2015-01-01 05:57 - 2013-10-31 19:36 - 01539227 _____ () C:\Windows\WindowsUpdate.log

2014-12-31 23:35 - 2009-07-14 05:50 - 00028384 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-12-31 23:35 - 2009-07-14 05:50 - 00028384 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-12-31 23:33 - 2011-04-12 09:14 - 00702640 _____ () C:\Windows\system32\perfh007.dat

2014-12-31 23:33 - 2011-04-12 09:14 - 00150280 _____ () C:\Windows\system32\perfc007.dat

2014-12-31 23:33 - 2009-07-14 06:12 - 01628044 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-12-31 23:29 - 2013-11-03 19:48 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-12-31 23:28 - 2013-10-31 19:44 - 00000000 _____ () C:\Windows\system32\Drivers\lvuvc.hs

2014-12-31 23:28 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-12-31 23:28 - 2009-07-14 05:56 - 00077957 _____ () C:\Windows\setupact.log

2014-12-31 23:10 - 2010-11-21 04:47 - 00358620 _____ () C:\Windows\PFRO.log

2014-12-31 20:53 - 2014-01-07 21:20 - 00000000 ____D () C:\Windows\ERUNT

2014-12-31 20:33 - 2013-10-31 19:40 - 00000000 ____D () C:\Users\Hans Desktop PC

2014-12-31 20:20 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\tracing

2014-12-31 17:51 - 2014-02-26 21:35 - 01647518 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI

2014-12-31 17:50 - 2014-04-22 20:42 - 00000000 ____D () C:\Users\dub_cm_auto

2014-12-31 17:50 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Default

2014-12-31 17:48 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini

2014-12-31 17:30 - 2009-07-14 03:34 - 74973184 _____ () C:\Windows\system32\config\software.bak

2014-12-31 17:30 - 2009-07-14 03:34 - 19136512 _____ () C:\Windows\system32\config\system.bak

2014-12-31 17:30 - 2009-07-14 03:34 - 00524288 _____ () C:\Windows\system32\config\default.bak

2014-12-31 17:30 - 2009-07-14 03:34 - 00262144 _____ () C:\Windows\system32\config\security.bak

2014-12-31 17:30 - 2009-07-14 03:34 - 00262144 _____ () C:\Windows\system32\config\sam.bak

2014-12-31 14:49 - 2014-03-30 12:53 - 00000000 ____D () C:\Users\Hans Desktop PC\AppData\Local\NPE

2014-12-31 14:47 - 2014-05-01 11:14 - 00000000 ____D () C:\NPE

2014-12-31 14:31 - 2013-11-01 19:24 - 00598528 _____ () C:\Users\Hans Desktop PC\Documents\Hans.wlt

2014-12-28 12:36 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF

2014-12-28 00:29 - 2013-12-18 16:56 - 00000000 ____D () C:\Users\Hans Desktop PC\Documents\Mein Steuer-Sparbuch Heute

2014-12-27 18:45 - 2009-07-14 06:38 - 00000000 ____D () C:\Program Files (x86)\Windows Sidebar

2014-12-27 17:39 - 2014-07-27 11:13 - 00000000 ____D () C:\Users\Hans

2014-12-26 11:29 - 2014-08-27 14:00 - 00000000 ____D () C:\Program Files\SAMSUNG

2014-12-26 11:29 - 2013-11-01 19:08 - 00000000 ____D () C:\Users\Hans Desktop PC\AppData\Local\Samsung

2014-12-26 11:29 - 2013-11-01 19:04 - 00000000 ____D () C:\ProgramData\Samsung

2014-12-26 11:29 - 2013-11-01 19:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung

2014-12-24 18:37 - 2014-05-01 09:51 - 00000186 _____ () C:\Users\Hans Desktop PC\Desktop\DiskStation.url

2014-12-23 01:00 - 2014-06-29 15:39 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-12-22 20:24 - 2014-01-01 11:16 - 00000000 ____D () C:\Users\Hans Desktop PC\AppData\Local\CrashDumps

2014-12-22 19:21 - 2013-11-01 19:01 - 00000000 ____D () C:\Users\Hans Desktop PC\AppData\Local\Downloaded Installations

2014-12-21 18:17 - 2014-01-01 15:12 - 00000000 ____D () C:\Users\Hans Desktop PC\AppData\Roaming\Mp3tag

2014-12-16 06:52 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache

2014-12-15 03:20 - 2014-05-07 19:24 - 00000000 ___SD () C:\Windows\system32\CompatTel

2014-12-15 03:20 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions

2014-12-15 03:20 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\AppCompat

2014-12-15 03:05 - 2013-10-31 20:26 - 00000000 ____D () C:\ProgramData\Microsoft Help

2014-12-15 03:04 - 2014-01-11 18:50 - 00000000 ____D () C:\Windows\system32\MRT

2014-12-15 03:02 - 2014-01-11 18:49 - 112710672 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-12-14 16:55 - 2014-01-01 14:44 - 00000000 ____D () C:\Users\Hans Desktop PC\AppData\Local\Nero

2014-12-14 13:27 - 2013-11-03 19:47 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk

2014-12-14 10:47 - 2014-08-18 13:52 - 00000000 ____D () C:\Users\Hans Desktop PC\AppData\Local\Adobe

2014-12-14 10:46 - 2013-11-01 18:59 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-12-14 10:46 - 2013-11-01 18:59 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-12-14 10:46 - 2013-11-01 18:59 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2014-12-14 10:40 - 2013-11-03 19:48 - 00002175 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

2014-12-10 16:42 - 2014-06-29 15:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-12-10 16:42 - 2014-01-03 13:56 - 00001106 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-12-08 14:58 - 2014-11-10 17:04 - 00000000 ____D () C:\Program Files (x86)\FRITZ!Powerline

2014-12-03 15:43 - 2013-11-03 19:47 - 00000000 ____D () C:\ProgramData\Adobe

2014-12-03 15:43 - 2013-11-03 19:47 - 00000000 ____D () C:\Program Files (x86)\Adobe

2014-12-03 15:43 - 2013-11-01 18:59 - 00000000 ____D () C:\Users\Hans Desktop PC\AppData\Roaming\Adobe
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-12-26 12:48
 

==================== End Of Log ============================

--- --- ---

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 28-12-2014

Ran by Hans Desktop PC at 2015-01-01 13:05:32

Running from C:\Users\Hans Desktop PC\Desktop

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

(If an entry is included in the fixlist, it will be removed.)
 

AV: Norton Internet Security (Disabled - Up to date) {D87FA2C0-F526-77B1-D6EC-0EDF3936CEDB}

AS: Norton Internet Security (Enabled - Up to date) {631E4324-D31C-783F-EC5C-35AD42B18466}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

FW: Norton Internet Security (Disabled) {E04423E5-BF49-76E9-FDB3-A7EAC7E589A0}
 

==================== Installed Programs ======================
 

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 

7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version:  - )

Acer System Information (HKLM-x32\...\{72199E33-4F2A-4B7F-8E25-95DDDD50A678}) (Version: 1.0.0 - Acer)

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 15.0.0.356 - Adobe Systems Incorporated)

Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.235 - Adobe Systems Incorporated)

Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)

Age of Empires II: HD Edition (HKLM-x32\...\Steam App 221380) (Version:  - Hidden Path Entertainment, Ensemble Studios)

AllShare Framework DMS (HKLM\...\{83232C27-8C3F-44A5-9EB2-BB7161228ADD}) (Version: 1.3.23 - Samsung)

Alt.Binz Prepaid Usenet edition Version 0.39.14 (HKLM-x32\...\{6B87C531-F762-46BA-AC33-C88B1CC7D83B}_is1) (Version: 0.39.14 - Prepaid usenet)

ALTools Update (HKLM-x32\...\ALUpdate_is1) (Version: v11.4 - ESTsoft Corp.)

ALZip 8.51 (HKLM-x32\...\ALZip_is1) (Version: v8.51 - ESTsoft Corp.)

Amazon Music (HKU\S-1-5-21-2081905457-2083805786-3871413059-1001\...\Amazon Amazon Music) (Version: 3.7.0.693 - Amazon Services LLC)

AnyDVD (HKLM-x32\...\AnyDVD) (Version: 7.5.1.0 - SlySoft)

ChessBase 12 64-bit (HKLM\...\{26C8EF65-314F-4353-8329-69093AD325C6}) (Version: 12.0.0.0 - ChessBase)

Cinergy XS Series V5.09.0304.00a (HKLM-x32\...\Cinergy XS Series) (Version: 5.09.0304.00a - )

Copy Handler 1.32Final (HKLM\...\{9CF6A157-F0E8-4216-B229-C0CA8204BE2C}_is1) (Version: 1.32Final - Józef Starosczyk)

DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.49.1.0356 - Disc Soft Ltd)

DRAGON 1.7 (HKLM-x32\...\DRAGON) (Version: 1.7 - PREPAID-USENET LIMITED)

DVBViewer TERRATEC Edition (HKLM-x32\...\DVBViewer TERRATEC Edition_is1) (Version:  - CM&V)

EaseUS Todo Backup Workstation 7.5 (HKLM-x32\...\EaseUS Todo Backup_is1) (Version: 7.5 - CHENGDU YIWO Tech Development Co., Ltd)

EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version:  - )

EPSON Speed Dial Utility (HKLM-x32\...\{F5576DA8-9F41-4FFD-8647-BAE877F08E28}) (Version: 3.0.202 - SEIKO EPSON CORP.)

Epson Universal Laser P6 (HKLM\...\Epson Universal Laser P6) (Version:  - )

EPSON-Drucker-Software (HKLM\...\EPSON Printer and Utilities) (Version:  - )

EpsonNet Config V2 (HKLM-x32\...\{221DBED3-CAF7-4D16-B968-76B66430868A}) (Version: 2.2b - SEIKO EPSON CORPORATION)

EpsonNet SetupManager (HKLM-x32\...\InstallShield_{DFAF5B6C-47F6-4D1E-BFC8-247659A8056D}) (Version: 1.5.dE - SEIKO EPSON CORPORATION)

EpsonNet SetupManager (x32 Version: 1.5.dE - SEIKO EPSON CORPORATION) Hidden

ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version:  - )

eWallet 7.4.3 for Windows PCs (HKLM-x32\...\Ilium Software eWallet_is1) (Version: 7.4.3 - Ilium Software)

Fritz 13 (HKLM-x32\...\{85EB0F56-3DB3-42CC-9384-A665C5FC5D08}) (Version: 13.0.0.0 - ChessBase)

FRITZ!Powerline (HKLM-x32\...\{F9C9378B-78D5-4CC0-8683-B7915DFEA9C5}) (Version: 01.00.65 - AVM Berlin)

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 39.0.2171.95 - Google Inc.)

Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.5111.1712 - Google Inc.)

Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden

Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden

Houdini 3 Pro (HKLM-x32\...\{E4724E9E-D338-4D86-B9F9-810F825DCDAF}) (Version: 13.12.0.0 - ChessBase)

Hyperion Download Manager (HKLM-x32\...\co.uk.Hyperion.downloader) (Version: v1.23 - Hyperion Records Limited)

Hyperion Download Manager (x32 Version: 1.23 - Hyperion Records Limited) Hidden

Jawbone Updater (HKLM-x32\...\Jawbone Updater) (Version: 0.1 - Jawbone)

K-Lite Codec Pack 10.1.0 Full (HKLM-x32\...\KLiteCodecPack_is1) (Version: 10.1.0 - )

LightScribe System Software (HKLM-x32\...\{E0E55FC1-C53D-4F8D-B14B-B59C312747C8}) (Version: 1.18.22.2 - LightScribe)

Magic DVD Copier Version 4.9 build 5 (HKLM-x32\...\Magic DVD Copier_is1) (Version:  - Magic DVD Software, Inc.)

MAGIX Video easy TERRATEC Edition (HKLM-x32\...\MAGIX_{2FA06473-23F0-4372-8DD5-1EAE42503D93}) (Version: 3.0.1.50 - MAGIX AG)

MAGIX Video easy TERRATEC Edition (Version: 3.0.1.50 - MAGIX AG) Hidden

Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)

Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)

Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISER) (Version: 12.0.6612.1000 - Microsoft Corporation)

Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)

Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)

Microsoft Sync Framework 2.0 Core Components (x86) ENU  (HKLM-x32\...\{FF63121D-91C6-42CC-B341-F1AA729728E7}) (Version: 2.0.1578.0 - Microsoft Corporation)

Microsoft Sync Framework 2.0 Provider Services (x86) ENU  (HKLM-x32\...\{D3A80508-CD83-4CA3-8671-914A1BC78B61}) (Version: 2.0.1578.0 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)

Mp3tag v2.65 (HKLM-x32\...\Mp3tag) (Version: v2.65 - Florian Heidenreich)

MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)

MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)

MyFreeCodec (HKU\S-1-5-21-2081905457-2083805786-3871413059-1001\...\MyFreeCodec) (Version:  - )

MyPhoneExplorer (HKLM-x32\...\MPE) (Version: 1.8.5 - F.J. Wechselberger)

Nero 11 Platinum (HKLM-x32\...\{79B3E8EE-35F2-4CCD-82D9-4A57F408E449}) (Version: 11.2.00700 - Nero AG)

Nero 2014 (HKLM-x32\...\{B7D4C429-9CAB-4B97-A879-AFD1F922DD27}) (Version: 15.0.06800 - Nero AG)

Nero Backup Drivers (HKLM\...\{D600D357-5CB9-4DE9-8FD4-14E208BD1970}) (Version: 12.0.4000 - Nero AG)

Nero Info (HKLM-x32\...\{B791E0AB-87A9-41A4-8D98-D13C2E37D928}) (Version: 15.1.0030 - Nero AG)

Nero Prerequisite Installer 1.0 (HKLM-x32\...\{AFD1BFF3-FE02-47BB-8F45-739D46AEA2BC}) (Version: 11.0.12700 - Nero AG)

Norton Internet Security (HKLM-x32\...\NIS) (Version: 21.6.0.32 - Symantec Corporation)

PDF Creator (HKLM\...\PDF Creator) (Version:  - )

Prerequisite installer (x32 Version: 15.0.0005 - Nero AG) Hidden

Private Internet Access Support Files (HKLM-x32\...\{7D72DAFF-DCB2-437B-BC22-4B2ABF21462B}) (Version: 1.0.0.0 - Private Internet Access)

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5704 - Realtek Semiconductor Corp.)

Remote Mouse version 2.54 (HKLM-x32\...\{01E4BC6D-3ACC-45E1-8928-C2FF626F63F3}_is1) (Version: 2.54 - Remote Mouse)

Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)

RPG Maker VX Ace (HKLM-x32\...\Steam App 220700) (Version:  - Enterbrain)

Samsung Kies (HKLM-x32\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.6.1.13105_7 - Samsung Electronics Co., Ltd.)

Samsung Kies (x32 Version: 2.6.1.13105_7 - Samsung Electronics Co., Ltd.) Hidden

Samsung Kies3 (HKLM-x32\...\InstallShield_{88547073-C566-4895-9005-EBE98EA3F7C7}) (Version: 3.2.14083.17 - Samsung Electronics Co., Ltd.)

Samsung Kies3 (x32 Version: 3.2.14083.17 - Samsung Electronics Co., Ltd.) Hidden

Samsung Link 1.8.0.1401171024 (HKLM\...\8474-7877-9059-0204) (Version: 1.8.0.1401171024 - Copyright 2013 SAMSUNG)

SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.45.0 - SAMSUNG Electronics Co., Ltd.)

SiSoftware Sandra Lite 2014.RTM (HKLM\...\{C3113E55-7BCB-4de3-8EBF-60E6CE6B2396}_is1) (Version: 20.10.2014.2 - SiSoftware)

Steam (HKLM-x32\...\Steam) (Version:  - Valve Corporation)

SyncToy 2.1 (x86) (HKLM-x32\...\{A066194B-DC8F-449A-8E0F-B57BDD3A2072}) (Version: 2.1.0 - Microsoft)

Synology Assistant (remove only) (HKLM-x32\...\Synology Assistant) (Version:  - )

TERRATEC CINERGY HTC Stick HD (64Bit) (HKLM-x32\...\{3C540F9B-0AD9-411B-A8BB-BFA63C9F7DC0}) (Version: 7.0.122.90 - TERRATEC)

TERRATEC CINERGY HTC Stick HD (HKLM-x32\...\{F3379143-B396-49E7-BE36-46B5651BFCC1}) (Version: 7.0.122.90 - TERRATEC)

TERRATEC Cinergy HTC USB XS HD (64 Bit) (HKLM-x32\...\{D4DC2182-41B4-4623-81A7-2A69AB169E6B}) (Version: 5.09.1202.00 - TERRATEC)

Toolwiz BHORM FREE (HKLM-x32\...\Toolwiz BHORM) (Version: 1.3.0.0 - Toolwiz BHORM Installer)

Toolwiz Time Freeze 2014 (HKLM-x32\...\{3A74D01E-3AEF-4DF4-8404-0056150C97A3}) (Version: 2.2.0.6000 - Toolwiz)

TuneUp Utilities 2012 (HKLM-x32\...\TuneUp Utilities 2012) (Version: 12.0.3600.114 - TuneUp Software)

TuneUp Utilities 2012 (x32 Version: 12.0.3600.114 - TuneUp Software) Hidden

TuneUp Utilities Language Pack (de-DE) (x32 Version: 12.0.3600.114 - TuneUp Software) Hidden

Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)

Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISER_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)

Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISER_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)

Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISER_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)

Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISER_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)

Welcome App (Start-up experience) (x32 Version: 11.0.23500.0.0 - Nero AG) Hidden

Windows-Treiberpaket - TerraTec  (USB28xxBGA) Media  (12/02/2009 5.09.1202.00) (HKLM\...\65164506FD435CC3986FDA4C94F3FFBAE17E7F97) (Version: 12/02/2009 5.09.1202.00 - TerraTec )

Windows-Treiberpaket - TERRATEC (CXIR) HIDClass  (06/04/2013 7.0.122.9) (HKLM\...\72D3DC17AEF4FF562A1A6DC91649D923F4F13D22) (Version: 06/04/2013 7.0.122.9 - TERRATEC)

Windows-Treiberpaket - TERRATEC (CXPOLARIS) Media  (06/04/2013 7.0.122.9) (HKLM\...\5C806C6AF50EE53D0B94B36E4B6E1E91AA7FDF3C) (Version: 06/04/2013 7.0.122.9 - TERRATEC)

WinPcap 4.1.2 (HKLM-x32\...\WinPcapInst) (Version: 4.1.0.2001 - CACE Technologies)

Wireshark 1.12.2 (64-bit) (HKLM-x32\...\Wireshark) (Version: 1.12.2 - The Wireshark developer community, hxxp://www.wireshark.org)

WISO Hausverwalter 2014 (HKLM-x32\...\{F7DA791F-5149-4520-92F9-69379E72436F}) (Version: 8.00.8332 - Buhl Data Service GmbH)

WISO Steuer-Sparbuch 2014 (HKLM-x32\...\{318EB991-761F-4C0E-BED6-91D1D3FC223C}) (Version: 21.00.8480 - Buhl Data Service GmbH)
 

==================== Custom CLSID (selected items): ==========================
 

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
 
 

==================== Restore Points  =========================
 

25-12-2014 22:04:37 Windows Update

26-12-2014 10:31:15 TuneUp Utilities 2012 wird entfernt

26-12-2014 10:31:28 TuneUp Utilities Language Pack (de-DE) wird entfernt

26-12-2014 10:33:10 TuneUp Utilities 2012 wird installiert

28-12-2014 19:00:47 Windows-Sicherung

31-12-2014 17:12:59 Revo Uninstaller's restore point - PDF Creator Packages

31-12-2014 17:15:33 Revo Uninstaller's restore point - Update for PDF Creator
 

==================== Hosts content: ==========================
 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 

2009-07-14 03:34 - 2014-12-31 17:47 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts

127.0.0.1       localhost
 

==================== Scheduled Tasks (whitelisted) =============
 

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
 

Task: {0B8525F4-32F2-40CD-A9A7-E6125DF17EE5} - System32\Tasks\Norton Internet Security\Norton Error Processor => C:\Program Files (x86)\Norton Internet Security\Engine\21.6.0.32\SymErr.exe [2014-01-30] (Symantec Corporation)

Task: {42926C80-5756-4BC0-B43B-84C1D7B75D96} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-11-03] (Google Inc.)

Task: {559DC91C-0DB2-43B2-8E45-F13144461F9E} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)

Task: {C5C94D19-5421-4B9B-8B21-788D065F45B2} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-12-14] (Adobe Systems Incorporated)

Task: {CC5DB143-623B-4CDC-8348-61DBC9DA3BBA} - System32\Tasks\Nero\Nero Info => C:\Program Files (x86)\Common Files\Nero\Nero Info\NeroInfo.exe [2013-10-16] (Nero AG)

Task: {DADCCC07-3937-41CB-9C00-16E86CCC31E4} - System32\Tasks\Private Internet Access Startup => C:\Program Files\pia_manager\pia_manager.exe [2014-12-24] ()

Task: {DDC67A09-8DBD-4EBB-8228-6276F6EA96B7} - System32\Tasks\Norton Internet Security\Norton Error Analyzer => C:\Program Files (x86)\Norton Internet Security\Engine\21.6.0.32\SymErr.exe [2014-01-30] (Symantec Corporation)

Task: {E10E2AC9-C728-4D72-9F56-18F5C499E0D3} - System32\Tasks\{721768B1-8EC5-42C1-926B-B96A848DA9F0} => pcalua.exe -a "C:\Program Files (x86)\EpsonNet\EpsonNet SetupManager\IManager.exe" -d "C:\Program Files (x86)\EpsonNet\EpsonNet SetupManager\"

Task: {E3B687E7-6B87-4064-B2FC-FD3B55EC102E} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)

Task: {E666C32A-9E5C-4F5C-AFFC-002E80FAFEE7} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-11-03] (Google Inc.)

Task: {F2DEE82C-D7B8-4EFE-9D63-255CA716AF84} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton Internet Security\Engine\21.6.0.32\WSCStub.exe [2014-09-21] (Symantec Corporation)

Task: {F3527D0B-84B5-4698-83FA-A313CC715AA2} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2012 => C:\Program Files (x86)\TuneUp Utilities 2012\OneClick.exe [2012-07-04] (TuneUp Software)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
 

==================== Loaded Modules (whitelisted) =============
 

2013-12-03 12:13 - 2011-10-04 22:43 - 00087552 _____ () C:\Windows\System32\custmon64i.dll

2014-12-26 11:29 - 2014-01-17 10:24 - 00013824 _____ () C:\Program Files\SAMSUNG\Samsung Link\JniSys.dll

2014-12-31 20:35 - 2014-12-31 23:11 - 00515584 _____ () C:\Windows\Temp\sqlite-3.7.2-sqlitejdbc.dll

2014-12-26 11:29 - 2014-01-17 10:24 - 01394176 _____ () C:\Program Files\SAMSUNG\Samsung Link\scone_proxy.dll

2014-12-26 11:29 - 2014-01-17 10:24 - 01435648 _____ () C:\Program Files\SAMSUNG\Samsung Link\scone_stub.dll

2013-12-21 11:25 - 2013-12-21 11:25 - 00036864 _____ () C:\Program Files\SAMSUNG\AllShare Framework DMS\1.3.23\64bit\JNIInterface.dll

2013-12-21 11:26 - 2013-12-21 11:26 - 00144384 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\64bit\ASFAPI.dll

2013-12-21 11:27 - 2013-12-21 11:27 - 00018944 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\64bit\MediaDB_Manager.dll

2013-10-22 09:52 - 2013-10-22 09:52 - 00030720 _____ () C:\Windows\system32\MediaDB64.dll

2013-10-22 09:52 - 2013-10-22 09:52 - 00908800 _____ () C:\Windows\system32\ContentDirectoryPresenter64.dll

2013-12-21 11:27 - 2013-12-21 11:27 - 00521728 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\64bit\DMS_Manager.dll

2013-07-23 19:19 - 2013-07-23 19:19 - 00049152 _____ () C:\Windows\system32\boost_date_time-vc90-mt-1_47.dll

2013-07-23 19:19 - 2013-07-23 19:19 - 00016896 _____ () C:\Windows\system32\boost_system-vc90-mt-1_47.dll

2013-07-23 19:19 - 2013-07-23 19:19 - 00058880 _____ () C:\Windows\system32\boost_thread-vc90-mt-1_47.dll

2013-07-23 19:19 - 2013-07-23 19:19 - 00299520 _____ () C:\Windows\system32\boost_serialization-vc90-mt-1_47.dll

2013-08-14 08:52 - 2013-08-14 08:52 - 00248704 _____ () C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe

2014-12-26 11:29 - 2014-01-17 10:24 - 00048640 _____ () C:\Program Files\SAMSUNG\Samsung Link\JniIO.dll

2014-11-02 10:29 - 2014-10-20 16:56 - 00240680 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\TodoBackupService.exe

2014-12-22 16:22 - 2014-12-24 20:04 - 08817658 _____ () C:\Program Files\pia_manager\pia_manager.exe

2014-04-22 19:23 - 2010-03-07 18:05 - 00290816 _____ () C:\Program Files\Copy Handler\chext64.dll

2014-12-08 19:51 - 2014-11-19 01:55 - 06277952 _____ () C:\Users\Hans Desktop PC\AppData\Local\Amazon Music\Amazon Music Helper.exe

2013-12-15 12:14 - 2014-02-28 17:49 - 01429808 _____ () D:\Program Files (x86)\WISO\Steuersoftware 2014\mshaktuell.exe

2014-04-22 19:23 - 2010-03-07 18:04 - 00318976 _____ () C:\Program Files\Copy Handler\libicpf64u.dll

2014-04-22 19:23 - 2010-03-07 18:05 - 00037376 _____ () C:\Program Files\Copy Handler\libchcore64u.dll

2014-12-22 16:22 - 2014-12-24 20:04 - 00184320 _____ () C:\Program Files\pia_manager\pia_tray\pia_tray.exe

2014-12-22 16:22 - 2014-12-24 20:04 - 00690176 _____ () C:\Program Files\pia_manager\openvpn.exe

2014-12-22 16:22 - 2014-12-24 20:04 - 00190317 _____ () C:\Program Files\pia_manager\liblzo2-2.dll

2014-12-22 16:22 - 2014-12-24 20:04 - 00108441 _____ () C:\Program Files\pia_manager\libpkcs11-helper-1.dll

2013-08-14 08:52 - 2013-08-14 08:52 - 04897152 _____ () C:\Program Files (x86)\Synology\Assistant\DSAssistant.exe

2013-12-11 16:46 - 2013-12-11 16:46 - 01114624 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\DMSManager.dll

2013-10-22 09:48 - 2013-10-22 09:48 - 00707072 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\ContentDirectoryPresenter.dll

2013-10-24 16:53 - 2013-10-24 16:53 - 00107008 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\DCMCDP.dll

2013-12-11 16:46 - 2013-12-11 16:46 - 00102400 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\FolderCDP.dll

2013-12-11 16:46 - 2013-12-11 16:46 - 00077312 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\MetadataFramework.dll

2013-02-14 19:42 - 2013-02-14 19:42 - 00520234 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\sqlite3.dll

2013-02-14 19:42 - 2013-02-14 19:42 - 00450560 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\MoodExtractor.dll

2013-02-14 19:42 - 2013-02-14 19:42 - 05717504 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\DCMImgExtractor.dll

2013-10-25 19:48 - 2013-10-25 19:48 - 00028672 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\AutoChaptering.dll

2013-02-14 19:42 - 2013-02-14 19:42 - 00147456 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\libexpat.dll

2013-10-25 19:48 - 2013-10-25 19:48 - 00012288 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\VideoThumb.dll

2013-02-14 19:42 - 2013-02-14 19:42 - 04671488 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\avcodec-52.dll

2013-02-14 19:42 - 2013-02-14 19:42 - 00070656 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\avutil-50.dll

2013-02-14 19:42 - 2013-02-14 19:42 - 00686080 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\avformat-52.dll

2013-02-14 19:42 - 2013-02-14 19:42 - 00152064 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\swscale-0.dll

2013-10-25 19:49 - 2013-10-25 19:49 - 00028160 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\AudioExtractor.dll

2013-10-25 19:48 - 2013-10-25 19:48 - 00064000 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\ID3Driver.dll

2013-02-14 19:42 - 2013-02-14 19:42 - 00366592 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\tag.dll

2013-10-25 19:48 - 2013-10-25 19:48 - 00289792 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\libThumbnail.dll

2013-10-25 19:48 - 2013-10-25 19:48 - 00023040 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\RichInfoDriver.dll

2013-12-11 16:45 - 2013-12-11 16:45 - 00017920 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\VideoExtractor.dll

2013-10-25 19:53 - 2013-10-25 19:53 - 00117248 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\ThumbnailMaker.dll

2013-10-25 19:53 - 2013-10-25 19:53 - 01033728 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\ImageMagickWrapper.dll

2013-12-11 16:45 - 2013-12-11 16:45 - 00134144 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\VideoMetadataDriver.dll

2013-10-25 19:48 - 2013-10-25 19:48 - 00290816 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\libKeyFrame.dll

2013-10-25 19:48 - 2013-10-25 19:48 - 00024064 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\SECMetaDriver.dll

2013-10-25 19:53 - 2013-10-25 19:53 - 00012288 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\ImageExtractor.dll

2013-10-25 19:48 - 2013-10-25 19:48 - 00024064 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\photoDriver.dll

2013-02-14 19:42 - 2013-02-14 19:42 - 00399826 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\libexif-12.dll.dll

2013-10-25 19:48 - 2013-10-25 19:48 - 00013824 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\TextExtractor.dll

2013-10-24 16:53 - 2013-10-24 16:53 - 00032768 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\Autobackup.dll

2013-04-19 16:38 - 2013-04-19 16:38 - 00055808 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\RosettaAllShare.dll

2013-07-23 19:18 - 2013-07-23 19:18 - 00227840 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\boost_serialization-vc90-mt-1_47.dll

2013-07-23 19:18 - 2013-07-23 19:18 - 00038912 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\boost_date_time-vc90-mt-1_47.dll

2013-07-23 19:18 - 2013-07-23 19:18 - 00012800 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\boost_system-vc90-mt-1_47.dll

2013-07-23 19:18 - 2013-07-23 19:18 - 00046592 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\boost_thread-vc90-mt-1_47.dll

2013-02-14 19:42 - 2013-02-14 19:42 - 00044032 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\us.dll

2014-11-02 10:29 - 2014-10-14 09:42 - 00098824 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\CodeLog.dll

2014-11-02 10:29 - 2014-10-14 09:41 - 00031240 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\CheckTool.dll

2014-11-02 10:29 - 2014-10-14 10:01 - 01296392 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\libxml2.dll

2014-11-02 10:29 - 2014-10-14 10:19 - 00060936 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\zlib1.dll

2014-11-02 10:29 - 2014-10-14 09:42 - 00017416 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\CompressFile.dll

2014-11-02 10:29 - 2014-10-14 10:13 - 00088584 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\TBGetRemoteNetInfo.dll

2014-11-02 10:29 - 2014-10-14 09:36 - 00107528 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\ActivationOnline.dll

2014-11-02 10:29 - 2014-10-14 10:02 - 00075784 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\logsys.dll

2014-11-02 10:29 - 2014-10-14 09:44 - 00030216 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\DiskSearchImg.dll

2014-11-02 10:29 - 2014-10-14 10:05 - 00068104 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\MountImg.dll

2014-11-02 10:29 - 2014-10-14 09:55 - 00158216 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\ImgFile.dll

2014-11-02 10:29 - 2014-10-14 09:45 - 00275976 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\DsImgFile.dll

2014-11-02 10:29 - 2014-10-14 09:40 - 00072200 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\CheckImg.dll

2014-11-02 10:29 - 2014-10-14 10:17 - 00139784 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\vhdvmdk.dll

2014-11-02 10:29 - 2014-10-14 09:39 - 00037384 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\BootDriver.dll

2014-11-02 10:29 - 2014-10-20 16:46 - 00743976 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\ExImage.dll

2014-11-02 10:29 - 2014-10-14 09:46 - 00193032 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\EmailBackupSize.dll

2014-11-02 10:29 - 2014-10-14 09:37 - 00255496 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\AndroidImage.dll

2014-11-02 10:29 - 2014-10-14 09:47 - 00145928 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\EnumDisk.dll

2014-11-02 10:29 - 2014-10-14 09:50 - 00076808 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\FatLib.dll

2014-11-02 10:29 - 2014-10-14 10:08 - 00207880 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\NTFSLib.dll

2014-11-02 10:29 - 2014-10-14 09:54 - 00024584 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\GetDriverInfo.dll

2014-11-02 10:29 - 2014-10-14 09:42 - 00020488 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\CorrectMbr.dll

2014-11-02 10:29 - 2014-10-14 09:47 - 00032264 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\EnumTapeDevice.dll

2014-11-02 10:29 - 2014-10-14 10:14 - 00034824 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\TbTapeBrowse.dll

2014-11-02 10:29 - 2014-10-14 10:10 - 00064008 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\RegLib.dll

2014-11-02 10:29 - 2014-10-14 09:36 - 00022536 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\AccountManager.dll

2014-11-02 10:29 - 2014-10-14 10:06 - 00115720 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\NasOperator.dll

2014-11-02 10:29 - 2014-10-14 09:46 - 00194056 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\EmailBrowser.dll

2014-11-02 10:29 - 2014-10-14 09:41 - 00135688 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\CloudOperator.dll

2014-11-02 10:29 - 2014-10-14 09:36 - 00037896 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\ActiveOnline.dll

2014-11-02 10:29 - 2014-10-14 10:18 - 00135688 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\VMConfig.dll

2014-11-02 10:29 - 2014-10-14 09:37 - 00019976 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\AndroidDeviceManager.dll

2014-11-02 10:29 - 2014-10-14 10:12 - 00043016 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\TbDataSwap.dll

2014-11-02 10:29 - 2014-10-14 10:12 - 00096776 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\TBFireWall.dll

2014-11-02 10:29 - 2014-10-14 09:44 - 00353800 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\DeviceManager.dll

2014-11-02 10:29 - 2014-10-14 09:44 - 00027144 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\DeviceAdapter.dll

2014-11-02 10:29 - 2014-10-14 09:43 - 00137224 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\Device.dll

2014-11-02 10:29 - 2014-10-14 10:08 - 00146952 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\Partition.dll

2014-11-02 10:29 - 2014-10-14 09:51 - 00050184 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\FileSystemAnalyser.dll

2014-11-02 10:29 - 2014-10-14 09:50 - 00061960 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\FATFileSystemAnalyser.dll

2014-11-02 10:29 - 2014-10-14 09:42 - 00089608 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\Common.dll

2014-11-02 10:29 - 2014-10-14 10:07 - 00056328 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\NTFSFileSystemAnalyser.dll

2011-03-04 12:02 - 2011-03-04 12:02 - 02121728 _____ () C:\Program Files (x86)\Common Files\LightScribe\QtCore4.dll

2011-03-04 12:02 - 2011-03-04 12:02 - 07745536 _____ () C:\Program Files (x86)\Common Files\LightScribe\QtGui4.dll

2011-03-04 12:02 - 2011-03-04 12:02 - 00135168 _____ () C:\Program Files (x86)\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll

2014-11-02 10:29 - 2014-10-14 10:11 - 00223752 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\SmartBackup.dll

2014-12-31 23:29 - 2014-12-31 23:29 - 00012800 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocr4C3B.tmp\lib\ruby\1.9.1\i386-mingw32\enc\encdb.so

2014-12-31 23:29 - 2014-12-31 23:29 - 00009728 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocr4C3B.tmp\lib\ruby\1.9.1\i386-mingw32\enc\iso_8859_1.so

2014-12-31 23:29 - 2014-12-31 23:29 - 00014848 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocr4C3B.tmp\lib\ruby\1.9.1\i386-mingw32\enc\trans\transdb.so

2014-12-31 23:29 - 2014-12-31 23:29 - 00094208 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocr4C3B.tmp\src\rgloader\rgloader193.mswin.so

2014-12-31 23:29 - 2014-12-31 23:29 - 00009216 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocr4C3B.tmp\lib\ruby\1.9.1\i386-mingw32\etc.so

2014-12-31 23:29 - 2014-12-31 23:29 - 00094208 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocr4C3B.tmp\lib\ruby\site_ruby\1.9.1\rgloader\rgloader193.mswin.so

2014-12-31 23:29 - 2014-12-31 23:29 - 00126976 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocr4C3B.tmp\lib\ruby\1.9.1\i386-mingw32\win32ole.so

2014-12-31 23:29 - 2014-12-31 23:29 - 00087552 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocr4C3B.tmp\lib\ruby\1.9.1\i386-mingw32\dl.so

2014-12-31 23:29 - 2014-12-31 23:29 - 00016384 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocr4C3B.tmp\lib\ruby\1.9.1\i386-mingw32\fiddle.so

2014-12-31 23:29 - 2014-12-31 23:29 - 00127316 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocr4C3B.tmp\bin\libffi-6.dll

2014-12-31 23:29 - 2014-12-31 23:29 - 00008704 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocr4C3B.tmp\lib\ruby\1.9.1\i386-mingw32\enc\utf_16le.so

2014-12-31 23:29 - 2014-12-31 23:29 - 00013312 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocr4C3B.tmp\lib\ruby\1.9.1\i386-mingw32\enc\trans\utf_16_32.so

2014-12-31 23:29 - 2014-12-31 23:29 - 00095744 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocr4C3B.tmp\lib\ruby\1.9.1\i386-mingw32\enc\trans\single_byte.so

2014-12-31 23:29 - 2014-12-31 23:29 - 00026624 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocr4C3B.tmp\lib\ruby\gems\1.9.1\gems\win32-api-1.5.0-universal-mingw32\lib\win32\ruby19\win32\api.so

2014-07-20 11:55 - 2013-11-19 21:34 - 00152576 _____ () C:\Program Files (x86)\Remote Mouse\FileS.dll

2013-12-15 12:12 - 2014-02-28 17:49 - 09666864 _____ () D:\Program Files (x86)\WISO\Steuersoftware 2014\wgui14.dll

2013-12-15 12:12 - 2014-02-28 17:48 - 00035120 _____ () D:\Program Files (x86)\WISO\Steuersoftware 2014\rsdcom48.dll

2013-12-15 12:12 - 2014-02-28 17:48 - 00309040 _____ () D:\Program Files (x86)\WISO\Steuersoftware 2014\rscorewinapi48.dll

2013-12-15 12:12 - 2014-02-28 17:48 - 00321840 _____ () D:\Program Files (x86)\WISO\Steuersoftware 2014\rsguiwinapi48.dll

2013-12-15 12:12 - 2014-02-28 17:48 - 03786544 _____ () D:\Program Files (x86)\WISO\Steuersoftware 2014\wcore14.dll

2013-12-15 12:12 - 2014-02-28 17:48 - 00136496 _____ () D:\Program Files (x86)\WISO\Steuersoftware 2014\rsodbc48.dll

2013-12-15 12:12 - 2014-02-28 17:49 - 02674480 _____ () D:\Program Files (x86)\WISO\Steuersoftware 2014\wfvie14.dll

2013-12-15 12:12 - 2014-02-28 17:48 - 01982256 _____ () D:\Program Files (x86)\WISO\Steuersoftware 2014\wsteu14.dll

2013-12-15 12:12 - 2014-02-28 17:48 - 01915184 _____ () D:\Program Files (x86)\WISO\Steuersoftware 2014\wreli14.dll

2013-12-15 12:12 - 2014-03-03 10:46 - 04329776 _____ () D:\Program Files (x86)\WISO\Steuersoftware 2014\wauff14.dll

2013-12-15 12:12 - 2014-02-11 11:53 - 01043456 _____ () D:\Program Files (x86)\WISO\Steuersoftware 2014\clucene-core.dll

2013-12-15 12:12 - 2014-02-11 11:53 - 00094720 _____ () D:\Program Files (x86)\WISO\Steuersoftware 2014\clucene-shared.dll

2013-12-15 12:12 - 2014-02-11 11:53 - 00250368 _____ () D:\Program Files (x86)\WISO\Steuersoftware 2014\clucene-contribs-lib.dll

2013-12-15 12:12 - 2014-03-03 10:46 - 01512752 _____ () D:\Program Files (x86)\WISO\Steuersoftware 2014\wmain14.dll

2013-12-15 12:12 - 2014-02-28 17:49 - 05099312 _____ () D:\Program Files (x86)\WISO\Steuersoftware 2014\wbae114.dll

2013-12-15 12:12 - 2014-02-28 17:49 - 01690416 _____ () D:\Program Files (x86)\WISO\Steuersoftware 2014\wbae214.dll

2013-12-15 12:12 - 2014-02-28 17:49 - 01801008 _____ () D:\Program Files (x86)\WISO\Steuersoftware 2014\wbae314.dll

2013-12-15 12:12 - 2014-02-28 17:49 - 01627952 _____ () D:\Program Files (x86)\WISO\Steuersoftware 2014\wbae414.dll

2013-12-15 12:12 - 2014-02-28 17:49 - 01115440 _____ () D:\Program Files (x86)\WISO\Steuersoftware 2014\whau114.dll

2013-12-15 12:12 - 2014-02-28 17:49 - 01322288 _____ () D:\Program Files (x86)\WISO\Steuersoftware 2014\whau214.dll

2013-12-15 12:12 - 2014-02-28 17:49 - 01245488 _____ () D:\Program Files (x86)\WISO\Steuersoftware 2014\wwerb14.dll

2013-12-15 12:12 - 2014-02-28 17:50 - 07319344 _____ () D:\Program Files (x86)\WISO\Steuersoftware 2014\wkont14.dll

2013-12-15 12:12 - 2014-02-28 17:49 - 01277232 _____ () D:\Program Files (x86)\WISO\Steuersoftware 2014\wimp14.dll

2013-12-15 12:12 - 2014-02-28 17:49 - 01330480 _____ () D:\Program Files (x86)\WISO\Steuersoftware 2014\wfabu14.dll

2014-12-31 23:29 - 2014-12-31 23:29 - 00012800 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocr6EA9.tmp\lib\ruby\1.9.1\i386-mingw32\enc\encdb.so

2014-12-31 23:29 - 2014-12-31 23:29 - 00009728 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocr6EA9.tmp\lib\ruby\1.9.1\i386-mingw32\enc\iso_8859_1.so

2014-12-31 23:29 - 2014-12-31 23:29 - 00014848 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocr6EA9.tmp\lib\ruby\1.9.1\i386-mingw32\enc\trans\transdb.so

2014-12-31 23:29 - 2014-12-31 23:29 - 00094208 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocr6EA9.tmp\src\rgloader\rgloader193.mswin.so

2014-12-31 23:29 - 2014-12-31 23:29 - 00094208 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocr6EA9.tmp\lib\ruby\site_ruby\1.9.1\rgloader\rgloader193.mswin.so

2014-12-31 23:29 - 2014-12-31 23:29 - 00118784 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocr6EA9.tmp\lib\ruby\1.9.1\i386-mingw32\socket.so

2014-12-31 23:29 - 2014-12-31 23:29 - 00069120 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocr6EA9.tmp\lib\ruby\1.9.1\i386-mingw32\zlib.so

2014-12-31 23:29 - 2014-12-31 23:29 - 00083968 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocr6EA9.tmp\bin\zlib1.dll

2014-12-31 23:29 - 2014-12-31 23:29 - 00026624 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocr6EA9.tmp\lib\ruby\1.9.1\i386-mingw32\stringio.so

2014-12-31 23:29 - 2014-12-31 23:29 - 00275968 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocr6EA9.tmp\lib\ruby\1.9.1\i386-mingw32\openssl.so

2014-12-31 23:29 - 2014-12-31 23:29 - 00015360 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocr6EA9.tmp\lib\ruby\1.9.1\i386-mingw32\digest.so

2014-12-31 23:29 - 2014-12-31 23:29 - 00008192 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocr6EA9.tmp\lib\ruby\1.9.1\i386-mingw32\fcntl.so

2014-12-31 23:29 - 2014-12-31 23:29 - 00009216 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocr6EA9.tmp\lib\ruby\1.9.1\i386-mingw32\etc.so

2014-12-31 23:29 - 2014-12-31 23:29 - 00023552 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocr6EA9.tmp\lib\ruby\1.9.1\i386-mingw32\json\ext\parser.so

2014-12-31 23:29 - 2014-12-31 23:29 - 00008704 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocr6EA9.tmp\lib\ruby\1.9.1\i386-mingw32\enc\utf_16be.so

2014-12-31 23:29 - 2014-12-31 23:29 - 00008704 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocr6EA9.tmp\lib\ruby\1.9.1\i386-mingw32\enc\utf_16le.so

2014-12-31 23:29 - 2014-12-31 23:29 - 00008704 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocr6EA9.tmp\lib\ruby\1.9.1\i386-mingw32\enc\utf_32be.so

2014-12-31 23:29 - 2014-12-31 23:29 - 00008704 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocr6EA9.tmp\lib\ruby\1.9.1\i386-mingw32\enc\utf_32le.so

2014-12-31 23:29 - 2014-12-31 23:29 - 00036352 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocr6EA9.tmp\lib\ruby\1.9.1\i386-mingw32\json\ext\generator.so

2014-12-31 23:29 - 2014-12-31 23:29 - 00126976 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocr6EA9.tmp\lib\ruby\1.9.1\i386-mingw32\win32ole.so

2014-12-31 23:29 - 2014-12-31 23:29 - 00087552 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocr6EA9.tmp\lib\ruby\1.9.1\i386-mingw32\dl.so

2014-12-31 23:29 - 2014-12-31 23:29 - 00016384 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocr6EA9.tmp\lib\ruby\1.9.1\i386-mingw32\fiddle.so

2014-12-31 23:29 - 2014-12-31 23:29 - 00127316 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocr6EA9.tmp\bin\libffi-6.dll

2014-12-31 23:29 - 2014-12-31 23:29 - 00013312 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocr6EA9.tmp\lib\ruby\1.9.1\i386-mingw32\enc\trans\utf_16_32.so

2014-12-31 23:29 - 2014-12-31 23:29 - 00095744 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocr6EA9.tmp\lib\ruby\1.9.1\i386-mingw32\enc\trans\single_byte.so

2014-12-31 23:29 - 2014-12-31 23:29 - 00026624 _____ () C:\Users\Hans Desktop PC\AppData\Local\Temp\ocr6EA9.tmp\lib\ruby\gems\1.9.1\gems\win32-api-1.5.0-universal-mingw32\lib\win32\ruby19\win32\api.so

2014-12-22 16:22 - 2014-12-24 20:04 - 00815104 _____ () C:\Program Files\pia_manager\pia_tray\runtime\1.2.0.RC6d\khost.dll

2014-12-22 16:22 - 2014-12-24 20:04 - 01198592 _____ () C:\Program Files\pia_manager\pia_tray\runtime\1.2.0.RC6d\PocoFoundation.dll

2014-12-22 16:22 - 2014-12-24 20:04 - 00745472 _____ () C:\Program Files\pia_manager\pia_tray\runtime\1.2.0.RC6d\CFLite.dll

2014-12-22 16:22 - 2014-12-24 20:04 - 00059904 _____ () C:\Program Files\pia_manager\pia_tray\runtime\1.2.0.RC6d\zlib1.dll

2014-12-22 16:22 - 2014-12-24 20:04 - 01234944 _____ () C:\Program Files\pia_manager\pia_tray\runtime\1.2.0.RC6d\libxml2.dll

2014-12-22 16:22 - 2014-12-24 20:04 - 00200704 _____ () C:\Program Files\pia_manager\pia_tray\modules\tiapp\1.2.0.RC6d\tiappmodule.dll

2014-12-22 16:22 - 2014-12-24 20:04 - 00290816 _____ () C:\Program Files\pia_manager\pia_tray\runtime\1.2.0.RC6d\PocoUtil.dll

2014-12-22 16:22 - 2014-12-24 20:04 - 00511488 _____ () C:\Program Files\pia_manager\pia_tray\runtime\1.2.0.RC6d\PocoXML.dll

2014-12-22 16:22 - 2014-12-24 20:04 - 00180224 _____ () C:\Program Files\pia_manager\pia_tray\modules\tifilesystem\1.2.0.RC6d\tifilesystemmodule.dll

2014-12-22 16:22 - 2014-12-24 20:04 - 00344064 _____ () C:\Program Files\pia_manager\pia_tray\modules\tiui\1.2.0.RC6d\tiuimodule.dll

2014-12-22 16:22 - 2014-12-24 20:04 - 00368640 _____ () C:\Program Files\pia_manager\pia_tray\modules\tinetwork\1.2.0.RC6d\tinetworkmodule.dll

2014-12-22 16:22 - 2014-12-24 20:04 - 00642048 _____ () C:\Program Files\pia_manager\pia_tray\runtime\1.2.0.RC6d\PocoNet.dll

2014-12-22 16:22 - 2014-12-24 20:04 - 00217088 _____ () C:\Program Files\pia_manager\pia_tray\modules\tiprocess\1.2.0.RC6d\tiprocessmodule.dll

2013-03-06 11:13 - 2013-03-06 11:13 - 00611328 _____ () C:\Program Files (x86)\Synology\Assistant\qwt5.dll

2009-02-26 13:46 - 2009-02-26 13:46 - 00064344 _____ () C:\Program Files (x86)\Microsoft Office\Office12\ADDINS\ColleagueImport.dll

2011-06-22 11:46 - 2011-06-22 11:46 - 00434016 _____ () C:\Program Files (x86)\Microsoft Office\Office12\ADDINS\UmOutlookAddin.dll

2013-07-10 18:07 - 2013-07-10 18:07 - 00756888 _____ () C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\MSPTLS.DLL
 

==================== Alternate Data Streams (whitelisted) =========
 

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
 
 

==================== Safe Mode (whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
 

==================== EXE Association (whitelisted) =============
 

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
 
 

==================== MSCONFIG/TASK MANAGER disabled items =========
 

(Currently there is no automatic fix for this section.)
 
 

========================= Accounts: ==========================
 

Administrator (S-1-5-21-2081905457-2083805786-3871413059-500 - Administrator - Disabled)

ETB User (S-1-5-21-2081905457-2083805786-3871413059-1004 - Administrator - Enabled)

Gast (S-1-5-21-2081905457-2083805786-3871413059-501 - Limited - Disabled)

Hans (S-1-5-21-2081905457-2083805786-3871413059-1003 - Limited - Enabled) => C:\Users\Hans

Hans Desktop PC (S-1-5-21-2081905457-2083805786-3871413059-1001 - Administrator - Enabled) => C:\Users\Hans Desktop PC

HomeGroupUser$ (S-1-5-21-2081905457-2083805786-3871413059-1002 - Limited - Enabled)
 

==================== Faulty Device Manager Devices =============
 

Name: Standardtastatur (PS/2)

Description: Standardtastatur (PS/2)

Class Guid: {4d36e96b-e325-11ce-bfc1-08002be10318}

Manufacturer: (Standardtastaturen)

Service: i8042prt

Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)

Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.

Devices stay in this state if they have been prepared for removal.

After you remove the device, this error disappears.Remove the device, and this error should be resolved.
 

Name: Microsoft PS/2-Maus

Description: Microsoft PS/2-Maus

Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318}

Manufacturer: Microsoft

Service: i8042prt

Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)

Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.

Devices stay in this state if they have been prepared for removal.

After you remove the device, this error disappears.Remove the device, and this error should be resolved.
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (01/01/2015 00:51:53 PM) (Source: SideBySide) (EventID: 80) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in

Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit

einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 

Error: (12/31/2014 11:40:10 PM) (Source: SideBySide) (EventID: 80) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in

Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit

einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 

Error: (12/31/2014 11:40:05 PM) (Source: SideBySide) (EventID: 80) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in

Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit

einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 

Error: (12/31/2014 11:40:04 PM) (Source: SideBySide) (EventID: 80) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in

Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit

einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 

Error: (12/31/2014 11:39:55 PM) (Source: SideBySide) (EventID: 80) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in

Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit

einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 

Error: (12/31/2014 11:30:09 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (12/31/2014 11:12:35 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
 

System errors:

=============

Error: (12/31/2014 11:28:58 PM) (Source: VDS Basic Provider) (EventID: 1) (User: )

Description: Unerwarteter Fehler. Fehlercode: D@01010004
 

Error: (12/31/2014 11:28:58 PM) (Source: VDS Basic Provider) (EventID: 1) (User: )

Description: Unerwarteter Fehler. Fehlercode: D@01010004
 

Error: (12/31/2014 11:28:58 PM) (Source: VDS Basic Provider) (EventID: 1) (User: )

Description: Unerwarteter Fehler. Fehlercode: D@01010004
 

Error: (12/31/2014 11:28:58 PM) (Source: VDS Basic Provider) (EventID: 1) (User: )

Description: Unerwarteter Fehler. Fehlercode: D@01010004
 

Error: (12/31/2014 11:28:58 PM) (Source: VDS Basic Provider) (EventID: 1) (User: )

Description: Unerwarteter Fehler. Fehlercode: D@01010004
 

Error: (12/31/2014 11:28:58 PM) (Source: VDS Basic Provider) (EventID: 1) (User: )

Description: Unerwarteter Fehler. Fehlercode: D@01010004
 

Error: (12/31/2014 11:28:35 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Der Dienst "AVM FRITZ!Powerline Service" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%1053
 

Error: (12/31/2014 11:28:35 PM) (Source: Service Control Manager) (EventID: 7009) (User: )

Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst AVM FRITZ!Powerline Service erreicht.
 

Error: (12/31/2014 11:28:29 PM) (Source: volmgr) (EventID: 45) (User: )

Description: Das System konnte den Treiber für das Speicherabbild nicht laden.
 

Error: (12/31/2014 11:28:33 PM) (Source: EventLog) (EventID: 6008) (User: )

Description: Das System wurde zuvor am ‎31.‎12.‎2014 um 23:26:44 unerwartet heruntergefahren.
 
 

Microsoft Office Sessions:

=========================
 

CodeIntegrity Errors:

===================================

  Date: 2014-12-31 17:28:59.636

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-12-31 17:28:59.608

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 
 

==================== Memory info =========================== 
 

Processor: Intel(R) Core(TM) i7 CPU 920 @ 2.67GHz

Percentage of memory in use: 55%

Total physical RAM: 6135.17 MB

Available physical RAM: 2738.3 MB

Total Pagefile: 12268.52 MB

Available Pagefile: 7736.99 MB

Total Virtual: 8192 MB

Available Virtual: 8191.84 MB
 

==================== Drives ================================
 

Drive c: () (Fixed) (Total:119.14 GB) (Free:33.83 GB) NTFS ==>[Drive with boot components (obtained from BCD)]

Drive d: (Volume) (Fixed) (Total:1863.01 GB) (Free:163.61 GB) NTFS

Drive e: (SYSTEM RESERVED) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]

Drive f: (Volume) (Fixed) (Total:2794.39 GB) (Free:1413.24 GB) NTFS

Drive g: (Acer) (Fixed) (Total:691.95 GB) (Free:389.9 GB) NTFS

Drive h: (DATA) (Fixed) (Total:692.21 GB) (Free:455.15 GB) NTFS

Drive z: () (Network) (Total:8238.63 GB) (Free:5359.6 GB) 
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (Size: 119.2 GB) (Disk ID: 42BEBAC4)

Partition 1: (Not Active) - (Size=100 MB) - (Type=27)

Partition 2: (Active) - (Size=119.1 GB) - (Type=07 NTFS)
 

========================================================

Disk: 1 (Size: 1397.3 GB) (Disk ID: F41CCCF5)

Partition 1: (Not Active) - (Size=13 GB) - (Type=27)

Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=692 GB) - (Type=07 NTFS)

Partition 4: (Not Active) - (Size=692.2 GB) - (Type=07 NTFS)
 

========================================================

Disk: 2 (Size: 2794.5 GB) (Disk ID: 1100DA85)
 

Partition: GPT Partition Type.
 

========================================================

Disk: 3 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: 02F717BE)

Partition 1: (Not Active) - (Size=1863 GB) - (Type=07 NTFS)
 

==================== End Of Log ============================

So das war es fürs erste, oder?
Soll ich die erkannten Dateien von Esetonline löschen?

Gruß und gutes neues Jahr wünsche ich!
Gusti

Funde auf D, F, G und H von Hand löschen. Der ganze Download Kram und die Backups.

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

C:\Users\Hans Desktop PC\Downloads\MyPhoneExplorer_1.8.5.exe
 

C:\Users\Hans Desktop PC\Downloads\PDFCreatorSetup.exe

Emptytemp:

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Fertig :)

Die Reihenfolge ist hier entscheidend.

Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun :)

Hier noch ein paar Tipps zur Absicherung deines Systems.

Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
Windows Updates
- Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
- Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
Gehe sicher das die automatischen Updates aktiviert sind.
Software Updates
Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti- Viren Software

Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

MalwareBytes Anti Malware
Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
Ein Tutorial zur Verwendung findest Du hier.
WinPatrol
Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

SpywareBlaster
Eine kurze Einführung findest du Hier
MVPs hosts file
Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
WOT (Web of trust)
Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

Opera
Mozilla Firefox.
- Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
- NoScript
  Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
- AdblockPlus
  Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
  Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )

Don'ts

Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

Hier das Fixlog:

Code:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 28-12-2014

Ran by Hans Desktop PC at 2015-01-01 13:29:19 Run:2

Running from C:\Users\Hans Desktop PC\Desktop

Loaded Profiles: Hans Desktop PC & Hans (Available profiles: Hans Desktop PC & Hans)

Boot Mode: Normal

==============================================
 

Content of fixlist:

*****************

C:\Users\Hans Desktop PC\Downloads\MyPhoneExplorer_1.8.5.exe
 

C:\Users\Hans Desktop PC\Downloads\PDFCreatorSetup.exe

Emptytemp:

         

*****************
 

C:\Users\Hans Desktop PC\Downloads\MyPhoneExplorer_1.8.5.exe => Moved successfully.

C:\Users\Hans Desktop PC\Downloads\PDFCreatorSetup.exe => Moved successfully.

EmptyTemp: => Removed 34.5 MB temporary data.
 
 

The system needed a reboot. 
 

==== End of Fixlog 13:31:20 ====

Bin ich jetzt fertig und mein PC ist wieder sauber. Kann ich irgendwie mit eset online die Bedrohungen "automatisch" löschen lassen ohne nochmal einen Scan durchlaufen zu lassen?
Die unteren Anmerkungen sind zum deinstallieren der verwendeten Software. Ist das unbedingt erforderlich?

Gruß und ein herzliches :dankeschoen:
Gusti

Zitat:

Ist das unbedingt erforderlich?

Ja, warum soll man den Datenmüll behalten? :)