Trojaner-Board - Firefox: Probleme mit Werbung +Script

Hilfe bitte!!
Ich habe ein Riesenproblem und zwar:

Kaum öffne ich Firefox habe ich gleich mehrere Dinge die mir das surfen erschweren und dies sind folgende:

Da sind mehrere tabs mit Werbung und Gewinnspielen etc., dasselbe auch wenn ich irgendwo auf einer Seite hinklicke.

hxxp://s1185.photobucket.com/user/lexib1/media/Malware%20Problem/Newtab1.png.html?sort=3&o=3

Des weiteren sind manche Wörter blau und unterlegt und wenn ich darauf klicke komme ich zu ebensolchen Seiten.

hxxp://s1185.photobucket.com/user/lexib1/media/Malware%20Problem/BlaueWorte.png.html?sort=3&o=0

Es gibt ständig kleine Ads auf der Seite mit z.B. ebay oder amazon die man zwar wegklicken kann aber sie kommen immer wieder wenn die Seite neu lädt.

hxxp://s1185.photobucket.com/user/lexib1/media/Malware%20Problem/KleineAds.png.html?sort=3&o=1

Es öffnen sich auch schon mal tabs mit Java Updates oder Firefox Updates aber inzwischen wie ich nicht mehr welchem ich wirklich trauen kann und welchem nicht.

hxxp://s1185.photobucket.com/user/lexib1/media/Malware%20Problem/Firefoxoutdated.png.html?sort=3&o=2

Firefox ist zudem auch langsamer geworden.

Ich wäre super dankbar wenn ihr mir ganz schnell helfen könnt da meine Nerven schon arg strapaziert sind.

Danke im Voraus und ich finde es absolut genial das es diese Seite mit Leuten wie euch gibt!!

Lg Lexi

Log Files:

Defogger:

Code:

defogger_disable by jpshortstuff (23.02.10.1)

Log created at 20:54 on 18/01/2015 (Fred)
 

Checking for autostart values...

HKCU\~\Run values retrieved.

HKLM\~\Run values retrieved.
 

Checking for services/drivers...
 
 

-=E.O.F=-

FRST.txt

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 18-01-2015 01

Ran by Fred (administrator) on FRED-PC on 18-01-2015 19:45:18

Running from C:\Users\Fred\Downloads

Loaded Profiles: Fred (Available profiles: Fred)

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 10 (Default browser: FF)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(AMD) C:\Windows\System32\atiesrxx.exe

(AMD) C:\Windows\System32\atieclxx.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(LSI Corporation) C:\Program Files\LSI SoftModem\agr64svc.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(APN LLC.) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe

(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GregHSRW.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe

(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe

(Acer Incorporated) C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe

(Acer) C:\Program Files\Acer\Acer Updater\UpdaterService.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe

(AlcorMicro Co., Ltd.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe

(Egis Technology Inc.) C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

() C:\Windows\PLFSetI.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe

(Electronic Arts) C:\Program Files (x86)\Origin\Origin.exe

(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(ICQ) C:\Users\Fred\AppData\Roaming\ICQM\icq.exe

(Tango Inc.) C:\Program Files (x86)\Tango\Tango.exe

(Acer Incorporated) C:\Program Files (x86)\Acer\Acer VCM\AcerVCM.exe

(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe

(Egis Technology Inc.) C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe

(CyberLink Corp.) C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe

(Acer Corp.) C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe

(CyberLink Corp.) C:\Program Files (x86)\Cyberlink\PowerDVD10\PDVD10Serv.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe

(APN) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

(Search Protect) C:\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox 4.0 Beta 4\firefox.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox 4.0 Beta 4\plugin-container.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_257.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_257.exe

(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE

(Microsoft Corporation) C:\Windows\splwow64.exe

(Microsoft Corporation) C:\Windows\System32\mspaint.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [AmIcoSinglun64] => C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [323072 2009-07-22] (AlcorMicro Co., Ltd.)

HKLM\...\Run: [IAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-05] (Intel Corporation)

HKLM\...\Run: [mwlDaemon] => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe [349480 2009-09-11] (Egis Technology Inc.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8312352 2009-10-29] (Realtek Semiconductor)

HKLM\...\Run: [PLFSetI] => C:\Windows\PLFSetI.exe [200704 2009-11-20] ()

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1842472 2009-09-18] (Synaptics Incorporated)

HKLM\...\Run: [Acer ePower Management] => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [823840 2009-09-30] (Acer Incorporated)

HKLM-x32\...\Run: [BackupManagerTray] => C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe [261888 2009-09-25] (NewTech Infosystems, Inc.)

HKLM-x32\...\Run: [EgisTecLiveUpdate] => C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe [199464 2009-08-04] (Egis Technology Inc.)

HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-12-09] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [1094736 2009-11-02] (Dritek System Inc.)

HKLM-x32\...\Run: [ArcadeDeluxeAgent] => C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe [419112 2009-10-29] (CyberLink Corp.)

HKLM-x32\...\Run: [PlayMovie] => C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe [181480 2009-11-12] (Acer Corp.)

HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [87336 2010-02-02] (CyberLink Corp.)

HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)

HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2012-10-25] (Apple Inc.)

HKLM-x32\...\Run: [] => [X]

HKLM-x32\...\Run: [ApnUpdater] => C:\Program Files (x86)\Ask.com\Updater\Updater.exe [1648264 2013-04-30] (Ask)

HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [702768 2014-12-16] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-08-16] (Apple Inc.)

HKLM-x32\...\Run: [ApnTBMon] => C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [2039192 2014-11-24] (APN)

HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [126200 2014-11-20] (Avira Operations GmbH & Co. KG)

HKU\S-1-5-21-432033561-2934589633-1803115819-1001\...\Run: [ImpulseFastStart] => C:\Program Files (x86)\Stardock\Impulse\Impulse.exe [1717616 2008-10-14] (Stardock Corporation)

HKU\S-1-5-21-432033561-2934589633-1803115819-1001\...\Run: [PureSync] => "C:\Program Files (x86)\PureSync\PureSyncTray.exe"

HKU\S-1-5-21-432033561-2934589633-1803115819-1001\...\Run: [EADM] => C:\Program Files (x86)\Origin\Origin.exe [3618648 2014-12-29] (Electronic Arts)

HKU\S-1-5-21-432033561-2934589633-1803115819-1001\...\Run: [swg] => C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2009-11-05] (Google Inc.)

HKU\S-1-5-21-432033561-2934589633-1803115819-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [21444224 2014-05-08] (Skype Technologies S.A.)

HKU\S-1-5-21-432033561-2934589633-1803115819-1001\...\Run: [icq] => C:\Users\Fred\AppData\Roaming\ICQM\icq.exe [35239432 2014-11-07] (ICQ)

HKU\S-1-5-21-432033561-2934589633-1803115819-1001\...\Run: [Tango] => C:\Program Files (x86)\Tango\Tango.exe [13489992 2011-11-04] (Tango Inc.)

HKU\S-1-5-21-432033561-2934589633-1803115819-1001\...\MountPoints2: {0e86b2b0-26ef-11df-b21e-806e6f6e6963} - D:\Autorun.exe

HKU\S-1-5-21-432033561-2934589633-1803115819-1001\...\MountPoints2: {292694cd-07a6-11e2-93f5-00262d91798f} - E:\Startme.exe

HKU\S-1-5-21-432033561-2934589633-1803115819-1001\...\MountPoints2: {36eeecac-8451-11e0-bfec-00262d91798f} - E:\AutoRun.exe

HKU\S-1-5-21-432033561-2934589633-1803115819-1001\...\MountPoints2: {44fb2512-e2af-11df-891d-00262d91798f} - E:\AutoRun.exe

HKU\S-1-5-21-432033561-2934589633-1803115819-1001\...\MountPoints2: {a6d15461-d612-11df-b1e6-00262d91798f} - E:\AutoRun.exe

HKU\S-1-5-21-432033561-2934589633-1803115819-1001\...\MountPoints2: {a6d15485-d612-11df-b1e6-00262d91798f} - E:\AutoRun.exe

HKU\S-1-5-21-432033561-2934589633-1803115819-1001\...\MountPoints2: {b718c7af-8f2f-11e3-8aa0-00262d91798f} - E:\LGAutoRun.exe

AppInit_DLLs: C:\PROGRA~2\SearchProtect\SearchProtect\bin\VC64Loader.dll => C:\Program Files (x86)\SearchProtect\SearchProtect\bin\VC64Loader.dll [233280 2014-11-10] (Search Protect)

AppInit_DLLs-x32: C:\PROGRA~2\SearchProtect\SearchProtect\bin\VC32Loader.dll => C:\Program Files (x86)\SearchProtect\SearchProtect\bin\VC32Loader.dll [188224 2014-11-10] (Search Protect)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Acer VCM.lnk

ShortcutTarget: Acer VCM.lnk -> C:\Program Files (x86)\Acer\Acer VCM\AcerVCM.exe (Acer Incorporated)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk

ShortcutTarget: Adobe Gamma Loader.lnk -> C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)

ShellIconOverlayIdentifiers: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x64\psdprotect.dll (Egis Technology Inc.)

ShellIconOverlayIdentifiers-x32: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\psdprotect.dll (Egis Technology Inc.)
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = about:blank

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank

HKU\S-1-5-21-432033561-2934589633-1803115819-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com/?ctid=CT3319434&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=4&UP=SPC029EA41-EE54-4506-B60F-1447AB21B9BE&SSPV=

HKU\S-1-5-21-432033561-2934589633-1803115819-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.sweet-page.com/?type=hp&ts=1412980467&from=sof&uid=WDCXWD6400BEVT-22A0RT0_WD-WX71A106919369193

HKU\S-1-5-21-432033561-2934589633-1803115819-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.giga.de/androidnews/

URLSearchHook: HKU\S-1-5-21-432033561-2934589633-1803115819-1001 - UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)

StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.sweet-page.com/?type=sc&ts=1412980467&from=sof&uid=WDCXWD6400BEVT-22A0RT0_WD-WX71A106919369193

SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = 

SearchScopes: HKLM-x32 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = 

SearchScopes: HKLM-x32 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW

SearchScopes: HKU\S-1-5-21-432033561-2934589633-1803115819-1001 -> DefaultScope {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://search.conduit.com/Results.aspx?ctid=CT3319434&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SPC029EA41-EE54-4506-B60F-1447AB21B9BE&q={searchTerms}&SSPV=

SearchScopes: HKU\S-1-5-21-432033561-2934589633-1803115819-1001 -> {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://search.conduit.com/Results.aspx?ctid=CT3319434&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SPC029EA41-EE54-4506-B60F-1447AB21B9BE&q={searchTerms}&SSPV=

SearchScopes: HKU\S-1-5-21-432033561-2934589633-1803115819-1001 -> {09DBF6C9-48D6-4340-867C-35A386BB8580} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10263&src=kw&q={searchTerms}&locale=de_AT&apn_ptnrs=^AGU&apn_dtid=^YYYYYY^YY^AT&apn_uid=35f1a1e1-3349-4081-ab71-dc00c3f2e2f0&apn_sauid=66298A1B-F603-4734-AD33-CC5533F2B3DF

SearchScopes: HKU\S-1-5-21-432033561-2934589633-1803115819-1001 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=vc_trans_8140&type=foxysecurity

SearchScopes: HKU\S-1-5-21-432033561-2934589633-1803115819-1001 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_deAT383

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

BHO: DVDVideoSoft IE Extension -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll (DVDVideoSoft Ltd.)

BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation)

BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

BHO-x32: Ask Toolbar -> {D4027C7F-154A-4066-A1AD-4243D8127440} -> C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)

BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation)

BHO-x32: DVDVideoSoft IE Extension -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.)

Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

Toolbar: HKLM-x32 - Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)

Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

Toolbar: HKU\S-1-5-21-432033561-2934589633-1803115819-1001 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

Toolbar: HKU\S-1-5-21-432033561-2934589633-1803115819-1001 -> No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} -  No File

DPF: HKLM {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} hxxp://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection2.cab

DPF: HKLM-x32 {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework//microsoft/wrc32.ocx

Winsock: Catalog9 01 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)

Winsock: Catalog9 02 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)

Winsock: Catalog9 03 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)

Winsock: Catalog9 04 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)

Winsock: Catalog9 05 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)

Winsock: Catalog9 06 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)

Winsock: Catalog9 07 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)

Winsock: Catalog9 08 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)

Winsock: Catalog9 19 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)

Winsock: Catalog9-x64 01 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll [523344] (Avira Operations GmbH & Co. KG)

Winsock: Catalog9-x64 02 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll [523344] (Avira Operations GmbH & Co. KG)

Winsock: Catalog9-x64 03 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll [523344] (Avira Operations GmbH & Co. KG)

Winsock: Catalog9-x64 04 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll [523344] (Avira Operations GmbH & Co. KG)

Winsock: Catalog9-x64 05 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll [523344] (Avira Operations GmbH & Co. KG)

Winsock: Catalog9-x64 06 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll [523344] (Avira Operations GmbH & Co. KG)

Winsock: Catalog9-x64 07 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll [523344] (Avira Operations GmbH & Co. KG)

Winsock: Catalog9-x64 08 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll [523344] (Avira Operations GmbH & Co. KG)

Winsock: Catalog9-x64 19 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll [523344] (Avira Operations GmbH & Co. KG)

Tcpip\Parameters: [DhcpNameServer] 195.34.133.21 212.186.211.21
 

FireFox:

========

FF ProfilePath: C:\Users\Fred\AppData\Roaming\Mozilla\Firefox\Profiles\ppc2ynj6.default

FF NewTab: chrome://quick_start/content/index.html

FF SearchEngineOrder.1: Ask.com

FF Homepage: hxxp://www.search.ask.com/?tpid=ORJ-SPE&o=APN11409&pf=V7&trgb=FF&p2=%5EBBH%5EOSJ000%5EYY%5EAT&gct=hp&apn_ptnrs=BBH&apn_dtid=%5EOSJ000%5EYY%5EAT&apn_dbr=ff_32.0.3.5379&apn_uid=07A84C11-5816-449D-9E46-9872D7727E9A&itbv=12.18.0.82&doi=2014-11-01&psv=&pt=tb

FF NetworkProxy: "no_proxies_on", "*.local"

FF NetworkProxy: "type", 0

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_257.dll ()

FF Plugin: @microsoft.com/GENUINE -> disabled No File

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_257.dll ()

FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @playstation.com/PsndlCheck,version=1.00 -> C:\Program Files (x86)\Sony\PLAYSTATION Network Downloader\nppsndl.dll (Sony Computer Entertainment Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF user.js: detected! => C:\Users\Fred\AppData\Roaming\Mozilla\Firefox\Profiles\ppc2ynj6.default\user.js

FF SearchPlugin: C:\Users\Fred\AppData\Roaming\Mozilla\Firefox\Profiles\ppc2ynj6.default\searchplugins\ask-search.xml

FF SearchPlugin: C:\Users\Fred\AppData\Roaming\Mozilla\Firefox\Profiles\ppc2ynj6.default\searchplugins\askcom.xml

FF SearchPlugin: C:\Users\Fred\AppData\Roaming\Mozilla\Firefox\Profiles\ppc2ynj6.default\searchplugins\avira-safesearch.xml

FF SearchPlugin: C:\Users\Fred\AppData\Roaming\Mozilla\Firefox\Profiles\ppc2ynj6.default\searchplugins\trovi-search.xml

FF Extension: Avira Browser Safety - C:\Users\Fred\AppData\Roaming\Mozilla\Firefox\Profiles\ppc2ynj6.default\Extensions\abs@avira.com [2014-12-12]

FF Extension: Amazon-Icon - C:\Users\Fred\AppData\Roaming\Mozilla\Firefox\Profiles\ppc2ynj6.default\Extensions\amazon-icon@giga.de [2014-10-11]

FF Extension: Fast Start - C:\Users\Fred\AppData\Roaming\Mozilla\Firefox\Profiles\ppc2ynj6.default\Extensions\faststartff@gmail.com [2014-10-10]

FF Extension: Fox Sec 7 - C:\Users\Fred\AppData\Roaming\Mozilla\Firefox\Profiles\ppc2ynj6.default\Extensions\fx@foxysecureKDJJHVLSDUVFU.com [2014-10-11]

FF Extension: Avira SafeSearch - C:\Users\Fred\AppData\Roaming\Mozilla\Firefox\Profiles\ppc2ynj6.default\Extensions\safesearch@avira.com [2014-12-12]

FF Extension: SparPilot - Gutscheine &amp; mehr... - C:\Users\Fred\AppData\Roaming\Mozilla\Firefox\Profiles\ppc2ynj6.default\Extensions\sparpilot@sparpilot.com [2014-10-11]

FF Extension: Ask Toolbar - C:\Users\Fred\AppData\Roaming\Mozilla\Firefox\Profiles\ppc2ynj6.default\Extensions\toolbar@ask.com [2012-12-03]

FF Extension: Ex-Assistance-Pro - C:\Users\Fred\AppData\Roaming\Mozilla\Firefox\Profiles\ppc2ynj6.default\Extensions\{0dbda103-5b1e-4059-ac8f-15aeb3862327} [2015-01-13]

FF Extension: Advisor Lite - C:\Users\Fred\AppData\Roaming\Mozilla\Firefox\Profiles\ppc2ynj6.default\Extensions\{536296fd-0562-4b56-8f95-1a25c5ffc83f} [2014-10-10]

FF Extension: Test Pilot - C:\Users\Fred\AppData\Roaming\Mozilla\Firefox\Profiles\ppc2ynj6.default\Extensions\testpilot@labs.mozilla.com.xpi [2011-02-01]

FF Extension: Search App by Ask - C:\Users\Fred\AppData\Roaming\Mozilla\Firefox\Profiles\ppc2ynj6.default\Extensions\toolbar_ORJ-SPE@apn.ask.com.xpi [2014-10-10]

FF Extension: Speed Helper Pro - C:\Users\Fred\AppData\Roaming\Mozilla\Firefox\Profiles\ppc2ynj6.default\Extensions\{5bb77e51-6a94-46cc-9089-278110be0fdd}.xpi [2014-12-23]

FF Extension: {f30826b0-94ec-4c03-917b-27c345b7572e} - C:\Users\Fred\AppData\Roaming\Mozilla\Firefox\Profiles\ppc2ynj6.default\Extensions\{f30826b0-94ec-4c03-917b-27c345b7572e}.xpi [2014-12-14]

FF HKLM-x32\...\Firefox\Extensions: [faststartff@gmail.com] - C:\Users\Fred\AppData\Roaming\Mozilla\Firefox\Profiles\ppc2ynj6.default\extensions\faststartff@gmail.com

FF HKU\S-1-5-21-432033561-2934589633-1803115819-1001\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff

FF Extension: Download videos and MP3s from YouTube - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-02-06]

FF StartMenuInternet: FIREFOX.EXE - C:\Program Files (x86)\Mozilla Firefox 4.0 Beta 4\firefox.exe hxxp://www.sweet-page.com/?type=sc&ts=1412980467&from=sof&uid=WDCXWD6400BEVT-22A0RT0_WD-WX71A106919369193
 

Chrome: 

=======

CHR Profile: C:\Users\Fred\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Docs) - C:\Users\Fred\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-05-15]

CHR Extension: (Google Drive) - C:\Users\Fred\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-05-15]

CHR Extension: (YouTube) - C:\Users\Fred\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-05-15]

CHR Extension: (Google Search) - C:\Users\Fred\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-05-15]

CHR Extension: (Gmail) - C:\Users\Fred\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-05-15]

CHR HKU\S-1-5-21-432033561-2934589633-1803115819-1001\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\DVDVideoSoftBrowserExtension.crx [2014-02-06]

CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path

CHR HKLM-x32\...\Chrome\Extension: [ocbnpbkmjpgbdcgiflkgkpnkinifpgpj] - C:\Users\Fred\ChromeExtensions\ocbnpbkmjpgbdcgiflkgkpnkinifpgpj\amazon-icon-2.crx [2014-10-11]
 

==================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-12-16] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-12-16] (Avira Operations GmbH & Co. KG)

R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [992560 2014-12-16] (Avira Operations GmbH & Co. KG)

R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [166296 2014-10-30] (APN LLC.)

S2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [166192 2014-11-20] (Avira Operations GmbH & Co. KG)

R2 CltMngSvc; C:\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe [3056960 2014-11-10] (Search Protect)

S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]

S3 MWLService; C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [305448 2009-09-11] (Egis Technology Inc.)

S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [1903472 2014-12-29] (Electronic Arts)

R2 RS_Service; C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe [253952 2009-07-10] (Acer Incorporated) [File not signed]

S2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe [2100024 2013-08-30] (TuneUp Software)

R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-14] (Microsoft Corporation)

S3 aspnet_state; %SystemRoot%\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [X]
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2014-03-12] ()

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-14] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-10-14] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-12-09] (Avira Operations GmbH & Co. KG)

R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2014-03-12] ()

S3 s1039bus; C:\Windows\System32\DRIVERS\s1039bus.sys [127600 2010-03-15] (MCCI Corporation)

S3 s1039mdfl; C:\Windows\System32\DRIVERS\s1039mdfl.sys [19568 2010-03-15] (MCCI Corporation)

S3 s1039mdm; C:\Windows\System32\DRIVERS\s1039mdm.sys [161904 2010-03-15] (MCCI Corporation)

S3 s1039mgmt; C:\Windows\System32\DRIVERS\s1039mgmt.sys [141424 2010-03-15] (MCCI Corporation)

S3 s1039nd5; C:\Windows\System32\DRIVERS\s1039nd5.sys [34416 2010-03-15] (MCCI Corporation)

S3 s1039obex; C:\Windows\System32\DRIVERS\s1039obex.sys [137328 2010-03-15] (MCCI Corporation)

S3 s1039unic; C:\Windows\System32\DRIVERS\s1039unic.sys [158320 2010-03-15] (MCCI Corporation)

R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesDriver64.sys [14112 2013-08-21] (TuneUp Software)

R2 TurboB; C:\Windows\System32\DRIVERS\TurboB.sys [13784 2009-11-02] ()

S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X]

S3 hwusbdev; system32\DRIVERS\ewusbdev.sys [X]

R3 SPPD; \??\C:\Windows\system32\drivers\SPPD.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2015-01-18 19:45 - 2015-01-18 19:46 - 00030602 _____ () C:\Users\Fred\Downloads\FRST.txt

2015-01-18 19:45 - 2015-01-18 19:45 - 00000000 ___DC () C:\FRST

2015-01-18 19:43 - 2015-01-18 19:44 - 02126848 _____ (Farbar) C:\Users\Fred\Downloads\FRST64.exe

2015-01-18 19:42 - 2015-01-18 19:42 - 00000470 _____ () C:\Users\Fred\Downloads\defogger_disable.log

2015-01-18 19:42 - 2015-01-18 19:42 - 00000000 _____ () C:\Users\Fred\defogger_reenable

2015-01-18 19:37 - 2015-01-18 19:37 - 00050477 _____ () C:\Users\Fred\Downloads\Defogger.exe

2015-01-18 18:47 - 2015-01-18 19:33 - 00000000 ____D () C:\Users\Fred\Desktop\MalwareProblem

2015-01-04 16:59 - 2015-01-04 16:59 - 00001815 _____ () C:\Users\Public\Desktop\Tango.lnk

2015-01-04 16:59 - 2015-01-04 16:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tango

2015-01-04 16:58 - 2015-01-04 16:59 - 00000000 ____D () C:\Users\Fred\AppData\Local\tango

2015-01-04 16:58 - 2015-01-04 16:59 - 00000000 ____D () C:\Program Files (x86)\Tango

2015-01-01 22:59 - 2015-01-01 22:59 - 00001520 _____ () C:\Users\Public\Desktop\SimCity 2000 Special Edition.lnk

2015-01-01 22:59 - 2015-01-01 22:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SimCity 2000 Special Edition

2014-12-23 18:02 - 2014-12-23 18:02 - 00003886 _____ () C:\Windows\System32\Tasks\Adobe Acrobat Update Task

2014-12-23 18:01 - 2014-12-23 18:01 - 00001141 _____ () C:\Users\Public\Desktop\Avira.lnk
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2015-01-18 19:42 - 2010-06-09 20:12 - 00000000 ____D () C:\Users\Fred

2015-01-18 19:31 - 2013-04-02 19:04 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2015-01-18 19:11 - 2013-03-24 18:51 - 00000000 ____D () C:\Users\Fred\Desktop\Combine

2015-01-18 19:01 - 2010-07-22 09:46 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2015-01-18 18:02 - 2013-05-15 20:03 - 00002391 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

2015-01-18 17:50 - 2010-03-03 19:07 - 01841223 _____ () C:\Windows\WindowsUpdate.log

2015-01-18 17:42 - 2009-07-14 05:45 - 00017600 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2015-01-18 17:42 - 2009-07-14 05:45 - 00017600 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2015-01-18 17:31 - 2013-09-01 17:51 - 00000000 ____D () C:\Users\Fred\AppData\Roaming\Skype

2015-01-18 17:30 - 2013-03-25 16:34 - 00000000 ____D () C:\Program Files (x86)\Origin

2015-01-18 17:29 - 2010-07-22 09:46 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2015-01-18 17:27 - 2013-07-22 13:21 - 00020251 _____ () C:\Windows\setupact.log

2015-01-18 17:27 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2015-01-14 00:35 - 2013-04-02 19:04 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2015-01-14 00:35 - 2012-06-29 20:10 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2015-01-14 00:35 - 2011-11-14 19:00 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2015-01-13 22:45 - 2014-09-22 17:16 - 00001342 _____ () C:\Users\Public\Desktop\Die Sims 4.lnk

2015-01-13 21:19 - 2013-03-25 16:34 - 00000000 ____D () C:\ProgramData\Origin

2015-01-12 20:31 - 2014-10-11 00:11 - 00000000 ____D () C:\Users\Fred\AppData\Roaming\Security Systems

2015-01-06 20:41 - 2013-03-25 16:35 - 00000000 ____D () C:\Users\Fred\AppData\Roaming\Origin

2015-01-01 22:59 - 2013-03-25 16:35 - 00000000 ____D () C:\Program Files (x86)\Origin Games

2015-01-01 22:59 - 2009-07-14 06:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games

2015-01-01 12:16 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF

2014-12-23 18:01 - 2014-08-25 15:57 - 00000000 ____D () C:\ProgramData\Package Cache

2014-12-23 18:01 - 2012-12-03 18:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira

2014-12-23 18:01 - 2012-12-03 18:55 - 00000000 ____D () C:\Program Files (x86)\Avira
 

==================== Files in the root of some directories =======

2009-11-05 04:32 - 2009-02-10 21:23 - 0192484 _____ () C:\Program Files (x86)\Common Files\Acer GameZone online.ico

2013-03-28 18:06 - 2013-05-06 19:14 - 0001112 _____ () C:\Users\Fred\AppData\Roaming\wklnhst.dat

2013-09-10 12:52 - 2013-09-10 13:08 - 0005120 _____ () C:\Users\Fred\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

2010-07-22 08:58 - 2010-07-22 08:58 - 0000092 _____ () C:\Users\Fred\AppData\Local\fusioncache.dat

2010-03-03 19:12 - 2010-03-03 19:15 - 0008278 _____ () C:\ProgramData\ArcadeDeluxe3.log

2009-11-05 04:33 - 2009-07-18 03:57 - 0036136 _____ (Oberon Media) C:\ProgramData\FullRemove.exe
 

Some content of TEMP:

====================

C:\Users\Fred\AppData\Local\Temp\amazonicon_v10.exe

C:\Users\Fred\AppData\Local\Temp\amazoninstallernircmdc.exe

C:\Users\Fred\AppData\Local\Temp\APNSetup.exe

C:\Users\Fred\AppData\Local\Temp\avgnt.exe

C:\Users\Fred\AppData\Local\Temp\CBSUpdate_1_3_Zusatzpaket.exe

C:\Users\Fred\AppData\Local\Temp\Fahr-Simulator_Upgrade_1.2_Setup.exe

C:\Users\Fred\AppData\Local\Temp\FoxySecurity6_FF_IE_Setup-GIGA.exe

C:\Users\Fred\AppData\Local\Temp\jre-7u71-windows-i586-iftw.exe

C:\Users\Fred\AppData\Local\Temp\sdan.exe

C:\Users\Fred\AppData\Local\Temp\sdapk.exe

C:\Users\Fred\AppData\Local\Temp\sdaspwn.exe

C:\Users\Fred\AppData\Local\Temp\SimBundD.exe

C:\Users\Fred\AppData\Local\Temp\SkypeSetup.exe

C:\Users\Fred\AppData\Local\Temp\sof_sweet-page.exe
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-10-19 23:13
 

==================== End Of Log ============================

Additions.txt

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 18-01-2015 01

Ran by Fred at 2015-01-18 19:47:41

Running from C:\Users\Fred\Downloads

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

(If an entry is included in the fixlist, it will be removed.)
 

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}

AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}

AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 

==================== Installed Programs ======================
 

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 

7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)

Acer Arcade Deluxe (HKLM-x32\...\InstallShield_{2637C347-9DAD-11D6-9EA2-00055D0CA761}) (Version: 3.0.7112 - CyberLink Corp.)

Acer Arcade Deluxe (x32 Version: 3.0.7112 - CyberLink Corp.) Hidden

Acer Backup Manager (HKLM-x32\...\InstallShield_{72B776E5-4530-4C4B-9453-751DF87D9D93}) (Version: 2.0.0.29 - NewTech Infosystems)

Acer Crystal Eye Webcam (HKLM-x32\...\{7760D94E-B1B5-40A0-9AA0-ABF942108755}) (Version: 5.2.9.3 - Suyin Optronics Corp)

Acer ePower Management (HKLM-x32\...\{3DB0448D-AD82-4923-B305-D001E521A964}) (Version: 4.05.3004 - Acer Incorporated)

Acer eRecovery Management (HKLM-x32\...\{7F811A54-5A09-4579-90E1-C93498E230D9}) (Version: 4.05.3005 - Acer Incorporated)

Acer GameZone Console (HKLM-x32\...\{8ed9688e-4f79-4308-91ca-f1c37ca142b4}_is1) (Version: 5.1.0.2 - Oberon Media, Inc.)

Acer GridVista (HKLM-x32\...\GridVista) (Version: 3.01.0730 - Acer Inc.)

Acer Registration (HKLM-x32\...\Acer Registration) (Version: 1.02.3006 - Acer Incorporated)

Acer ScreenSaver (HKLM-x32\...\Acer Screensaver) (Version: 1.1.2009.1217 - Acer Incorporated)

Acer Updater (HKLM-x32\...\{EE171732-BEB4-4576-887D-CB62727F01CA}) (Version: 1.01.3017 - Acer Incorporated)

Acer VCM (HKLM-x32\...\{047F790A-7A2A-4B6A-AD02-38092BA63DAC}) (Version: 4.05.3000 - Acer Incorporated)

Acrobat.com (HKLM-x32\...\{287ECFA4-719A-2143-A09B-D6A12DE54E40}) (Version: 1.6.65 - Adobe Systems Incorporated)

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 2.0.2.12610 - Adobe Systems Inc.)

Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.257 - Adobe Systems Incorporated)

Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.257 - Adobe Systems Incorporated)

Adobe Photoshop 7.0 (HKLM-x32\...\Adobe Photoshop 7.0) (Version: 7.0 - Adobe Systems, Inc.)

Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)

Alcor Micro USB Card Reader (HKLM-x32\...\InstallShield_{DBCE1208-433D-4D3E-A26A-CB1B5E71A8F5}) (Version: 1.4.17.35005 - Alcor Micro Corp.)

Alcor Micro USB Card Reader (x32 Version: 1.4.17.35005 - Alcor Micro Corp.) Hidden

Alice Greenfingers (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112920767}) (Version:  - Oberon Media)

Amazonia (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11273477}) (Version:  - Oberon Media)

ANNO 1404 (HKLM-x32\...\{3D9CF3CA-3AB0-4A82-9853-D7C43FD1D775}) (Version: 1.00.0000 - Ubisoft)

Anno 1404 (x32 Version: 1.00.0000 - Ubisoft) Hidden

Apple Application Support (HKLM-x32\...\{5D09C772-ECB3-442B-9CC6-B4341C78FDC2}) (Version: 2.3.4 - Apple Inc.)

Apple Mobile Device Support (HKLM\...\{2F72F540-1F60-4266-9506-952B21D6640D}) (Version: 6.1.0.13 - Apple Inc.)

Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)

Ask Toolbar (HKLM-x32\...\{86D4B82A-ABED-442A-BE86-96357B70F4FE}) (Version: 1.15.26.0 - Ask.com) <==== ATTENTION

Ask Toolbar Updater (HKU\S-1-5-21-432033561-2934589633-1803115819-1001\...\{79A765E1-C399-405B-85AF-466F52E918B0}) (Version: 1.2.6.45268 - Ask.com) <==== ATTENTION

ATI Catalyst Install Manager (HKLM\...\{11F38253-8940-FFDA-D131-B14120C357E4}) (Version: 3.0.754.0 - ATI Technologies, Inc.)

Aurora Blu-ray Media Player (HKLM-x32\...\Aurora Blu-ray Media Player) (Version: 2.13.4.1435 - Aurora Software Inc.)

Avira (HKLM-x32\...\{e7c7c227-b742-4878-9425-f09bbf9951db}) (Version: 1.1.27.25527 - Avira Operations & Co. KG)

Avira (x32 Version: 1.1.27.25527 - Avira Operations & Co. KG) Hidden

Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.7.468 - Avira)

Backup Manager Basic (x32 Version: 2.0.0.29 - NewTech Infosystems) Hidden

Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)

Broadcom Gigabit NetLink Controller (HKLM\...\{A325B368-A9EC-40EF-A95C-9DEAD3683AE3}) (Version: 12.33.03 - Broadcom Corporation)

Bus Simulator 2008 Demo (HKLM-x32\...\Bus Simulator 2008 Demo_is1) (Version:  - contendo media Ltd.)

ccc-core-static (x32 Version: 2009.1209.2335.42329 - Ihr Firmenname) Hidden

CCleaner (HKLM\...\CCleaner) (Version: 4.01 - Piriform)

Chicken Invaders 2 (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110209593}) (Version:  - Oberon Media)

Compatibility Pack für 2007 Office System (HKLM-x32\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)

CyberLink PowerDVD 10 (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.1516 - CyberLink Corp.)

D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden

Dairy Dash (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-115053100}) (Version:  - Oberon Media)

Die Sims™ 3 (HKLM-x32\...\{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}) (Version: 1.67.2 - Electronic Arts)

Die Sims™ 3 70er, 80er & 90er Accessoires (HKLM-x32\...\{E1868CAE-E3B9-4099-8C18-AA8944D336FD}) (Version: 17.0.77 - Electronic Arts)

Die Sims™ 3 Einfach tierisch (HKLM-x32\...\{C12631C6-804D-4B32-B0DD-8A496462F106}) (Version: 10.0.96 - Electronic Arts)

Die Sims™ 3 Inselparadies (HKLM-x32\...\{DB21639E-FE55-432C-BCA2-0C5249E3F79E}) (Version: 19.0.101 - Electronic Arts)

Die Sims™ 3 Jahreszeiten (HKLM-x32\...\{3DE92282-CB49-434F-81BF-94E5B380E889}) (Version: 16.0.136 - Electronic Arts)

Die Sims™ 3 Late Night (HKLM-x32\...\{45057FCE-5784-48BE-8176-D9D00AF56C3C}) (Version: 6.0.81 - Electronic Arts)

Die Sims™ 3 Lebensfreude (HKLM-x32\...\{E6B88BD6-E4B2-4701-A648-B6DAC6E491CC}) (Version: 8.0.152 - Electronic Arts)

Die Sims™ 3 Luxus-Accessoires (HKLM-x32\...\{71828142-5A24-4BD0-97E7-976DA08CE6CF}) (Version: 3.0.38 - Electronic Arts)

Die Sims™ 3 Reiseabenteuer (HKLM-x32\...\{BA26FFA5-6D47-47DB-BE56-34C357B5F8CC}) (Version: 2.0.86 - Electronic Arts)

Die Sims™ 3 Showtime (HKLM-x32\...\{3BBFD444-5FAB-49F6-98B1-A1954E831399}) (Version: 12.0.273 - Electronic Arts)

Die Sims™ 3 Stadt-Accessoires (HKLM-x32\...\{7B11296A-F894-449C-8DF6-6AAAA7D4D118}) (Version: 9.0.73 - Electronic Arts)

Die Sims™ 3 Supernatural (HKLM-x32\...\{B37DAFA5-717D-41F8-BDFB-3A4B68C0B3A1}) (Version: 15.0.135 - Electronic Arts)

Die Sims™ 3 Traumkarrieren (HKLM-x32\...\{910F4A29-1134-49E0-AD8B-56E4A3152BD1}) (Version: 4.0.87 - Electronic Arts)

Die Sims™ 3 Traumsuite-Accessoires (HKLM-x32\...\{08A25478-C5DD-4EA7-B168-3D687CA987FF}) (Version: 11.0.84 - Electronic Arts)

Die Sims™ 3 Wildes Studentenleben (HKLM-x32\...\{F26DE8EF-F2CF-40DC-8CDA-CC0D82D11B36}) (Version: 18.0.126 - Electronic Arts)

Die Sims™ 4 (HKLM-x32\...\{48EBEBBF-B9F8-4520-A3CF-89A730721917}) (Version: 1.3.32.1010 - Electronic Arts Inc.)

Die Sims™ 4 Erstelle einen Sim-Demo (HKLM-x32\...\{6908ED99-F02B-4E99-A202-3FAC99C510ED}) (Version: 1.0.237.100 - Electronic Arts Inc.)

Dream Day First Home (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113832110}) (Version:  - Oberon Media)

eSobi v2 (HKLM-x32\...\InstallShield_{15D967B5-A4BE-42AE-9E84-64CD062B25AA}) (Version: 2.0.4.000274 - esobi Inc.)

eSobi v2 (x32 Version: 2.0.4.000274 - esobi Inc.) Hidden

Farm Frenzy 2 (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11531173}) (Version:  - Oberon Media)

FileViewPro (HKLM\...\FileViewPro_is1) (Version: 4.0 - stfx, Ath)

First Class Flurry (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-115208410}) (Version:  - Oberon Media)

Foxy Secure (HKLM-x32\...\Foxy Secure) (Version: 6 - ) <==== ATTENTION

Free YouTube to MP3 Converter version 3.12.20.1230 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.20.1230 - DVDVideoSoft Ltd.)

GameSpy Comrade (HKLM-x32\...\{176B3593-72F1-459C-829C-5E9671E2CB35}) (Version: 1.4.3.154 - GameSpy)

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 39.0.2171.99 - Google Inc.)

Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.5111.1712 - Google Inc.)

Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden

Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden

Granny In Paradise (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110551697}) (Version:  - Oberon Media)

Heroes of Hellas (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113786380}) (Version:  - Oberon Media)

HP Deskjet 1050 J410 series - Grundlegende Software für das Gerät (HKLM\...\{A7096369-9332-466C-8357-08770CDCE277}) (Version: 22.50.231.0 - Hewlett-Packard Co.)

HP Deskjet 1050 J410 series Hilfe (HKLM-x32\...\{5C90D8CF-F12A-41C6-9007-3B651A1F0D78}) (Version: 140.0.66.66 - Hewlett Packard)

HP Product Detection (HKLM-x32\...\{CAE7D1D9-3794-4169-B4DD-964ADBC534EE}) (Version: 10.7.9.0 - Hewlett-Packard Company)

IceChat 7.70 (Build 20101031) (HKLM-x32\...\IceChat_is1) (Version: 7.70 - IceChat Networks)

ICQ 8.2 (build 7138) (HKU\S-1-5-21-432033561-2934589633-1803115819-1001\...\ICQ) (Version: 8.2.7138.0 - ICQ)

Identity Card (HKLM-x32\...\Identity Card) (Version: 1.00.3003 - Acer Incorporated)

Impulse (HKLM-x32\...\Impulse) (Version:  - Stardock)

Impulse (x32 Version: 1.0 - Stardock Corporation) Hidden

Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 6.0.0.1179 - Intel Corporation)

Intel(R) Turbo Boost Technology Driver (HKLM-x32\...\{D6C630BF-8DBB-4042-8562-DC9A52CB6E7E}) (Version: 01.00.01.1002 - Intel Corporation)

Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version:  - Intel Corporation)

iTunes (HKLM\...\{427174C0-096E-40D9-9684-9C109BEE2CBF}) (Version: 11.0.5.5 - Apple Inc.)

Java 7 Update 71 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217045FF}) (Version: 7.0.710 - Oracle)

Java 8 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)

LAME v3.98.2 for Audacity (HKLM-x32\...\LAME for Audacity_is1) (Version:  - )

Launch Manager (HKLM-x32\...\LManager) (Version: 3.0.05 - Acer Inc.)

LSI HDA Modem (HKLM\...\LSI Soft Modem) (Version: 2.2.98 - LSI Corporation)

Mahjongg Master 4 (HKLM-x32\...\Mahjongg Master 4) (Version:  - )

Merriam Websters Spell Jam (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112662477}) (Version:  - Oberon Media)

Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden

Microsoft .NET Framework 1.1 (HKLM-x32\...\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}) (Version: 1.1.4322 - Microsoft)

Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)

Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)

Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0100-0407-0000-0000000FF1CE}_OMUI.de-de_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}) (Version:  - Microsoft)

Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)

Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)

Microsoft Office Home and Student 2007 (HKLM-x32\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)

Microsoft Office Language Pack 2007 - German/Deutsch (HKLM-x32\...\OMUI.de-de) (Version: 12.0.6612.1000 - Microsoft Corporation)

Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)

Microsoft Office PowerPoint Viewer 2007 (German) (HKLM-x32\...\{95120000-00AF-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)

Microsoft Office Suite Activation Assistant (HKLM-x32\...\{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}) (Version: 2.9 - Microsoft Corporation)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.20125.0 - Microsoft Corporation)

Microsoft SkyDrive (HKU\S-1-5-21-432033561-2934589633-1803115819-1001\...\SkyDriveSetup.exe) (Version: 16.4.6013.0910 - Microsoft Corporation)

Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM-x32\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)

Microsoft Works (HKLM-x32\...\{62F7DA7E-CCCB-439C-A760-00C3926E761F}) (Version: 9.7.0621 - Microsoft Corporation)

Mozilla Firefox 32.0.3 (x86 de) (HKLM-x32\...\Mozilla Firefox 32.0.3 (x86 de)) (Version: 32.0.3 - Mozilla)

Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)

MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)

MyWinLocker (HKLM-x32\...\{68301905-2DEA-41CE-A4D4-E8B443B099BA}) (Version: 3.1.76.0 - Egis Technology Inc.)

Need for Speed™ Most Wanted (HKLM-x32\...\{FB0127F3-985B-44CE-AE29-378CAF60B361}) (Version: 1.5.0.0 - Electronic Arts)

NTI Backup Now 5 (HKLM-x32\...\InstallShield_{12EFA1A4-AC3B-443C-8143-237EDE760403}) (Version: 5.1.2.627 - NewTech Infosystems)

NTI Backup Now Standard (x32 Version: 5.1.2.627 - NewTech Infosystems) Hidden

NTI Media Maker 8 (HKLM-x32\...\InstallShield_{2413930C-8309-47A6-BC61-5EF27A4222BC}) (Version: 8.0.12.6623 - NewTech Infosystems)

NTI Media Maker 8 (x32 Version: 8.0.12.6623 - NewTech Infosystems) Hidden

Origin (HKLM-x32\...\Origin) (Version: 9.1.15.109 - Electronic Arts, Inc.)

PlayStation(R)Network Downloader (HKLM-x32\...\{B6659DD8-00A7-4A24-BBFB-C1F6982E5D66}) (Version: 2.07.00849 - Sony Computer Entertainment Inc.)

PlayStation(R)Store (HKLM-x32\...\{0E532C84-4275-41B3-9D81-D4A1A20D8EE7}) (Version: 4.9.4.14625 - Sony Computer Entertainment Inc.)

ProtectDisc Driver, Version 11 (HKLM-x32\...\ProtectDisc Driver 11) (Version: 11.0.0.14 - ProtectDisc Software GmbH)

QuickTime (HKLM-x32\...\{AF0CE7C0-A3E4-4D73-988B-B29187EC6E9A}) (Version: 7.73.80.64 - Apple Inc.)

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5969 - Realtek Semiconductor Corp.)

RIFT (HKU\S-1-5-21-432033561-2934589633-1803115819-1001\...\RIFT) (Version:  - Trion Worlds, Inc.)

Search App by Ask (HKLM-x32\...\{4F524A2D-5350-4500-76A7-A758B70C1500}) (Version: 12.21.0.114 - APN, LLC) <==== ATTENTION

Search Protect (HKLM-x32\...\SearchProtect) (Version: 2.18.20.209 - Search Protect) <==== ATTENTION

Sid Meier's Civilization 4 Complete (HKLM-x32\...\{30D1F3D2-54CF-481D-A005-F94B0E98FEEC}) (Version: 1.74 - Firaxis Games)

SimCity 2000 Special Edition (HKLM-x32\...\{59D2C751-F7BE-4E9F-9C8C-1F16013802C7}) (Version: 2.0.0.1 - Electronic Arts)

Skillstraining für Borderline-Patienten, 2. Auflage (HKLM-x32\...\com.mmm.app.schattauer.skillstraining2) (Version: 2.0.10 - Schattauer GmbH)

Skillstraining für Borderline-Patienten, 2. Auflage (x32 Version: 2.0.10 - Schattauer GmbH) Hidden

Skype™ 6.16 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.16.105 - Skype Technologies S.A.)

sweet-page uninstall (HKLM-x32\...\sweet-page uninstall) (Version:  - sweet-page) <==== ATTENTION

Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 14.0.6.0 - Synaptics Incorporated)

Tango (HKU\S-1-5-21-432033561-2934589633-1803115819-1001\...\Tango) (Version: 1.6.14117 - TangoMe, Inc.)

TuneUp Utilities 2014 (de-DE) (x32 Version: 14.0.1000.89 - TuneUp Software) Hidden

TuneUp Utilities 2014 (HKLM-x32\...\TuneUp Utilities 2014) (Version: 14.0.1000.89 - TuneUp Software)

TuneUp Utilities 2014 (x32 Version: 14.0.1000.89 - TuneUp Software) Hidden

Überwachungstool für die Intel® Turbo-Boost-Technik (HKLM\...\{39F4C6F9-618A-4E5B-8FB2-6BD661174E32}) (Version: 1.0.186.6 - Intel)

Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)

Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_OMUI.de-de_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)

Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_OMUI.de-de_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)

Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_OMUI.de-de_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)

Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_OMUI.de-de_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)

Welcome Center (HKLM-x32\...\Acer Welcome Center) (Version: 1.00.3008 - Acer Incorporated)

Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3502.0922 - Microsoft Corporation)

Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)

Windows Live Sync (HKLM-x32\...\{76618402-179D-4699-A66B-D351C59436BC}) (Version: 14.0.8089.726 - Microsoft Corporation)

WindowsMangerProtect20.0.0.722 (HKLM-x32\...\WindowsMangerProtect) (Version: 20.0.0.722 - WindowsProtect LIMITED) <==== ATTENTION

Youda Farmer (HKLM-x32\...\Youda Farmer) (Version:  - )

Youda Kindergarten (HKLM-x32\...\Youda Kindergarten) (Version:  - )

Youda Legend (HKLM-x32\...\Youda Legend) (Version:  - )

Youda Sushi Chef (HKLM-x32\...\Youda Sushi Chef) (Version:  - )
 

==================== Custom CLSID (selected items): ==========================
 

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
 

CustomCLSID: HKU\S-1-5-21-432033561-2934589633-1803115819-1001_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Fred\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-432033561-2934589633-1803115819-1001_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Fred\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-432033561-2934589633-1803115819-1001_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Fred\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-432033561-2934589633-1803115819-1001_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Fred\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\FileSyncApi64.dll (Microsoft Corporation)
 

==================== Restore Points  =========================
 
 

==================== Hosts content: ==========================
 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
 

==================== Scheduled Tasks (whitelisted) =============
 

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
 

Task: {102AC1D8-2695-4A0E-92B2-97A26B5321E5} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-01-14] (Adobe Systems Incorporated)

Task: {4C1A0EE9-4164-46C0-8F7C-8B139AE73F60} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-04-23] (Piriform Ltd)

Task: {503E2A67-83CA-4DE5-8A8A-2134CCD5B80E} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)

Task: {65E5A3A9-D8F9-470E-863E-581237DEF09C} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)

Task: {6B2E1908-768E-424F-AE4B-90C21EBBBCFA} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-28] (Google Inc.)

Task: {73BEDE60-33AC-48F3-BAD2-49080984999E} - System32\Tasks\Scheduled Update for Ask Toolbar => C:\Program Files (x86)\Ask.com\UpdateTask.exe [2013-04-30] () <==== ATTENTION

Task: {C21C063F-4A6D-4982-8EA7-0079E088D398} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 => C:\Program Files (x86)\TuneUp Utilities 2014\OneClick.exe [2013-08-30] (TuneUp Software)

Task: {D10D07C1-DF6C-4E1E-810E-3B6C053719AC} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-28] (Google Inc.)

Task: {DD0D09EC-FA0A-4571-A982-A729AC614376} - System32\Tasks\{030917A2-2E69-40CA-9CB3-A081DCF939E9} => pcalua.exe -a "C:\Program Files (x86)\Steam\steam.exe" -c steam://uninstall/8930

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
 

==================== Loaded Modules (whitelisted) =============
 

2010-03-03 19:11 - 2009-11-20 15:34 - 00200704 _____ () C:\Windows\PLFSetI.exe

2009-07-29 13:10 - 2009-07-29 13:10 - 00016384 ____R () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll

2010-03-03 19:07 - 2010-03-03 19:07 - 00270336 _____ () C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CrossDisplay.Graphics.Dashboard\1.0.0.0__90ba9c70f846762e\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll

2011-09-27 07:23 - 2011-09-27 07:23 - 00087912 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll

2011-09-27 07:22 - 2011-09-27 07:22 - 01242472 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll

2009-02-03 02:33 - 2009-02-03 02:33 - 00460199 _____ () C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\sqlite3.dll

2008-09-29 02:55 - 2008-09-29 02:55 - 01076224 _____ () C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\ACE.dll

2014-02-03 20:47 - 2014-12-29 20:53 - 01007104 _____ () C:\Program Files (x86)\Origin\platforms\qwindows.dll

2014-02-03 20:47 - 2014-12-29 20:53 - 00023552 _____ () C:\Program Files (x86)\Origin\imageformats\qgif.dll

2014-02-03 20:47 - 2014-12-29 20:53 - 00024576 _____ () C:\Program Files (x86)\Origin\imageformats\qico.dll

2014-02-03 20:47 - 2014-12-29 20:53 - 00216576 _____ () C:\Program Files (x86)\Origin\imageformats\qjpeg.dll

2014-02-03 20:47 - 2014-12-29 20:53 - 00261120 _____ () C:\Program Files (x86)\Origin\imageformats\qmng.dll

2014-02-03 20:47 - 2014-12-29 20:53 - 00019456 _____ () C:\Program Files (x86)\Origin\imageformats\qtga.dll

2014-02-03 20:47 - 2014-12-29 20:53 - 00337408 _____ () C:\Program Files (x86)\Origin\imageformats\qtiff.dll

2014-02-03 20:47 - 2014-12-29 20:53 - 00018944 _____ () C:\Program Files (x86)\Origin\imageformats\qwbmp.dll

2014-11-07 19:57 - 2014-11-07 19:57 - 00859144 _____ () C:\Users\Fred\AppData\Roaming\ICQM\ICQ\dll\YLUSBTEL.dll

2011-04-14 09:43 - 2011-04-14 09:43 - 08448512 _____ () C:\Program Files (x86)\Tango\QtGui4.dll

2011-04-14 09:35 - 2011-04-14 09:35 - 02346496 _____ () C:\Program Files (x86)\Tango\QtCore4.dll

2011-04-14 09:50 - 2011-04-14 09:50 - 00113152 _____ () C:\Program Files (x86)\Tango\QtMultimedia4.dll

2011-04-14 09:36 - 2011-04-14 09:36 - 00859648 _____ () C:\Program Files (x86)\Tango\QtNetwork4.dll

2011-04-14 10:58 - 2011-04-14 10:58 - 11159040 _____ () C:\Program Files (x86)\Tango\QtWebKit4.dll

2011-04-14 09:49 - 2011-04-14 09:49 - 00270336 _____ () C:\Program Files (x86)\Tango\phonon4.dll

2011-08-09 11:31 - 2011-08-09 11:31 - 00054784 _____ () C:\Program Files (x86)\Tango\CrashRpt.dll

2014-10-10 19:43 - 2014-10-10 19:43 - 03715184 _____ () C:\Program Files (x86)\Mozilla Firefox 4.0 Beta 4\mozjs.dll

2015-01-14 00:35 - 2015-01-14 00:35 - 16844464 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_257.dll

2011-10-05 03:52 - 2011-10-05 03:52 - 00756048 _____ () C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\MSPTLS.DLL
 

==================== Alternate Data Streams (whitelisted) =========
 

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
 

AlternateDataStreams: C:\ProgramData\Temp:444C53BA

AlternateDataStreams: C:\ProgramData\Temp:4CF61E54

AlternateDataStreams: C:\ProgramData\Temp:4D066AD2

AlternateDataStreams: C:\ProgramData\Temp:5D7E5A8F

AlternateDataStreams: C:\ProgramData\Temp:93DE1838

AlternateDataStreams: C:\ProgramData\Temp:ABE89FFE

AlternateDataStreams: C:\ProgramData\Temp:E1F04E8D

AlternateDataStreams: C:\ProgramData\Temp:E3C56885
 

==================== Safe Mode (whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
 

==================== EXE Association (whitelisted) =============
 

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
 
 

==================== MSCONFIG/TASK MANAGER disabled items =========
 

(Currently there is no automatic fix for this section.)
 
 

========================= Accounts: ==========================
 

Administrator (S-1-5-21-432033561-2934589633-1803115819-500 - Administrator - Disabled)

ASPNET (S-1-5-21-432033561-2934589633-1803115819-1004 - Limited - Enabled)

Fred (S-1-5-21-432033561-2934589633-1803115819-1001 - Administrator - Enabled) => C:\Users\Fred

Gast (S-1-5-21-432033561-2934589633-1803115819-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-432033561-2934589633-1803115819-1002 - Limited - Enabled)
 

==================== Faulty Device Manager Devices =============
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (01/18/2015 05:28:05 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: TuneUpUtilitiesService64.exe, Version: 14.0.1000.89, Zeitstempel: 0x52204ece

Name des fehlerhaften Moduls: TuneUpUtilitiesService64.exe, Version: 14.0.1000.89, Zeitstempel: 0x52204ece

Ausnahmecode: 0xc0000005

Fehleroffset: 0x000000000001c076

ID des fehlerhaften Prozesses: 0x82c

Startzeit der fehlerhaften Anwendung: 0xTuneUpUtilitiesService64.exe0

Pfad der fehlerhaften Anwendung: TuneUpUtilitiesService64.exe1

Pfad des fehlerhaften Moduls: TuneUpUtilitiesService64.exe2

Berichtskennung: TuneUpUtilitiesService64.exe3
 

Error: (01/10/2015 09:29:11 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: TuneUpUtilitiesService64.exe, Version: 14.0.1000.89, Zeitstempel: 0x52204ece

Name des fehlerhaften Moduls: TuneUpUtilitiesService64.exe, Version: 14.0.1000.89, Zeitstempel: 0x52204ece

Ausnahmecode: 0xc0000005

Fehleroffset: 0x000000000001c076

ID des fehlerhaften Prozesses: 0xa58

Startzeit der fehlerhaften Anwendung: 0xTuneUpUtilitiesService64.exe0

Pfad der fehlerhaften Anwendung: TuneUpUtilitiesService64.exe1

Pfad des fehlerhaften Moduls: TuneUpUtilitiesService64.exe2

Berichtskennung: TuneUpUtilitiesService64.exe3
 

Error: (01/04/2015 09:43:44 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 3443052
 

Error: (01/04/2015 09:43:44 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledEvent 3443052
 

Error: (01/04/2015 09:43:44 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: Continuously busy for more than a second
 

Error: (01/04/2015 09:43:43 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 3441959
 

Error: (01/04/2015 09:43:43 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledEvent 3441959
 

Error: (01/04/2015 09:43:43 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: Continuously busy for more than a second
 

Error: (01/04/2015 09:43:42 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 3440930
 

Error: (01/04/2015 09:43:42 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledEvent 3440930
 
 

System errors:

=============

Error: (01/18/2015 06:47:02 PM) (Source: cdrom) (EventID: 7) (User: )

Description: Fehlerhafter Block bei Gerät \Device\CdRom0.
 

Error: (01/18/2015 05:30:28 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Der Dienst "Windows Media Player-Netzwerkfreigabedienst" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%1053
 

Error: (01/18/2015 05:30:28 PM) (Source: Service Control Manager) (EventID: 7009) (User: )

Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows Media Player-Netzwerkfreigabedienst erreicht.
 

Error: (01/18/2015 05:28:49 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: Dienst "TuneUp Utilities Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
 

Error: (01/18/2015 05:28:22 PM) (Source: Service Control Manager) (EventID: 7009) (User: )

Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Avira Service Host erreicht.
 

Error: (01/18/2015 05:28:20 PM) (Source: Service Control Manager) (EventID: 7011) (User: )

Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst TuneUp.UtilitiesSvc erreicht.
 

Error: (01/13/2015 10:17:27 PM) (Source: Service Control Manager) (EventID: 7022) (User: )

Description: Der Dienst "Windows Update" wurde nicht richtig gestartet.
 

Error: (01/13/2015 10:09:31 PM) (Source: Service Control Manager) (EventID: 7009) (User: )

Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Avira Service Host erreicht.
 

Error: (01/13/2015 10:08:39 PM) (Source: EventLog) (EventID: 6008) (User: )

Description: Das System wurde zuvor am ‎13.‎01.‎2015 um 22:04:27 unerwartet heruntergefahren.
 

Error: (01/12/2015 08:31:08 PM) (Source: Service Control Manager) (EventID: 7022) (User: )

Description: Der Dienst "Windows Update" wurde nicht richtig gestartet.
 
 

Microsoft Office Sessions:

=========================
 

CodeIntegrity Errors:

===================================

  Date: 2014-03-12 19:43:09.988

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-03-12 19:43:09.863

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-03-12 19:43:09.489

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\atksgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-03-12 19:43:09.364

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\atksgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-03-11 19:41:15.038

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-03-11 19:41:14.928

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-03-11 19:41:14.538

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\atksgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-03-11 19:41:14.414

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\atksgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-03-02 10:42:14.218

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-03-02 10:42:14.109

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 
 

==================== Memory info =========================== 
 

Processor: Intel(R) Core(TM) i5 CPU M 430 @ 2.27GHz

Percentage of memory in use: 61%

Total physical RAM: 3956.5 MB

Available physical RAM: 1518.16 MB

Total Pagefile: 7911.19 MB

Available Pagefile: 4780.64 MB

Total Virtual: 8192 MB

Available Virtual: 8191.83 MB
 

==================== Drives ================================
 

Drive c: (ACER) (Fixed) (Total:584.35 GB) (Free:278.57 GB) NTFS

Drive d: (Sims3EP10) (CDROM) (Total:4.37 GB) (Free:0 GB) UDF
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 596.2 GB) (Disk ID: FDACFDAC)

Partition 1: (Not Active) - (Size=11.7 GB) - (Type=27)

Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=584.4 GB) - (Type=07 NTFS)
 

==================== End Of Log ============================

GMER.txt

Code:

GMER 2.1.19357 - hxxp://www.gmer.net

Rootkit scan 2015-01-18 20:37:03

Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD64 rev.01.0 596,17GB

Running: Gmer-19357.exe; Driver: C:\Users\Fred\AppData\Local\Temp\kgldypob.sys
 
 

---- User code sections - GMER 2.1 ----
 

.text   C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[568] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69   0000000076d41465 2 bytes [D4, 76]

.text   C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[568] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155  0000000076d414bb 2 bytes [D4, 76]

.text   ...                                                                                                                                            * 2

.text   C:\Users\Fred\AppData\Roaming\ICQM\icq.exe[4352] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                       0000000076d41465 2 bytes [D4, 76]

.text   C:\Users\Fred\AppData\Roaming\ICQM\icq.exe[4352] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                      0000000076d414bb 2 bytes [D4, 76]

.text   ...                                                                                                                                            * 2

.text   C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe[2680] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69          0000000076d41465 2 bytes [D4, 76]

.text   C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe[2680] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155         0000000076d414bb 2 bytes [D4, 76]

.text   ...                                                                                                                                            * 2

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5300] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69   0000000076d41465 2 bytes [D4, 76]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5300] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155  0000000076d414bb 2 bytes [D4, 76]

.text   ...                                                                                                                                            * 2
 

---- Threads - GMER 2.1 ----
 

Thread  C:\Windows\SysWOW64\ntdll.dll [1708:1712]                                                                                                      00000000003fc18f

Thread  C:\Windows\SysWOW64\ntdll.dll [1708:1772]                                                                                                      0000000072c18f48

Thread  C:\Windows\SysWOW64\ntdll.dll [1708:1788]                                                                                                      0000000072c18f48

Thread  C:\Windows\SysWOW64\ntdll.dll [1708:1792]                                                                                                      0000000072871c10

Thread  C:\Windows\SysWOW64\ntdll.dll [1708:2872]                                                                                                      000000006fff5880

Thread  C:\Windows\SysWOW64\ntdll.dll [1708:2884]                                                                                                      000000006fff3520

Thread  C:\Windows\SysWOW64\ntdll.dll [1708:2888]                                                                                                      000000006ffd3e60

Thread  C:\Windows\SysWOW64\ntdll.dll [1708:5848]                                                                                                      000000006fff5880

Thread  C:\Windows\SysWOW64\ntdll.dll [1708:6360]                                                                                                      0000000072945590

Thread  C:\Windows\SysWOW64\ntdll.dll [1708:3444]                                                                                                      0000000072945d70

Thread  C:\Windows\SysWOW64\ntdll.dll [1708:5792]                                                                                                      000000006fff5880

Thread  C:\Windows\SysWOW64\ntdll.dll [1708:6712]                                                                                                      000000006fff5880

Thread  C:\Windows\System32\svchost.exe [6096:4220]                                                                                                    000007fef1f79688
 

---- EOF - GMER 2.1 ----

Danke erstmal für die schnell und freundliche Antwort :applaus:

Hier die benötigten logs:

AdwCleaner:

Code:

# AdwCleaner v4.108 - Bericht erstellt am 21/01/2015 um 21:53:49

# Aktualisiert 17/01/2015 von Xplode

# Database : 2015-01-18.1 [Live]

# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)

# Benutzername : Fred - FRED-PC

# Gestartet von : C:\Users\Fred\Downloads\AdwCleaner_4.108.exe

# Option : Löschen
 

***** [ Dienste ] *****
 
 

***** [ Dateien / Ordner ] *****
 

Ordner Gelöscht : C:\ProgramData\apn

Ordner Gelöscht : C:\ProgramData\Partner

Ordner Gelöscht : C:\ProgramData\Trymedia

Ordner Gelöscht : C:\ProgramData\WindowsMangerProtect

Ordner Gelöscht : C:\Windows\SysWOW64\SearchProtect

Ordner Gelöscht : C:\Users\Fred\AppData\Local\Temp\apn

Ordner Gelöscht : C:\Users\Fred\AppData\Local\PackageAware

Ordner Gelöscht : C:\Users\Fred\AppData\LocalLow\IE-BHO

Ordner Gelöscht : C:\Users\Fred\AppData\Roaming\OpenCandy

Ordner Gelöscht : C:\Users\Fred\AppData\Roaming\Security Systems

Ordner Gelöscht : C:\Users\Fred\AppData\Roaming\WebExtend

Ordner Gelöscht : C:\Users\Fred\AppData\Roaming\Mozilla\Firefox\Profiles\ppc2ynj6.default\Extensions\faststartff@gmail.com

Ordner Gelöscht : C:\Users\Fred\AppData\Roaming\Mozilla\Firefox\Profiles\ppc2ynj6.default\Extensions\sparpilot@sparpilot.com

Datei Gelöscht : C:\END

Datei Gelöscht : C:\Users\Fred\AppData\Roaming\Mozilla\Firefox\Profiles\ppc2ynj6.default\invalidprefs.js

Datei Gelöscht : C:\Users\Fred\AppData\Roaming\Mozilla\Firefox\Profiles\ppc2ynj6.default\searchplugins\Askcom.xml

Datei Gelöscht : C:\Users\Fred\AppData\Roaming\Mozilla\Firefox\Profiles\ppc2ynj6.default\searchplugins\ask-search.xml

Datei Gelöscht : C:\Users\Fred\AppData\Roaming\Mozilla\Firefox\Profiles\ppc2ynj6.default\searchplugins\trovi-search.xml

Datei Gelöscht : C:\Users\Fred\AppData\Roaming\Mozilla\Firefox\Profiles\ppc2ynj6.default\user.js
 

***** [ Tasks ] *****
 
 

***** [ Verknüpfungen ] *****
 

Verknüpfung Desinfiziert : C:\Users\Public\Desktop\Google Chrome.lnk

Verknüpfung Desinfiziert : C:\Users\Public\Desktop\Mozilla Firefox.lnk

Verknüpfung Desinfiziert : C:\Users\Fred\Desktop\Internet Explorer (64-bit).lnk

Verknüpfung Desinfiziert : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox 4.0 Beta 10.lnk

Verknüpfung Desinfiziert : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

Verknüpfung Desinfiziert : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk

Verknüpfung Desinfiziert : C:\Users\Fred\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

Verknüpfung Desinfiziert : C:\Users\Fred\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk

Verknüpfung Desinfiziert : C:\Users\Fred\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk

Verknüpfung Desinfiziert : C:\Users\Fred\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk

Verknüpfung Desinfiziert : C:\Users\Fred\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox 4.0 Beta 4.lnk

Verknüpfung Desinfiziert : C:\Users\Fred\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox 4.0 Beta 4.lnk
 

***** [ Registrierungsdatenbank ] *****
 

Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [faststartff@gmail.com]

Schlüssel Gelöscht : HKCU\Software\Google\Chrome\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protector_dll.protectorbho

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protector_dll.protectorbho.1

Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WindowsMangerProtect

Schlüssel Gelöscht : HKCU\Software\Mozilla\Extends

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A1CCCE0D-AE21-42A2-BE58-8E6109410995}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8F0B76E1-4E46-427B-B55B-B90593468AC6}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}

Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}

Schlüssel Gelöscht : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}

Schlüssel Gelöscht : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}

Daten Wiederhergestellt : HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command

Daten Wiederhergestellt : HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{09DBF6C9-48D6-4340-867C-35A386BB8580}

Schlüssel Gelöscht : HKCU\Software\Softonic

Schlüssel Gelöscht : HKLM\SOFTWARE\supWindowsMangerProtect

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WindowsMangerProtect

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{EE171732-BEB4-4576-887D-CB62727F01CA}
 

***** [ Browser ] *****
 

-\\ Internet Explorer v10.0.9200.16521
 

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Default_Page_URL]
 

-\\ Mozilla Firefox v32.0.3 (x86 de)
 

[ppc2ynj6.default\prefs.js] - Zeile gelöscht : user_pref("avira.safe_search.prev_newtab", "chrome://quick_start/content/index.html");

[ppc2ynj6.default\prefs.js] - Zeile gelöscht : user_pref("browser.newtab.url", "chrome://quick_start/content/index.html");

[ppc2ynj6.default\prefs.js] - Zeile gelöscht : user_pref("browser.search.order.1", "Ask.com");

[ppc2ynj6.default\prefs.js] - Zeile gelöscht : user_pref("browser.startup.homepage", "hxxp://search.conduit.com/?ctid=CT3319434&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=4&UP=SPC029EA41-EE54-4506-B60F-1447AB21B9BE&SSPV=");

[ppc2ynj6.default\prefs.js] - Zeile gelöscht : user_pref("browser.uiCustomization.state", "{\"placements\":{\"PanelUI-contents\":[\"edit-controls\",\"zoom-controls\",\"new-window-button\",\"privatebrowsing-button\",\"save-page-button\",\"print-but[...]

[ppc2ynj6.default\prefs.js] - Zeile gelöscht : user_pref("extensions.quick_start.enable_search1", false);

[ppc2ynj6.default\prefs.js] - Zeile gelöscht : user_pref("extensions.quick_start.sd.closeWindowWithLastTab_prev_state", false);

[ppc2ynj6.default\prefs.js] - Zeile gelöscht : user_pref("extensions.safesearch.MP_DISTINCT_ID", "\"1480db0ee9db6-0df877eb0875e88-43514136-0-1480db0ee9ef1\"");

[ppc2ynj6.default\prefs.js] - Zeile gelöscht : user_pref("extensions.safesearch.SAUTH_expires_at", "1422203652");

[ppc2ynj6.default\prefs.js] - Zeile gelöscht : user_pref("extensions.safesearch.SAUTH_rndsnr", "\"b4de96ef8118d9ab26a5dc14e9f2d908ca62edcc\"");

[ppc2ynj6.default\prefs.js] - Zeile gelöscht : user_pref("extensions.safesearch.SAUTH_userid", "4293793721");

[ppc2ynj6.default\prefs.js] - Zeile gelöscht : user_pref("extensions.safesearch.SAUTH_utoken", "\"87d00f71ffd01cb73f7d3707e9f9d6dc43f11455\"");

[ppc2ynj6.default\prefs.js] - Zeile gelöscht : user_pref("extensions.safesearch.install", "1408978972327");
 

-\\ Google Chrome v39.0.2171.99
 

[C:\Users\Fred\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://search.conduit.com/Results.aspx?ctid=CT3319434&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SPC029EA41-EE54-4506-B60F-1447AB21B9BE&q={searchTerms}&SSPV=

[C:\Users\Fred\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://search.conduit.com/Results.aspx?ctid=CT3319434&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SPC029EA41-EE54-4506-B60F-1447AB21B9BE&q={searchTerms}&SSPV=

[C:\Users\Fred\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://www.sweet-page.com/web/?type=ds&ts=1412980467&from=sof&uid=WDCXWD6400BEVT-22A0RT0_WD-WX71A106919369193&q={searchTerms}

[C:\Users\Fred\AppData\Local\Google\Chrome\User Data\Default\preferences] - Gelöscht [Startup_URLs] : hxxp://suggest.search.conduit.com/CSuggestJson.ashx?prefix={searchTerms}

[C:\Users\Fred\AppData\Local\Google\Chrome\User Data\Default\preferences] - Gelöscht [Startup_URLs] : hxxp://search.conduit.com/Results.aspx?ctid=CT3319434&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SPC029EA41-EE54-4506-B60F-1447AB21B9BE&q={searchTerms}&SSPV=

[C:\Users\Fred\AppData\Local\Google\Chrome\User Data\Default\preferences] - Gelöscht [Startup_URLs] : hxxp://www.sweet-page.com/?type=hp&ts=1412980467&from=sof&uid=WDCXWD6400BEVT-22A0RT0_WD-WX71A106919369193
 

*************************
 

AdwCleaner[R0].txt - [9112 octets] - [21/01/2015 21:46:53]

AdwCleaner[S0].txt - [9515 octets] - [21/01/2015 21:53:49]
 

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [9575 octets] ##########

Malwarebytes Anti Malware:

Code:

Malwarebytes Anti-Malware

www.malwarebytes.org
 
 

Protection, 21.01.2015 22:04:34, SYSTEM, FRED-PC, Protection, Malware Protection, Starting, 

Protection, 21.01.2015 22:04:34, SYSTEM, FRED-PC, Protection, Malware Protection, Started, 

Protection, 21.01.2015 22:04:34, SYSTEM, FRED-PC, Protection, Malicious Website Protection, Starting, 

Update, 21.01.2015 22:04:42, SYSTEM, FRED-PC, Manual, Remediation Database, 2013.10.16.1, 2014.12.6.1, 

Update, 21.01.2015 22:04:42, SYSTEM, FRED-PC, Manual, Rootkit Database, 2014.11.18.1, 2015.1.14.1, 

Update, 21.01.2015 22:04:48, SYSTEM, FRED-PC, Manual, Malware Database, 2014.11.20.6, 2015.1.21.10, 

Protection, 21.01.2015 22:04:48, SYSTEM, FRED-PC, Protection, Refresh, Starting, 

Protection, 21.01.2015 22:05:23, SYSTEM, FRED-PC, Protection, Malicious Website Protection, Started, 

Protection, 21.01.2015 22:05:23, SYSTEM, FRED-PC, Protection, Malicious Website Protection, Stopping, 

Protection, 21.01.2015 22:05:23, SYSTEM, FRED-PC, Protection, Malicious Website Protection, Stopped, 

Protection, 21.01.2015 22:05:29, SYSTEM, FRED-PC, Protection, Refresh, Success, 

Protection, 21.01.2015 22:05:29, SYSTEM, FRED-PC, Protection, Malicious Website Protection, Starting, 

Protection, 21.01.2015 22:05:29, SYSTEM, FRED-PC, Protection, Malicious Website Protection, Started, 

Update, 21.01.2015 22:55:44, SYSTEM, FRED-PC, Scheduler, Malware Database, 2015.1.21.10, 2015.1.21.11, 

Protection, 21.01.2015 22:55:45, SYSTEM, FRED-PC, Protection, Refresh, Starting, 

Protection, 21.01.2015 22:55:45, SYSTEM, FRED-PC, Protection, Malicious Website Protection, Stopping, 

Protection, 21.01.2015 22:55:45, SYSTEM, FRED-PC, Protection, Malicious Website Protection, Stopped, 

Protection, 21.01.2015 22:56:26, SYSTEM, FRED-PC, Protection, Refresh, Success, 

Protection, 21.01.2015 22:56:26, SYSTEM, FRED-PC, Protection, Malicious Website Protection, Starting, 

Protection, 21.01.2015 22:56:26, SYSTEM, FRED-PC, Protection, Malicious Website Protection, Started, 
 

(end)

FRST.txt:

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 18-01-2015 01

Ran by Fred (administrator) on FRED-PC on 21-01-2015 23:06:03

Running from C:\Users\Fred\Downloads

Loaded Profiles: Fred &  (Available profiles: Fred)

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 10 (Default browser: FF)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(AMD) C:\Windows\System32\atiesrxx.exe

(AMD) C:\Windows\System32\atieclxx.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(LSI Corporation) C:\Program Files\LSI SoftModem\agr64svc.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe

(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GregHSRW.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe

(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe

(Acer Incorporated) C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe

(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe

(Acer) C:\Program Files\Acer\Acer Updater\UpdaterService.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe

(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe

(AlcorMicro Co., Ltd.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe

(Egis Technology Inc.) C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

() C:\Windows\PLFSetI.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe

(ICQ) C:\Users\Fred\AppData\Roaming\ICQM\icq.exe

(Tango Inc.) C:\Program Files (x86)\Tango\Tango.exe

(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe

(Acer Incorporated) C:\Program Files (x86)\Acer\Acer VCM\AcerVCM.exe

(Egis Technology Inc.) C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe

(CyberLink Corp.) C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe

(Acer Corp.) C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe

(CyberLink Corp.) C:\Program Files (x86)\Cyberlink\PowerDVD10\PDVD10Serv.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox 4.0 Beta 4\firefox.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox 4.0 Beta 4\plugin-container.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_257.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_257.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe

(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE

(Microsoft Corporation) C:\Windows\splwow64.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [AmIcoSinglun64] => C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [323072 2009-07-22] (AlcorMicro Co., Ltd.)

HKLM\...\Run: [IAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-05] (Intel Corporation)

HKLM\...\Run: [mwlDaemon] => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe [349480 2009-09-11] (Egis Technology Inc.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8312352 2009-10-29] (Realtek Semiconductor)

HKLM\...\Run: [PLFSetI] => C:\Windows\PLFSetI.exe [200704 2009-11-20] ()

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1842472 2009-09-18] (Synaptics Incorporated)

HKLM\...\Run: [Acer ePower Management] => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [823840 2009-09-30] (Acer Incorporated)

HKLM-x32\...\Run: [BackupManagerTray] => C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe [261888 2009-09-25] (NewTech Infosystems, Inc.)

HKLM-x32\...\Run: [EgisTecLiveUpdate] => C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe [199464 2009-08-04] (Egis Technology Inc.)

HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-12-09] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [1094736 2009-11-02] (Dritek System Inc.)

HKLM-x32\...\Run: [ArcadeDeluxeAgent] => C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe [419112 2009-10-29] (CyberLink Corp.)

HKLM-x32\...\Run: [PlayMovie] => C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe [181480 2009-11-12] (Acer Corp.)

HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [87336 2010-02-02] (CyberLink Corp.)

HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)

HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2012-10-25] (Apple Inc.)

HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [702768 2014-12-16] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-08-16] (Apple Inc.)

HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [126200 2014-11-20] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\RunOnce: [Malwarebytes Anti-Malware (cleanup)] => C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\mbamdor.exe [54072 2014-11-21] (Malwarebytes Corporation)

HKU\S-1-5-21-432033561-2934589633-1803115819-1001\...\Run: [ImpulseFastStart] => C:\Program Files (x86)\Stardock\Impulse\Impulse.exe [1717616 2008-10-14] (Stardock Corporation)

HKU\S-1-5-21-432033561-2934589633-1803115819-1001\...\Run: [PureSync] => "C:\Program Files (x86)\PureSync\PureSyncTray.exe"

HKU\S-1-5-21-432033561-2934589633-1803115819-1001\...\Run: [EADM] => C:\Program Files (x86)\Origin\Origin.exe [3618648 2014-12-29] (Electronic Arts)

HKU\S-1-5-21-432033561-2934589633-1803115819-1001\...\Run: [swg] => C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2009-11-05] (Google Inc.)

HKU\S-1-5-21-432033561-2934589633-1803115819-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [21444224 2014-05-08] (Skype Technologies S.A.)

HKU\S-1-5-21-432033561-2934589633-1803115819-1001\...\Run: [icq] => C:\Users\Fred\AppData\Roaming\ICQM\icq.exe [35239432 2014-11-07] (ICQ)

HKU\S-1-5-21-432033561-2934589633-1803115819-1001\...\Run: [Tango] => C:\Program Files (x86)\Tango\Tango.exe [13489992 2011-11-04] (Tango Inc.)

HKU\S-1-5-21-432033561-2934589633-1803115819-1001\...\MountPoints2: {0e86b2b0-26ef-11df-b21e-806e6f6e6963} - D:\Autorun.exe

HKU\S-1-5-21-432033561-2934589633-1803115819-1001\...\MountPoints2: {292694cd-07a6-11e2-93f5-00262d91798f} - E:\Startme.exe

HKU\S-1-5-21-432033561-2934589633-1803115819-1001\...\MountPoints2: {36eeecac-8451-11e0-bfec-00262d91798f} - E:\AutoRun.exe

HKU\S-1-5-21-432033561-2934589633-1803115819-1001\...\MountPoints2: {44fb2512-e2af-11df-891d-00262d91798f} - E:\AutoRun.exe

HKU\S-1-5-21-432033561-2934589633-1803115819-1001\...\MountPoints2: {a6d15461-d612-11df-b1e6-00262d91798f} - E:\AutoRun.exe

HKU\S-1-5-21-432033561-2934589633-1803115819-1001\...\MountPoints2: {a6d15485-d612-11df-b1e6-00262d91798f} - E:\AutoRun.exe

HKU\S-1-5-21-432033561-2934589633-1803115819-1001\...\MountPoints2: {b718c7af-8f2f-11e3-8aa0-00262d91798f} - E:\LGAutoRun.exe

HKU\S-1-5-21-432033561-2934589633-1803115819-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [ImpulseFastStart] => C:\Program Files (x86)\Stardock\Impulse\Impulse.exe [1717616 2008-10-14] (Stardock Corporation)

HKU\S-1-5-21-432033561-2934589633-1803115819-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [PureSync] => "C:\Program Files (x86)\PureSync\PureSyncTray.exe"

HKU\S-1-5-21-432033561-2934589633-1803115819-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [EADM] => C:\Program Files (x86)\Origin\Origin.exe [3618648 2014-12-29] (Electronic Arts)

HKU\S-1-5-21-432033561-2934589633-1803115819-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [swg] => C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2009-11-05] (Google Inc.)

HKU\S-1-5-21-432033561-2934589633-1803115819-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [21444224 2014-05-08] (Skype Technologies S.A.)

HKU\S-1-5-21-432033561-2934589633-1803115819-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [icq] => C:\Users\Fred\AppData\Roaming\ICQM\icq.exe [35239432 2014-11-07] (ICQ)

HKU\S-1-5-21-432033561-2934589633-1803115819-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Tango] => C:\Program Files (x86)\Tango\Tango.exe [13489992 2011-11-04] (Tango Inc.)

HKU\S-1-5-21-432033561-2934589633-1803115819-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {0e86b2b0-26ef-11df-b21e-806e6f6e6963} - D:\Autorun.exe

HKU\S-1-5-21-432033561-2934589633-1803115819-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {292694cd-07a6-11e2-93f5-00262d91798f} - E:\Startme.exe

HKU\S-1-5-21-432033561-2934589633-1803115819-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {36eeecac-8451-11e0-bfec-00262d91798f} - E:\AutoRun.exe

HKU\S-1-5-21-432033561-2934589633-1803115819-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {44fb2512-e2af-11df-891d-00262d91798f} - E:\AutoRun.exe

HKU\S-1-5-21-432033561-2934589633-1803115819-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {a6d15461-d612-11df-b1e6-00262d91798f} - E:\AutoRun.exe

HKU\S-1-5-21-432033561-2934589633-1803115819-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {a6d15485-d612-11df-b1e6-00262d91798f} - E:\AutoRun.exe

HKU\S-1-5-21-432033561-2934589633-1803115819-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {b718c7af-8f2f-11e3-8aa0-00262d91798f} - E:\LGAutoRun.exe

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Acer VCM.lnk

ShortcutTarget: Acer VCM.lnk -> C:\Program Files (x86)\Acer\Acer VCM\AcerVCM.exe (Acer Incorporated)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk

ShortcutTarget: Adobe Gamma Loader.lnk -> C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)

ShellIconOverlayIdentifiers: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x64\psdprotect.dll (Egis Technology Inc.)

ShellIconOverlayIdentifiers-x32: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\psdprotect.dll (Egis Technology Inc.)
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = about:blank

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank

HKU\S-1-5-21-432033561-2934589633-1803115819-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.giga.de/androidnews/

HKU\S-1-5-21-432033561-2934589633-1803115819-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.giga.de/androidnews/

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

SearchScopes: HKLM-x32 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW

SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-21-432033561-2934589633-1803115819-1001 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_deAT383

SearchScopes: HKU\S-1-5-21-432033561-2934589633-1803115819-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_deAT383

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation)

BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

Toolbar: HKU\S-1-5-21-432033561-2934589633-1803115819-1001 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

Toolbar: HKU\S-1-5-21-432033561-2934589633-1803115819-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

DPF: HKLM {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} hxxp://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection2.cab

DPF: HKLM-x32 {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework//microsoft/wrc32.ocx

Tcpip\Parameters: [DhcpNameServer] 195.34.133.21 212.186.211.21
 

FireFox:

========

FF ProfilePath: C:\Users\Fred\AppData\Roaming\Mozilla\Firefox\Profiles\ppc2ynj6.default

FF DefaultSearchEngine: Google

FF NetworkProxy: "no_proxies_on", "*.local"

FF NetworkProxy: "type", 0

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_257.dll ()

FF Plugin: @microsoft.com/GENUINE -> disabled No File

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_257.dll ()

FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @playstation.com/PsndlCheck,version=1.00 -> C:\Program Files (x86)\Sony\PLAYSTATION Network Downloader\nppsndl.dll (Sony Computer Entertainment Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF SearchPlugin: C:\Users\Fred\AppData\Roaming\Mozilla\Firefox\Profiles\ppc2ynj6.default\searchplugins\avira-safesearch.xml

FF Extension: Avira Browser Safety - C:\Users\Fred\AppData\Roaming\Mozilla\Firefox\Profiles\ppc2ynj6.default\Extensions\abs@avira.com [2014-12-12]

FF Extension: Amazon-Icon - C:\Users\Fred\AppData\Roaming\Mozilla\Firefox\Profiles\ppc2ynj6.default\Extensions\amazon-icon@giga.de [2014-10-11]

FF Extension: Avira SafeSearch - C:\Users\Fred\AppData\Roaming\Mozilla\Firefox\Profiles\ppc2ynj6.default\Extensions\safesearch@avira.com [2015-01-21]

FF Extension: Ex-Assistance-Pro - C:\Users\Fred\AppData\Roaming\Mozilla\Firefox\Profiles\ppc2ynj6.default\Extensions\{0dbda103-5b1e-4059-ac8f-15aeb3862327} [2015-01-21]

FF Extension: Advisor Lite - C:\Users\Fred\AppData\Roaming\Mozilla\Firefox\Profiles\ppc2ynj6.default\Extensions\{536296fd-0562-4b56-8f95-1a25c5ffc83f} [2014-10-10]

FF Extension: Test Pilot - C:\Users\Fred\AppData\Roaming\Mozilla\Firefox\Profiles\ppc2ynj6.default\Extensions\testpilot@labs.mozilla.com.xpi [2011-02-01]

FF Extension: Speed Helper Pro - C:\Users\Fred\AppData\Roaming\Mozilla\Firefox\Profiles\ppc2ynj6.default\Extensions\{5bb77e51-6a94-46cc-9089-278110be0fdd}.xpi [2014-12-23]

FF Extension: {f30826b0-94ec-4c03-917b-27c345b7572e} - C:\Users\Fred\AppData\Roaming\Mozilla\Firefox\Profiles\ppc2ynj6.default\Extensions\{f30826b0-94ec-4c03-917b-27c345b7572e}.xpi [2014-12-14]

FF HKU\S-1-5-21-432033561-2934589633-1803115819-1001\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff

FF Extension: Download videos and MP3s from YouTube - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-02-06]

FF HKU\S-1-5-21-432033561-2934589633-1803115819-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff

FF Extension: No Name - C:\Users\Fred\AppData\Roaming\Mozilla\Firefox\Profiles\ppc2ynj6.default\extensions\fx@foxysecureKDJJHVLSDUVFU.com [Not Found]
 

Chrome: 

=======

Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION

CHR Profile: C:\Users\Fred\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Docs) - C:\Users\Fred\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-05-15]

CHR Extension: (Google Drive) - C:\Users\Fred\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-05-15]

CHR Extension: (YouTube) - C:\Users\Fred\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-05-15]

CHR Extension: (Google Search) - C:\Users\Fred\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-05-15]

CHR Extension: (Gmail) - C:\Users\Fred\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-05-15]

CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path

CHR HKLM-x32\...\Chrome\Extension: [ocbnpbkmjpgbdcgiflkgkpnkinifpgpj] - C:\Users\Fred\ChromeExtensions\ocbnpbkmjpgbdcgiflkgkpnkinifpgpj\amazon-icon-2.crx [2014-10-11]
 

==================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-12-16] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-12-16] (Avira Operations GmbH & Co. KG)

R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [992560 2014-12-16] (Avira Operations GmbH & Co. KG)

R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [166192 2014-11-20] (Avira Operations GmbH & Co. KG)

S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)

S3 MWLService; C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [305448 2009-09-11] (Egis Technology Inc.)

S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [1903472 2014-12-29] (Electronic Arts)

R2 RS_Service; C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe [253952 2009-07-10] (Acer Incorporated) [File not signed]

R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe [2100024 2013-08-30] (TuneUp Software)

R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-14] (Microsoft Corporation)

S3 aspnet_state; %SystemRoot%\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [X]
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2014-03-12] ()

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-14] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-10-14] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-12-09] (Avira Operations GmbH & Co. KG)

R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2014-03-12] ()

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)

R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-01-21] (Malwarebytes Corporation)

R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation)

S3 s1039bus; C:\Windows\System32\DRIVERS\s1039bus.sys [127600 2010-03-15] (MCCI Corporation)

S3 s1039mdfl; C:\Windows\System32\DRIVERS\s1039mdfl.sys [19568 2010-03-15] (MCCI Corporation)

S3 s1039mdm; C:\Windows\System32\DRIVERS\s1039mdm.sys [161904 2010-03-15] (MCCI Corporation)

S3 s1039mgmt; C:\Windows\System32\DRIVERS\s1039mgmt.sys [141424 2010-03-15] (MCCI Corporation)

S3 s1039nd5; C:\Windows\System32\DRIVERS\s1039nd5.sys [34416 2010-03-15] (MCCI Corporation)

S3 s1039obex; C:\Windows\System32\DRIVERS\s1039obex.sys [137328 2010-03-15] (MCCI Corporation)

S3 s1039unic; C:\Windows\System32\DRIVERS\s1039unic.sys [158320 2010-03-15] (MCCI Corporation)

R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesDriver64.sys [14112 2013-08-21] (TuneUp Software)

R2 TurboB; C:\Windows\System32\DRIVERS\TurboB.sys [13784 2009-11-02] ()

U0 xjglidb; C:\Windows\System32\drivers\wnst.sys [79064 2015-01-21] (Malwarebytes Corporation)

S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X]

S3 hwusbdev; system32\DRIVERS\ewusbdev.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2015-01-21 23:00 - 2015-01-21 23:00 - 00079064 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\wnst.sys

2015-01-21 22:04 - 2015-01-21 22:56 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2015-01-21 22:04 - 2015-01-21 22:04 - 00001106 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2015-01-21 22:04 - 2015-01-21 22:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2015-01-21 22:04 - 2015-01-21 22:04 - 00000000 ____D () C:\ProgramData\Malwarebytes

2015-01-21 22:04 - 2015-01-21 22:04 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2015-01-21 22:04 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2015-01-21 22:04 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2015-01-21 22:04 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2015-01-21 22:02 - 2015-01-21 22:02 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Fred\Downloads\mbam-setup-2.0.4.1028.exe

2015-01-21 21:46 - 2015-01-21 21:53 - 00000000 ___DC () C:\AdwCleaner

2015-01-21 21:44 - 2015-01-21 21:44 - 02186752 _____ () C:\Users\Fred\Downloads\AdwCleaner_4.108.exe

2015-01-18 20:43 - 2015-01-18 20:43 - 00275544 _____ () C:\Windows\Minidump\011815-26520-01.dmp

2015-01-18 20:37 - 2015-01-18 20:37 - 00004690 _____ () C:\Users\Fred\Desktop\GMER.txt

2015-01-18 20:36 - 2015-01-18 20:36 - 00004690 _____ () C:\Users\Fred\Downloads\18012015gmer.log

2015-01-18 19:58 - 2015-01-18 19:58 - 00380416 _____ () C:\Users\Fred\Downloads\Gmer-19357.exe

2015-01-18 19:47 - 2015-01-18 19:49 - 00039104 _____ () C:\Users\Fred\Downloads\Addition.txt

2015-01-18 19:45 - 2015-01-21 23:06 - 00027923 _____ () C:\Users\Fred\Downloads\FRST.txt

2015-01-18 19:45 - 2015-01-21 23:06 - 00000000 ___DC () C:\FRST

2015-01-18 19:43 - 2015-01-18 19:44 - 02126848 _____ (Farbar) C:\Users\Fred\Downloads\FRST64.exe

2015-01-18 19:42 - 2015-01-18 20:54 - 00000470 _____ () C:\Users\Fred\Downloads\defogger_disable.log

2015-01-18 19:42 - 2015-01-18 19:42 - 00000000 _____ () C:\Users\Fred\defogger_reenable

2015-01-18 19:37 - 2015-01-18 19:37 - 00050477 _____ () C:\Users\Fred\Downloads\Defogger.exe

2015-01-18 18:47 - 2015-01-18 21:32 - 00000000 ____D () C:\Users\Fred\Desktop\MalwareProblem

2015-01-04 16:59 - 2015-01-04 16:59 - 00001815 _____ () C:\Users\Public\Desktop\Tango.lnk

2015-01-04 16:59 - 2015-01-04 16:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tango

2015-01-04 16:58 - 2015-01-04 16:59 - 00000000 ____D () C:\Users\Fred\AppData\Local\tango

2015-01-04 16:58 - 2015-01-04 16:59 - 00000000 ____D () C:\Program Files (x86)\Tango

2015-01-01 22:59 - 2015-01-01 22:59 - 00001520 _____ () C:\Users\Public\Desktop\SimCity 2000 Special Edition.lnk

2015-01-01 22:59 - 2015-01-01 22:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SimCity 2000 Special Edition

2014-12-23 18:02 - 2014-12-23 18:02 - 00003886 _____ () C:\Windows\System32\Tasks\Adobe Acrobat Update Task

2014-12-23 18:01 - 2014-12-23 18:01 - 00001141 _____ () C:\Users\Public\Desktop\Avira.lnk
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2015-01-21 23:01 - 2010-07-22 09:46 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2015-01-21 23:00 - 2010-06-09 20:12 - 00000000 ____D () C:\Users\Fred

2015-01-21 23:00 - 2009-10-05 22:35 - 00000000 ____D () C:\Windows\DeployWinRE2

2015-01-21 22:32 - 2013-05-15 20:03 - 00002179 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

2015-01-21 22:31 - 2013-04-02 19:04 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2015-01-21 22:07 - 2013-03-25 16:34 - 00000000 ____D () C:\ProgramData\Origin

2015-01-21 22:05 - 2010-03-03 19:07 - 02014502 _____ () C:\Windows\WindowsUpdate.log

2015-01-21 22:05 - 2009-07-14 05:45 - 00017600 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2015-01-21 22:05 - 2009-07-14 05:45 - 00017600 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2015-01-21 21:58 - 2013-09-01 17:51 - 00000000 ____D () C:\Users\Fred\AppData\Roaming\Skype

2015-01-21 21:56 - 2013-03-25 16:34 - 00000000 ____D () C:\Program Files (x86)\Origin

2015-01-21 21:56 - 2010-07-22 09:46 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2015-01-21 21:55 - 2013-07-22 13:21 - 00020475 _____ () C:\Windows\setupact.log

2015-01-21 21:55 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2015-01-21 21:54 - 2013-07-23 14:08 - 00015094 _____ () C:\Windows\PFRO.log

2015-01-21 21:53 - 2013-05-15 20:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome

2015-01-21 21:53 - 2012-09-15 09:37 - 00001146 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

2015-01-21 21:53 - 2012-09-15 09:37 - 00001134 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk

2015-01-21 21:53 - 2011-02-01 05:35 - 00001146 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox 4.0 Beta 10.lnk

2015-01-21 21:53 - 2010-07-22 09:25 - 00000967 _____ () C:\Users\Fred\Desktop\Internet Explorer (64-bit).lnk

2015-01-21 21:53 - 2010-06-09 20:15 - 00000997 _____ () C:\Users\Fred\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

2015-01-19 21:54 - 2013-10-10 16:47 - 00109568 ___SH () C:\Users\Fred\Thumbs.db

2015-01-19 21:53 - 2013-03-24 18:50 - 00000000 ____D () C:\Users\Fred\Desktop\AG

2015-01-18 20:43 - 2014-04-11 13:26 - 612097790 _____ () C:\Windows\MEMORY.DMP

2015-01-18 20:43 - 2013-04-30 19:33 - 00000000 ____D () C:\Windows\Minidump

2015-01-18 20:40 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF

2015-01-18 19:11 - 2013-03-24 18:51 - 00000000 ____D () C:\Users\Fred\Desktop\Combine

2015-01-14 00:35 - 2013-04-02 19:04 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2015-01-14 00:35 - 2012-06-29 20:10 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2015-01-14 00:35 - 2011-11-14 19:00 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2015-01-13 22:45 - 2014-09-22 17:16 - 00001342 _____ () C:\Users\Public\Desktop\Die Sims 4.lnk

2015-01-06 20:41 - 2013-03-25 16:35 - 00000000 ____D () C:\Users\Fred\AppData\Roaming\Origin

2015-01-01 22:59 - 2013-03-25 16:35 - 00000000 ____D () C:\Program Files (x86)\Origin Games

2015-01-01 22:59 - 2009-07-14 06:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games

2014-12-23 18:01 - 2014-08-25 15:57 - 00000000 ____D () C:\ProgramData\Package Cache

2014-12-23 18:01 - 2012-12-03 18:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira

2014-12-23 18:01 - 2012-12-03 18:55 - 00000000 ____D () C:\Program Files (x86)\Avira
 

==================== Files in the root of some directories =======

2009-11-05 04:32 - 2009-02-10 21:23 - 0192484 _____ () C:\Program Files (x86)\Common Files\Acer GameZone online.ico

2013-03-28 18:06 - 2013-05-06 19:14 - 0001112 _____ () C:\Users\Fred\AppData\Roaming\wklnhst.dat

2013-09-10 12:52 - 2013-09-10 13:08 - 0005120 _____ () C:\Users\Fred\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

2010-07-22 08:58 - 2010-07-22 08:58 - 0000092 _____ () C:\Users\Fred\AppData\Local\fusioncache.dat

2010-03-03 19:12 - 2010-03-03 19:15 - 0008278 _____ () C:\ProgramData\ArcadeDeluxe3.log

2009-11-05 04:33 - 2009-07-18 03:57 - 0036136 _____ (Oberon Media) C:\ProgramData\FullRemove.exe
 

Some content of TEMP:

====================

C:\Users\Fred\AppData\Local\Temp\amazonicon_v10.exe

C:\Users\Fred\AppData\Local\Temp\amazoninstallernircmdc.exe

C:\Users\Fred\AppData\Local\Temp\APNSetup.exe

C:\Users\Fred\AppData\Local\Temp\avgnt.exe

C:\Users\Fred\AppData\Local\Temp\CBSUpdate_1_3_Zusatzpaket.exe

C:\Users\Fred\AppData\Local\Temp\Fahr-Simulator_Upgrade_1.2_Setup.exe

C:\Users\Fred\AppData\Local\Temp\FoxySecurity6_FF_IE_Setup-GIGA.exe

C:\Users\Fred\AppData\Local\Temp\jre-7u71-windows-i586-iftw.exe

C:\Users\Fred\AppData\Local\Temp\Quarantine.exe

C:\Users\Fred\AppData\Local\Temp\sdan.exe

C:\Users\Fred\AppData\Local\Temp\sdapk.exe

C:\Users\Fred\AppData\Local\Temp\sdaspwn.exe

C:\Users\Fred\AppData\Local\Temp\SimBundD.exe

C:\Users\Fred\AppData\Local\Temp\SkypeSetup.exe

C:\Users\Fred\AppData\Local\Temp\sqlite3.dll
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-10-19 23:13
 

==================== End Of Log ============================

--- --- ---

--- --- ---

Addition.txt:

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 18-01-2015 01

Ran by Fred at 2015-01-21 23:07:22

Running from C:\Users\Fred\Downloads

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

(If an entry is included in the fixlist, it will be removed.)
 

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}

AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}

AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 

==================== Installed Programs ======================
 

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 

7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)

Acer Arcade Deluxe (HKLM-x32\...\InstallShield_{2637C347-9DAD-11D6-9EA2-00055D0CA761}) (Version: 3.0.7112 - CyberLink Corp.)

Acer Arcade Deluxe (x32 Version: 3.0.7112 - CyberLink Corp.) Hidden

Acer Backup Manager (HKLM-x32\...\InstallShield_{72B776E5-4530-4C4B-9453-751DF87D9D93}) (Version: 2.0.0.29 - NewTech Infosystems)

Acer Crystal Eye Webcam (HKLM-x32\...\{7760D94E-B1B5-40A0-9AA0-ABF942108755}) (Version: 5.2.9.3 - Suyin Optronics Corp)

Acer ePower Management (HKLM-x32\...\{3DB0448D-AD82-4923-B305-D001E521A964}) (Version: 4.05.3004 - Acer Incorporated)

Acer eRecovery Management (HKLM-x32\...\{7F811A54-5A09-4579-90E1-C93498E230D9}) (Version: 4.05.3005 - Acer Incorporated)

Acer GameZone Console (HKLM-x32\...\{8ed9688e-4f79-4308-91ca-f1c37ca142b4}_is1) (Version: 5.1.0.2 - Oberon Media, Inc.)

Acer GridVista (HKLM-x32\...\GridVista) (Version: 3.01.0730 - Acer Inc.)

Acer Registration (HKLM-x32\...\Acer Registration) (Version: 1.02.3006 - Acer Incorporated)

Acer ScreenSaver (HKLM-x32\...\Acer Screensaver) (Version: 1.1.2009.1217 - Acer Incorporated)

Acer VCM (HKLM-x32\...\{047F790A-7A2A-4B6A-AD02-38092BA63DAC}) (Version: 4.05.3000 - Acer Incorporated)

Acrobat.com (HKLM-x32\...\{287ECFA4-719A-2143-A09B-D6A12DE54E40}) (Version: 1.6.65 - Adobe Systems Incorporated)

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 2.0.2.12610 - Adobe Systems Inc.)

Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.257 - Adobe Systems Incorporated)

Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.257 - Adobe Systems Incorporated)

Adobe Photoshop 7.0 (HKLM-x32\...\Adobe Photoshop 7.0) (Version: 7.0 - Adobe Systems, Inc.)

Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)

Alcor Micro USB Card Reader (HKLM-x32\...\InstallShield_{DBCE1208-433D-4D3E-A26A-CB1B5E71A8F5}) (Version: 1.4.17.35005 - Alcor Micro Corp.)

Alcor Micro USB Card Reader (x32 Version: 1.4.17.35005 - Alcor Micro Corp.) Hidden

Alice Greenfingers (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112920767}) (Version:  - Oberon Media)

Amazonia (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11273477}) (Version:  - Oberon Media)

ANNO 1404 (HKLM-x32\...\{3D9CF3CA-3AB0-4A82-9853-D7C43FD1D775}) (Version: 1.00.0000 - Ubisoft)

Anno 1404 (x32 Version: 1.00.0000 - Ubisoft) Hidden

Apple Application Support (HKLM-x32\...\{5D09C772-ECB3-442B-9CC6-B4341C78FDC2}) (Version: 2.3.4 - Apple Inc.)

Apple Mobile Device Support (HKLM\...\{2F72F540-1F60-4266-9506-952B21D6640D}) (Version: 6.1.0.13 - Apple Inc.)

Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)

ATI Catalyst Install Manager (HKLM\...\{11F38253-8940-FFDA-D131-B14120C357E4}) (Version: 3.0.754.0 - ATI Technologies, Inc.)

Aurora Blu-ray Media Player (HKLM-x32\...\Aurora Blu-ray Media Player) (Version: 2.13.4.1435 - Aurora Software Inc.)

Avira (HKLM-x32\...\{e7c7c227-b742-4878-9425-f09bbf9951db}) (Version: 1.1.27.25527 - Avira Operations & Co. KG)

Avira (x32 Version: 1.1.27.25527 - Avira Operations & Co. KG) Hidden

Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.7.468 - Avira)

Backup Manager Basic (x32 Version: 2.0.0.29 - NewTech Infosystems) Hidden

Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)

Broadcom Gigabit NetLink Controller (HKLM\...\{A325B368-A9EC-40EF-A95C-9DEAD3683AE3}) (Version: 12.33.03 - Broadcom Corporation)

Bus Simulator 2008 Demo (HKLM-x32\...\Bus Simulator 2008 Demo_is1) (Version:  - contendo media Ltd.)

ccc-core-static (x32 Version: 2009.1209.2335.42329 - Ihr Firmenname) Hidden

CCleaner (HKLM\...\CCleaner) (Version: 4.01 - Piriform)

Chicken Invaders 2 (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110209593}) (Version:  - Oberon Media)

Compatibility Pack für 2007 Office System (HKLM-x32\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)

CyberLink PowerDVD 10 (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.1516 - CyberLink Corp.)

D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden

Dairy Dash (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-115053100}) (Version:  - Oberon Media)

Die Sims™ 3 (HKLM-x32\...\{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}) (Version: 1.67.2 - Electronic Arts)

Die Sims™ 3 70er, 80er & 90er Accessoires (HKLM-x32\...\{E1868CAE-E3B9-4099-8C18-AA8944D336FD}) (Version: 17.0.77 - Electronic Arts)

Die Sims™ 3 Einfach tierisch (HKLM-x32\...\{C12631C6-804D-4B32-B0DD-8A496462F106}) (Version: 10.0.96 - Electronic Arts)

Die Sims™ 3 Inselparadies (HKLM-x32\...\{DB21639E-FE55-432C-BCA2-0C5249E3F79E}) (Version: 19.0.101 - Electronic Arts)

Die Sims™ 3 Jahreszeiten (HKLM-x32\...\{3DE92282-CB49-434F-81BF-94E5B380E889}) (Version: 16.0.136 - Electronic Arts)

Die Sims™ 3 Late Night (HKLM-x32\...\{45057FCE-5784-48BE-8176-D9D00AF56C3C}) (Version: 6.0.81 - Electronic Arts)

Die Sims™ 3 Lebensfreude (HKLM-x32\...\{E6B88BD6-E4B2-4701-A648-B6DAC6E491CC}) (Version: 8.0.152 - Electronic Arts)

Die Sims™ 3 Luxus-Accessoires (HKLM-x32\...\{71828142-5A24-4BD0-97E7-976DA08CE6CF}) (Version: 3.0.38 - Electronic Arts)

Die Sims™ 3 Reiseabenteuer (HKLM-x32\...\{BA26FFA5-6D47-47DB-BE56-34C357B5F8CC}) (Version: 2.0.86 - Electronic Arts)

Die Sims™ 3 Showtime (HKLM-x32\...\{3BBFD444-5FAB-49F6-98B1-A1954E831399}) (Version: 12.0.273 - Electronic Arts)

Die Sims™ 3 Stadt-Accessoires (HKLM-x32\...\{7B11296A-F894-449C-8DF6-6AAAA7D4D118}) (Version: 9.0.73 - Electronic Arts)

Die Sims™ 3 Supernatural (HKLM-x32\...\{B37DAFA5-717D-41F8-BDFB-3A4B68C0B3A1}) (Version: 15.0.135 - Electronic Arts)

Die Sims™ 3 Traumkarrieren (HKLM-x32\...\{910F4A29-1134-49E0-AD8B-56E4A3152BD1}) (Version: 4.0.87 - Electronic Arts)

Die Sims™ 3 Traumsuite-Accessoires (HKLM-x32\...\{08A25478-C5DD-4EA7-B168-3D687CA987FF}) (Version: 11.0.84 - Electronic Arts)

Die Sims™ 3 Wildes Studentenleben (HKLM-x32\...\{F26DE8EF-F2CF-40DC-8CDA-CC0D82D11B36}) (Version: 18.0.126 - Electronic Arts)

Die Sims™ 4 (HKLM-x32\...\{48EBEBBF-B9F8-4520-A3CF-89A730721917}) (Version: 1.3.32.1010 - Electronic Arts Inc.)

Die Sims™ 4 Erstelle einen Sim-Demo (HKLM-x32\...\{6908ED99-F02B-4E99-A202-3FAC99C510ED}) (Version: 1.0.237.100 - Electronic Arts Inc.)

Dream Day First Home (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113832110}) (Version:  - Oberon Media)

eSobi v2 (HKLM-x32\...\InstallShield_{15D967B5-A4BE-42AE-9E84-64CD062B25AA}) (Version: 2.0.4.000274 - esobi Inc.)

eSobi v2 (x32 Version: 2.0.4.000274 - esobi Inc.) Hidden

Farm Frenzy 2 (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11531173}) (Version:  - Oberon Media)

FileViewPro (HKLM\...\FileViewPro_is1) (Version: 4.0 - stfx, Ath)

First Class Flurry (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-115208410}) (Version:  - Oberon Media)

Free YouTube to MP3 Converter version 3.12.20.1230 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.20.1230 - DVDVideoSoft Ltd.)

GameSpy Comrade (HKLM-x32\...\{176B3593-72F1-459C-829C-5E9671E2CB35}) (Version: 1.4.3.154 - GameSpy)

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 40.0.2214.91 - Google Inc.)

Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.5111.1712 - Google Inc.)

Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden

Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden

Granny In Paradise (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110551697}) (Version:  - Oberon Media)

Heroes of Hellas (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113786380}) (Version:  - Oberon Media)

HP Deskjet 1050 J410 series - Grundlegende Software für das Gerät (HKLM\...\{A7096369-9332-466C-8357-08770CDCE277}) (Version: 22.50.231.0 - Hewlett-Packard Co.)

HP Deskjet 1050 J410 series Hilfe (HKLM-x32\...\{5C90D8CF-F12A-41C6-9007-3B651A1F0D78}) (Version: 140.0.66.66 - Hewlett Packard)

HP Product Detection (HKLM-x32\...\{CAE7D1D9-3794-4169-B4DD-964ADBC534EE}) (Version: 10.7.9.0 - Hewlett-Packard Company)

IceChat 7.70 (Build 20101031) (HKLM-x32\...\IceChat_is1) (Version: 7.70 - IceChat Networks)

ICQ 8.2 (build 7138) (HKU\S-1-5-21-432033561-2934589633-1803115819-1001\...\ICQ) (Version: 8.2.7138.0 - ICQ)

ICQ 8.2 (build 7138) (HKU\S-1-5-21-432033561-2934589633-1803115819-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\ICQ) (Version: 8.2.7138.0 - ICQ)

Identity Card (HKLM-x32\...\Identity Card) (Version: 1.00.3003 - Acer Incorporated)

Impulse (HKLM-x32\...\Impulse) (Version:  - Stardock)

Impulse (x32 Version: 1.0 - Stardock Corporation) Hidden

Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 6.0.0.1179 - Intel Corporation)

Intel(R) Turbo Boost Technology Driver (HKLM-x32\...\{D6C630BF-8DBB-4042-8562-DC9A52CB6E7E}) (Version: 01.00.01.1002 - Intel Corporation)

Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version:  - Intel Corporation)

iTunes (HKLM\...\{427174C0-096E-40D9-9684-9C109BEE2CBF}) (Version: 11.0.5.5 - Apple Inc.)

Java 7 Update 71 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217045FF}) (Version: 7.0.710 - Oracle)

Java 8 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)

LAME v3.98.2 for Audacity (HKLM-x32\...\LAME for Audacity_is1) (Version:  - )

Launch Manager (HKLM-x32\...\LManager) (Version: 3.0.05 - Acer Inc.)

LSI HDA Modem (HKLM\...\LSI Soft Modem) (Version: 2.2.98 - LSI Corporation)

Mahjongg Master 4 (HKLM-x32\...\Mahjongg Master 4) (Version:  - )

Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)

Merriam Websters Spell Jam (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112662477}) (Version:  - Oberon Media)

Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden

Microsoft .NET Framework 1.1 (HKLM-x32\...\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}) (Version: 1.1.4322 - Microsoft)

Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)

Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)

Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0100-0407-0000-0000000FF1CE}_OMUI.de-de_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}) (Version:  - Microsoft)

Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)

Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)

Microsoft Office Home and Student 2007 (HKLM-x32\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)

Microsoft Office Language Pack 2007 - German/Deutsch (HKLM-x32\...\OMUI.de-de) (Version: 12.0.6612.1000 - Microsoft Corporation)

Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)

Microsoft Office PowerPoint Viewer 2007 (German) (HKLM-x32\...\{95120000-00AF-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)

Microsoft Office Suite Activation Assistant (HKLM-x32\...\{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}) (Version: 2.9 - Microsoft Corporation)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.20125.0 - Microsoft Corporation)

Microsoft SkyDrive (HKU\S-1-5-21-432033561-2934589633-1803115819-1001\...\SkyDriveSetup.exe) (Version: 16.4.6013.0910 - Microsoft Corporation)

Microsoft SkyDrive (HKU\S-1-5-21-432033561-2934589633-1803115819-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\SkyDriveSetup.exe) (Version: 16.4.6013.0910 - Microsoft Corporation)

Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM-x32\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)

Microsoft Works (HKLM-x32\...\{62F7DA7E-CCCB-439C-A760-00C3926E761F}) (Version: 9.7.0621 - Microsoft Corporation)

Mozilla Firefox 32.0.3 (x86 de) (HKLM-x32\...\Mozilla Firefox 32.0.3 (x86 de)) (Version: 32.0.3 - Mozilla)

Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)

MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)

MyWinLocker (HKLM-x32\...\{68301905-2DEA-41CE-A4D4-E8B443B099BA}) (Version: 3.1.76.0 - Egis Technology Inc.)

Need for Speed™ Most Wanted (HKLM-x32\...\{FB0127F3-985B-44CE-AE29-378CAF60B361}) (Version: 1.5.0.0 - Electronic Arts)

NTI Backup Now 5 (HKLM-x32\...\InstallShield_{12EFA1A4-AC3B-443C-8143-237EDE760403}) (Version: 5.1.2.627 - NewTech Infosystems)

NTI Backup Now Standard (x32 Version: 5.1.2.627 - NewTech Infosystems) Hidden

NTI Media Maker 8 (HKLM-x32\...\InstallShield_{2413930C-8309-47A6-BC61-5EF27A4222BC}) (Version: 8.0.12.6623 - NewTech Infosystems)

NTI Media Maker 8 (x32 Version: 8.0.12.6623 - NewTech Infosystems) Hidden

Origin (HKLM-x32\...\Origin) (Version: 9.1.15.109 - Electronic Arts, Inc.)

PlayStation(R)Network Downloader (HKLM-x32\...\{B6659DD8-00A7-4A24-BBFB-C1F6982E5D66}) (Version: 2.07.00849 - Sony Computer Entertainment Inc.)

PlayStation(R)Store (HKLM-x32\...\{0E532C84-4275-41B3-9D81-D4A1A20D8EE7}) (Version: 4.9.4.14625 - Sony Computer Entertainment Inc.)

ProtectDisc Driver, Version 11 (HKLM-x32\...\ProtectDisc Driver 11) (Version: 11.0.0.14 - ProtectDisc Software GmbH)

QuickTime (HKLM-x32\...\{AF0CE7C0-A3E4-4D73-988B-B29187EC6E9A}) (Version: 7.73.80.64 - Apple Inc.)

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5969 - Realtek Semiconductor Corp.)

RIFT (HKU\S-1-5-21-432033561-2934589633-1803115819-1001\...\RIFT) (Version:  - Trion Worlds, Inc.)

RIFT (HKU\S-1-5-21-432033561-2934589633-1803115819-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\RIFT) (Version:  - Trion Worlds, Inc.)

Sid Meier's Civilization 4 Complete (HKLM-x32\...\{30D1F3D2-54CF-481D-A005-F94B0E98FEEC}) (Version: 1.74 - Firaxis Games)

SimCity 2000 Special Edition (HKLM-x32\...\{59D2C751-F7BE-4E9F-9C8C-1F16013802C7}) (Version: 2.0.0.1 - Electronic Arts)

Skillstraining für Borderline-Patienten, 2. Auflage (HKLM-x32\...\com.mmm.app.schattauer.skillstraining2) (Version: 2.0.10 - Schattauer GmbH)

Skillstraining für Borderline-Patienten, 2. Auflage (x32 Version: 2.0.10 - Schattauer GmbH) Hidden

Skype™ 6.16 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.16.105 - Skype Technologies S.A.)

Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 14.0.6.0 - Synaptics Incorporated)

Tango (HKU\S-1-5-21-432033561-2934589633-1803115819-1001\...\Tango) (Version: 1.6.14117 - TangoMe, Inc.)

Tango (HKU\S-1-5-21-432033561-2934589633-1803115819-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Tango) (Version: 1.6.14117 - TangoMe, Inc.)

TuneUp Utilities 2014 (de-DE) (x32 Version: 14.0.1000.89 - TuneUp Software) Hidden

TuneUp Utilities 2014 (HKLM-x32\...\TuneUp Utilities 2014) (Version: 14.0.1000.89 - TuneUp Software)

TuneUp Utilities 2014 (x32 Version: 14.0.1000.89 - TuneUp Software) Hidden

Überwachungstool für die Intel® Turbo-Boost-Technik (HKLM\...\{39F4C6F9-618A-4E5B-8FB2-6BD661174E32}) (Version: 1.0.186.6 - Intel)

Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)

Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_OMUI.de-de_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)

Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_OMUI.de-de_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)

Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_OMUI.de-de_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)

Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_OMUI.de-de_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)

Welcome Center (HKLM-x32\...\Acer Welcome Center) (Version: 1.00.3008 - Acer Incorporated)

Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3502.0922 - Microsoft Corporation)

Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)

Windows Live Sync (HKLM-x32\...\{76618402-179D-4699-A66B-D351C59436BC}) (Version: 14.0.8089.726 - Microsoft Corporation)

Youda Farmer (HKLM-x32\...\Youda Farmer) (Version:  - )

Youda Kindergarten (HKLM-x32\...\Youda Kindergarten) (Version:  - )

Youda Legend (HKLM-x32\...\Youda Legend) (Version:  - )

Youda Sushi Chef (HKLM-x32\...\Youda Sushi Chef) (Version:  - )
 

==================== Custom CLSID (selected items): ==========================
 

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
 

CustomCLSID: HKU\S-1-5-21-432033561-2934589633-1803115819-1001_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Fred\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-432033561-2934589633-1803115819-1001_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Fred\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-432033561-2934589633-1803115819-1001_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Fred\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-432033561-2934589633-1803115819-1001_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Fred\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\FileSyncApi64.dll (Microsoft Corporation)
 

==================== Restore Points  =========================
 
 

==================== Hosts content: ==========================
 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
 

==================== Scheduled Tasks (whitelisted) =============
 

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
 

Task: {102AC1D8-2695-4A0E-92B2-97A26B5321E5} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-01-14] (Adobe Systems Incorporated)

Task: {4C1A0EE9-4164-46C0-8F7C-8B139AE73F60} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-04-23] (Piriform Ltd)

Task: {503E2A67-83CA-4DE5-8A8A-2134CCD5B80E} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)

Task: {65E5A3A9-D8F9-470E-863E-581237DEF09C} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)

Task: {6B2E1908-768E-424F-AE4B-90C21EBBBCFA} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-28] (Google Inc.)

Task: {C21C063F-4A6D-4982-8EA7-0079E088D398} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 => C:\Program Files (x86)\TuneUp Utilities 2014\OneClick.exe [2013-08-30] (TuneUp Software)

Task: {D10D07C1-DF6C-4E1E-810E-3B6C053719AC} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-28] (Google Inc.)

Task: {DD0D09EC-FA0A-4571-A982-A729AC614376} - System32\Tasks\{030917A2-2E69-40CA-9CB3-A081DCF939E9} => pcalua.exe -a "C:\Program Files (x86)\Steam\steam.exe" -c steam://uninstall/8930

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
 

==================== Loaded Modules (whitelisted) =============
 

2013-08-30 09:51 - 2013-08-30 09:51 - 00757048 _____ () C:\Program Files (x86)\TuneUp Utilities 2014\avgrepliba.dll

2010-03-03 19:11 - 2009-11-20 15:34 - 00200704 _____ () C:\Windows\PLFSetI.exe

2009-07-29 13:10 - 2009-07-29 13:10 - 00016384 ____R () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll

2010-03-03 19:07 - 2010-03-03 19:07 - 00270336 _____ () C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CrossDisplay.Graphics.Dashboard\1.0.0.0__90ba9c70f846762e\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll

2011-09-27 07:23 - 2011-09-27 07:23 - 00087912 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll

2011-09-27 07:22 - 2011-09-27 07:22 - 01242472 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll

2009-02-03 02:33 - 2009-02-03 02:33 - 00460199 _____ () C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\sqlite3.dll

2008-09-29 02:55 - 2008-09-29 02:55 - 01076224 _____ () C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\ACE.dll

2014-11-07 19:57 - 2014-11-07 19:57 - 00859144 _____ () C:\Users\Fred\AppData\Roaming\ICQM\ICQ\dll\YLUSBTEL.dll

2011-04-14 09:43 - 2011-04-14 09:43 - 08448512 _____ () C:\Program Files (x86)\Tango\QtGui4.dll

2011-04-14 09:35 - 2011-04-14 09:35 - 02346496 _____ () C:\Program Files (x86)\Tango\QtCore4.dll

2011-04-14 09:50 - 2011-04-14 09:50 - 00113152 _____ () C:\Program Files (x86)\Tango\QtMultimedia4.dll

2011-04-14 09:36 - 2011-04-14 09:36 - 00859648 _____ () C:\Program Files (x86)\Tango\QtNetwork4.dll

2011-04-14 10:58 - 2011-04-14 10:58 - 11159040 _____ () C:\Program Files (x86)\Tango\QtWebKit4.dll

2011-04-14 09:49 - 2011-04-14 09:49 - 00270336 _____ () C:\Program Files (x86)\Tango\phonon4.dll

2011-08-09 11:31 - 2011-08-09 11:31 - 00054784 _____ () C:\Program Files (x86)\Tango\CrashRpt.dll

2014-10-10 19:43 - 2014-10-10 19:43 - 03715184 _____ () C:\Program Files (x86)\Mozilla Firefox 4.0 Beta 4\mozjs.dll

2015-01-14 00:35 - 2015-01-14 00:35 - 16844464 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_257.dll

2011-10-05 03:52 - 2011-10-05 03:52 - 00756048 _____ () C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\MSPTLS.DLL
 

==================== Alternate Data Streams (whitelisted) =========
 

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
 

AlternateDataStreams: C:\ProgramData\Temp:444C53BA

AlternateDataStreams: C:\ProgramData\Temp:4CF61E54

AlternateDataStreams: C:\ProgramData\Temp:4D066AD2

AlternateDataStreams: C:\ProgramData\Temp:5D7E5A8F

AlternateDataStreams: C:\ProgramData\Temp:93DE1838

AlternateDataStreams: C:\ProgramData\Temp:ABE89FFE

AlternateDataStreams: C:\ProgramData\Temp:E1F04E8D

AlternateDataStreams: C:\ProgramData\Temp:E3C56885
 

==================== Safe Mode (whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
 

==================== EXE Association (whitelisted) =============
 

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
 
 

==================== MSCONFIG/TASK MANAGER disabled items =========
 

(Currently there is no automatic fix for this section.)
 
 

========================= Accounts: ==========================
 

Administrator (S-1-5-21-432033561-2934589633-1803115819-500 - Administrator - Disabled)

ASPNET (S-1-5-21-432033561-2934589633-1803115819-1004 - Limited - Enabled)

Fred (S-1-5-21-432033561-2934589633-1803115819-1001 - Administrator - Enabled) => C:\Users\Fred

Gast (S-1-5-21-432033561-2934589633-1803115819-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-432033561-2934589633-1803115819-1002 - Limited - Enabled)
 

==================== Faulty Device Manager Devices =============
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (01/19/2015 11:25:36 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 1297850
 

Error: (01/19/2015 11:25:36 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledEvent 1297850
 

Error: (01/19/2015 11:25:36 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: Continuously busy for more than a second
 

Error: (01/19/2015 11:25:35 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 1296836
 

Error: (01/19/2015 11:25:35 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledEvent 1296836
 

Error: (01/19/2015 11:25:35 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: Continuously busy for more than a second
 

Error: (01/19/2015 11:25:34 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 1295681
 

Error: (01/19/2015 11:25:34 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledEvent 1295681
 

Error: (01/19/2015 11:25:34 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: Continuously busy for more than a second
 

Error: (01/19/2015 11:25:33 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 1294636
 
 

System errors:

=============

Error: (01/21/2015 09:53:56 PM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: Der Dienst "Avira Service Host" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 10000 Millisekunden durchgeführt: Neustart des Diensts.
 

Error: (01/21/2015 09:53:55 PM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.
 

Error: (01/21/2015 09:53:55 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: Dienst "NTI Backup Now 5 Scheduler Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
 

Error: (01/21/2015 09:53:55 PM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: Der Dienst "Druckwarteschlange" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.
 

Error: (01/21/2015 09:53:55 PM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: Der Dienst "Apple Mobile Device" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.
 

Error: (01/21/2015 09:53:55 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: Dienst "TuneUp Utilities Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
 

Error: (01/21/2015 09:53:55 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: Dienst "Intel(R) Matrix Storage Event Monitor" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
 

Error: (01/21/2015 09:53:55 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: Dienst "Raw Socket Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
 

Error: (01/21/2015 09:53:55 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: Dienst "Erkennung interaktiver Dienste" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
 

Error: (01/21/2015 09:53:55 PM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: Der Dienst "Windows Media Player-Netzwerkfreigabedienst" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.
 
 

Microsoft Office Sessions:

=========================
 

CodeIntegrity Errors:

===================================

  Date: 2014-03-12 19:43:09.988

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-03-12 19:43:09.863

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-03-12 19:43:09.489

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\atksgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-03-12 19:43:09.364

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\atksgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-03-11 19:41:15.038

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-03-11 19:41:14.928

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-03-11 19:41:14.538

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\atksgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-03-11 19:41:14.414

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\atksgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-03-02 10:42:14.218

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-03-02 10:42:14.109

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 
 

==================== Memory info =========================== 
 

Processor: Intel(R) Core(TM) i5 CPU M 430 @ 2.27GHz

Percentage of memory in use: 65%

Total physical RAM: 3956.5 MB

Available physical RAM: 1378.45 MB

Total Pagefile: 7911.19 MB

Available Pagefile: 4634.95 MB

Total Virtual: 8192 MB

Available Virtual: 8191.85 MB
 

==================== Drives ================================
 

Drive c: (ACER) (Fixed) (Total:584.35 GB) (Free:277.99 GB) NTFS

Drive d: (Sims3EP10) (CDROM) (Total:4.37 GB) (Free:0 GB) UDF
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 596.2 GB) (Disk ID: FDACFDAC)

Partition 1: (Not Active) - (Size=11.7 GB) - (Type=27)

Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=584.4 GB) - (Type=07 NTFS)
 

==================== End Of Log ============================

Hoff ich hab alles richtig gemacht :eek: