Trojaner-Board - Windows 8: neuer Laptop öffnet Unmengen an Werbung im Browser

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Windows 8: neuer Laptop öffnet Unmengen an Werbung im Browser (https://www.trojaner-board.de/165817-windows-8-neuer-laptop-oeffnet-unmengen-werbung-browser.html)

Windows 8: neuer Laptop öffnet Unmengen an Werbung im Browser

Hallo Community,

ich bin gerade bei Freunden, welche einen neuen Laptop haben und der macht große Probleme. Das Surfen im Internet wird von Unmengen an Werbung gestört. Funde von MBAM und AntiVir wurden gelöscht, aber das Problem bleibt. Wäre super, wenn mal jemand Zeit findet, über die Logs drüberzuschauen und die Probleme zu lösen.
Danke und frohe Osterfest.

Logs:

FRST

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015

Ran by Winfried (administrator) on KLEINERPCANDI on 05-04-2015 14:11:16

Running from C:\Users\Winfried\Desktop

Loaded Profiles: Winfried &  (Available profiles: Winfried)

Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11 (Default browser: FF)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(Intel Corporation) C:\Windows\System32\igfxCUIService.exe

(Microsoft Corporation) C:\Windows\System32\wlanext.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe

(Intel Corporation) C:\Windows\SysWOW64\esif_uf.exe

(Microsoft Corporation) C:\Windows\System32\dasHost.exe

(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe

(Lenovo) C:\Program Files\Lenovo\OneKey Optimizer\bin\FbService.exe

() C:\Program Files (x86)\Lenovo\Harmony\Picks\HarmonyPicksService.exe

() C:\Program Files (x86)\Lenovo\Harmony\Setting\HarmonySettingService.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\utilities\ibtsiva.exe

(Lenovo(beijing) Limited) C:\Program Files\Lenovo\OneKey Optimizer\bin\OKOUpdataService.exe

(Lenovo Group Limited) C:\Program Files\Lenovo\SettingsDependency\SettingsService.exe

(LENOVO INCORPORATED.) C:\Program Files\Lenovo\iMController\SystemAgentService.exe

() C:\Program Files\Lenovo PhoneCompanion\LPAWDService.exe

(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Lenovo Settings\x86\LenovoSetSvr.exe

(Lenovo(beijing) Limited) C:\Windows\System32\LenovoWiFiHotspotSvr.exe

(Nitro PDF Software) C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe

(Nalpeiron Ltd.) C:\Windows\SysWOW64\NLSSRV32.EXE

(Lenovo(beijing) Limited) C:\Program Files\Lenovo\OneKey Optimizer\bin\OKOControlSvc.exe

(Lenovo) C:\Program Files (x86)\Lenovo\PaperDisplay\x86\PaperLookingSrv.exe

(PointGrab LTD) C:\Program Files (x86)\Lenovo\Motion Control\PGService.exe

(PointGrab LTD) C:\Program Files (x86)\Lenovo\Motion Control\PG_Service_Launcher.exe

(Lenovo) C:\Program Files\Lenovo PhoneCompanion\PhoneCompanionPusher.exe

() C:\Program Files (x86)\Lenovo\PaperDisplay\x86\PLHotkeyService.exe

(PointGrab LTD) C:\Program Files (x86)\Lenovo\Motion Control\WebcamSplitterServer.exe

(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe

() C:\Program Files\CyberLink\Shared files\RichVideo64.exe

(Conexant Systems, Inc.) C:\Windows\SysWOW64\SASrv.exe

() C:\Program Files (x86)\Lenovo\Lenovo VeriFace Pro\VfConnectorService.exe

(Lenovo) C:\ProgramData\LenovoTransition\Server\x64\ymc.exe

(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe

(Lenovo) C:\Windows\System32\LenovoUpdate.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

() C:\Program Files (x86)\Lenovo\CCSDK\CCSDK.exe

(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Lenovo Corporation) C:\Program Files\Lenovo\Communications Utility\AVControlCenter32.exe

(Lenovo Corporation) C:\Program Files\Lenovo\Communications Utility\vcamsvc.exe

(Lenovo Corporation) C:\Program Files\Lenovo\Communications Utility\CamMute.exe

() C:\Program Files\Lenovo PhoneCompanion\adb.exe

(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe

(Intel Corporation) C:\Windows\System32\igfxEM.exe

(Intel Corporation) C:\Windows\System32\igfxHK.exe

() C:\Windows\System32\igfxTray.exe

(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe

(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

() C:\Program Files (x86)\Lenovo\CCSDK\WinGather.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe

(Intel Corporation) C:\Windows\Temp\DPTF\esif_assist.exe

() C:\Program Files\CONEXANT\ForteConfig\fmapp.exe

(Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe

(Waves Audio Ltd.) C:\Program Files\Waves\MaxxAudio\WavesSvc64.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

() C:\Program Files\Lenovo\LenovoUtility\utility.exe

() C:\Program Files (x86)\Lenovo\LenovoTransition\TransitionServer.exe

(Lenovo) C:\Program Files\Lenovo PhoneCompanion\Phone Companion.exe

(Lenovo(beijing) Limited) C:\Program Files\Lenovo\OneKey Optimizer\bin\OneKeyOptimizerTray.exe

(Lenovo(beijing) Limited) C:\Program Files\Lenovo\OneKey Optimizer\bin\OnekeyOptimizerUpdata.exe

(Lenovo) C:\Program Files (x86)\Lenovo\Harmony\Picks\Lenovo.HarmonyPicks.exe

(Lenovo) C:\Program Files (x86)\Lenovo\Harmony\Setting\Lenovo.HarmonySetting.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe

(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe

(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_6.3.9600.20280_x64__8wekyb3d8bbwe\soundrec.exe

(Microsoft Corporation) C:\Windows\System32\WWAHost.exe

(Lenovo Corporation) C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe

(Lenovo(beijing) Limited) C:\Program Files\Lenovo\OneKey Optimizer\bin\OneKeyOptimizer.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_17_0_0_134.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_17_0_0_134.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [322712 2014-10-09] (Intel Corporation)

HKLM\...\Run: [ForteConfig] => C:\Program Files\Conexant\ForteConfig\fmapp.exe [49056 2010-10-26] ()

HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SACpl.exe [1830616 2014-04-10] (Conexant Systems, Inc.)

HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [919768 2014-11-20] (Conexant Systems, Inc.)

HKLM\...\Run: [WavesSvc] => C:\Program Files\Waves\MaxxAudio\WavesSvc64.exe [606296 2014-10-02] (Waves Audio Ltd.)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2809072 2014-09-19] (Synaptics Incorporated)

HKLM\...\Run: [LENOVO.TPKNRRES] => rundll32.exe "C:\Program Files\Lenovo\Communications Utility\LibStartStub.dll",AVStartupStub

HKLM\...\Run: [LenovoUtility] => C:\Program Files\Lenovo\LenovoUtility\utility.exe [791368 2015-02-26] ()

HKLM\...\Run: [AutoStartTransition] => C:\Program Files (x86)\Lenovo\LenovoTransition\TransitionServer.exe [109840 2014-08-14] ()

HKLM\...\Run: [PhoneCompanion] => C:\Program Files\Lenovo PhoneCompanion\Phone Companion.exe [802800 2015-02-26] (Lenovo)

HKLM\...\Run: [OneKeyOptimizer] => C:\Program Files\Lenovo\OneKey Optimizer\bin\OneKeyOptimizerTray.exe [559896 2014-11-18] (Lenovo(beijing) Limited)

HKLM\...\Run: [3D BubbleSound] => "C:\Program Files\BubbleSound\3D BubbleSound.exe"

HKLM-x32\...\Run: [HarmonyPicks] => C:\Program Files (x86)\Lenovo\Harmony\Picks\Lenovo.HarmonyPicks.exe [1221912 2014-09-28] (Lenovo)

HKLM-x32\...\Run: [HarmonySetting] => C:\Program Files (x86)\Lenovo\Harmony\Setting\Lenovo.HarmonySetting.exe [2696472 2014-09-28] (Lenovo)

HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [704512 2015-03-17] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [126712 2015-01-19] (Avira Operations GmbH & Co. KG)

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = www.google.com

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com

HKU\S-1-5-21-1872664996-1993104736-2441894966-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKU\S-1-5-21-1872664996-1993104736-2441894966-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKU\S-1-5-21-1872664996-1993104736-2441894966-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKU\S-1-5-21-1872664996-1993104736-2441894966-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-2\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKU\S-1-5-21-1872664996-1993104736-2441894966-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-3\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-2 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-3 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-2 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-3 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-21-1872664996-1993104736-2441894966-1001 -> {015DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = 

SearchScopes: HKU\S-1-5-21-1872664996-1993104736-2441894966-1001 -> {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = 

SearchScopes: HKU\S-1-5-21-1872664996-1993104736-2441894966-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {015DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = 

SearchScopes: HKU\S-1-5-21-1872664996-1993104736-2441894966-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = 

SearchScopes: HKU\S-1-5-21-1872664996-1993104736-2441894966-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1 -> {015DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = 

SearchScopes: HKU\S-1-5-21-1872664996-1993104736-2441894966-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1 -> {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = 

SearchScopes: HKU\S-1-5-21-1872664996-1993104736-2441894966-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-2 -> {015DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = 

SearchScopes: HKU\S-1-5-21-1872664996-1993104736-2441894966-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-2 -> {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = 

SearchScopes: HKU\S-1-5-21-1872664996-1993104736-2441894966-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-3 -> {015DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = 

SearchScopes: HKU\S-1-5-21-1872664996-1993104736-2441894966-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-3 -> {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = 

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

StartMenuInternet: IEXPLORE.EXE - iexplore.exe
 

FireFox:

========

FF ProfilePath: C:\Users\Winfried\AppData\Roaming\Mozilla\Firefox\Profiles\4dr5421m.default

FF SelectedSearchEngine: Google

FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_17_0_0_134.dll [2015-03-23] ()

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_134.dll [2015-03-23] ()

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.56 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2014-10-10] (Intel Corporation)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2014-10-10] (Intel Corporation)

FF Plugin-x32: @nitropdf.com/NitroPDF -> C:\Program Files (x86)\Nitro\Pro 9\npnitromozilla.dll [2013-12-12] (Nitro PDF)

FF Extension: Adblock Plus - C:\Users\Winfried\AppData\Roaming\Mozilla\Firefox\Profiles\4dr5421m.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-03-24]
 

==================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [432888 2015-03-17] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [432888 2015-03-17] (Avira Operations GmbH & Co. KG)

R3 AVControlCenter; C:\Program Files\Lenovo\Communications Utility\AVControlCenter32.exe [599024 2014-08-05] (Lenovo Corporation)

R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [182520 2015-01-19] (Avira Operations GmbH & Co. KG)

R2 CCSDK; C:\Program Files (x86)\Lenovo\CCSDK\CCSDK.exe [644080 2014-10-22] ()

R2 esifsvc; C:\WINDOWS\SysWOW64\esif_uf.exe [1037568 2014-09-18] (Intel Corporation)

R2 FastbootService; C:\Program Files\Lenovo\OneKey Optimizer\bin\FbService.exe [191512 2014-11-20] (Lenovo)

R2 HarmonyPicksService; C:\Program Files (x86)\Lenovo\Harmony\Picks\HarmonyPicksService.exe [17176 2014-08-25] ()

R2 HarmonySettingService; C:\Program Files (x86)\Lenovo\Harmony\Setting\HarmonySettingService.exe [17688 2014-09-04] ()

R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [18584 2014-10-09] (Intel Corporation)

R2 ibtsiva.exe; C:\Program Files (x86)\Intel\Bluetooth\utilities\ibtsiva.exe [121288 2014-08-13] (Intel Corporation)

R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [328296 2014-11-21] (Intel Corporation)

S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [887256 2014-05-13] (Intel(R) Corporation)

R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [132896 2014-10-10] (Intel Corporation)

S3 iumsvc; C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [174368 2014-04-09] ()

R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [158496 2014-10-10] (Intel Corporation)

S3 Lenovo EasyPlus Hotspot; C:\Program Files (x86)\Common Files\lenovo\easyplussdk\bin\EPHotspot64.exe [561408 2014-09-22] (Lenovo)

R2 Lenovo OKO Service; C:\Program Files\Lenovo\OneKey Optimizer\bin\OKOUpdataService.exe [2544408 2014-11-18] (Lenovo(beijing) Limited)

R2 Lenovo Settings Service; C:\Program Files\Lenovo\SettingsDependency\SettingsService.exe [2005320 2014-10-13] (Lenovo Group Limited)

R2 Lenovo System Agent Service; C:\Program Files\Lenovo\iMController\SystemAgentService.exe [584632 2015-03-06] (LENOVO INCORPORATED.)

R3 LENOVO.TVTVCAM; C:\Program Files\Lenovo\Communications Utility\vcamsvc.exe [727536 2014-08-05] (Lenovo Corporation)

R2 LenovoPAWDService; C:\Program Files\Lenovo PhoneCompanion\LPAWDService.exe [133440 2015-02-26] ()

R2 LenovoSetSvr; C:\Program Files (x86)\Lenovo\Lenovo Settings\x86\LenovoSetSvr.exe [258544 2014-06-19] (Lenovo(beijing) Limited)

R3 LenovoUpdate; C:\Windows\System32\LenovoUpdate.exe [26608 2015-04-04] (Lenovo)

R2 LenovoWiFiHotspotSvr; C:\Windows\System32\LenovoWiFiHotspotSvr.exe [218952 2014-08-25] (Lenovo(beijing) Limited)

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2015-03-17] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1080120 2015-03-17] (Malwarebytes Corporation)

S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [265936 2014-10-29] ()

R2 NitroDriverReadSpool9; C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe [230920 2013-12-12] (Nitro PDF Software)

R2 OKOControlSvc; C:\Program Files\Lenovo\OneKey Optimizer\bin\OKOControlSvc.exe [113944 2014-11-17] (Lenovo(beijing) Limited)

R2 PaperLookingSrv; C:\Program Files (x86)\Lenovo\PaperDisplay\x86\PaperLookingSrv.exe [173848 2014-11-25] (Lenovo)

R2 PGService; C:\Program Files (x86)\Lenovo\Motion Control\PGService.exe [167176 2014-05-28] (PointGrab LTD)

R2 PG_Service_Launcher; C:\Program Files (x86)\Lenovo\Motion Control\PG_Service_Launcher.exe [524552 2014-05-28] (PointGrab LTD)

R2 PhoneCompanionPusher; C:\Program Files\Lenovo PhoneCompanion\PhoneCompanionPusher.exe [321520 2015-02-26] (Lenovo)

S3 PhoneCompanionVap; C:\Program Files\Lenovo PhoneCompanion\PhoneCompanionVap.exe [338416 2015-02-26] (Lenovo)

R2 PLHotkeyService; C:\Program Files (x86)\Lenovo\PaperDisplay\x86\PLHotkeyService.exe [26392 2014-11-25] ()

R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [390632 2012-04-24] ()

R2 VeriFaceSrv; C:\Program Files (x86)\Lenovo\Lenovo VeriFace Pro\VfConnectorService.exe [68880 2015-02-26] ()

S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-04] (Microsoft Corporation)

S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-04] (Microsoft Corporation)

R2 ymc; C:\ProgramData\LenovoTransition\Server\x64\ymc.exe [34576 2014-09-03] (Lenovo)

R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3818704 2014-10-29] (Intel® Corporation)
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [128536 2015-03-17] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [132120 2015-03-17] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2015-03-17] (Avira Operations GmbH & Co. KG)

S3 AX88772; C:\Windows\system32\DRIVERS\ax88772.sys [113864 2013-07-18] (ASIX Electronics Corp.)

R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-03-18] (Microsoft Corporation)

R3 dptf_cpu; C:\Windows\System32\drivers\dptf_cpu.sys [38720 2014-09-18] (Intel Corporation)

R3 esif_lf; C:\Windows\System32\drivers\esif_lf.sys [216360 2014-09-18] (Intel Corporation)

R0 Fastboot; C:\Windows\System32\DRIVERS\Fastboot.sys [70168 2014-11-20] (Windows (R) Win 7 DDK provider)

R3 ibtusb; C:\Windows\system32\DRIVERS\ibtusb.sys [219592 2014-08-13] (Intel Corporation)

R0 IntelHSWPcc; C:\Windows\System32\drivers\IntelPcc.sys [79528 2014-09-05] (Intel Corporation)

R3 KMDFVirtualKbd; C:\Windows\System32\drivers\KMDFVirtualKbd.sys [22264 2014-08-04] ()

R3 KMDFVirtualMouse; C:\Windows\System32\drivers\KMDFVirtualMouse.sys [21240 2014-08-04] ()

R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2015-03-17] (Malwarebytes Corporation)

R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [136408 2015-04-05] (Malwarebytes Corporation)

R3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2015-03-17] (Malwarebytes Corporation)

R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [129312 2014-10-10] (Intel Corporation)

R3 NETwNb64; C:\Windows\system32\DRIVERS\Netwbw02.sys [3482600 2014-11-06] (Intel Corporation)

S3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew02.sys [4649440 2013-06-18] (Intel Corporation)

R3 rtsuvc; C:\Windows\system32\DRIVERS\rtsuvc.sys [2803416 2014-10-09] (Realtek Semiconductor Corp.)

R3 SensorsHIDClassDriver; C:\Windows\system32\DRIVERS\WUDFRd.sys [227840 2014-05-31] (Microsoft Corporation)

R3 SensorsServiceDriver; C:\Windows\system32\DRIVERS\WUDFRd.sys [227840 2014-05-31] (Microsoft Corporation)

R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [31472 2014-09-19] (Synaptics Incorporated)

S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-04] (Microsoft Corporation)

S3 wsvd; C:\Windows\system32\DRIVERS\wsvd.sys [102376 2012-06-13] ("CyberLink)
 

==================== NetSvcs (Whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2015-04-05 14:11 - 2015-04-05 14:11 - 00022854 _____ () C:\Users\Winfried\Desktop\FRST.txt

2015-04-05 14:11 - 2015-04-05 14:11 - 00000000 ____D () C:\FRST

2015-04-05 14:10 - 2015-04-05 14:10 - 02095616 _____ (Farbar) C:\Users\Winfried\Desktop\FRST64.exe

2015-04-04 14:20 - 2015-04-04 14:20 - 681778017 _____ () C:\WINDOWS\MEMORY.DMP

2015-04-04 14:20 - 2015-04-04 14:20 - 00289624 _____ () C:\WINDOWS\Minidump\040415-5984-01.dmp

2015-04-04 14:20 - 2015-04-04 14:20 - 00000000 ____D () C:\WINDOWS\Minidump

2015-04-04 13:59 - 2015-04-04 13:55 - 00043576 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avnetflt.sys

2015-04-04 12:28 - 2015-04-04 12:28 - 00001129 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2015-04-04 11:55 - 2015-04-04 11:55 - 00001164 _____ () C:\Users\Public\Desktop\Avira.lnk

2015-04-04 11:53 - 2015-04-04 11:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira

2015-04-04 11:53 - 2015-04-04 11:53 - 00000000 ____D () C:\Users\Winfried\AppData\Roaming\Avira

2015-04-04 11:52 - 2015-04-04 11:55 - 00000000 ____D () C:\ProgramData\Avira

2015-04-04 11:52 - 2015-04-04 11:55 - 00000000 ____D () C:\Program Files (x86)\Avira

2015-04-04 11:52 - 2015-03-17 13:01 - 00132120 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avipbb.sys

2015-04-04 11:52 - 2015-03-17 13:01 - 00128536 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avgntflt.sys

2015-04-04 11:52 - 2015-03-17 13:01 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avkmgr.sys

2015-04-04 11:45 - 2014-10-18 11:55 - 00055776 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe

2015-04-04 11:45 - 2014-10-18 10:09 - 00060416 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups.dll

2015-04-04 11:45 - 2014-10-18 10:09 - 00051712 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups2.dll

2015-04-04 11:45 - 2014-10-18 09:25 - 00025600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wups.dll

2015-04-04 11:45 - 2014-10-18 08:50 - 00017408 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaext.dll

2015-04-04 11:45 - 2014-10-18 08:38 - 03557376 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll

2015-04-04 11:45 - 2014-10-18 08:27 - 00035840 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapp.exe

2015-04-04 11:45 - 2014-10-18 08:26 - 00140288 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuwebv.dll

2015-04-04 11:45 - 2014-10-18 08:23 - 00407552 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUSettingsProvider.dll

2015-04-04 11:45 - 2014-10-18 08:23 - 00095744 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll

2015-04-04 11:45 - 2014-10-18 08:21 - 00894976 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll

2015-04-04 11:45 - 2014-10-18 08:20 - 01714176 _____ (Microsoft Corporation) C:\WINDOWS\system32\wucltux.dll

2015-04-04 11:45 - 2014-10-18 08:14 - 00124928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuwebv.dll

2015-04-04 11:45 - 2014-10-18 08:14 - 00029696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapp.exe

2015-04-04 11:45 - 2014-10-18 08:12 - 00081920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll

2015-04-04 11:45 - 2014-10-18 08:11 - 00723968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll

2015-04-04 11:32 - 2015-01-30 05:01 - 00097792 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hidbth.sys

2015-04-04 11:32 - 2015-01-30 05:00 - 00167424 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rfcomm.sys

2015-04-04 11:32 - 2014-10-29 04:46 - 00081920 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\BTHUSB.SYS

2015-04-04 11:32 - 2014-10-29 04:46 - 00053248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthenum.sys

2015-04-04 11:32 - 2014-10-29 04:45 - 01198080 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthport.sys

2015-04-04 11:32 - 2014-10-29 04:03 - 00241152 _____ (Microsoft Corporation) C:\WINDOWS\system32\fsquirt.exe

2015-04-04 11:22 - 2015-01-30 04:02 - 00102912 _____ (Microsoft Corporation) C:\WINDOWS\system32\eappgnui.dll

2015-04-04 11:22 - 2015-01-30 03:40 - 00091648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eappgnui.dll

2015-04-04 11:22 - 2015-01-30 03:37 - 00331776 _____ (Microsoft Corporation) C:\WINDOWS\system32\eapp3hst.dll

2015-04-04 11:22 - 2015-01-30 03:24 - 00339456 _____ (Microsoft Corporation) C:\WINDOWS\system32\eapphost.dll

2015-04-04 11:22 - 2015-01-30 03:24 - 00250880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eapp3hst.dll

2015-04-04 11:22 - 2015-01-30 03:16 - 00266752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eapphost.dll

2015-04-04 11:22 - 2015-01-30 03:08 - 00346112 _____ (Microsoft Corporation) C:\WINDOWS\system32\eappcfg.dll

2015-04-04 11:22 - 2015-01-30 03:06 - 00278016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eappcfg.dll

2015-04-04 11:22 - 2014-10-29 03:19 - 00070656 _____ (Microsoft Corporation) C:\WINDOWS\system32\eappprxy.dll

2015-04-04 11:22 - 2014-10-29 02:59 - 00056320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eappprxy.dll

2015-04-04 11:18 - 2015-04-04 11:18 - 02208768 _____ () C:\Users\Winfried\Downloads\adwcleaner_4.200.exe

2015-04-04 11:04 - 2015-04-04 11:44 - 165283560 _____ () C:\Users\Winfried\Downloads\avira_free_antivirus_de_15.0.9.504.exe

2015-04-04 09:52 - 2015-04-05 13:52 - 00001366 _____ () C:\WINDOWS\Tasks\disco_savings_notification_service.job

2015-04-04 09:52 - 2015-04-05 13:45 - 00001052 _____ () C:\WINDOWS\Tasks\oDweklayyunBXthwbuHX.job

2015-04-04 09:52 - 2015-04-04 09:53 - 00000000 ____D () C:\Program Files (x86)\disco savings

2015-04-04 09:52 - 2015-04-04 09:52 - 00004380 _____ () C:\WINDOWS\System32\Tasks\disco_savings_notification_service

2015-04-04 09:52 - 2015-04-04 09:52 - 00004076 _____ () C:\WINDOWS\System32\Tasks\oDweklayyunBXthwbuHX

2015-04-04 09:51 - 2015-04-04 12:13 - 00000000 ____D () C:\ProgramData\{47b36d71-bb6e-ffd8-47b3-36d71bb6b5c6}

2015-04-04 09:41 - 2015-04-04 09:41 - 00000004 _____ () C:\WINDOWS\SysWOW64\029B560A371F4E00AB32838EBC01B9E7

2015-04-03 21:45 - 2015-04-05 13:45 - 00001376 _____ () C:\WINDOWS\Tasks\AXDGX.job

2015-04-03 21:45 - 2015-04-05 13:45 - 00001372 _____ () C:\WINDOWS\Tasks\XLA.job

2015-04-03 21:45 - 2015-04-03 21:45 - 00004400 _____ () C:\WINDOWS\System32\Tasks\AXDGX

2015-04-03 21:45 - 2015-04-03 21:45 - 00004394 _____ () C:\WINDOWS\System32\Tasks\XLA

2015-04-03 15:33 - 2015-04-03 15:33 - 00000000 __SHD () C:\Users\Winfried\AppData\Local\EmieBrowserModeList

2015-04-03 15:15 - 2015-04-03 15:16 - 01203488 _____ () C:\Users\Winfried\Downloads\Free M4a to MP3 Converter - CHIP-Installer.exe

2015-03-31 10:14 - 2015-03-31 10:14 - 00004387 _____ () C:\Users\Winfried\AppData\Roaming\oDweklayyunBXthwbuHX

2015-03-26 21:14 - 2015-03-26 21:14 - 00005542 _____ () C:\Users\Winfried\AppData\Roaming\AXDGX

2015-03-26 21:14 - 2015-03-26 21:14 - 00004185 _____ () C:\Users\Winfried\AppData\Roaming\XLA

2015-03-24 10:54 - 2015-01-29 02:59 - 02773504 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll

2015-03-24 10:54 - 2015-01-29 02:49 - 02459136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll

2015-03-24 10:54 - 2015-01-28 04:24 - 00075264 _____ (Microsoft Corporation) C:\WINDOWS\system32\StorageContextHandler.dll

2015-03-24 10:54 - 2015-01-28 03:47 - 00060928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\StorageContextHandler.dll

2015-03-24 10:53 - 2015-02-04 01:58 - 00264000 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdFilter.sys

2015-03-24 10:53 - 2015-02-04 01:58 - 00114496 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdNisDrv.sys

2015-03-24 10:53 - 2015-02-04 01:58 - 00044024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdBoot.sys

2015-03-24 10:53 - 2015-02-03 02:03 - 03551744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DCompiler_47.dll

2015-03-24 10:53 - 2015-02-03 02:02 - 04298240 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_47.dll

2015-03-24 10:53 - 2015-02-03 01:53 - 00014848 _____ (Microsoft Corporation) C:\WINDOWS\system32\winshfhc.dll

2015-03-24 10:53 - 2015-02-03 01:53 - 00012800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winshfhc.dll

2015-03-24 10:53 - 2015-01-30 04:03 - 01488896 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfc42u.dll

2015-03-24 10:53 - 2015-01-30 04:03 - 01464832 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfc42.dll

2015-03-24 10:53 - 2015-01-30 03:44 - 01230336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfc42u.dll

2015-03-24 10:53 - 2015-01-30 03:42 - 01204224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfc42.dll

2015-03-24 10:53 - 2015-01-30 03:29 - 00035840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\atlthunk.dll

2015-03-24 10:53 - 2014-11-01 01:57 - 01091072 _____ (Microsoft Corporation) C:\WINDOWS\system32\MrmCoreR.dll

2015-03-24 10:53 - 2014-11-01 01:47 - 00790528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MrmCoreR.dll

2015-03-24 10:53 - 2014-10-29 03:28 - 00048128 _____ (Microsoft Corporation) C:\WINDOWS\system32\atlthunk.dll

2015-03-24 10:52 - 2015-01-31 01:42 - 03097600 _____ (Microsoft Corporation) C:\WINDOWS\system32\msftedit.dll

2015-03-24 10:52 - 2015-01-31 01:29 - 02484224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msftedit.dll

2015-03-24 10:52 - 2015-01-28 01:47 - 02501368 _____ (Microsoft Corporation) C:\WINDOWS\explorer.exe

2015-03-24 10:52 - 2015-01-28 01:41 - 02207488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe

2015-03-24 10:52 - 2014-12-11 07:36 - 00046456 _____ (Microsoft Corporation) C:\WINDOWS\system32\LockScreenContentServer.exe

2015-03-24 02:15 - 2015-02-20 05:03 - 00358912 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll

2015-03-24 02:15 - 2015-02-20 04:58 - 00044032 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll

2015-03-24 02:15 - 2015-02-20 04:20 - 00301056 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\atmfd.dll

2015-03-24 02:15 - 2015-02-20 04:15 - 00035840 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll

2015-03-24 02:15 - 2014-10-29 04:49 - 00003072 _____ (Microsoft Corporation) C:\WINDOWS\system32\lpk.dll

2015-03-24 02:15 - 2014-10-29 04:44 - 00096256 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontsub.dll

2015-03-24 02:15 - 2014-10-29 04:44 - 00014848 _____ (Microsoft Corporation) C:\WINDOWS\system32\dciman32.dll

2015-03-24 02:15 - 2014-10-29 04:04 - 00003072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\lpk.dll

2015-03-24 02:15 - 2014-10-29 04:00 - 00077824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontsub.dll

2015-03-24 02:15 - 2014-10-29 04:00 - 00011776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dciman32.dll

2015-03-24 02:13 - 2014-12-19 08:26 - 00140800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxdav.sys

2015-03-24 02:13 - 2014-12-12 04:04 - 00087040 _____ (Microsoft Corporation) C:\WINDOWS\system32\TSWbPrxy.exe

2015-03-24 02:13 - 2014-12-12 02:51 - 00075776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ahcache.sys

2015-03-24 02:13 - 2014-10-17 09:01 - 00789184 _____ (Microsoft Corporation) C:\WINDOWS\system32\oleaut32.dll

2015-03-24 02:13 - 2014-10-17 08:58 - 00602768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\oleaut32.dll

2015-03-24 02:13 - 2014-09-04 02:12 - 00590336 _____ (Microsoft Corporation) C:\WINDOWS\system32\rastls.dll

2015-03-24 02:13 - 2014-09-04 02:01 - 00514048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rastls.dll

2015-03-24 02:13 - 2014-08-23 07:18 - 02149376 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml3.dll

2015-03-24 02:13 - 2014-08-23 07:03 - 01346048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml3.dll

2015-03-24 02:13 - 2014-06-10 00:13 - 00035480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TsWpfWrp.exe

2015-03-24 02:13 - 2014-06-10 00:13 - 00035480 _____ (Microsoft Corporation) C:\WINDOWS\system32\TsWpfWrp.exe

2015-03-24 02:12 - 2015-01-28 17:41 - 07472960 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe

2015-03-24 02:12 - 2015-01-28 17:41 - 01733440 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll

2015-03-24 02:12 - 2015-01-28 17:41 - 01498360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll

2015-03-24 02:12 - 2014-10-29 04:02 - 00285184 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64.dll

2015-03-24 02:12 - 2014-10-29 04:02 - 00013312 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64cpu.dll

2015-03-24 02:12 - 2014-10-29 03:57 - 00016896 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntvdm64.dll

2015-03-24 02:12 - 2014-10-29 03:15 - 00014336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntvdm64.dll

2015-03-24 02:12 - 2014-10-29 03:15 - 00005632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wow32.dll

2015-03-24 02:12 - 2014-10-29 03:14 - 00004096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\user.exe

2015-03-24 02:12 - 2014-10-29 03:13 - 00025600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\setup16.exe

2015-03-24 02:12 - 2014-10-29 03:13 - 00008704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\instnm.exe

2015-03-24 02:12 - 2014-10-23 07:48 - 00081408 _____ (Microsoft Corporation) C:\WINDOWS\system32\packager.dll

2015-03-24 02:12 - 2014-10-23 07:05 - 00072192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\packager.dll

2015-03-24 02:12 - 2014-10-13 04:43 - 00238912 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdbus.sys

2015-03-24 02:12 - 2014-10-13 04:43 - 00153920 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dumpsd.sys

2015-03-24 02:12 - 2014-10-13 04:43 - 00086336 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pdc.sys

2015-03-24 02:12 - 2014-10-13 04:43 - 00039744 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\intelpep.sys

2015-03-24 02:12 - 2014-05-19 08:31 - 00057856 _____ (Microsoft Corporation) C:\WINDOWS\system32\drvcfg.exe

2015-03-24 02:12 - 2014-05-19 08:21 - 00110592 _____ (Microsoft Corporation) C:\WINDOWS\system32\drvinst.exe

2015-03-24 02:12 - 2014-05-19 07:23 - 00098816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\drvinst.exe

2015-03-24 02:11 - 2015-01-31 01:20 - 00203264 _____ (Microsoft Corporation) C:\WINDOWS\system32\ubpm.dll

2015-03-24 02:11 - 2015-01-27 06:22 - 00131584 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll

2015-03-24 02:11 - 2015-01-27 04:11 - 03547648 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll

2015-03-24 02:11 - 2014-12-06 05:17 - 00360448 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncsi.dll

2015-03-24 02:11 - 2014-12-06 03:41 - 00391680 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlasvc.dll

2015-03-24 02:11 - 2014-10-29 05:56 - 00027456 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rdpvideominiport.sys

2015-03-24 02:11 - 2014-10-29 04:37 - 00040448 _____ (Microsoft Corporation) C:\WINDOWS\system32\rfxvmt.dll

2015-03-24 02:11 - 2014-10-29 03:24 - 00086016 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlaapi.dll

2015-03-24 02:11 - 2014-10-29 03:01 - 00065536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nlaapi.dll

2015-03-24 02:09 - 2015-03-24 02:09 - 00000000 ____D () C:\Users\Winfried\AppData\Roaming\Nitro

2015-03-24 02:07 - 2015-04-05 13:45 - 00136408 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys

2015-03-24 02:07 - 2015-04-04 12:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2015-03-24 02:07 - 2015-04-04 12:28 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2015-03-24 02:07 - 2015-03-24 02:07 - 00000000 ____D () C:\ProgramData\Malwarebytes

2015-03-24 02:07 - 2015-03-17 06:15 - 00107736 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys

2015-03-24 02:07 - 2015-03-17 06:15 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys

2015-03-24 02:07 - 2015-03-17 06:15 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys

2015-03-24 01:58 - 2015-03-24 01:58 - 00000000 ____D () C:\Users\Public\Pokki

2015-03-24 01:55 - 2015-04-05 13:53 - 00000000 ____D () C:\AdwCleaner

2015-03-24 01:54 - 2015-03-24 01:55 - 01203488 _____ () C:\Users\Winfried\Downloads\Malwarebytes Anti Malware Malware Scanner - CHIP-Installer.exe

2015-03-24 01:52 - 2014-10-31 00:37 - 00129536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\poqexec.exe

2015-03-24 01:52 - 2014-10-31 00:34 - 00146432 _____ (Microsoft Corporation) C:\WINDOWS\system32\poqexec.exe

2015-03-24 01:50 - 2015-01-29 20:45 - 01763352 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecs.dll

2015-03-24 01:50 - 2015-01-29 20:34 - 01488040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WindowsCodecs.dll

2015-03-24 01:49 - 2015-02-12 19:40 - 22291584 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll

2015-03-24 01:49 - 2015-02-12 19:34 - 19731824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll

2015-03-24 01:47 - 2015-01-28 03:31 - 00402432 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMPhoto.dll

2015-03-24 01:47 - 2015-01-28 03:11 - 00357376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WMPhoto.dll

2015-03-24 01:47 - 2014-12-08 21:42 - 00535640 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll

2015-03-24 01:47 - 2014-12-08 21:42 - 00531616 _____ (Microsoft Corporation) C:\WINDOWS\system32\ci.dll

2015-03-24 01:47 - 2014-12-08 21:42 - 00448792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wer.dll

2015-03-24 01:47 - 2014-12-08 21:42 - 00413248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Faultrep.dll

2015-03-24 01:47 - 2014-12-08 21:42 - 00372408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Faultrep.dll

2015-03-24 01:47 - 2014-12-08 21:42 - 00108944 _____ (Microsoft Corporation) C:\WINDOWS\system32\EncDump.dll

2015-03-24 01:47 - 2014-12-08 21:42 - 00038264 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFaultSecure.exe

2015-03-24 01:47 - 2014-12-08 21:42 - 00033584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFaultSecure.exe

2015-03-24 01:47 - 2014-12-06 03:35 - 00229888 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll

2015-03-24 01:47 - 2014-11-10 01:19 - 00991232 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll

2015-03-24 01:47 - 2014-11-10 01:19 - 00806400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll

2015-03-24 01:47 - 2014-11-10 01:18 - 00259584 _____ (Microsoft Corporation) C:\WINDOWS\system32\pku2u.dll

2015-03-24 01:47 - 2014-11-10 01:18 - 00208896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\pku2u.dll

2015-03-24 01:47 - 2014-10-29 06:00 - 00465320 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFault.exe

2015-03-24 01:47 - 2014-10-29 06:00 - 00139984 _____ (Microsoft Corporation) C:\WINDOWS\system32\wermgr.exe

2015-03-24 01:47 - 2014-10-29 05:52 - 00500016 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll

2015-03-24 01:47 - 2014-10-29 05:52 - 00482872 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll

2015-03-24 01:47 - 2014-10-29 05:52 - 00394120 _____ (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll

2015-03-24 01:47 - 2014-10-29 05:52 - 00272248 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiodg.exe

2015-03-24 01:47 - 2014-10-29 05:12 - 00413136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFault.exe

2015-03-24 01:47 - 2014-10-29 05:12 - 00136296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wermgr.exe

2015-03-24 01:47 - 2014-10-29 05:07 - 00424544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioEng.dll

2015-03-24 01:47 - 2014-10-29 05:07 - 00370424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll

2015-03-24 01:47 - 2014-10-29 05:07 - 00344536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AUDIOKSE.dll

2015-03-24 01:47 - 2014-10-29 04:44 - 00037888 _____ (Microsoft Corporation) C:\WINDOWS\system32\werdiagcontroller.dll

2015-03-24 01:47 - 2014-10-29 03:59 - 00033280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\werdiagcontroller.dll

2015-03-24 01:47 - 2014-10-29 03:02 - 00911360 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll

2015-03-24 01:47 - 2014-09-10 08:25 - 00474432 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\netio.sys

2015-03-24 01:47 - 2014-09-08 05:07 - 02497344 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys

2015-03-24 01:47 - 2014-09-08 05:07 - 00428864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\FWPKCLNT.SYS

2015-03-24 01:47 - 2014-09-08 00:08 - 00389176 _____ () C:\WINDOWS\system32\ApnDatabase.xml

2015-03-24 01:47 - 2014-09-05 00:30 - 00822272 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32spl.dll

2015-03-24 01:47 - 2014-09-05 00:21 - 01053184 _____ (Microsoft Corporation) C:\WINDOWS\system32\localspl.dll

2015-03-24 01:47 - 2014-09-04 05:05 - 00836176 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmp4srcsnk.dll

2015-03-24 01:47 - 2014-09-04 04:22 - 00670384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll

2015-03-24 01:47 - 2014-09-04 03:01 - 00448512 _____ (Microsoft Corporation) C:\WINDOWS\system32\puiobj.dll

2015-03-24 01:47 - 2014-09-04 02:32 - 00334336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\puiobj.dll

2015-03-24 01:47 - 2014-09-04 02:10 - 00118272 _____ (Microsoft Corporation) C:\WINDOWS\system32\winbici.dll

2015-03-24 01:47 - 2014-08-31 02:17 - 00148800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBSTOR.SYS

2015-03-24 01:47 - 2014-08-31 00:05 - 00615424 _____ (Microsoft Corporation) C:\WINDOWS\system32\FXSCOMEX.dll

2015-03-24 01:47 - 2014-08-30 23:58 - 00275968 _____ (Microsoft Corporation) C:\WINDOWS\system32\FXSAPI.dll

2015-03-24 01:47 - 2014-08-30 23:04 - 00941568 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll

2015-03-24 01:47 - 2014-08-30 22:53 - 00239104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FXSAPI.dll

2015-03-24 01:47 - 2014-08-30 22:17 - 00799744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll

2015-03-24 01:47 - 2014-08-28 02:21 - 02480128 _____ (Microsoft Corporation) C:\WINDOWS\system32\WsmSvc.dll

2015-03-24 01:47 - 2014-08-28 02:06 - 02030592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WsmSvc.dll

2015-03-24 01:47 - 2014-08-23 07:14 - 13424128 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll

2015-03-24 01:47 - 2014-08-23 07:04 - 11820544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll

2015-03-24 01:47 - 2014-08-23 06:50 - 02714112 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers.dll

2015-03-24 01:47 - 2014-08-02 02:51 - 00545792 _____ (Microsoft Corporation) C:\WINDOWS\system32\untfs.dll

2015-03-24 01:47 - 2014-08-02 02:35 - 00485376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\untfs.dll

2015-03-24 01:44 - 2015-01-21 07:54 - 01384712 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctf.dll

2015-03-24 01:44 - 2015-01-21 07:15 - 01123848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctf.dll

2015-03-24 01:44 - 2014-07-24 05:20 - 00875688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvcr120_clr0400.dll

2015-03-24 01:44 - 2014-07-24 05:20 - 00869544 _____ (Microsoft Corporation) C:\WINDOWS\system32\msvcr120_clr0400.dll

2015-03-24 01:37 - 2015-03-24 01:38 - 00000000 ____D () C:\Users\Public\CyberLink

2015-03-24 01:37 - 2015-03-24 01:37 - 00000000 ____D () C:\Users\Winfried\Documents\CyberLink

2015-03-24 01:36 - 2015-03-24 01:36 - 00000000 ____D () C:\Users\Winfried\AppData\Roaming\CyberLink

2015-03-24 01:25 - 2015-04-04 09:52 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2015-03-24 01:25 - 2015-04-04 09:45 - 00001186 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

2015-03-24 01:25 - 2015-04-04 09:45 - 00001174 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk

2015-03-24 01:25 - 2015-03-24 01:25 - 00000000 ____D () C:\Users\Winfried\AppData\Roaming\Mozilla

2015-03-24 01:25 - 2015-03-24 01:25 - 00000000 ____D () C:\Users\Winfried\AppData\Local\Mozilla

2015-03-24 01:25 - 2015-03-24 01:25 - 00000000 ____D () C:\ProgramData\Mozilla

2015-03-24 01:25 - 2015-03-24 01:25 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

2015-03-24 01:22 - 2015-03-24 01:22 - 00000000 ____D () C:\Users\Winfried\AppData\Local\CyberLink

2015-03-24 01:02 - 2015-03-24 01:02 - 00000000 ____H () C:\WINDOWS\system32\Drivers\Msft_User_LocationProvider_01_11_00.Wdf

2015-03-23 20:00 - 2015-03-23 20:00 - 00000000 ____D () C:\Users\Winfried\AppData\Local\Macromedia

2015-03-23 19:54 - 2015-04-04 16:18 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job

2015-03-23 19:54 - 2015-03-23 19:54 - 00003772 _____ () C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater

2015-03-23 19:51 - 2015-03-23 19:58 - 00000000 ____D () C:\Users\Winfried\AppData\Local\Adobe

2015-03-23 19:39 - 2015-02-21 03:16 - 25021440 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll

2015-03-23 19:39 - 2015-02-21 02:41 - 12827648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll

2015-03-23 19:39 - 2015-02-21 02:27 - 00285696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll

2015-03-23 19:39 - 2015-02-21 02:27 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll

2015-03-23 19:39 - 2015-02-21 02:25 - 19720192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll

2015-03-23 19:39 - 2015-02-21 01:58 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll

2015-03-23 19:39 - 2015-02-21 01:32 - 00076288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll

2015-03-23 19:39 - 2015-02-20 04:49 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll

2015-03-23 19:39 - 2015-02-20 04:48 - 02886144 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll

2015-03-23 19:39 - 2015-02-20 04:47 - 00088064 _____ (Microsoft Corporation) C:\WINDOWS\system32\MshtmlDac.dll

2015-03-23 19:39 - 2015-02-20 04:35 - 00816128 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll

2015-03-23 19:39 - 2015-02-20 04:34 - 00814080 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll

2015-03-23 19:39 - 2015-02-20 04:32 - 06035456 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll

2015-03-23 19:39 - 2015-02-20 04:09 - 00503296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll

2015-03-23 19:39 - 2015-02-20 04:07 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll

2015-03-23 19:39 - 2015-02-20 04:06 - 00064000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MshtmlDac.dll

2015-03-23 19:39 - 2015-02-20 04:05 - 00316928 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll

2015-03-23 19:39 - 2015-02-20 04:03 - 02278400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll

2015-03-23 19:39 - 2015-02-20 03:59 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll

2015-03-23 19:39 - 2015-02-20 03:56 - 00664064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll

2015-03-23 19:39 - 2015-02-20 03:52 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll

2015-03-23 19:39 - 2015-02-20 03:49 - 00801280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll

2015-03-23 19:39 - 2015-02-20 03:49 - 00374272 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll

2015-03-23 19:39 - 2015-02-20 03:46 - 02125824 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl

2015-03-23 19:39 - 2015-02-20 03:43 - 14398976 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll

2015-03-23 19:39 - 2015-02-20 03:30 - 04300288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll

2015-03-23 19:39 - 2015-02-20 03:30 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll

2015-03-23 19:39 - 2015-02-20 03:29 - 02865152 _____ (Microsoft Corporation) C:\WINDOWS\system32\actxprxy.dll

2015-03-23 19:39 - 2015-02-20 03:28 - 02358784 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll

2015-03-23 19:39 - 2015-02-20 03:26 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll

2015-03-23 19:39 - 2015-02-20 03:24 - 02052608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl

2015-03-23 19:39 - 2015-02-20 03:24 - 00689152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll

2015-03-23 19:39 - 2015-02-20 03:16 - 01548288 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll

2015-03-23 19:39 - 2015-02-20 03:03 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll

2015-03-23 19:39 - 2015-02-20 03:01 - 01888256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll

2015-03-23 19:39 - 2015-02-20 02:57 - 01311232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll

2015-03-23 19:39 - 2015-02-20 02:55 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll

2015-03-23 19:39 - 2015-01-12 04:21 - 00490496 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtmsft.dll

2015-03-23 19:39 - 2015-01-12 03:48 - 00718848 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe

2015-03-23 19:39 - 2015-01-12 03:45 - 00418304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtmsft.dll

2015-03-23 19:39 - 2015-01-12 03:23 - 00327168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll

2015-03-23 19:39 - 2014-11-22 04:49 - 00417280 _____ (Microsoft Corporation) C:\WINDOWS\system32\html.iec

2015-03-23 19:39 - 2014-11-22 04:06 - 00340992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\html.iec

2015-03-23 19:39 - 2014-10-31 07:12 - 00143872 _____ (Microsoft Corporation) C:\WINDOWS\system32\wextract.exe

2015-03-23 19:39 - 2014-10-31 07:12 - 00013824 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshta.exe

2015-03-23 19:39 - 2014-10-31 07:10 - 00167424 _____ (Microsoft Corporation) C:\WINDOWS\system32\iexpress.exe

2015-03-23 19:39 - 2014-10-31 07:09 - 00064512 _____ (Microsoft Corporation) C:\WINDOWS\system32\pngfilt.dll

2015-03-23 19:39 - 2014-10-31 07:08 - 00012800 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeedssync.exe

2015-03-23 19:39 - 2014-10-31 07:06 - 00237568 _____ (Microsoft Corporation) C:\WINDOWS\system32\url.dll

2015-03-23 19:39 - 2014-10-31 07:06 - 00066560 _____ (Microsoft Corporation) C:\WINDOWS\system32\iesetup.dll

2015-03-23 19:39 - 2014-10-31 07:06 - 00048640 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieetwproxystub.dll

2015-03-23 19:39 - 2014-10-31 06:57 - 00054784 _____ (Microsoft Corporation) C:\WINDOWS\system32\jsproxy.dll

2015-03-23 19:39 - 2014-10-31 06:56 - 00034304 _____ (Microsoft Corporation) C:\WINDOWS\system32\iernonce.dll

2015-03-23 19:39 - 2014-10-31 06:54 - 00132096 _____ (Microsoft Corporation) C:\WINDOWS\system32\IEAdvpack.dll

2015-03-23 19:39 - 2014-10-31 06:53 - 00633856 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieui.dll

2015-03-23 19:39 - 2014-10-31 06:52 - 00108544 _____ (Microsoft Corporation) C:\WINDOWS\system32\hlink.dll

2015-03-23 19:39 - 2014-10-31 06:51 - 00144384 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieUnatt.exe

2015-03-23 19:39 - 2014-10-31 06:51 - 00114688 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieetwcollector.exe

2015-03-23 19:39 - 2014-10-31 06:40 - 00033280 _____ (Microsoft Corporation) C:\WINDOWS\system32\licmgr10.dll

2015-03-23 19:39 - 2014-10-31 06:30 - 00077824 _____ (Microsoft Corporation) C:\WINDOWS\system32\JavaScriptCollectionAgent.dll

2015-03-23 19:39 - 2014-10-31 06:29 - 00111616 _____ (Microsoft Corporation) C:\WINDOWS\system32\iesysprep.dll

2015-03-23 19:39 - 2014-10-31 06:29 - 00087552 _____ (Microsoft Corporation) C:\WINDOWS\system32\tdc.ocx

2015-03-23 19:39 - 2014-10-31 06:28 - 00107520 _____ (Microsoft Corporation) C:\WINDOWS\system32\inseng.dll

2015-03-23 19:39 - 2014-10-31 06:25 - 00199680 _____ (Microsoft Corporation) C:\WINDOWS\system32\msrating.dll

2015-03-23 19:39 - 2014-10-31 06:24 - 00060416 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeedsbs.dll

2015-03-23 19:39 - 2014-10-31 06:19 - 00152064 _____ (Microsoft Corporation) C:\WINDOWS\system32\occache.dll

2015-03-23 19:39 - 2014-10-31 05:42 - 00051200 _____ (Microsoft Corporation) C:\WINDOWS\system32\imgutil.dll

2015-03-23 19:39 - 2014-10-31 05:28 - 00137728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wextract.exe

2015-03-23 19:39 - 2014-10-31 05:28 - 00012800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshta.exe

2015-03-23 19:39 - 2014-10-31 05:27 - 00152064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iexpress.exe

2015-03-23 19:39 - 2014-10-31 05:26 - 00057344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\pngfilt.dll

2015-03-23 19:39 - 2014-10-31 05:25 - 00011264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeedssync.exe

2015-03-23 19:39 - 2014-10-31 05:24 - 00235520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\url.dll

2015-03-23 19:39 - 2014-10-31 05:24 - 00062464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iesetup.dll

2015-03-23 19:39 - 2014-10-31 05:23 - 00047616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieetwproxystub.dll

2015-03-23 19:39 - 2014-10-31 05:16 - 00047104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jsproxy.dll

2015-03-23 19:39 - 2014-10-31 05:15 - 00030720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iernonce.dll

2015-03-23 19:39 - 2014-10-31 05:14 - 00112128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\IEAdvpack.dll

2015-03-23 19:39 - 2014-10-31 05:13 - 00478208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieui.dll

2015-03-23 19:39 - 2014-10-31 05:13 - 00099328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\hlink.dll

2015-03-23 19:39 - 2014-10-31 05:12 - 00115712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieUnatt.exe

2015-03-23 19:39 - 2014-10-31 05:11 - 00620032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9diag.dll

2015-03-23 19:39 - 2014-10-31 05:03 - 00027136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\licmgr10.dll

2015-03-23 19:39 - 2014-10-31 04:57 - 00060416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\JavaScriptCollectionAgent.dll

2015-03-23 19:39 - 2014-10-31 04:56 - 00091136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inseng.dll

2015-03-23 19:39 - 2014-10-31 04:56 - 00090624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iesysprep.dll

2015-03-23 19:39 - 2014-10-31 04:56 - 00073216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tdc.ocx

2015-03-23 19:39 - 2014-10-31 04:53 - 00168960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msrating.dll

2015-03-23 19:39 - 2014-10-31 04:53 - 00052736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeedsbs.dll

2015-03-23 19:39 - 2014-10-31 04:48 - 00130048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\occache.dll

2015-03-23 19:39 - 2014-10-31 04:26 - 01042944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\actxprxy.dll

2015-03-23 19:39 - 2014-10-31 04:24 - 00040448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\imgutil.dll

2015-03-23 19:13 - 2015-03-06 04:53 - 00430080 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll

2015-03-23 19:13 - 2015-03-06 04:33 - 00358912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll

2015-03-23 19:13 - 2015-02-26 01:26 - 04178944 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys

2015-03-23 19:13 - 2015-01-16 00:43 - 00563504 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys

2015-03-23 19:13 - 2015-01-16 00:43 - 00177984 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys

2015-03-23 19:13 - 2015-01-14 06:22 - 00445440 _____ (Microsoft Corporation) C:\WINDOWS\system32\certcli.dll

2015-03-23 19:13 - 2015-01-14 05:53 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certcli.dll

2015-03-23 19:13 - 2014-12-09 03:50 - 00225280 _____ (Microsoft Corporation) C:\WINDOWS\system32\profsvc.dll

2015-03-23 19:13 - 2014-10-29 04:51 - 00154112 _____ (Microsoft Corporation) C:\WINDOWS\system32\msaudite.dll

2015-03-23 19:13 - 2014-10-29 04:50 - 00736768 _____ (Microsoft Corporation) C:\WINDOWS\system32\adtschema.dll

2015-03-23 19:13 - 2014-10-29 04:06 - 00736768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\adtschema.dll

2015-03-23 19:13 - 2014-10-29 04:06 - 00154112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msaudite.dll

2015-03-23 19:13 - 2014-10-29 03:31 - 01441792 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll

2015-03-23 19:12 - 2014-12-09 05:45 - 00393728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\scesrv.dll

2015-03-23 19:12 - 2014-12-09 03:56 - 00538624 _____ (Microsoft Corporation) C:\WINDOWS\system32\scesrv.dll

2015-03-23 19:12 - 2014-09-27 09:13 - 00104336 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncryptsslp.dll

2015-03-23 19:12 - 2014-09-27 07:24 - 00088800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ncryptsslp.dll

2015-03-23 19:12 - 2014-09-27 05:30 - 00185856 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpapisrv.dll

2015-03-21 23:00 - 2015-03-24 10:46 - 00000000 ____D () C:\Users\Winfried\AppData\Local\Lenovo

2015-03-21 22:56 - 2015-04-05 13:50 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1872664996-1993104736-2441894966-1001

2015-03-21 22:55 - 2015-04-05 13:48 - 00003962 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{083CACEA-2800-4375-A9CE-E755E8D02B7A}

2015-03-21 22:55 - 2015-03-21 22:55 - 00000000 __SHD () C:\Users\Winfried\AppData\Local\EmieUserList

2015-03-21 22:55 - 2015-03-21 22:55 - 00000000 __SHD () C:\Users\Winfried\AppData\Local\EmieSiteList

2015-03-21 22:55 - 2015-03-21 22:55 - 00000000 ____D () C:\ProgramData\OneKey Optimizer

2015-03-21 22:52 - 2015-04-05 14:11 - 01370842 _____ () C:\Users\Public\Documents\TestPicksStart.txt

2015-03-21 22:52 - 2015-04-05 13:45 - 00002262 _____ () C:\Users\Winfried\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Harmony Picks Introduction.lnk

2015-03-21 22:52 - 2015-04-05 13:45 - 00001366 _____ () C:\Users\Winfried\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Harmony Settings Introduction.lnk

2015-03-21 22:52 - 2015-04-05 13:45 - 00000000 ____D () C:\Users\Winfried\OneDrive

2015-03-21 22:52 - 2015-03-21 22:52 - 00000000 ____D () C:\Users\Winfried\AppData\Roaming\Macromedia

2015-03-21 22:52 - 2015-03-21 22:52 - 00000000 ____D () C:\Users\Winfried\AppData\Roaming\Intel Corporation

2015-03-21 22:51 - 2015-04-04 09:45 - 00001465 _____ () C:\Users\Winfried\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

2015-03-21 22:51 - 2015-03-23 20:17 - 00000000 ____D () C:\Users\Winfried\AppData\Local\Packages

2015-03-21 22:51 - 2015-03-21 22:51 - 00000118 _____ () C:\WINDOWS\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat

2015-03-21 22:51 - 2015-03-21 22:51 - 00000020 ___SH () C:\Users\Winfried\ntuser.ini

2015-03-21 22:51 - 2015-03-21 22:51 - 00000000 _SHDL () C:\Users\Winfried\Vorlagen

2015-03-21 22:51 - 2015-03-21 22:51 - 00000000 _SHDL () C:\Users\Winfried\Startmenü

2015-03-21 22:51 - 2015-03-21 22:51 - 00000000 _SHDL () C:\Users\Winfried\Netzwerkumgebung

2015-03-21 22:51 - 2015-03-21 22:51 - 00000000 _SHDL () C:\Users\Winfried\Lokale Einstellungen

2015-03-21 22:51 - 2015-03-21 22:51 - 00000000 _SHDL () C:\Users\Winfried\Eigene Dateien

2015-03-21 22:51 - 2015-03-21 22:51 - 00000000 _SHDL () C:\Users\Winfried\Druckumgebung

2015-03-21 22:51 - 2015-03-21 22:51 - 00000000 _SHDL () C:\Users\Winfried\Documents\Eigene Musik

2015-03-21 22:51 - 2015-03-21 22:51 - 00000000 _SHDL () C:\Users\Winfried\Documents\Eigene Bilder

2015-03-21 22:51 - 2015-03-21 22:51 - 00000000 _SHDL () C:\Users\Winfried\AppData\Roaming\Microsoft\Windows\Start Menu\Programme

2015-03-21 22:51 - 2015-03-21 22:51 - 00000000 _SHDL () C:\Users\Winfried\AppData\Local\Verlauf

2015-03-21 22:51 - 2015-03-21 22:51 - 00000000 _SHDL () C:\Users\Winfried\AppData\Local\Anwendungsdaten

2015-03-21 22:51 - 2015-03-21 22:51 - 00000000 _SHDL () C:\Users\Winfried\Anwendungsdaten

2015-03-21 22:51 - 2015-03-21 22:51 - 00000000 ____D () C:\WINDOWS\System32\Tasks\WPD

2015-03-21 22:51 - 2015-03-21 22:51 - 00000000 ____D () C:\Users\Winfried\AppData\Roaming\Intel

2015-03-21 22:51 - 2015-03-21 22:51 - 00000000 ____D () C:\Users\Winfried\AppData\Roaming\Adobe

2015-03-21 22:51 - 2015-03-21 22:51 - 00000000 ____D () C:\Users\Winfried\AppData\Local\VirtualStore

2015-03-21 22:50 - 2015-04-04 16:33 - 00000000 ____D () C:\Users\Winfried

2015-03-21 22:50 - 2015-02-26 19:05 - 00000000 ___RD () C:\Users\Winfried\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility

2015-03-21 22:50 - 2014-08-23 23:39 - 00000000 ___RD () C:\Users\Winfried\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools

2015-03-21 22:50 - 2014-03-18 11:55 - 00000369 _____ () C:\Users\Winfried\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pictures.lnk

2015-03-21 22:50 - 2014-03-18 11:55 - 00000369 _____ () C:\Users\Winfried\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Documents.lnk

2015-03-21 22:50 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Winfried\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories

2015-03-21 22:50 - 2013-08-22 17:36 - 00000000 ____D () C:\Users\Winfried\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Public\Documents\Eigene Musik

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Public\Documents\Eigene Bilder

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default\Vorlagen

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default\Startmenü

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default\Netzwerkumgebung

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default\Lokale Einstellungen

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default\Eigene Dateien

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default\Druckumgebung

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default\Documents\Eigene Musik

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default\Documents\Eigene Bilder

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programme

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default\AppData\Local\Verlauf

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default\AppData\Local\Anwendungsdaten

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default\Anwendungsdaten

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default User\Documents\Eigene Musik

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default User\Documents\Eigene Bilder

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programme

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default User\AppData\Local\Verlauf

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default User\AppData\Local\Anwendungsdaten

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Programme

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\ProgramData\Vorlagen

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\ProgramData\Startmenü

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\ProgramData\Microsoft\Windows\Start Menu\Programme

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\ProgramData\Dokumente

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\ProgramData\Anwendungsdaten

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Program Files\Gemeinsame Dateien

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Dokumente und Einstellungen
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2015-04-05 14:05 - 2015-02-26 18:58 - 01096954 _____ () C:\WINDOWS\WindowsUpdate.log

2015-04-05 14:00 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\sru

2015-04-05 13:45 - 2015-02-26 19:17 - 00027489 _____ () C:\WINDOWS\SysWOW64\Gms.log

2015-04-04 16:53 - 2015-02-26 19:11 - 00407346 _____ () C:\Users\Public\CAFADEBUG.log

2015-04-04 16:15 - 2015-02-26 19:01 - 00000784 _____ () C:\WINDOWS\lupdate.log

2015-04-04 16:11 - 2015-02-27 03:53 - 00768056 _____ () C:\WINDOWS\system32\perfh007.dat

2015-04-04 16:11 - 2015-02-27 03:53 - 00160322 _____ () C:\WINDOWS\system32\perfc007.dat

2015-04-04 16:11 - 2014-03-18 11:53 - 01780340 _____ () C:\WINDOWS\system32\PerfStringBackup.INI

2015-04-04 14:20 - 2015-02-26 18:56 - 00153336 _____ () C:\WINDOWS\system32\wpbbin.exe

2015-04-04 14:20 - 2015-02-26 18:56 - 00111088 _____ (Lenovo (Beijing) Limited) C:\WINDOWS\system32\LenovoCheck.exe

2015-04-04 14:20 - 2015-02-26 18:56 - 00026608 _____ (Lenovo) C:\WINDOWS\system32\LenovoUpdate.exe

2015-04-04 14:20 - 2014-03-18 11:44 - 00282522 _____ () C:\WINDOWS\PFRO.log

2015-04-04 14:20 - 2013-08-22 16:46 - 00026323 _____ () C:\WINDOWS\setupact.log

2015-04-04 14:20 - 2013-08-22 16:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT

2015-04-04 14:19 - 2015-02-26 19:34 - 00002560 _____ () C:\WINDOWS\system32\VfService.trf

2015-04-04 14:01 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\AppReadiness

2015-04-04 13:50 - 2013-08-22 17:36 - 00000000 ___RD () C:\WINDOWS\ImmersiveControlPanel

2015-04-04 13:50 - 2013-08-22 15:25 - 00262144 ___SH () C:\WINDOWS\system32\config\BBI

2015-04-04 12:15 - 2013-08-22 17:20 - 00000000 ____D () C:\WINDOWS\CbsTemp

2015-04-04 12:01 - 2015-02-26 19:10 - 00003718 _____ () C:\WINDOWS\System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473

2015-04-04 11:54 - 2015-02-26 19:35 - 00000000 ____D () C:\ProgramData\McAfee

2015-04-04 11:54 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools

2015-04-04 11:54 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools

2015-04-04 11:54 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files\Windows Defender

2015-04-04 11:54 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files (x86)\Windows Defender

2015-04-04 11:53 - 2015-02-26 19:06 - 00000000 ____D () C:\ProgramData\Package Cache

2015-04-04 11:51 - 2013-08-22 17:36 - 00000000 ___HD () C:\WINDOWS\ELAMBKUP

2015-04-04 11:39 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files\Common Files\microsoft shared

2015-04-04 11:38 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\rescache

2015-04-04 11:00 - 2013-08-22 17:43 - 00000000 ____D () C:\WINDOWS\DigitalLocker

2015-04-03 14:55 - 2013-08-22 15:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM

2015-03-24 02:09 - 2015-02-26 19:34 - 00000000 ____D () C:\WINDOWS\System32\Tasks\Lenovo

2015-03-24 01:22 - 2015-02-26 19:39 - 00000000 ____D () C:\ProgramData\CyberLink

2015-03-23 20:58 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\PolicyDefinitions

2015-03-23 20:57 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\sr-Latn-RS

2015-03-23 20:57 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\sr-Latn-CS

2015-03-23 19:41 - 2013-08-22 16:44 - 00346960 _____ () C:\WINDOWS\system32\FNTCACHE.DAT

2015-03-23 19:40 - 2013-08-22 17:36 - 00000000 ___RD () C:\WINDOWS\ToastData

2015-03-23 19:40 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\MediaViewer

2015-03-23 19:40 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\FileManager

2015-03-23 19:40 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\Camera

2015-03-23 19:17 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\Help

2015-03-21 23:09 - 2015-02-26 19:18 - 00000000 ____D () C:\ProgramData\Lenovo

2015-03-21 22:58 - 2015-02-26 19:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lenovo

2015-03-21 22:58 - 2015-02-26 19:23 - 00000000 ____D () C:\Program Files (x86)\Lenovo

2015-03-21 22:56 - 2015-02-26 19:08 - 00000000 ____D () C:\ProgramData\Intel

2015-03-21 22:52 - 2015-02-26 19:36 - 00000000 ____D () C:\Users\Public\Documents\Lenovo

2015-03-21 22:51 - 2015-02-27 04:47 - 00149785 ____H () C:\WINDOWS\modules.log

2015-03-21 22:51 - 2014-04-03 21:15 - 00000000 ____D () C:\WINDOWS\Panther

2015-03-20 07:01 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files\Windows NT

2015-03-20 07:01 - 2013-08-22 15:36 - 00000000 ___HD () C:\Users\Default
 

==================== Files in the root of some directories =======
 

2015-03-26 21:14 - 2015-03-26 21:14 - 0005542 _____ () C:\Users\Winfried\AppData\Roaming\AXDGX

2015-03-31 10:14 - 2015-03-31 10:14 - 0004387 _____ () C:\Users\Winfried\AppData\Roaming\oDweklayyunBXthwbuHX

2015-03-26 21:14 - 2015-03-26 21:14 - 0004185 _____ () C:\Users\Winfried\AppData\Roaming\XLA
 

Some content of TEMP:

====================

C:\Users\Winfried\AppData\Local\Temp\avgnt.exe

C:\Users\Winfried\AppData\Local\Temp\mccspuninstall.exe
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-08-23 23:30
 

==================== End Of Log ============================

MBAM (letzter Scan):

Code:

Malwarebytes Anti-Malware

www.malwarebytes.org
 

Suchlauf Datum: 05.04.2015

Suchlauf-Zeit: 13:54:59

Logdatei: MBAM.txt

Administrator: Ja
 

Version: 2.01.4.1018

Malware Datenbank: v2015.04.05.01

Rootkit Datenbank: v2015.03.31.01

Lizenz: Testversion

Malware Schutz: Aktiviert

Bösartiger Webseiten Schutz: Aktiviert

Selbstschutz: Deaktiviert
 

Betriebssystem: Windows 8.1

CPU: x64

Dateisystem: NTFS

Benutzer: Winfried
 

Suchlauf-Art: Bedrohungs-Suchlauf

Ergebnis: Abgeschlossen

Durchsuchte Objekte: 340415

Verstrichene Zeit: 9 Min, 8 Sek
 

Speicher: Aktiviert

Autostart: Aktiviert

Dateisystem: Aktiviert

Archive: Aktiviert

Rootkits: Deaktiviert

Heuristik: Aktiviert

PUP: Aktiviert

PUM: Aktiviert
 

Prozesse: 0

(Keine schädliche Elemente gefunden)
 

Module: 0

(Keine schädliche Elemente gefunden)
 

Registrierungsschlüssel: 0

(Keine schädliche Elemente gefunden)
 

Registrierungswerte: 0

(Keine schädliche Elemente gefunden)
 

Registrierungsdaten: 0

(Keine schädliche Elemente gefunden)
 

Ordner: 0

(Keine schädliche Elemente gefunden)
 

Dateien: 0

(Keine schädliche Elemente gefunden)
 

Physische Sektoren: 0

(Keine schädliche Elemente gefunden)
 
 

(end)

AntiVir (Funde wurden aber danach entfernt):

Code:



Avira Free Antivirus

Erstellungsdatum der Reportdatei: Samstag, 4. April 2015  11:56
 
 

Das Programm läuft als uneingeschränkte Vollversion.

Online-Dienste stehen zur Verfügung.
 

Lizenznehmer   : Avira Antivirus Free

Seriennummer   : 0000149996-AVHOE-0000001

Plattform      : Windows 8.1

Windowsversion : (plain)  [6.2.9200]

Boot Modus     : Normal gebootet

Benutzername   : SYSTEM

Computername   : KLEINERPCANDI
 

Versionsinformationen:

BUILD.DAT      : 15.0.8.656     91858 Bytes  17.03.2015 13:02:00

AVSCAN.EXE     : 15.0.8.652   1014064 Bytes  17.03.2015 11:01:55

AVSCANRC.DLL   : 15.0.8.652     63792 Bytes  17.03.2015 11:01:55

LUKE.DLL       : 15.0.8.652     60664 Bytes  17.03.2015 11:02:00

AVSCPLR.DLL    : 15.0.8.652     93488 Bytes  17.03.2015 11:01:55

REPAIR.DLL     : 15.0.8.652    365360 Bytes  17.03.2015 11:01:55

REPAIR.RDF     : 1.0.6.44      801970 Bytes  17.03.2015 11:02:03

AVREG.DLL      : 15.0.8.652    265464 Bytes  17.03.2015 11:01:55

AVLODE.DLL     : 15.0.8.656    645368 Bytes  17.03.2015 11:01:54

AVLODE.RDF     : 14.0.4.54      78895 Bytes  17.03.2015 11:01:54

XBV00017.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 11:02:04

XBV00018.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 11:02:04

XBV00019.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 11:02:04

XBV00020.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 11:02:04

XBV00021.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 11:02:04

XBV00022.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 11:02:04

XBV00023.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 11:02:04

XBV00024.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 11:02:04

XBV00025.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 11:02:04

XBV00026.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 11:02:04

XBV00027.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 11:02:04

XBV00028.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 11:02:04

XBV00029.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 11:02:04

XBV00030.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 11:02:04

XBV00031.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 11:02:04

XBV00032.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 11:02:04

XBV00033.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 11:02:04

XBV00034.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 11:02:04

XBV00035.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 11:02:04

XBV00036.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 11:02:04

XBV00037.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 11:02:04

XBV00038.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 11:02:04

XBV00039.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 11:02:04

XBV00040.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 11:02:04

XBV00041.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 11:02:04

XBV00146.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00147.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00148.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00149.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00150.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00151.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00152.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00153.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00154.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00155.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00156.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00157.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00158.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00159.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00160.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00161.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00162.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00163.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00164.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00165.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00166.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00167.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00168.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00169.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00170.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00171.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00172.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00173.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00174.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00175.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00176.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00177.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00178.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00179.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00180.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00181.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00182.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00183.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00184.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00185.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00186.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00187.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00188.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00189.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00190.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00191.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00192.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00193.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00194.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00195.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00196.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00197.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00198.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00199.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00200.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00201.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00202.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00203.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00204.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00205.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00206.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00207.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00208.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00209.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00210.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00211.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00212.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00213.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00214.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00215.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00216.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00217.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00218.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00219.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00220.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00221.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00222.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00223.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00224.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00225.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00226.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00227.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00228.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00229.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00230.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00231.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00232.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00233.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00234.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00235.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00236.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00237.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00238.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00239.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00240.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00241.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00242.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00243.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00244.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00245.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00246.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00247.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00248.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00249.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00250.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00251.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00252.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00253.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00254.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00255.VDF   : 8.11.213.176     2048 Bytes  05.03.2015 11:02:04

XBV00000.VDF   : 7.11.70.0   66736640 Bytes  04.04.2013 11:02:04

XBV00001.VDF   : 7.11.74.226  2201600 Bytes  30.04.2013 11:02:04

XBV00002.VDF   : 7.11.80.60   2751488 Bytes  28.05.2013 11:02:04

XBV00003.VDF   : 7.11.85.214  2162688 Bytes  21.06.2013 11:02:04

XBV00004.VDF   : 7.11.91.176  3903488 Bytes  23.07.2013 11:02:04

XBV00005.VDF   : 7.11.98.186  6822912 Bytes  29.08.2013 11:02:04

XBV00006.VDF   : 7.11.139.38 15708672 Bytes  27.03.2014 11:02:04

XBV00007.VDF   : 7.11.152.100  4193792 Bytes  02.06.2014 11:02:04

XBV00008.VDF   : 8.11.165.192  4251136 Bytes  07.08.2014 11:02:04

XBV00009.VDF   : 8.11.172.30  2094080 Bytes  15.09.2014 11:02:04

XBV00010.VDF   : 8.11.178.32  1581056 Bytes  14.10.2014 11:02:04

XBV00011.VDF   : 8.11.184.50  2178560 Bytes  11.11.2014 11:02:04

XBV00012.VDF   : 8.11.190.32  1876992 Bytes  03.12.2014 11:02:04

XBV00013.VDF   : 8.11.201.28  2973696 Bytes  14.01.2015 11:02:04

XBV00014.VDF   : 8.11.206.252  2695680 Bytes  04.02.2015 11:02:04

XBV00015.VDF   : 8.11.213.84  3175936 Bytes  03.03.2015 11:02:04

XBV00016.VDF   : 8.11.213.176   212480 Bytes  05.03.2015 11:02:04

XBV00042.VDF   : 8.11.213.202     3584 Bytes  05.03.2015 11:02:04

XBV00043.VDF   : 8.11.213.204     2048 Bytes  05.03.2015 11:02:04

XBV00044.VDF   : 8.11.213.230    40960 Bytes  05.03.2015 11:02:04

XBV00045.VDF   : 8.11.214.2     29184 Bytes  05.03.2015 11:02:04

XBV00046.VDF   : 8.11.214.28    25088 Bytes  05.03.2015 11:02:04

XBV00047.VDF   : 8.11.214.30    14848 Bytes  05.03.2015 11:02:04

XBV00048.VDF   : 8.11.214.32     3072 Bytes  05.03.2015 11:02:04

XBV00049.VDF   : 8.11.214.34     2048 Bytes  06.03.2015 11:02:04

XBV00050.VDF   : 8.11.214.38    39424 Bytes  06.03.2015 11:02:04

XBV00051.VDF   : 8.11.214.40     6656 Bytes  06.03.2015 11:02:04

XBV00052.VDF   : 8.11.214.42     4608 Bytes  06.03.2015 11:02:04

XBV00053.VDF   : 8.11.214.44     5120 Bytes  06.03.2015 11:02:04

XBV00054.VDF   : 8.11.214.46    23552 Bytes  06.03.2015 11:02:04

XBV00055.VDF   : 8.11.214.48     3072 Bytes  06.03.2015 11:02:04

XBV00056.VDF   : 8.11.214.50    25600 Bytes  06.03.2015 11:02:04

XBV00057.VDF   : 8.11.214.72     2048 Bytes  06.03.2015 11:02:04

XBV00058.VDF   : 8.11.214.92    48128 Bytes  06.03.2015 11:02:04

XBV00059.VDF   : 8.11.214.112    12800 Bytes  06.03.2015 11:02:04

XBV00060.VDF   : 8.11.214.114     2560 Bytes  06.03.2015 11:02:04

XBV00061.VDF   : 8.11.214.136    32256 Bytes  06.03.2015 11:02:04

XBV00062.VDF   : 8.11.214.138     2048 Bytes  06.03.2015 11:02:04

XBV00063.VDF   : 8.11.214.140     2048 Bytes  07.03.2015 11:02:04

XBV00064.VDF   : 8.11.214.144    34304 Bytes  07.03.2015 11:02:04

XBV00065.VDF   : 8.11.214.146     2048 Bytes  07.03.2015 11:02:04

XBV00066.VDF   : 8.11.214.168    33792 Bytes  07.03.2015 11:02:04

XBV00067.VDF   : 8.11.214.188    71168 Bytes  08.03.2015 11:02:04

XBV00068.VDF   : 8.11.214.190     2048 Bytes  08.03.2015 11:02:04

XBV00069.VDF   : 8.11.214.192     2048 Bytes  08.03.2015 11:02:04

XBV00070.VDF   : 8.11.214.212     2048 Bytes  08.03.2015 11:02:04

XBV00071.VDF   : 8.11.214.232    28672 Bytes  08.03.2015 11:02:04

XBV00072.VDF   : 8.11.214.252    69120 Bytes  09.03.2015 11:02:04

XBV00073.VDF   : 8.11.215.14     3584 Bytes  09.03.2015 11:02:04

XBV00074.VDF   : 8.11.215.32     7168 Bytes  09.03.2015 11:02:04

XBV00075.VDF   : 8.11.215.50    12800 Bytes  09.03.2015 11:02:04

XBV00076.VDF   : 8.11.215.52     5120 Bytes  09.03.2015 11:02:04

XBV00077.VDF   : 8.11.215.70    17920 Bytes  09.03.2015 11:02:04

XBV00078.VDF   : 8.11.215.90     2048 Bytes  09.03.2015 11:02:04

XBV00079.VDF   : 8.11.215.110     2048 Bytes  09.03.2015 11:02:04

XBV00080.VDF   : 8.11.215.132    29696 Bytes  09.03.2015 11:02:04

XBV00081.VDF   : 8.11.215.134    11264 Bytes  09.03.2015 11:02:04

XBV00082.VDF   : 8.11.215.136    11264 Bytes  09.03.2015 11:02:04

XBV00083.VDF   : 8.11.215.138    12288 Bytes  10.03.2015 11:02:04

XBV00084.VDF   : 8.11.215.140    35840 Bytes  10.03.2015 11:02:04

XBV00085.VDF   : 8.11.215.158     6144 Bytes  10.03.2015 11:02:04

XBV00086.VDF   : 8.11.215.174     5632 Bytes  10.03.2015 11:02:04

XBV00087.VDF   : 8.11.215.190     8704 Bytes  10.03.2015 11:02:04

XBV00088.VDF   : 8.11.215.206    19968 Bytes  10.03.2015 11:02:04

XBV00089.VDF   : 8.11.215.222    12800 Bytes  10.03.2015 11:02:04

XBV00090.VDF   : 8.11.215.226     2048 Bytes  10.03.2015 11:02:04

XBV00091.VDF   : 8.11.215.230    14336 Bytes  10.03.2015 11:02:04

XBV00092.VDF   : 8.11.215.234    26112 Bytes  10.03.2015 11:02:04

XBV00093.VDF   : 8.11.215.236    11776 Bytes  10.03.2015 11:02:04

XBV00094.VDF   : 8.11.215.240    22016 Bytes  11.03.2015 11:02:04

XBV00095.VDF   : 8.11.215.242     2048 Bytes  11.03.2015 11:02:04

XBV00096.VDF   : 8.11.215.244     2048 Bytes  11.03.2015 11:02:04

XBV00097.VDF   : 8.11.216.4      7680 Bytes  11.03.2015 11:02:04

XBV00098.VDF   : 8.11.216.20    12800 Bytes  11.03.2015 11:02:04

XBV00099.VDF   : 8.11.216.36    19968 Bytes  11.03.2015 11:02:04

XBV00100.VDF   : 8.11.216.52     2560 Bytes  11.03.2015 11:02:04

XBV00101.VDF   : 8.11.216.54    22016 Bytes  11.03.2015 11:02:04

XBV00102.VDF   : 8.11.216.56     8192 Bytes  11.03.2015 11:02:04

XBV00103.VDF   : 8.11.216.58     4608 Bytes  11.03.2015 11:02:04

XBV00104.VDF   : 8.11.216.60    16896 Bytes  11.03.2015 11:02:04

XBV00105.VDF   : 8.11.216.76    14336 Bytes  11.03.2015 11:02:04

XBV00106.VDF   : 8.11.216.90    30208 Bytes  11.03.2015 11:02:04

XBV00107.VDF   : 8.11.216.104     5632 Bytes  12.03.2015 11:02:04

XBV00108.VDF   : 8.11.216.118     6656 Bytes  12.03.2015 11:02:04

XBV00109.VDF   : 8.11.216.120    24576 Bytes  12.03.2015 11:02:04

XBV00110.VDF   : 8.11.216.122    16896 Bytes  12.03.2015 11:02:04

XBV00111.VDF   : 8.11.216.124     2048 Bytes  12.03.2015 11:02:04

XBV00112.VDF   : 8.11.216.138    16896 Bytes  12.03.2015 11:02:04

XBV00113.VDF   : 8.11.216.140     2048 Bytes  12.03.2015 11:02:04

XBV00114.VDF   : 8.11.216.154     3584 Bytes  12.03.2015 11:02:04

XBV00115.VDF   : 8.11.216.168     2048 Bytes  12.03.2015 11:02:04

XBV00116.VDF   : 8.11.216.182    70144 Bytes  12.03.2015 11:02:04

XBV00117.VDF   : 8.11.216.196     2048 Bytes  13.03.2015 11:02:04

XBV00118.VDF   : 8.11.216.200    46080 Bytes  13.03.2015 11:02:04

XBV00119.VDF   : 8.11.216.214    11776 Bytes  13.03.2015 11:02:04

XBV00120.VDF   : 8.11.216.228     4096 Bytes  13.03.2015 11:02:04

XBV00121.VDF   : 8.11.216.242     2560 Bytes  13.03.2015 11:02:04

XBV00122.VDF   : 8.11.216.254     2560 Bytes  13.03.2015 11:02:04

XBV00123.VDF   : 8.11.217.10     7680 Bytes  13.03.2015 11:02:04

XBV00124.VDF   : 8.11.217.14     2048 Bytes  13.03.2015 11:02:04

XBV00125.VDF   : 8.11.217.16    24576 Bytes  13.03.2015 11:02:04

XBV00126.VDF   : 8.11.217.22    17408 Bytes  13.03.2015 11:02:04

XBV00127.VDF   : 8.11.217.24     2048 Bytes  13.03.2015 11:02:04

XBV00128.VDF   : 8.11.217.26     2048 Bytes  13.03.2015 11:02:04

XBV00129.VDF   : 8.11.217.28    15872 Bytes  13.03.2015 11:02:04

XBV00130.VDF   : 8.11.217.42    84480 Bytes  14.03.2015 11:02:04

XBV00131.VDF   : 8.11.217.54     2048 Bytes  14.03.2015 11:02:04

XBV00132.VDF   : 8.11.217.66     2048 Bytes  14.03.2015 11:02:04

XBV00133.VDF   : 8.11.217.78    19456 Bytes  14.03.2015 11:02:04

XBV00134.VDF   : 8.11.217.90    71680 Bytes  15.03.2015 11:02:04

XBV00135.VDF   : 8.11.217.102     2048 Bytes  15.03.2015 11:02:04

XBV00136.VDF   : 8.11.217.124     6656 Bytes  15.03.2015 11:02:04

XBV00137.VDF   : 8.11.217.136    76800 Bytes  16.03.2015 11:02:04

XBV00138.VDF   : 8.11.217.146     3584 Bytes  16.03.2015 11:02:04

XBV00139.VDF   : 8.11.217.156     3584 Bytes  16.03.2015 11:02:04

XBV00140.VDF   : 8.11.217.166     4096 Bytes  16.03.2015 11:02:04

XBV00141.VDF   : 8.11.217.176    12288 Bytes  16.03.2015 11:02:04

XBV00142.VDF   : 8.11.217.186    13312 Bytes  16.03.2015 11:02:04

XBV00143.VDF   : 8.11.217.188    24064 Bytes  16.03.2015 11:02:04

XBV00144.VDF   : 8.11.217.194     7680 Bytes  16.03.2015 11:02:04

XBV00145.VDF   : 8.11.217.198    31232 Bytes  16.03.2015 11:02:04

LOCAL000.VDF   : 8.11.217.198 124588544 Bytes  16.03.2015 09:53:13

Engineversion  : 8.3.30.0  

AEVDF.DLL      : 8.3.1.6       133992 Bytes  17.03.2015 11:01:51

AESCRIPT.DLL   : 8.2.2.56      554920 Bytes  17.03.2015 11:01:51

AESCN.DLL      : 8.3.2.2       139456 Bytes  17.03.2015 11:01:51

AESBX.DLL      : 8.2.20.34    1615784 Bytes  17.03.2015 11:01:51

AERDL.DLL      : 8.2.1.20      731040 Bytes  17.03.2015 11:01:51

AEPACK.DLL     : 8.4.0.62      793456 Bytes  17.03.2015 11:01:51

AEOFFICE.DLL   : 8.3.1.14      354216 Bytes  17.03.2015 11:01:51

AEMOBILE.DLL   : 8.1.7.0       281456 Bytes  17.03.2015 11:01:51

AEHEUR.DLL     : 8.1.4.1578   8137584 Bytes  17.03.2015 11:01:51

AEHELP.DLL     : 8.3.1.0       278728 Bytes  17.03.2015 11:01:51

AEGEN.DLL      : 8.1.7.40      456608 Bytes  17.03.2015 11:01:51

AEEXP.DLL      : 8.4.2.70      255904 Bytes  17.03.2015 11:01:51

AEEMU.DLL      : 8.1.3.4       399264 Bytes  17.03.2015 11:01:51

AEDROID.DLL    : 8.4.3.116    1050536 Bytes  17.03.2015 11:01:51

AECORE.DLL     : 8.3.4.0       243624 Bytes  17.03.2015 11:01:51

AEBB.DLL       : 8.1.2.0        60448 Bytes  17.03.2015 11:01:51

AVWINLL.DLL    : 15.0.8.652     25904 Bytes  17.03.2015 11:01:56

AVPREF.DLL     : 15.0.8.652     53248 Bytes  17.03.2015 11:01:55

AVREP.DLL      : 15.0.8.652    221432 Bytes  17.03.2015 11:01:55

AVARKT.DLL     : 15.0.8.652    228088 Bytes  17.03.2015 11:01:52

AVEVTLOG.DLL   : 15.0.8.652    183600 Bytes  17.03.2015 11:01:53

SQLITE3.DLL    : 15.0.8.652    456440 Bytes  17.03.2015 11:02:03

AVSMTP.DLL     : 15.0.8.652     79360 Bytes  17.03.2015 11:01:56

NETNT.DLL      : 15.0.8.652     17352 Bytes  17.03.2015 11:02:01

RCIMAGE.DLL    : 15.0.8.652   4864816 Bytes  17.03.2015 11:02:02

RCTEXT.DLL     : 15.0.8.652     75056 Bytes  17.03.2015 11:02:02
 

Konfiguration für den aktuellen Suchlauf:

Job Name..............................: Vollständige Systemprüfung

Konfigurationsdatei...................: C:\Program Files (x86)\Avira\AntiVir Desktop\sysscan.avp

Protokollierung.......................: standard

Primäre Aktion........................: Interaktiv

Sekundäre Aktion......................: Ignorieren

Durchsuche Masterbootsektoren.........: ein

Durchsuche Bootsektoren...............: ein

Bootsektoren..........................: C:, 

Durchsuche aktive Programme...........: ein

Laufende Programme erweitert..........: ein

Durchsuche Registrierung..............: ein

Suche nach Rootkits...................: ein

Integritätsprüfung von Systemdateien..: aus

Prüfe alle Dateien....................: Alle Dateien

Durchsuche Archive....................: ein

Rekursionstiefe einschränken..........: 20

Archiv Smart Extensions...............: ein

Makrovirenheuristik...................: ein

Dateiheuristik........................: erweitert
 

Beginn des Suchlaufs: Samstag, 4. April 2015  11:56
 

Der Suchlauf über die Bootsektoren wird begonnen:

Bootsektor 'HDD0(C:)'

    [INFO]      Es wurde kein Virus gefunden!
 

Der Suchlauf nach versteckten Objekten wird begonnen.

Fehler in der ARK Library
 

Der Suchlauf über gestartete Prozesse wird begonnen:

Durchsuche Prozess 'svchost.exe' - '46' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '26' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '61' Modul(e) wurden durchsucht

Durchsuche Prozess 'dwm.exe' - '40' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '193' Modul(e) wurden durchsucht

Durchsuche Prozess 'TrustedInstaller.exe' - '22' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '46' Modul(e) wurden durchsucht

Durchsuche Prozess 'igfxCUIService.exe' - '40' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '111' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '65' Modul(e) wurden durchsucht

Durchsuche Prozess 'WLANExt.exe' - '75' Modul(e) wurden durchsucht

Durchsuche Prozess 'conhost.exe' - '12' Modul(e) wurden durchsucht

Durchsuche Prozess 'spoolsv.exe' - '69' Modul(e) wurden durchsucht

Durchsuche Prozess 'sched.exe' - '63' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '82' Modul(e) wurden durchsucht

Durchsuche Prozess 'avguard.exe' - '103' Modul(e) wurden durchsucht

Durchsuche Prozess 'CxAudMsg64.exe' - '32' Modul(e) wurden durchsucht

Durchsuche Prozess 'esif_uf.exe' - '33' Modul(e) wurden durchsucht

Durchsuche Prozess 'EvtEng.exe' - '58' Modul(e) wurden durchsucht

Durchsuche Prozess 'FbService.exe' - '21' Modul(e) wurden durchsucht

Durchsuche Prozess 'HarmonyPicksService.exe' - '58' Modul(e) wurden durchsucht

Durchsuche Prozess 'HarmonySettingService.exe' - '80' Modul(e) wurden durchsucht

Durchsuche Prozess 'ibtsiva.exe' - '26' Modul(e) wurden durchsucht

Durchsuche Prozess 'OKOUpdataService.exe' - '27' Modul(e) wurden durchsucht

Durchsuche Prozess 'SettingsService.exe' - '46' Modul(e) wurden durchsucht

Durchsuche Prozess 'SystemAgentService.exe' - '38' Modul(e) wurden durchsucht

Durchsuche Prozess 'LPAWDService.exe' - '22' Modul(e) wurden durchsucht

Durchsuche Prozess 'LenovoSetSvr.exe' - '33' Modul(e) wurden durchsucht

Durchsuche Prozess 'LenovoWiFiHotspotSvr.exe' - '50' Modul(e) wurden durchsucht

Durchsuche Prozess 'dashost.exe' - '22' Modul(e) wurden durchsucht

Durchsuche Prozess 'NitroPDFDriverService9x64.exe' - '16' Modul(e) wurden durchsucht

Durchsuche Prozess 'NLSSRV32.EXE' - '16' Modul(e) wurden durchsucht

Durchsuche Prozess 'OKOControlSvc.exe' - '24' Modul(e) wurden durchsucht

Durchsuche Prozess 'PaperLookingSrv.exe' - '38' Modul(e) wurden durchsucht

Durchsuche Prozess 'PGService.exe' - '33' Modul(e) wurden durchsucht

Durchsuche Prozess 'PG_Service_Launcher.exe' - '49' Modul(e) wurden durchsucht

Durchsuche Prozess 'PhoneCompanionPusher.exe' - '13' Modul(e) wurden durchsucht

Durchsuche Prozess 'PLHotkeyService.exe' - '49' Modul(e) wurden durchsucht

Durchsuche Prozess 'WebcamSplitterServer.exe' - '51' Modul(e) wurden durchsucht

Durchsuche Prozess 'RegSrvc.exe' - '36' Modul(e) wurden durchsucht

Durchsuche Prozess 'RichVideo64.exe' - '23' Modul(e) wurden durchsucht

Durchsuche Prozess 'SAsrv.exe' - '26' Modul(e) wurden durchsucht

Durchsuche Prozess 'VfConnectorService.exe' - '30' Modul(e) wurden durchsucht

Durchsuche Prozess 'ymc.exe' - '69' Modul(e) wurden durchsucht

Durchsuche Prozess 'ZeroConfigService.exe' - '75' Modul(e) wurden durchsucht

Durchsuche Prozess 'unsecapp.exe' - '23' Modul(e) wurden durchsucht

Durchsuche Prozess 'wmiprvse.exe' - '51' Modul(e) wurden durchsucht

Durchsuche Prozess 'wmiprvse.exe' - '52' Modul(e) wurden durchsucht

Durchsuche Prozess 'avshadow.exe' - '29' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '26' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '54' Modul(e) wurden durchsucht

Durchsuche Prozess 'WUDFHost.exe' - '48' Modul(e) wurden durchsucht

Durchsuche Prozess 'WUDFHost.exe' - '36' Modul(e) wurden durchsucht

Durchsuche Prozess 'WUDFHost.exe' - '46' Modul(e) wurden durchsucht

Durchsuche Prozess 'WUDFHost.exe' - '22' Modul(e) wurden durchsucht

Durchsuche Prozess 'esif_assist.exe' - '22' Modul(e) wurden durchsucht

Durchsuche Prozess 'PresentationFontCache.exe' - '36' Modul(e) wurden durchsucht

Durchsuche Prozess 'Explorer.EXE' - '198' Modul(e) wurden durchsucht

Durchsuche Prozess 'taskeng.exe' - '32' Modul(e) wurden durchsucht

Durchsuche Prozess 'taskhostex.exe' - '41' Modul(e) wurden durchsucht

Durchsuche Prozess 'igfxEM.exe' - '50' Modul(e) wurden durchsucht

Durchsuche Prozess 'igfxHK.exe' - '31' Modul(e) wurden durchsucht

Durchsuche Prozess 'igfxTray.exe' - '47' Modul(e) wurden durchsucht

Durchsuche Prozess 'TiWorker.exe' - '46' Modul(e) wurden durchsucht

Durchsuche Prozess 'LiveComm.exe' - '51' Modul(e) wurden durchsucht

Durchsuche Prozess 'TabTip.exe' - '44' Modul(e) wurden durchsucht

Durchsuche Prozess 'SearchIndexer.exe' - '70' Modul(e) wurden durchsucht

Durchsuche Prozess 'TabTip32.exe' - '21' Modul(e) wurden durchsucht

Durchsuche Prozess 'skydrive.exe' - '65' Modul(e) wurden durchsucht

Durchsuche Prozess 'SearchProtocolHost.exe' - '42' Modul(e) wurden durchsucht

Durchsuche Prozess 'SearchFilterHost.exe' - '31' Modul(e) wurden durchsucht

Durchsuche Prozess 'msiexec.exe' - '52' Modul(e) wurden durchsucht

Durchsuche Prozess 'Avira.OE.ServiceHost.exe' - '105' Modul(e) wurden durchsucht

Durchsuche Prozess 'Avira.OE.Systray.exe' - '112' Modul(e) wurden durchsucht

Durchsuche Prozess 'RuntimeBroker.exe' - '52' Modul(e) wurden durchsucht

Durchsuche Prozess 'fmapp.exe' - '15' Modul(e) wurden durchsucht

Durchsuche Prozess 'CAudioFilterAgent64.exe' - '34' Modul(e) wurden durchsucht

Durchsuche Prozess 'WavesSvc64.exe' - '27' Modul(e) wurden durchsucht

Durchsuche Prozess 'SynTPEnh.exe' - '51' Modul(e) wurden durchsucht

Durchsuche Prozess 'SYNTPHELPER.EXE' - '19' Modul(e) wurden durchsucht

Durchsuche Prozess 'rundll32.exe' - '14' Modul(e) wurden durchsucht

Durchsuche Prozess 'rundll32.exe' - '48' Modul(e) wurden durchsucht

Durchsuche Prozess 'utility.exe' - '51' Modul(e) wurden durchsucht

Durchsuche Prozess 'TransitionServer.exe' - '34' Modul(e) wurden durchsucht

Durchsuche Prozess 'Phone Companion.exe' - '34' Modul(e) wurden durchsucht

Durchsuche Prozess 'OneKeyOptimizerTray.exe' - '48' Modul(e) wurden durchsucht

Durchsuche Prozess 'OnekeyOptimizerUpdata.exe' - '27' Modul(e) wurden durchsucht

Durchsuche Prozess 'Lenovo.HarmonyPicks.exe' - '127' Modul(e) wurden durchsucht

Durchsuche Prozess 'Lenovo.HarmonySetting.exe' - '118' Modul(e) wurden durchsucht

Durchsuche Prozess 'avgnt.exe' - '99' Modul(e) wurden durchsucht

Durchsuche Prozess 'WMIADAP.EXE' - '26' Modul(e) wurden durchsucht

Durchsuche Prozess 'avcenter.exe' - '105' Modul(e) wurden durchsucht

Durchsuche Prozess 'IAStorIcon.exe' - '62' Modul(e) wurden durchsucht

Durchsuche Prozess 'avscan.exe' - '109' Modul(e) wurden durchsucht

Durchsuche Prozess 'vssvc.exe' - '39' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '30' Modul(e) wurden durchsucht

Durchsuche Prozess 'ipmGui.exe' - '88' Modul(e) wurden durchsucht

Durchsuche Prozess 'wininit.exe' - '15' Modul(e) wurden durchsucht

Durchsuche Prozess 'winlogon.exe' - '28' Modul(e) wurden durchsucht

Durchsuche Prozess 'lsass.exe' - '60' Modul(e) wurden durchsucht
 

Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:

C:\ProgramData\{47b36d71-bb6e-ffd8-47b3-36d71bb6b5c6}\hqghumeaylnlf.exe

  [FUND]      Enthält Muster der Software PUA/OptimizerPro.Gen
 

Die Registry wurde durchsucht ( '1673' Dateien ).
 
 

Der Suchlauf über die ausgewählten Dateien wird begonnen:
 

Beginne mit der Suche in 'C:\' <Windows8_OS>

C:\swapfile.sys

  [WARNUNG]   Die Datei konnte nicht geöffnet werden!

C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\ProtectService.exe.vir

  [FUND]      Enthält Muster der Software PUA/SearchProtect.EH

C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\SupTab.dll.vir

  [FUND]      Enthält Muster der Software PUA/Subtab.Gen

C:\AdwCleaner\Quarantine\C\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe.vir

  [FUND]      Enthält Erkennungsmuster der Adware ADWARE/Adware.Gen

C:\ProgramData\{47b36d71-bb6e-ffd8-47b3-36d71bb6b5c6}\hqghumeaylnlf.exe

  [FUND]      Enthält Muster der Software PUA/OptimizerPro.Gen

C:\Users\Winfried\AppData\Local\Microsoft\Windows\INetCache\IE\B4408QSB\OptimizerPro3[1].exe

  [FUND]      Enthält Muster der Software PUA/OptimizerPro.Gen

C:\Users\Winfried\AppData\Local\Microsoft\Windows\INetCache\IE\HT0OSLKQ\BrowserGood[1].dll

  [FUND]      Enthält Erkennungsmuster der Adware ADWARE/BrowseFox.Gen2

C:\Users\Winfried\AppData\Local\Microsoft\Windows\INetCache\IE\HT0OSLKQ\Reimage[2].exe

    [0] Archivtyp: NSIS

    --> ProgramFilesDir/[PluginsDir]/htnfb.dll

        [FUND]      Enthält Muster der Software PUA/Outbrowse.Gen

        [WARNUNG]   Infizierte Dateien in Archiven können nicht repariert werden

C:\Users\Winfried\AppData\Local\Microsoft\Windows\INetCache\IE\T7J7BXCZ\Firefox_36.0.1_einrichten.exe

  [FUND]      Ist das Trojanische Pferd TR/Crypt.XPACK.Gen

C:\Users\Winfried\AppData\Local\Temp\supoptsetup.exe

    [0] Archivtyp: Inno Setup

    --> {app}\SupOptReminder.exe

        [FUND]      Enthält Muster der Software PUA/OptimizerPro.Gen

        [WARNUNG]   Infizierte Dateien in Archiven können nicht repariert werden

    --> {app}\SupOptGuard.exe

        [FUND]      Enthält Muster der Software PUA/OptimizerPro.Gen

        [WARNUNG]   Infizierte Dateien in Archiven können nicht repariert werden

C:\Users\Winfried\AppData\Local\Temp\is-4UOR5.tmp\gentlemjmp_ieu.exe

    [0] Archivtyp: Inno Setup

    --> {tmp}\package_ytd_installer_multilang.exe

        [1] Archivtyp: Inno Setup

      --> {tmp}\FileDownloader.exe

          [FUND]      Enthält Erkennungsmuster der Adware ADWARE/EoRezo.bond

          [WARNUNG]   Infizierte Dateien in Archiven können nicht repariert werden

    --> {tmp}\GetHomepage.exe

        [FUND]      Enthält Erkennungsmuster der Adware ADWARE/EoRezo.bond

        [WARNUNG]   Infizierte Dateien in Archiven können nicht repariert werden

C:\Users\Winfried\AppData\Local\Temp\is-SJH4C.tmp\gentlemjmp_ieu.exe

    [0] Archivtyp: Inno Setup

    --> {tmp}\package_ytd_installer_multilang.exe

        [1] Archivtyp: Inno Setup

      --> {tmp}\FileDownloader.exe

          [FUND]      Enthält Erkennungsmuster der Adware ADWARE/EoRezo.bond

          [WARNUNG]   Infizierte Dateien in Archiven können nicht repariert werden

    --> {tmp}\GetHomepage.exe

        [FUND]      Enthält Erkennungsmuster der Adware ADWARE/EoRezo.bond

        [WARNUNG]   Infizierte Dateien in Archiven können nicht repariert werden
 

Beginne mit der Desinfektion:

Die Datei '\\?\C:\Users\Winfried\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hqghumeaylnlf.lnk' wurde ins Quarantäneverzeichnis verschoben.

C:\Users\Winfried\AppData\Local\Temp\is-SJH4C.tmp\gentlemjmp_ieu.exe

  [FUND]      Enthält Erkennungsmuster der Adware ADWARE/EoRezo.bond

  [HINWEIS]   Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '506e1b81.qua' verschoben!

C:\Users\Winfried\AppData\Local\Temp\is-4UOR5.tmp\gentlemjmp_ieu.exe

  [FUND]      Enthält Erkennungsmuster der Adware ADWARE/EoRezo.bond

  [HINWEIS]   Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '48f934dc.qua' verschoben!

C:\Users\Winfried\AppData\Local\Temp\supoptsetup.exe

  [FUND]      Enthält Muster der Software PUA/OptimizerPro.Gen

  [HINWEIS]   Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '1aa46e22.qua' verschoben!

C:\Users\Winfried\AppData\Local\Microsoft\Windows\INetCache\IE\T7J7BXCZ\Firefox_36.0.1_einrichten.exe

  [FUND]      Ist das Trojanische Pferd TR/Crypt.XPACK.Gen

  [HINWEIS]   Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '7c8d21fc.qua' verschoben!

C:\Users\Winfried\AppData\Local\Microsoft\Windows\INetCache\IE\HT0OSLKQ\Reimage[2].exe

  [FUND]      Enthält Muster der Software PUA/Outbrowse.Gen

  [HINWEIS]   Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '39100cc3.qua' verschoben!

C:\Users\Winfried\AppData\Local\Microsoft\Windows\INetCache\IE\HT0OSLKQ\BrowserGood[1].dll

  [FUND]      Enthält Erkennungsmuster der Adware ADWARE/BrowseFox.Gen2

  [HINWEIS]   Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '460d3eb4.qua' verschoben!

C:\Users\Winfried\AppData\Local\Microsoft\Windows\INetCache\IE\B4408QSB\OptimizerPro3[1].exe

  [FUND]      Enthält Muster der Software PUA/OptimizerPro.Gen

  [HINWEIS]   Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '0aa812c3.qua' verschoben!

C:\AdwCleaner\Quarantine\C\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe.vir

  [FUND]      Enthält Erkennungsmuster der Adware ADWARE/Adware.Gen

  [HINWEIS]   Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '76ad5294.qua' verschoben!

C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\SupTab.dll.vir

  [FUND]      Enthält Muster der Software PUA/Subtab.Gen

  [HINWEIS]   Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5bf67dd0.qua' verschoben!

C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\ProtectService.exe.vir

  [FUND]      Enthält Muster der Software PUA/SearchProtect.EH

  [HINWEIS]   Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '429f464f.qua' verschoben!

C:\ProgramData\{47b36d71-bb6e-ffd8-47b3-36d71bb6b5c6}\hqghumeaylnlf.exe

  [FUND]      Enthält Muster der Software PUA/OptimizerPro.Gen

  [HINWEIS]   Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5f7253ee.qua' verschoben!
 
 

Ende des Suchlaufs: Samstag, 4. April 2015  12:13

Benötigte Zeit: 15:33 Minute(n)
 

Der Suchlauf wurde vollständig durchgeführt.
 

  37202 Verzeichnisse wurden überprüft

 865870 Dateien wurden geprüft

     15 Viren bzw. unerwünschte Programme wurden gefunden

      0 Dateien wurden als verdächtig eingestuft

      0 Dateien wurden gelöscht

      0 Viren bzw. unerwünschte Programme wurden repariert

     11 Dateien wurden in die Quarantäne verschoben

      0 Dateien wurden umbenannt

      1 Dateien konnten nicht durchsucht werden

 865854 Dateien ohne Befall

   7509 Archive wurden durchsucht

      8 Warnungen

     11 Hinweise

   1327 Objekte wurden beim Rootkitscan durchsucht

      0 Versteckte Objekte wurden gefunden

GMER:

Funktioniert leider nicht. Es kommt die Fehlermeldung "c:\WINDOWS\system32\config\system: der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird"

hi,

Addition.txt fehlt noch :)

Zitat:

Zitat von schrauber (Beitrag 1451410)

hi,

Addition.txt fehlt noch :)

stimmt :)

addition.txt

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-03-2015

Ran by Winfried at 2015-04-05 14:11:45

Running from C:\Users\Winfried\Desktop

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

(If an entry is included in the fixlist, it will be removed.)
 

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 

==================== Installed Programs ======================
 

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 

 Lenovo Photo Master (HKLM-x32\...\InstallShield_{BC94C56A-3649-420C-8756-2ADEBE399D33}) (Version: 1.5.2126.02 - CyberLink Corp.)

 Lenovo Photo Master (x32 Version: 1.5.2126.02 - CyberLink Corp.) Hidden

Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.134 - Adobe Systems Incorporated)

Avira (HKLM-x32\...\{bd538030-07d4-4999-a525-7fafa2483f56}) (Version: 1.1.30.21727 - Avira Operations & Co. KG)

Avira (x32 Version: 1.1.30.21727 - Avira Operations & Co. KG) Hidden

Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 15.0.8.656 - Avira)

Benutzerhandbücher (x32 Version: 3.0.0.3 - Lenovo) Hidden

CCSDK (HKLM-x32\...\{AE75190B-11B4-4F90-8254-DAB275CF2557}_is1) (Version: 1.1.0.7 - Lenovo)

Conexant HD Audio (HKLM\...\CNXT_AUDIO_HDA) (Version: 8.65.55.0 - Conexant)

CyberLink PowerDirector 10 (HKLM-x32\...\InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}) (Version: 10.0.0.2810 - CyberLink Corp.)

CyberLink PowerDirector 10 (Version: 10.0.0.2810 - CyberLink Corp.) Hidden

Dependency Package Update (Version: 1.6.29.00 - Lenovo Inc.) Hidden

Dependency Package Update (Version: 1.6.36.00 - Lenovo Inc.) Hidden

Dependency Package Update (x32 Version: 1.6.32.00 - Lenovo Group Limited) Hidden

Harmony (HKLM-x32\...\{D02D9427-507D-4912-9285-97FCD5417E72}) (Version: 1.0.0.0929 - Lenovo)

Harmony (x32 Version: 1.0.0.0929 - Lenovo) Hidden

Intel Collaborative Processor Performance Control (HKLM-x32\...\0E7DAF70-FB54-4B91-B192-7E771C25AEEB) (Version: 1.0.0.1018 - Intel Corporation)

Intel(R) Dynamic Platform and Thermal Framework (HKLM-x32\...\{654EE65D-FAA4-4EA6-8C07-DC94E6A304D4}) (Version: 8.0.10100.71 - Intel Corporation)

Intel(R) Management Engine Components (HKLM\...\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 10.0.30.1072 - Intel Corporation)

Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.14.4029 - Intel Corporation)

Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 13.5.0.1056 - Intel Corporation)

Intel(R) Update Manager (HKLM-x32\...\{84A2B59B-6A7B-4C01-8592-15C9BFE6AC36}) (Version: 2.4.3 - Intel Corporation)

Intel(R) Wireless Bluetooth(R) (HKLM-x32\...\{5BC2A343-DED5-40E8-8F64-472FD74D80EA}) (Version: 17.1.1433.02 - Intel Corporation)

Intel® Chipsatz-Gerätesoftware (x32 Version: 10.0.22 - Intel(R) Corporation) Hidden

Intel® PROSet/Wireless Software (HKLM-x32\...\{c78a13fd-4324-4ddb-a613-746d2461441d}) (Version: 17.13.1 - Intel Corporation)

Lenovo Dependency Package (HKLM\...\Lenovo Dependency Package_is1) (Version: 1.6.36.00 - Lenovo Group Limited)

Lenovo EasyCamera (HKLM-x32\...\{E399A5B3-ED53-4DEA-AF04-8011E1EB1EAC}) (Version: 6.3.9600.11064 - Realtek Semiconductor Corp.)

Lenovo Experience Improvement (HKLM\...\LenovoExperienceImprovement) (Version: 1.0.19.0 - Lenovo)

Lenovo FusionEngine  (HKLM-x32\...\Lenovo FusionEngine) (Version: 1.0.13.0 - Lenovo, Inc.)

Lenovo Mobile Phone Wireless Import (HKLM-x32\...\InstallShield_{DFB2E0D6-8DDE-49A4-B8F7-03C14DACCBA6}) (Version: 1.1.1.9 - Lenovo)

Lenovo Mobile Phone Wireless Import (x32 Version: 1.1.1.9 - Lenovo) Hidden

Lenovo Motion Control (HKLM-x32\...\InstallShield_{D3F38500-4C99-4E4F-9786-B907224E13A1}) (Version: 2.6.0.0528 - PointGrab)

Lenovo Motion Control (x32 Version: 2.6.0.0528 - PointGrab) Hidden

Lenovo OneKey Recovery (HKLM-x32\...\InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}) (Version: 8.1.0.2619 - CyberLink Corp.)

Lenovo OneKey Recovery (Version: 8.1.0.2619 - CyberLink Corp.) Hidden

Lenovo Paper Display (HKLM-x32\...\InstallShield_{B5E4B638-FFF0-408F-9FB6-732CAFC73063}) (Version: 2.0.0.035 - Lenovo)

Lenovo Paper Display (x32 Version: 2.0.0.035 - Lenovo) Hidden

Lenovo Patch Utility (x32 Version: 1.3.2.6 - Lenovo Group Limited) Hidden

Lenovo Patch Utility 64 bit (Version: 1.3.2.6 - Lenovo Group Limited) Hidden

Lenovo PhoneCompanion (HKLM-x32\...\InstallShield_{0F82EA83-B0C5-4AB9-9695-DFE92C5FD57B}) (Version: 2.0.0.19 - Lenovo)

Lenovo PhoneCompanion (x32 Version: 2.0.0.19 - Lenovo) Hidden

Lenovo Settings - Camera Audio (HKLM\...\{88C6A6D9-324C-46E8-BA87-563D14021442}_is1) (Version: 4.3.5.0 - Lenovo Corporation)

Lenovo Settings (HKLM\...\{D14CCBF5-1A3A-4C08-955B-BE6D519835C4}_is1) (Version: 2.0.0.5 - Lenovo)

Lenovo Settings Dependency Package (HKLM\...\{3694BA2E-BE31-4B7E-886B-A0B559E69D4D}_is1) (Version: 2.3.1.28 - Lenovo Group Limited)

Lenovo Settings Service (HKLM\...\{8C6F1EBA-17F1-4481-B688-9777E63E985F}_is1) (Version: 2.3.0.20 - Lenovo Group Limited)

Lenovo Settings UMDF driver (HKLM\...\{2BDC7413-65EA-4B99-8C4B-02F11075BE6D}_is1) (Version: 1.2.0.6 - Lenovo Group Limited)

Lenovo Settings WiFi (HKLM\...\{86045A6C-C156-4349-A3E2-47A88A42F5C2}_is1) (Version: 2.0.0.3 - Lenovo)

Lenovo VeriFace Pro (HKLM\...\Lenovo VeriFace) (Version: 5.1.14.6181 - Lenovo)

Lenovo Yoga 3 Demo (HKLM-x32\...\{9B02CB47-B0E8-4BC8-9BF3-8EFF3CDEA30E}) (Version: 2.0.2 - Lenovo)

LenovoUtility (HKLM-x32\...\InstallShield_{6ADA7E88-8D16-4D0D-BC90-2B93AC5E56DA}) (Version: 2.0.0.3 - Lenovo)

LenovoUtility (x32 Version: 2.0.0.3 - Lenovo) Hidden

Malwarebytes Anti-Malware Version 2.1.4.1018 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.4.1018 - Malwarebytes Corporation)

Maxx Audio Installer (x64) (Version: 1.6.4815.83 - Waves Audio Ltd.) Hidden

Metric Collection SDK 35 (x32 Version: 1.2.0006.00 - Lenovo Group Limited) Hidden

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)

Mozilla Firefox 36.0.4 (x86 de) (HKLM-x32\...\Mozilla Firefox 36.0.4 (x86 de)) (Version: 36.0.4 - Mozilla)

Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 36.0.4 - Mozilla)

Nitro Pro 9 (HKLM\...\{4C32F7E8-A65F-4D3C-9153-9F3B57CB6872}) (Version: 9.0.5.9 - Nitro)

OneKey Optimizer (HKLM-x32\...\InstallShield_{D5D573DC-D989-4769-9B56-D6A7EA503D7F}) (Version: 1.1.20.16 - Lenovo)

OneKey Optimizer (x32 Version: 1.1.20.16 - Lenovo) Hidden

Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.3.9600.39060 - Realtek Semiconductor Corp.)

SHAREit (HKLM-x32\...\SHAREit_is1) (Version: 2.1.8.0 - Lenovo Group Limited)

Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 18.0.7.89 - Synaptics Incorporated)

User Manuals (HKLM-x32\...\InstallShield_{F07C2CF8-4C53-4EC3-8162-A6221E36EB88}) (Version: 3.0.0.3 - Lenovo)

Windows-Treiberpaket - Lenovo (ACPIVPC) System  (09/24/2013 19.29.2.34) (HKLM\...\EE9B1F2037C580F36D92FA431CC02BFF04C31F15) (Version: 09/24/2013 19.29.2.34 - Lenovo)

Windows-Treiberpaket - Lenovo (WUDFRd) LenovoVhid  (07/25/2013 10.30.0.288) (HKLM\...\6BCA401E9CBEED970D75F55FA5320F60D11984E9) (Version: 07/25/2013 10.30.0.288 - Lenovo)
 

==================== Custom CLSID (selected items): ==========================
 

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
 
 

==================== Restore Points  =========================
 

04-04-2015 11:32:34 McAfee  Vulnerability Scanner
 

==================== Hosts content: ==========================
 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 

2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts
 

==================== Scheduled Tasks (whitelisted) =============
 

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
 

Task: {10635313-837A-4988-8E43-C5C1F66D3101} - System32\Tasks\AXDGX => C:\Users\Winfried\AppData\Roaming\AXDGX.exe <==== ATTENTION

Task: {109FF231-DBF9-4736-BDC2-A51BD10357FC} - System32\Tasks\XLA => C:\Users\Winfried\AppData\Roaming\XLA.exe <==== ATTENTION

Task: {1CC7F122-A63D-47B3-9250-6CB00B5B0319} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473 => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [2014-04-09] ()

Task: {22C94394-D734-41DC-8A7E-E859D77628A6} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program 64 35 => C:\Program Files (x86)\Lenovo\Customer Feedback Program 35\Lenovo.TVT.CustomerFeedback.Agent35.exe [2014-09-10] (Lenovo)

Task: {269FBE55-C11D-446A-AF92-F49D575851EC} - System32\Tasks\oDweklayyunBXthwbuHX => C:\Users\Winfried\AppData\Roaming\oDweklayyunBXthwbuHX.exe

Task: {2FD9A8B3-9F46-48AF-BAAC-A808A4D7FDC7} - System32\Tasks\Lenovo\Experience Improvement => C:\Program Files\Lenovo\ExperienceImprovement\LenovoExperienceImprovement.exe [2015-03-21] (Lenovo)

Task: {4378E825-0D7A-4F9A-B061-5D10172E1712} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-03-23] (Adobe Systems Incorporated)

Task: {566F4469-2726-4A4E-B3C1-2CDD24B9158F} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473-Logon => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [2014-04-09] ()

Task: {6C8EB349-E5D0-467D-9956-A62A5D04324A} - System32\Tasks\Lenovo\Dependency Package Auto Update => C:\Program Files\Lenovo\iMController\AutoUpdate.exe [2015-03-06] ()

Task: {7752E575-2FA9-4CC6-B3DF-29BB9B0C01AF} - System32\Tasks\disco_savings_notification_service => C:\Program Files (x86)\disco savings\disco_savings_notification_service.exe

Task: {82351605-5B54-49EC-9642-1448F014DCC9} - \7b4ca387-5551-400b-9a35-fa2d32f182c9-4 No Task File <==== ATTENTION

Task: {E6BB0C1A-F09D-4228-9C91-789445B8BCAA} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program 64 => C:\Program Files (x86)\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe [2014-09-02] (Lenovo)

Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\WINDOWS\Tasks\AXDGX.job => C:\Users\Winfried\AppData\Roaming\AXDGX.exe <==== ATTENTION

Task: C:\WINDOWS\Tasks\disco_savings_notification_service.job => C:\Program Files (x86)\disco savings\disco_savings_notification_service.exeé/url='http:/cdn.selectbestopt.com/notf_sys/index.html' /crregname='disco savings' /appid='73143' /srcid='2913' /bic='f443762ed80e68e9a05cdcfa979034b6' /verifier='fe5513bae41efa38680f32b84a75c913' /installerversion='1.50.3.10' /statsdomain='http:/stats.buildomserv.com/data.gif?' /errorsdomain='http:/stats.buildomserv.com/data.gif?' /monetizationdomain='http:/logs.buildomserv.com/monetization.gif

Task: C:\WINDOWS\Tasks\oDweklayyunBXthwbuHX.job => C:\Users\Winfried\AppData\Roaming\oDweklayyunBXthwbuHX.exe

Task: C:\WINDOWS\Tasks\XLA.job => C:\Users\Winfried\AppData\Roaming\XLA.exe <==== ATTENTION
 

==================== Loaded Modules (whitelisted) ==============
 

2015-02-26 19:40 - 2014-11-20 11:43 - 00016920 _____ () C:\Program Files\Lenovo\OneKey Optimizer\bin\FbServicePS.dll

2015-02-26 19:36 - 2014-08-25 11:26 - 00017176 _____ () C:\Program Files (x86)\Lenovo\Harmony\Picks\HarmonyPicksService.exe

2015-02-26 19:36 - 2014-09-04 15:46 - 00017688 _____ () C:\Program Files (x86)\Lenovo\Harmony\Setting\HarmonySettingService.exe

2015-02-26 19:36 - 2014-09-28 17:29 - 00065304 _____ () C:\Program Files (x86)\Lenovo\Harmony\Setting\Util.dll

2015-04-04 13:30 - 2015-04-04 13:30 - 00632320 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\Windows.Security\c7f6d022c5d5aec4891cb6b3b9934336\Windows.Security.ni.dll

2015-02-26 19:36 - 2014-09-15 13:21 - 00018200 _____ () C:\Program Files (x86)\Lenovo\Harmony\Setting\RemoteObject.dll

2015-02-26 19:36 - 2014-08-25 11:30 - 00075032 _____ () C:\Program Files (x86)\Lenovo\Harmony\Setting\HarmonyAudio.dll

2015-02-26 19:36 - 2014-08-25 11:33 - 00017176 _____ () C:\Program Files (x86)\Lenovo\Harmony\Setting\TouchScreenContronlDLL.dll

2015-02-26 19:36 - 2014-08-25 11:32 - 00026392 _____ () C:\Program Files (x86)\Lenovo\Harmony\Setting\PowerDll.DLL

2015-02-26 19:38 - 2015-02-26 19:37 - 00133440 _____ () C:\Program Files\Lenovo PhoneCompanion\LPAWDService.exe

2014-11-25 15:54 - 2014-11-25 15:54 - 00026392 _____ () C:\Program Files (x86)\Lenovo\PaperDisplay\x86\PLHotkeyService.exe

2015-02-26 19:37 - 2012-04-24 12:43 - 00390632 ____N () C:\Program Files\CyberLink\Shared files\RichVideo64.exe

2015-02-26 19:34 - 2015-02-26 19:34 - 00068880 _____ () C:\Program Files (x86)\Lenovo\Lenovo VeriFace Pro\VfConnectorService.exe

2015-02-26 19:34 - 2015-02-26 19:34 - 00672016 _____ () C:\Program Files (x86)\Lenovo\Lenovo VeriFace Pro\VfDataStorageInterface.dll

2015-02-26 19:36 - 2014-05-20 17:16 - 00061200 _____ () C:\ProgramData\LenovoTransition\Server\x64\dptf.dll

2015-02-26 19:34 - 2014-10-22 11:15 - 00644080 _____ () C:\Program Files (x86)\Lenovo\CCSDK\CCSDK.exe

2015-02-26 19:38 - 2015-02-26 19:37 - 00815104 _____ () C:\Program Files\Lenovo PhoneCompanion\adb.exe

2015-02-26 19:39 - 2014-11-17 16:35 - 00036632 _____ () C:\Program Files\Lenovo\OneKey Optimizer\bin\Metric.dll

2015-02-26 19:39 - 2014-11-17 16:35 - 00166680 _____ () C:\Program Files\Lenovo\OneKey Optimizer\bin\Lenovo.MetricCollectionMFCx64.dll

2014-12-08 05:10 - 2014-11-21 10:54 - 00456808 _____ () C:\WINDOWS\system32\igfxTray.exe

2015-02-26 19:34 - 2014-10-22 11:15 - 00410096 _____ () C:\Program Files (x86)\Lenovo\CCSDK\WinGather.exe

2015-02-26 19:10 - 2010-10-26 06:40 - 00049056 _____ () C:\Program Files\CONEXANT\ForteConfig\fmapp.exe

2015-02-26 19:34 - 2015-02-26 19:34 - 00791368 _____ () C:\Program Files\Lenovo\LenovoUtility\utility.exe

2015-02-26 19:34 - 2015-02-26 19:34 - 00097048 _____ () C:\Program Files\Lenovo\LenovoUtility\kbdhook.dll

2015-02-26 19:36 - 2014-08-14 11:47 - 00109840 _____ () C:\Program Files (x86)\Lenovo\LenovoTransition\TransitionServer.exe

2015-02-26 19:39 - 2014-11-17 16:35 - 00047896 _____ () C:\Program Files\Lenovo\OneKey Optimizer\bin\res_GR_German_DEU.dll

2015-02-26 19:36 - 2014-09-28 17:29 - 00065304 _____ () C:\Program Files (x86)\Lenovo\Harmony\Picks\Util.dll

2015-02-26 19:36 - 2014-09-15 13:21 - 00018200 _____ () C:\Program Files (x86)\Lenovo\Harmony\Picks\RemoteObject.dll

2015-04-04 13:30 - 2015-04-04 13:30 - 00207872 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\Windows.System\a4efa88b742703220e527956d8ab4e84\Windows.System.ni.dll

2015-04-04 13:30 - 2015-04-04 13:30 - 00363520 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\Windows.Foundation\6382e6f5ad8b7a9db4f5cd4817e70319\Windows.Foundation.ni.dll

2015-02-26 19:40 - 2015-02-26 19:40 - 00019232 _____ () C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\Lenovo.MetricCollectionSDK\v4.0_1.1.9.0__d43be3ee47b19ecb\Lenovo.MetricCollectionSDK.dll

2015-04-04 13:30 - 2015-04-04 13:30 - 01259520 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\Windows.Networking\8f0dd293f95c402613c49fb2fac85bdd\Windows.Networking.ni.dll

2015-02-26 19:36 - 2014-08-25 11:27 - 00074520 _____ () C:\Program Files (x86)\Lenovo\Harmony\Picks\Lenovo.Harmonydll.dll

2014-12-08 05:10 - 2014-11-21 10:54 - 17170624 _____ () C:\WINDOWS\SYSTEM32\igd11dxva64.dll

2015-02-26 19:40 - 2014-11-20 11:43 - 00159256 _____ () C:\Program Files\Lenovo\OneKey Optimizer\bin\FbApi.dll

2015-02-26 19:39 - 2014-11-17 16:35 - 00036120 _____ () C:\Program Files\Lenovo\OneKey Optimizer\bin\zd.dll

2014-05-28 14:16 - 2014-05-28 14:16 - 00013576 _____ () C:\Program Files (x86)\Lenovo\Motion Control\PointGrabDeviceAPI.dll

2014-10-10 10:37 - 2014-10-10 10:37 - 01243936 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll

2015-02-26 19:23 - 2014-08-04 19:06 - 02201088 _____ () C:\Program Files\Lenovo\Communications Utility\cxcore210.dll

2015-02-26 19:23 - 2014-08-04 19:06 - 02085888 _____ () C:\Program Files\Lenovo\Communications Utility\cv210.dll

2015-04-04 13:30 - 2015-04-04 13:30 - 00402432 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Windows.Security\ade4f25e9d8384f190ede9eb090281cb\Windows.Security.ni.dll

2015-04-04 13:30 - 2015-04-04 13:30 - 00797696 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Windows.Networking\e1a2f3f274995f1f847c00f962657943\Windows.Networking.ni.dll

2015-04-04 13:30 - 2015-04-04 13:30 - 00228864 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Windows.Foundation\f7e726805e56676bd7b8662a3d842b0e\Windows.Foundation.ni.dll

2015-04-04 13:30 - 2015-04-04 13:30 - 00133120 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Windows.System\7819e306c2c55c42f35a5fa10b93710f\Windows.System.ni.dll

2015-02-26 19:36 - 2014-08-25 11:32 - 00168216 _____ () C:\Program Files (x86)\Lenovo\Harmony\Setting\PG_SettingsLib.dll

2015-02-26 19:36 - 2014-08-25 11:30 - 00018200 _____ () C:\Program Files (x86)\Lenovo\Harmony\Setting\Lenovo.Harmonydll.dll
 

==================== Alternate Data Streams (whitelisted) =========
 

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
 

AlternateDataStreams: C:\Windows:nlsPreferences

AlternateDataStreams: C:\Users\Winfried\OneDrive:ms-properties
 

==================== Safe Mode (whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
 

==================== EXE Association (whitelisted) ===============
 

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
 
 

==================== Other Areas ============================
 

(Currently there is no automatic fix for this section.)
 

HKU\S-1-5-21-1872664996-1993104736-2441894966-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Winfried\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper

HKU\S-1-5-21-1872664996-1993104736-2441894966-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Control Panel\Desktop\\Wallpaper -> C:\Users\Winfried\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper

HKU\S-1-5-21-1872664996-1993104736-2441894966-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\Control Panel\Desktop\\Wallpaper -> C:\Users\Winfried\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper

HKU\S-1-5-21-1872664996-1993104736-2441894966-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-2\Control Panel\Desktop\\Wallpaper -> C:\Users\Winfried\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper

HKU\S-1-5-21-1872664996-1993104736-2441894966-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-3\Control Panel\Desktop\\Wallpaper -> C:\Users\Winfried\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper

DNS Servers: 192.168.178.1
 

==================== MSCONFIG/TASK MANAGER disabled items ==
 

(Currently there is no automatic fix for this section.)
 
 

==================== Accounts: =============================
 

Administrator (S-1-5-21-1872664996-1993104736-2441894966-500 - Administrator - Disabled)

Gast (S-1-5-21-1872664996-1993104736-2441894966-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-1872664996-1993104736-2441894966-1003 - Limited - Enabled)

Winfried (S-1-5-21-1872664996-1993104736-2441894966-1001 - Administrator - Enabled) => C:\Users\Winfried
 

==================== Faulty Device Manager Devices =============
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (04/05/2015 01:45:26 PM) (Source: PLCoreService) (EventID: 0) (User: )

Description: PLCoreServicereg session lock = failed w/err 0x00000000
 

Error: (04/05/2015 01:45:26 PM) (Source: PLCoreService) (EventID: 0) (User: )

Description: PLCoreServicesession change id =  failed w/err 0x00000003
 

Error: (04/05/2015 01:45:18 PM) (Source: PLCoreService) (EventID: 0) (User: )

Description: PLCoreServicereg session lock = failed w/err 0x00000001
 

Error: (04/05/2015 01:45:18 PM) (Source: PLCoreService) (EventID: 0) (User: )

Description: PLCoreServicesession change id =  failed w/err 0x00000003
 

Error: (04/05/2015 01:45:17 PM) (Source: PLCoreService) (EventID: 0) (User: )

Description: PLCoreServiceevent type =  failed w/err 0x00000007
 

Error: (04/05/2015 01:45:12 PM) (Source: PLCoreService) (EventID: 0) (User: )

Description: PLCoreServiceevent type =  failed w/err 0x00000012
 

Error: (04/05/2015 01:45:12 PM) (Source: PLCoreService) (EventID: 0) (User: )

Description: PLCoreServiceevent type =  failed w/err 0x0000000a
 

Error: (04/05/2015 01:45:12 PM) (Source: PLCoreService) (EventID: 0) (User: )

Description: PLCoreServiceevent type =  failed w/err 0x00008013
 

Error: (04/04/2015 04:53:27 PM) (Source: PLCoreService) (EventID: 0) (User: )

Description: PLCoreServiceevent type =  failed w/err 0x00000004
 

Error: (04/04/2015 04:53:27 PM) (Source: PLCoreService) (EventID: 0) (User: )

Description: PLCoreServicereg session lock = failed w/err 0x00000001
 
 

System errors:

=============

Error: (04/04/2015 04:32:56 PM) (Source: DCOM) (EventID: 10016) (User: KLEINERPCANDI)

Description: ComputerstandardLokalAktivierung{53362C32-A296-4F2D-A2F8-FD984D08340B}{53362C32-A296-4F2D-A2F8-FD984D08340B}kleinerPCAndiWinfriedS-1-5-21-1872664996-1993104736-2441894966-1001LocalHost (unter Verwendung von LRPC)Microsoft.BingTravel_3.0.4.309_x64__8wekyb3d8bbweS-1-15-2-2870191891-2241688837-171142518-109998219-184790337-3361571429-3188846544
 

Error: (04/04/2015 02:20:45 PM) (Source: BugCheck) (EventID: 1001) (User: )

Description: 0x000000d1 (0x0000000000000008, 0x0000000000000002, 0x0000000000000000, 0xfffff80101e43823)C:\WINDOWS\MEMORY.DMP040415-5984-01
 

Error: (04/04/2015 02:20:43 PM) (Source: EventLog) (EventID: 6008) (User: )

Description: Das System wurde zuvor am ‎04.‎04.‎2015 um 14:15:43 unerwartet heruntergefahren.
 

Error: (04/04/2015 01:50:26 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: Dienst "PG_Service_Launcher" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
 

Error: (04/04/2015 00:19:12 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT-AUTORITÄT)

Description: Das WLAN-Erweiterungsmodul wurde unerwartet beendet.
 

Modulpfad: C:\WINDOWS\System32\IWMSSvc.dll
 

Error: (04/04/2015 00:19:12 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT-AUTORITÄT)

Description: Das WLAN-Erweiterungsmodul wurde unerwartet beendet.
 

Modulpfad: C:\WINDOWS\System32\IWMSSvc.dll
 

Error: (04/04/2015 00:19:10 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT-AUTORITÄT)

Description: Das WLAN-Erweiterungsmodul wurde unerwartet beendet.
 

Modulpfad: C:\WINDOWS\System32\IWMSSvc.dll
 

Error: (04/04/2015 00:18:54 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: Dienst "Windows Presentation Foundation-Schriftartcache 3.0.0.0" wurde unerwartet beendet. Dies ist bereits 2 Mal passiert.
 

Error: (04/04/2015 00:18:53 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: Dienst "lupdate" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
 

Error: (04/04/2015 00:18:53 PM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: Der Dienst "Windows Media Player-Netzwerkfreigabedienst" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.
 
 

Microsoft Office Sessions:

=========================

Error: (04/05/2015 01:45:26 PM) (Source: PLCoreService) (EventID: 0) (User: )

Description: PLCoreServicereg session lock = failed w/err 0x00000000
 

Error: (04/05/2015 01:45:26 PM) (Source: PLCoreService) (EventID: 0) (User: )

Description: PLCoreServicesession change id =  failed w/err 0x00000003
 

Error: (04/05/2015 01:45:18 PM) (Source: PLCoreService) (EventID: 0) (User: )

Description: PLCoreServicereg session lock = failed w/err 0x00000001
 

Error: (04/05/2015 01:45:18 PM) (Source: PLCoreService) (EventID: 0) (User: )

Description: PLCoreServicesession change id =  failed w/err 0x00000003
 

Error: (04/05/2015 01:45:17 PM) (Source: PLCoreService) (EventID: 0) (User: )

Description: PLCoreServiceevent type =  failed w/err 0x00000007
 

Error: (04/05/2015 01:45:12 PM) (Source: PLCoreService) (EventID: 0) (User: )

Description: PLCoreServiceevent type =  failed w/err 0x00000012
 

Error: (04/05/2015 01:45:12 PM) (Source: PLCoreService) (EventID: 0) (User: )

Description: PLCoreServiceevent type =  failed w/err 0x0000000a
 

Error: (04/05/2015 01:45:12 PM) (Source: PLCoreService) (EventID: 0) (User: )

Description: PLCoreServiceevent type =  failed w/err 0x00008013
 

Error: (04/04/2015 04:53:27 PM) (Source: PLCoreService) (EventID: 0) (User: )

Description: PLCoreServiceevent type =  failed w/err 0x00000004
 

Error: (04/04/2015 04:53:27 PM) (Source: PLCoreService) (EventID: 0) (User: )

Description: PLCoreServicereg session lock = failed w/err 0x00000001
 
 

CodeIntegrity Errors:

===================================

  Date: 2015-04-04 09:52:18.164

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files\BubbleSound\BubbleSound.dll because the set of per-page image hashes could not be found on the system.
 

  Date: 2015-04-04 09:51:32.391

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files\BubbleSound\BubbleSound.dll because the set of per-page image hashes could not be found on the system.
 
 

==================== Memory info =========================== 
 

Processor: Intel(R) Core(TM) i5-5200U CPU @ 2.20GHz

Percentage of memory in use: 64%

Total physical RAM: 3977.11 MB

Available physical RAM: 1393.56 MB

Total Pagefile: 8073.11 MB

Available Pagefile: 4426.64 MB

Total Virtual: 131072 MB

Available Virtual: 131071.79 MB
 

==================== Drives ================================
 

Drive c: (Windows8_OS) (Fixed) (Total:103.08 GB) (Free:66.81 GB) NTFS ==>[System with boot components (obtained from reading drive)]
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (Size: 119.2 GB) (Disk ID: 7CB0AFFE)
 

Partition: GPT Partition Type.
 

==================== End Of Log ============================

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

adware cleaner:

AdwCleaner Logfile:

Code:

# AdwCleaner v4.200 - Bericht erstellt 04/04/2015 um 14:20:03

# Aktualisiert 29/03/2015 von Xplode

# Datenbank : 2015-03-29.1 [Server]

# Betriebssystem : Windows 8.1  (x64)

# Benutzername : Winfried - KLEINERPCANDI

# Gestarted von : C:\Users\Winfried\Downloads\adwcleaner_4.200.exe

# Option : Löschen
 

***** [ Dienste ] *****
 
 

***** [ Dateien / Ordner ] *****
 
 

***** [ Geplante Tasks ] *****
 
 

***** [ Verknüpfungen ] *****
 
 

***** [ Registrierungsdatenbank ] *****
 

Schlüssel Gelöscht : HKCU\Software\OCS
 

***** [ Internetbrowser ] *****
 

-\\ Internet Explorer v11.0.9600.17416
 
 

-\\ Mozilla Firefox v36.0.4 (x86 de)
 

# AdwCleaner v4.200 - Bericht erstellt 05/04/2015 um 18:58:24

# Aktualisiert 29/03/2015 von Xplode

# Datenbank : 2015-03-29.1 [Server]

# Betriebssystem : Windows 8.1  (x64)

# Benutzername : Winfried - KLEINERPCANDI

# Gestarted von : C:\Users\Winfried\Desktop\AdwCleaner_4.200.exe

# Option : Löschen
 

***** [ Dienste ] *****
 
 

***** [ Dateien / Ordner ] *****
 
 

***** [ Geplante Tasks ] *****
 
 

***** [ Verknüpfungen ] *****
 
 

***** [ Registrierungsdatenbank ] *****
 

Schlüssel Gelöscht : HKCU\Software\OCS
 

***** [ Internetbrowser ] *****
 

-\\ Internet Explorer v11.0.9600.17416
 
 

-\\ Mozilla Firefox v36.0.4 (x86 de)
 
 

*************************
 

AdwCleaner[R0].txt - [7344 Bytes] - [24/03/2015 01:56:20]

AdwCleaner[R1].txt - [7643 Bytes] - [04/04/2015 11:20:11]

AdwCleaner[R2].txt - [1016 Bytes] - [04/04/2015 12:17:32]

AdwCleaner[R3].txt - [2501 Bytes] - [04/04/2015 14:19:21]

AdwCleaner[R4].txt - [1336 Bytes] - [05/04/2015 18:57:46]

AdwCleaner[S0].txt - [5081 Bytes] - [24/03/2015 02:00:12]

AdwCleaner[S1].txt - [7482 Bytes] - [04/04/2015 11:22:09]

AdwCleaner[S2].txt - [1075 Bytes] - [04/04/2015 12:18:53]

AdwCleaner[S3].txt - [1805 Bytes] - [04/04/2015 14:20:03]
 

########## EOF - C:\AdwCleaner\AdwCleaner[S3].txt - [1864  Bytes] ##########

--- --- ---

JRT:

Code:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.5.1 (04.02.2015:1)

OS: Windows 8.1 x64

Ran by Winfried on 05.04.2015 at 19:01:54,24

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 

~~~ Services
 
 
 

~~~ Registry Values
 
 
 

~~~ Registry Keys
 
 
 

~~~ Files
 
 
 

~~~ Folders
 
 
 

~~~ FireFox
 

Successfully deleted the following from C:\Users\Winfried\AppData\Roaming\mozilla\firefox\profiles\4dr5421m.default\prefs.js
 

user_pref("browser.search.searchengine.desc", "this is my first firefox searchEngine");

user_pref("browser.search.searchengine.ptid", "brd");

user_pref("browser.search.searchengine.uid", "SAMSUNGXMZYTE128HMGR-000L2_S1PMNYAFC04886");
 
 
 

~~~ Event Viewer Logs were cleared
 
 
 
 
 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 05.04.2015 at 19:05:13,13

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015

Ran by Winfried (administrator) on KLEINERPCANDI on 05-04-2015 19:08:34

Running from C:\Users\Winfried\Desktop

Loaded Profiles: Winfried (Available profiles: Winfried)

Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11 (Default browser: FF)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(Intel Corporation) C:\Windows\System32\igfxCUIService.exe

(Microsoft Corporation) C:\Windows\System32\wlanext.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe

(Intel Corporation) C:\Windows\SysWOW64\esif_uf.exe

(Microsoft Corporation) C:\Windows\System32\dasHost.exe

(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe

(Lenovo) C:\Program Files\Lenovo\OneKey Optimizer\bin\FbService.exe

() C:\Program Files (x86)\Lenovo\Harmony\Picks\HarmonyPicksService.exe

() C:\Program Files (x86)\Lenovo\Harmony\Setting\HarmonySettingService.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\utilities\ibtsiva.exe

(Lenovo(beijing) Limited) C:\Program Files\Lenovo\OneKey Optimizer\bin\OKOUpdataService.exe

(Lenovo Group Limited) C:\Program Files\Lenovo\SettingsDependency\SettingsService.exe

(LENOVO INCORPORATED.) C:\Program Files\Lenovo\iMController\SystemAgentService.exe

() C:\Program Files\Lenovo PhoneCompanion\LPAWDService.exe

(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Lenovo Settings\x86\LenovoSetSvr.exe

(Lenovo(beijing) Limited) C:\Windows\System32\LenovoWiFiHotspotSvr.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe

(Nitro PDF Software) C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe

(Nalpeiron Ltd.) C:\Windows\SysWOW64\NLSSRV32.EXE

(Lenovo(beijing) Limited) C:\Program Files\Lenovo\OneKey Optimizer\bin\OKOControlSvc.exe

(Lenovo) C:\Program Files (x86)\Lenovo\PaperDisplay\x86\PaperLookingSrv.exe

(PointGrab LTD) C:\Program Files (x86)\Lenovo\Motion Control\PGService.exe

(PointGrab LTD) C:\Program Files (x86)\Lenovo\Motion Control\PG_Service_Launcher.exe

(Lenovo) C:\Program Files\Lenovo PhoneCompanion\PhoneCompanionPusher.exe

() C:\Program Files (x86)\Lenovo\PaperDisplay\x86\PLHotkeyService.exe

(PointGrab LTD) C:\Program Files (x86)\Lenovo\Motion Control\WebcamSplitterServer.exe

() C:\Program Files\CyberLink\Shared files\RichVideo64.exe

(Conexant Systems, Inc.) C:\Windows\SysWOW64\SASrv.exe

() C:\Program Files (x86)\Lenovo\Lenovo VeriFace Pro\VfConnectorService.exe

(Lenovo) C:\ProgramData\LenovoTransition\Server\x64\ymc.exe

(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe

() C:\Program Files\CONEXANT\ForteConfig\fmapp.exe

(Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe

(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe

(Waves Audio Ltd.) C:\Program Files\Waves\MaxxAudio\WavesSvc64.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe

(Lenovo) C:\Windows\System32\LenovoUpdate.exe

() C:\Program Files (x86)\Lenovo\LenovoTransition\TransitionServer.exe

(Intel Corporation) C:\Windows\System32\igfxEM.exe

(Intel Corporation) C:\Windows\System32\igfxHK.exe

() C:\Windows\System32\igfxTray.exe

(Intel Corporation) C:\Windows\Temp\DPTF\esif_assist.exe

(Lenovo) C:\Program Files\Lenovo PhoneCompanion\Phone Companion.exe

(Lenovo(beijing) Limited) C:\Program Files\Lenovo\OneKey Optimizer\bin\OneKeyOptimizerTray.exe

(Lenovo) C:\Program Files (x86)\Lenovo\Harmony\Picks\Lenovo.HarmonyPicks.exe

(Lenovo(beijing) Limited) C:\Program Files\Lenovo\OneKey Optimizer\bin\OnekeyOptimizerUpdata.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Lenovo) C:\Program Files (x86)\Lenovo\Harmony\Setting\Lenovo.HarmonySetting.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe

() C:\Program Files\Lenovo PhoneCompanion\adb.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_6.3.9600.20280_x64__8wekyb3d8bbwe\soundrec.exe

(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe

(Lenovo Corporation) C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe

() C:\Program Files (x86)\Lenovo\CCSDK\CCSDK.exe

(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

() C:\Program Files (x86)\Lenovo\CCSDK\WinGather.exe

(Microsoft Corporation) C:\Windows\System32\WWAHost.exe

(Lenovo(beijing) Limited) C:\Program Files\Lenovo\OneKey Optimizer\bin\OneKeyOptimizer.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_17_0_0_134.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_17_0_0_134.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [322712 2014-10-09] (Intel Corporation)

HKLM\...\Run: [ForteConfig] => C:\Program Files\Conexant\ForteConfig\fmapp.exe [49056 2010-10-26] ()

HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SACpl.exe [1830616 2014-04-10] (Conexant Systems, Inc.)

HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [919768 2014-11-20] (Conexant Systems, Inc.)

HKLM\...\Run: [WavesSvc] => C:\Program Files\Waves\MaxxAudio\WavesSvc64.exe [606296 2014-10-02] (Waves Audio Ltd.)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2809072 2014-09-19] (Synaptics Incorporated)

HKLM\...\Run: [LENOVO.TPKNRRES] => rundll32.exe "C:\Program Files\Lenovo\Communications Utility\LibStartStub.dll",AVStartupStub

HKLM\...\Run: [LenovoUtility] => C:\Program Files\Lenovo\LenovoUtility\utility.exe [791368 2015-02-26] ()

HKLM\...\Run: [AutoStartTransition] => C:\Program Files (x86)\Lenovo\LenovoTransition\TransitionServer.exe [109840 2014-08-14] ()

HKLM\...\Run: [PhoneCompanion] => C:\Program Files\Lenovo PhoneCompanion\Phone Companion.exe [802800 2015-02-26] (Lenovo)

HKLM\...\Run: [OneKeyOptimizer] => C:\Program Files\Lenovo\OneKey Optimizer\bin\OneKeyOptimizerTray.exe [559896 2014-11-18] (Lenovo(beijing) Limited)

HKLM\...\Run: [3D BubbleSound] => "C:\Program Files\BubbleSound\3D BubbleSound.exe"

HKLM-x32\...\Run: [HarmonyPicks] => C:\Program Files (x86)\Lenovo\Harmony\Picks\Lenovo.HarmonyPicks.exe [1221912 2014-09-28] (Lenovo)

HKLM-x32\...\Run: [HarmonySetting] => C:\Program Files (x86)\Lenovo\Harmony\Setting\Lenovo.HarmonySetting.exe [2696472 2014-09-28] (Lenovo)

HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [704512 2015-03-17] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [126712 2015-01-19] (Avira Operations GmbH & Co. KG)

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = www.google.com

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com

HKU\S-1-5-21-1872664996-1993104736-2441894966-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-21-1872664996-1993104736-2441894966-1001 -> {015DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = 

SearchScopes: HKU\S-1-5-21-1872664996-1993104736-2441894966-1001 -> {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = 

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

StartMenuInternet: IEXPLORE.EXE - iexplore.exe
 

FireFox:

========

FF ProfilePath: C:\Users\Winfried\AppData\Roaming\Mozilla\Firefox\Profiles\4dr5421m.default

FF SelectedSearchEngine: Google

FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_17_0_0_134.dll [2015-03-23] ()

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_134.dll [2015-03-23] ()

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.56 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2014-10-10] (Intel Corporation)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2014-10-10] (Intel Corporation)

FF Plugin-x32: @nitropdf.com/NitroPDF -> C:\Program Files (x86)\Nitro\Pro 9\npnitromozilla.dll [2013-12-12] (Nitro PDF)

FF Extension: Adblock Plus - C:\Users\Winfried\AppData\Roaming\Mozilla\Firefox\Profiles\4dr5421m.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-03-24]
 

==================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [432888 2015-03-17] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [432888 2015-03-17] (Avira Operations GmbH & Co. KG)

S3 AVControlCenter; C:\Program Files\Lenovo\Communications Utility\AVControlCenter32.exe [599024 2014-08-05] (Lenovo Corporation)

R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [182520 2015-01-19] (Avira Operations GmbH & Co. KG)

R2 CCSDK; C:\Program Files (x86)\Lenovo\CCSDK\CCSDK.exe [644080 2014-10-22] ()

R2 esifsvc; C:\WINDOWS\SysWOW64\esif_uf.exe [1037568 2014-09-18] (Intel Corporation)

R2 FastbootService; C:\Program Files\Lenovo\OneKey Optimizer\bin\FbService.exe [191512 2014-11-20] (Lenovo)

R2 HarmonyPicksService; C:\Program Files (x86)\Lenovo\Harmony\Picks\HarmonyPicksService.exe [17176 2014-08-25] ()

R2 HarmonySettingService; C:\Program Files (x86)\Lenovo\Harmony\Setting\HarmonySettingService.exe [17688 2014-09-04] ()

R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [18584 2014-10-09] (Intel Corporation)

R2 ibtsiva.exe; C:\Program Files (x86)\Intel\Bluetooth\utilities\ibtsiva.exe [121288 2014-08-13] (Intel Corporation)

R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [328296 2014-11-21] (Intel Corporation)

S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [887256 2014-05-13] (Intel(R) Corporation)

R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [132896 2014-10-10] (Intel Corporation)

S3 iumsvc; C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [174368 2014-04-09] ()

R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [158496 2014-10-10] (Intel Corporation)

S3 Lenovo EasyPlus Hotspot; C:\Program Files (x86)\Common Files\lenovo\easyplussdk\bin\EPHotspot64.exe [561408 2014-09-22] (Lenovo)

R2 Lenovo OKO Service; C:\Program Files\Lenovo\OneKey Optimizer\bin\OKOUpdataService.exe [2544408 2014-11-18] (Lenovo(beijing) Limited)

R2 Lenovo Settings Service; C:\Program Files\Lenovo\SettingsDependency\SettingsService.exe [2005320 2014-10-13] (Lenovo Group Limited)

R2 Lenovo System Agent Service; C:\Program Files\Lenovo\iMController\SystemAgentService.exe [584632 2015-03-06] (LENOVO INCORPORATED.)

S3 LENOVO.TVTVCAM; C:\Program Files\Lenovo\Communications Utility\vcamsvc.exe [727536 2014-08-05] (Lenovo Corporation)

R2 LenovoPAWDService; C:\Program Files\Lenovo PhoneCompanion\LPAWDService.exe [133440 2015-02-26] ()

R2 LenovoSetSvr; C:\Program Files (x86)\Lenovo\Lenovo Settings\x86\LenovoSetSvr.exe [258544 2014-06-19] (Lenovo(beijing) Limited)

R3 LenovoUpdate; C:\Windows\System32\LenovoUpdate.exe [26608 2015-04-05] (Lenovo)

R2 LenovoWiFiHotspotSvr; C:\Windows\System32\LenovoWiFiHotspotSvr.exe [218952 2014-08-25] (Lenovo(beijing) Limited)

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2015-03-17] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1080120 2015-03-17] (Malwarebytes Corporation)

S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [265936 2014-10-29] ()

R2 NitroDriverReadSpool9; C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe [230920 2013-12-12] (Nitro PDF Software)

R2 OKOControlSvc; C:\Program Files\Lenovo\OneKey Optimizer\bin\OKOControlSvc.exe [113944 2014-11-17] (Lenovo(beijing) Limited)

R2 PaperLookingSrv; C:\Program Files (x86)\Lenovo\PaperDisplay\x86\PaperLookingSrv.exe [173848 2014-11-25] (Lenovo)

R2 PGService; C:\Program Files (x86)\Lenovo\Motion Control\PGService.exe [167176 2014-05-28] (PointGrab LTD)

R2 PG_Service_Launcher; C:\Program Files (x86)\Lenovo\Motion Control\PG_Service_Launcher.exe [524552 2014-05-28] (PointGrab LTD)

R2 PhoneCompanionPusher; C:\Program Files\Lenovo PhoneCompanion\PhoneCompanionPusher.exe [321520 2015-02-26] (Lenovo)

S3 PhoneCompanionVap; C:\Program Files\Lenovo PhoneCompanion\PhoneCompanionVap.exe [338416 2015-02-26] (Lenovo)

R2 PLHotkeyService; C:\Program Files (x86)\Lenovo\PaperDisplay\x86\PLHotkeyService.exe [26392 2014-11-25] ()

R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [390632 2012-04-24] ()

R2 VeriFaceSrv; C:\Program Files (x86)\Lenovo\Lenovo VeriFace Pro\VfConnectorService.exe [68880 2015-02-26] ()

S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-04] (Microsoft Corporation)

S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-04] (Microsoft Corporation)

R2 ymc; C:\ProgramData\LenovoTransition\Server\x64\ymc.exe [34576 2014-09-03] (Lenovo)

R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3818704 2014-10-29] (Intel® Corporation)
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [128536 2015-03-17] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [132120 2015-03-17] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2015-03-17] (Avira Operations GmbH & Co. KG)

S3 AX88772; C:\Windows\system32\DRIVERS\ax88772.sys [113864 2013-07-18] (ASIX Electronics Corp.)

R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-03-18] (Microsoft Corporation)

R3 dptf_cpu; C:\Windows\System32\drivers\dptf_cpu.sys [38720 2014-09-18] (Intel Corporation)

R3 esif_lf; C:\Windows\System32\drivers\esif_lf.sys [216360 2014-09-18] (Intel Corporation)

R0 Fastboot; C:\Windows\System32\DRIVERS\Fastboot.sys [70168 2014-11-20] (Windows (R) Win 7 DDK provider)

R3 ibtusb; C:\Windows\system32\DRIVERS\ibtusb.sys [219592 2014-08-13] (Intel Corporation)

R0 IntelHSWPcc; C:\Windows\System32\drivers\IntelPcc.sys [79528 2014-09-05] (Intel Corporation)

R3 KMDFVirtualKbd; C:\Windows\System32\drivers\KMDFVirtualKbd.sys [22264 2014-08-04] ()

R3 KMDFVirtualMouse; C:\Windows\System32\drivers\KMDFVirtualMouse.sys [21240 2014-08-04] ()

R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2015-03-17] (Malwarebytes Corporation)

R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [136408 2015-04-05] (Malwarebytes Corporation)

R3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2015-03-17] (Malwarebytes Corporation)

R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [129312 2014-10-10] (Intel Corporation)

R3 NETwNb64; C:\Windows\system32\DRIVERS\Netwbw02.sys [3482600 2014-11-06] (Intel Corporation)

S3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew02.sys [4649440 2013-06-18] (Intel Corporation)

R3 rtsuvc; C:\Windows\system32\DRIVERS\rtsuvc.sys [2803416 2014-10-09] (Realtek Semiconductor Corp.)

R3 SensorsHIDClassDriver; C:\Windows\system32\DRIVERS\WUDFRd.sys [227840 2014-05-31] (Microsoft Corporation)

R3 SensorsServiceDriver; C:\Windows\system32\DRIVERS\WUDFRd.sys [227840 2014-05-31] (Microsoft Corporation)

R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [31472 2014-09-19] (Synaptics Incorporated)

S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-04] (Microsoft Corporation)

S3 wsvd; C:\Windows\system32\DRIVERS\wsvd.sys [102376 2012-06-13] ("CyberLink)
 

==================== NetSvcs (Whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2015-04-05 19:05 - 2015-04-05 19:05 - 00001002 _____ () C:\Users\Winfried\Desktop\JRT.txt

2015-04-05 19:02 - 2015-04-05 19:02 - 00000207 _____ () C:\WINDOWS\tweaking.com-regbackup-KLEINERPCANDI-Windows-8.1-(64-bit).dat

2015-04-05 19:01 - 2015-04-05 19:01 - 02690981 _____ (Thisisu) C:\Users\Winfried\Desktop\JRT.exe

2015-04-05 19:01 - 2015-04-05 19:01 - 00000000 ____D () C:\RegBackup

2015-04-05 18:56 - 2015-04-05 18:56 - 02208768 _____ () C:\Users\Winfried\Desktop\AdwCleaner_4.200.exe

2015-04-05 14:21 - 2015-04-05 14:21 - 00001197 _____ () C:\Users\Winfried\Desktop\MBAM.txt

2015-04-05 14:13 - 2015-04-05 14:13 - 00380416 _____ () C:\Users\Winfried\Desktop\Gmer-19357.exe

2015-04-05 14:12 - 2015-04-05 14:12 - 00380416 _____ () C:\Users\Winfried\Desktop\kqmuntzg.exe

2015-04-05 14:11 - 2015-04-05 19:08 - 00019437 _____ () C:\Users\Winfried\Desktop\FRST.txt

2015-04-05 14:11 - 2015-04-05 19:08 - 00000000 ____D () C:\FRST

2015-04-05 14:11 - 2015-04-05 14:12 - 00027878 _____ () C:\Users\Winfried\Desktop\Addition.txt

2015-04-05 14:10 - 2015-04-05 14:10 - 02095616 _____ (Farbar) C:\Users\Winfried\Desktop\FRST64.exe

2015-04-04 14:20 - 2015-04-04 14:20 - 681778017 _____ () C:\WINDOWS\MEMORY.DMP

2015-04-04 14:20 - 2015-04-04 14:20 - 00289624 _____ () C:\WINDOWS\Minidump\040415-5984-01.dmp

2015-04-04 14:20 - 2015-04-04 14:20 - 00000000 ____D () C:\WINDOWS\Minidump

2015-04-04 13:59 - 2015-04-04 13:55 - 00043576 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avnetflt.sys

2015-04-04 12:28 - 2015-04-04 12:28 - 00001129 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2015-04-04 11:55 - 2015-04-04 11:55 - 00001164 _____ () C:\Users\Public\Desktop\Avira.lnk

2015-04-04 11:53 - 2015-04-04 11:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira

2015-04-04 11:53 - 2015-04-04 11:53 - 00000000 ____D () C:\Users\Winfried\AppData\Roaming\Avira

2015-04-04 11:52 - 2015-04-04 11:55 - 00000000 ____D () C:\ProgramData\Avira

2015-04-04 11:52 - 2015-04-04 11:55 - 00000000 ____D () C:\Program Files (x86)\Avira

2015-04-04 11:52 - 2015-03-17 13:01 - 00132120 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avipbb.sys

2015-04-04 11:52 - 2015-03-17 13:01 - 00128536 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avgntflt.sys

2015-04-04 11:52 - 2015-03-17 13:01 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avkmgr.sys

2015-04-04 11:45 - 2014-10-18 11:55 - 00055776 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe

2015-04-04 11:45 - 2014-10-18 10:09 - 00060416 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups.dll

2015-04-04 11:45 - 2014-10-18 10:09 - 00051712 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups2.dll

2015-04-04 11:45 - 2014-10-18 09:25 - 00025600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wups.dll

2015-04-04 11:45 - 2014-10-18 08:50 - 00017408 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaext.dll

2015-04-04 11:45 - 2014-10-18 08:38 - 03557376 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll

2015-04-04 11:45 - 2014-10-18 08:27 - 00035840 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapp.exe

2015-04-04 11:45 - 2014-10-18 08:26 - 00140288 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuwebv.dll

2015-04-04 11:45 - 2014-10-18 08:23 - 00407552 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUSettingsProvider.dll

2015-04-04 11:45 - 2014-10-18 08:23 - 00095744 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll

2015-04-04 11:45 - 2014-10-18 08:21 - 00894976 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll

2015-04-04 11:45 - 2014-10-18 08:20 - 01714176 _____ (Microsoft Corporation) C:\WINDOWS\system32\wucltux.dll

2015-04-04 11:45 - 2014-10-18 08:14 - 00124928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuwebv.dll

2015-04-04 11:45 - 2014-10-18 08:14 - 00029696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapp.exe

2015-04-04 11:45 - 2014-10-18 08:12 - 00081920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll

2015-04-04 11:45 - 2014-10-18 08:11 - 00723968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll

2015-04-04 11:32 - 2015-01-30 05:01 - 00097792 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hidbth.sys

2015-04-04 11:32 - 2015-01-30 05:00 - 00167424 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rfcomm.sys

2015-04-04 11:32 - 2014-10-29 04:46 - 00081920 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\BTHUSB.SYS

2015-04-04 11:32 - 2014-10-29 04:46 - 00053248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthenum.sys

2015-04-04 11:32 - 2014-10-29 04:45 - 01198080 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthport.sys

2015-04-04 11:32 - 2014-10-29 04:03 - 00241152 _____ (Microsoft Corporation) C:\WINDOWS\system32\fsquirt.exe

2015-04-04 11:22 - 2015-01-30 04:02 - 00102912 _____ (Microsoft Corporation) C:\WINDOWS\system32\eappgnui.dll

2015-04-04 11:22 - 2015-01-30 03:40 - 00091648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eappgnui.dll

2015-04-04 11:22 - 2015-01-30 03:37 - 00331776 _____ (Microsoft Corporation) C:\WINDOWS\system32\eapp3hst.dll

2015-04-04 11:22 - 2015-01-30 03:24 - 00339456 _____ (Microsoft Corporation) C:\WINDOWS\system32\eapphost.dll

2015-04-04 11:22 - 2015-01-30 03:24 - 00250880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eapp3hst.dll

2015-04-04 11:22 - 2015-01-30 03:16 - 00266752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eapphost.dll

2015-04-04 11:22 - 2015-01-30 03:08 - 00346112 _____ (Microsoft Corporation) C:\WINDOWS\system32\eappcfg.dll

2015-04-04 11:22 - 2015-01-30 03:06 - 00278016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eappcfg.dll

2015-04-04 11:22 - 2014-10-29 03:19 - 00070656 _____ (Microsoft Corporation) C:\WINDOWS\system32\eappprxy.dll

2015-04-04 11:22 - 2014-10-29 02:59 - 00056320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eappprxy.dll

2015-04-04 11:18 - 2015-04-04 11:18 - 02208768 _____ () C:\Users\Winfried\Downloads\adwcleaner_4.200.exe

2015-04-04 11:04 - 2015-04-04 11:44 - 165283560 _____ () C:\Users\Winfried\Downloads\avira_free_antivirus_de_15.0.9.504.exe

2015-04-04 09:52 - 2015-04-05 18:59 - 00001366 _____ () C:\WINDOWS\Tasks\disco_savings_notification_service.job

2015-04-04 09:52 - 2015-04-05 18:59 - 00001052 _____ () C:\WINDOWS\Tasks\oDweklayyunBXthwbuHX.job

2015-04-04 09:52 - 2015-04-04 09:53 - 00000000 ____D () C:\Program Files (x86)\disco savings

2015-04-04 09:52 - 2015-04-04 09:52 - 00004380 _____ () C:\WINDOWS\System32\Tasks\disco_savings_notification_service

2015-04-04 09:52 - 2015-04-04 09:52 - 00004076 _____ () C:\WINDOWS\System32\Tasks\oDweklayyunBXthwbuHX

2015-04-04 09:51 - 2015-04-04 12:13 - 00000000 ____D () C:\ProgramData\{47b36d71-bb6e-ffd8-47b3-36d71bb6b5c6}

2015-04-04 09:41 - 2015-04-04 09:41 - 00000004 _____ () C:\WINDOWS\SysWOW64\029B560A371F4E00AB32838EBC01B9E7

2015-04-03 21:45 - 2015-04-05 18:59 - 00001376 _____ () C:\WINDOWS\Tasks\AXDGX.job

2015-04-03 21:45 - 2015-04-05 18:59 - 00001372 _____ () C:\WINDOWS\Tasks\XLA.job

2015-04-03 21:45 - 2015-04-03 21:45 - 00004400 _____ () C:\WINDOWS\System32\Tasks\AXDGX

2015-04-03 21:45 - 2015-04-03 21:45 - 00004394 _____ () C:\WINDOWS\System32\Tasks\XLA

2015-04-03 15:33 - 2015-04-03 15:33 - 00000000 __SHD () C:\Users\Winfried\AppData\Local\EmieBrowserModeList

2015-04-03 15:15 - 2015-04-03 15:16 - 01203488 _____ () C:\Users\Winfried\Downloads\Free M4a to MP3 Converter - CHIP-Installer.exe

2015-03-31 10:14 - 2015-03-31 10:14 - 00004387 _____ () C:\Users\Winfried\AppData\Roaming\oDweklayyunBXthwbuHX

2015-03-26 21:14 - 2015-03-26 21:14 - 00005542 _____ () C:\Users\Winfried\AppData\Roaming\AXDGX

2015-03-26 21:14 - 2015-03-26 21:14 - 00004185 _____ () C:\Users\Winfried\AppData\Roaming\XLA

2015-03-24 10:54 - 2015-01-29 02:59 - 02773504 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll

2015-03-24 10:54 - 2015-01-29 02:49 - 02459136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll

2015-03-24 10:54 - 2015-01-28 04:24 - 00075264 _____ (Microsoft Corporation) C:\WINDOWS\system32\StorageContextHandler.dll

2015-03-24 10:54 - 2015-01-28 03:47 - 00060928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\StorageContextHandler.dll

2015-03-24 10:53 - 2015-02-04 01:58 - 00264000 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdFilter.sys

2015-03-24 10:53 - 2015-02-04 01:58 - 00114496 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdNisDrv.sys

2015-03-24 10:53 - 2015-02-04 01:58 - 00044024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdBoot.sys

2015-03-24 10:53 - 2015-02-03 02:03 - 03551744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DCompiler_47.dll

2015-03-24 10:53 - 2015-02-03 02:02 - 04298240 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_47.dll

2015-03-24 10:53 - 2015-02-03 01:53 - 00014848 _____ (Microsoft Corporation) C:\WINDOWS\system32\winshfhc.dll

2015-03-24 10:53 - 2015-02-03 01:53 - 00012800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winshfhc.dll

2015-03-24 10:53 - 2015-01-30 04:03 - 01488896 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfc42u.dll

2015-03-24 10:53 - 2015-01-30 04:03 - 01464832 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfc42.dll

2015-03-24 10:53 - 2015-01-30 03:44 - 01230336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfc42u.dll

2015-03-24 10:53 - 2015-01-30 03:42 - 01204224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfc42.dll

2015-03-24 10:53 - 2015-01-30 03:29 - 00035840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\atlthunk.dll

2015-03-24 10:53 - 2014-11-01 01:57 - 01091072 _____ (Microsoft Corporation) C:\WINDOWS\system32\MrmCoreR.dll

2015-03-24 10:53 - 2014-11-01 01:47 - 00790528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MrmCoreR.dll

2015-03-24 10:53 - 2014-10-29 03:28 - 00048128 _____ (Microsoft Corporation) C:\WINDOWS\system32\atlthunk.dll

2015-03-24 10:52 - 2015-01-31 01:42 - 03097600 _____ (Microsoft Corporation) C:\WINDOWS\system32\msftedit.dll

2015-03-24 10:52 - 2015-01-31 01:29 - 02484224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msftedit.dll

2015-03-24 10:52 - 2015-01-28 01:47 - 02501368 _____ (Microsoft Corporation) C:\WINDOWS\explorer.exe

2015-03-24 10:52 - 2015-01-28 01:41 - 02207488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe

2015-03-24 10:52 - 2014-12-11 07:36 - 00046456 _____ (Microsoft Corporation) C:\WINDOWS\system32\LockScreenContentServer.exe

2015-03-24 02:15 - 2015-02-20 05:03 - 00358912 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll

2015-03-24 02:15 - 2015-02-20 04:58 - 00044032 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll

2015-03-24 02:15 - 2015-02-20 04:20 - 00301056 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\atmfd.dll

2015-03-24 02:15 - 2015-02-20 04:15 - 00035840 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll

2015-03-24 02:15 - 2014-10-29 04:49 - 00003072 _____ (Microsoft Corporation) C:\WINDOWS\system32\lpk.dll

2015-03-24 02:15 - 2014-10-29 04:44 - 00096256 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontsub.dll

2015-03-24 02:15 - 2014-10-29 04:44 - 00014848 _____ (Microsoft Corporation) C:\WINDOWS\system32\dciman32.dll

2015-03-24 02:15 - 2014-10-29 04:04 - 00003072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\lpk.dll

2015-03-24 02:15 - 2014-10-29 04:00 - 00077824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontsub.dll

2015-03-24 02:15 - 2014-10-29 04:00 - 00011776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dciman32.dll

2015-03-24 02:13 - 2014-12-19 08:26 - 00140800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxdav.sys

2015-03-24 02:13 - 2014-12-12 04:04 - 00087040 _____ (Microsoft Corporation) C:\WINDOWS\system32\TSWbPrxy.exe

2015-03-24 02:13 - 2014-12-12 02:51 - 00075776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ahcache.sys

2015-03-24 02:13 - 2014-10-17 09:01 - 00789184 _____ (Microsoft Corporation) C:\WINDOWS\system32\oleaut32.dll

2015-03-24 02:13 - 2014-10-17 08:58 - 00602768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\oleaut32.dll

2015-03-24 02:13 - 2014-09-04 02:12 - 00590336 _____ (Microsoft Corporation) C:\WINDOWS\system32\rastls.dll

2015-03-24 02:13 - 2014-09-04 02:01 - 00514048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rastls.dll

2015-03-24 02:13 - 2014-08-23 07:18 - 02149376 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml3.dll

2015-03-24 02:13 - 2014-08-23 07:03 - 01346048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml3.dll

2015-03-24 02:13 - 2014-06-10 00:13 - 00035480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TsWpfWrp.exe

2015-03-24 02:13 - 2014-06-10 00:13 - 00035480 _____ (Microsoft Corporation) C:\WINDOWS\system32\TsWpfWrp.exe

2015-03-24 02:12 - 2015-01-28 17:41 - 07472960 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe

2015-03-24 02:12 - 2015-01-28 17:41 - 01733440 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll

2015-03-24 02:12 - 2015-01-28 17:41 - 01498360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll

2015-03-24 02:12 - 2014-10-29 04:02 - 00285184 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64.dll

2015-03-24 02:12 - 2014-10-29 04:02 - 00013312 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64cpu.dll

2015-03-24 02:12 - 2014-10-29 03:57 - 00016896 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntvdm64.dll

2015-03-24 02:12 - 2014-10-29 03:15 - 00014336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntvdm64.dll

2015-03-24 02:12 - 2014-10-29 03:15 - 00005632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wow32.dll

2015-03-24 02:12 - 2014-10-29 03:14 - 00004096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\user.exe

2015-03-24 02:12 - 2014-10-29 03:13 - 00025600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\setup16.exe

2015-03-24 02:12 - 2014-10-29 03:13 - 00008704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\instnm.exe

2015-03-24 02:12 - 2014-10-23 07:48 - 00081408 _____ (Microsoft Corporation) C:\WINDOWS\system32\packager.dll

2015-03-24 02:12 - 2014-10-23 07:05 - 00072192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\packager.dll

2015-03-24 02:12 - 2014-10-13 04:43 - 00238912 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdbus.sys

2015-03-24 02:12 - 2014-10-13 04:43 - 00153920 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dumpsd.sys

2015-03-24 02:12 - 2014-10-13 04:43 - 00086336 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pdc.sys

2015-03-24 02:12 - 2014-10-13 04:43 - 00039744 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\intelpep.sys

2015-03-24 02:12 - 2014-05-19 08:31 - 00057856 _____ (Microsoft Corporation) C:\WINDOWS\system32\drvcfg.exe

2015-03-24 02:12 - 2014-05-19 08:21 - 00110592 _____ (Microsoft Corporation) C:\WINDOWS\system32\drvinst.exe

2015-03-24 02:12 - 2014-05-19 07:23 - 00098816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\drvinst.exe

2015-03-24 02:11 - 2015-01-31 01:20 - 00203264 _____ (Microsoft Corporation) C:\WINDOWS\system32\ubpm.dll

2015-03-24 02:11 - 2015-01-27 06:22 - 00131584 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll

2015-03-24 02:11 - 2015-01-27 04:11 - 03547648 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll

2015-03-24 02:11 - 2014-12-06 05:17 - 00360448 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncsi.dll

2015-03-24 02:11 - 2014-12-06 03:41 - 00391680 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlasvc.dll

2015-03-24 02:11 - 2014-10-29 05:56 - 00027456 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rdpvideominiport.sys

2015-03-24 02:11 - 2014-10-29 04:37 - 00040448 _____ (Microsoft Corporation) C:\WINDOWS\system32\rfxvmt.dll

2015-03-24 02:11 - 2014-10-29 03:24 - 00086016 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlaapi.dll

2015-03-24 02:11 - 2014-10-29 03:01 - 00065536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nlaapi.dll

2015-03-24 02:09 - 2015-03-24 02:09 - 00000000 ____D () C:\Users\Winfried\AppData\Roaming\Nitro

2015-03-24 02:07 - 2015-04-05 18:59 - 00136408 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys

2015-03-24 02:07 - 2015-04-04 12:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2015-03-24 02:07 - 2015-04-04 12:28 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2015-03-24 02:07 - 2015-03-24 02:07 - 00000000 ____D () C:\ProgramData\Malwarebytes

2015-03-24 02:07 - 2015-03-17 06:15 - 00107736 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys

2015-03-24 02:07 - 2015-03-17 06:15 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys

2015-03-24 02:07 - 2015-03-17 06:15 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys

2015-03-24 01:58 - 2015-03-24 01:58 - 00000000 ____D () C:\Users\Public\Pokki

2015-03-24 01:55 - 2015-04-05 18:58 - 00000000 ____D () C:\AdwCleaner

2015-03-24 01:54 - 2015-03-24 01:55 - 01203488 _____ () C:\Users\Winfried\Downloads\Malwarebytes Anti Malware Malware Scanner - CHIP-Installer.exe

2015-03-24 01:52 - 2014-10-31 00:37 - 00129536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\poqexec.exe

2015-03-24 01:52 - 2014-10-31 00:34 - 00146432 _____ (Microsoft Corporation) C:\WINDOWS\system32\poqexec.exe

2015-03-24 01:50 - 2015-01-29 20:45 - 01763352 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecs.dll

2015-03-24 01:50 - 2015-01-29 20:34 - 01488040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WindowsCodecs.dll

2015-03-24 01:49 - 2015-02-12 19:40 - 22291584 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll

2015-03-24 01:49 - 2015-02-12 19:34 - 19731824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll

2015-03-24 01:47 - 2015-01-28 03:31 - 00402432 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMPhoto.dll

2015-03-24 01:47 - 2015-01-28 03:11 - 00357376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WMPhoto.dll

2015-03-24 01:47 - 2014-12-08 21:42 - 00535640 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll

2015-03-24 01:47 - 2014-12-08 21:42 - 00531616 _____ (Microsoft Corporation) C:\WINDOWS\system32\ci.dll

2015-03-24 01:47 - 2014-12-08 21:42 - 00448792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wer.dll

2015-03-24 01:47 - 2014-12-08 21:42 - 00413248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Faultrep.dll

2015-03-24 01:47 - 2014-12-08 21:42 - 00372408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Faultrep.dll

2015-03-24 01:47 - 2014-12-08 21:42 - 00108944 _____ (Microsoft Corporation) C:\WINDOWS\system32\EncDump.dll

2015-03-24 01:47 - 2014-12-08 21:42 - 00038264 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFaultSecure.exe

2015-03-24 01:47 - 2014-12-08 21:42 - 00033584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFaultSecure.exe

2015-03-24 01:47 - 2014-12-06 03:35 - 00229888 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll

2015-03-24 01:47 - 2014-11-10 01:19 - 00991232 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll

2015-03-24 01:47 - 2014-11-10 01:19 - 00806400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll

2015-03-24 01:47 - 2014-11-10 01:18 - 00259584 _____ (Microsoft Corporation) C:\WINDOWS\system32\pku2u.dll

2015-03-24 01:47 - 2014-11-10 01:18 - 00208896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\pku2u.dll

2015-03-24 01:47 - 2014-10-29 06:00 - 00465320 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFault.exe

2015-03-24 01:47 - 2014-10-29 06:00 - 00139984 _____ (Microsoft Corporation) C:\WINDOWS\system32\wermgr.exe

2015-03-24 01:47 - 2014-10-29 05:52 - 00500016 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll

2015-03-24 01:47 - 2014-10-29 05:52 - 00482872 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll

2015-03-24 01:47 - 2014-10-29 05:52 - 00394120 _____ (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll

2015-03-24 01:47 - 2014-10-29 05:52 - 00272248 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiodg.exe

2015-03-24 01:47 - 2014-10-29 05:12 - 00413136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFault.exe

2015-03-24 01:47 - 2014-10-29 05:12 - 00136296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wermgr.exe

2015-03-24 01:47 - 2014-10-29 05:07 - 00424544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioEng.dll

2015-03-24 01:47 - 2014-10-29 05:07 - 00370424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll

2015-03-24 01:47 - 2014-10-29 05:07 - 00344536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AUDIOKSE.dll

2015-03-24 01:47 - 2014-10-29 04:44 - 00037888 _____ (Microsoft Corporation) C:\WINDOWS\system32\werdiagcontroller.dll

2015-03-24 01:47 - 2014-10-29 03:59 - 00033280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\werdiagcontroller.dll

2015-03-24 01:47 - 2014-10-29 03:02 - 00911360 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll

2015-03-24 01:47 - 2014-09-10 08:25 - 00474432 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\netio.sys

2015-03-24 01:47 - 2014-09-08 05:07 - 02497344 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys

2015-03-24 01:47 - 2014-09-08 05:07 - 00428864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\FWPKCLNT.SYS

2015-03-24 01:47 - 2014-09-08 00:08 - 00389176 _____ () C:\WINDOWS\system32\ApnDatabase.xml

2015-03-24 01:47 - 2014-09-05 00:30 - 00822272 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32spl.dll

2015-03-24 01:47 - 2014-09-05 00:21 - 01053184 _____ (Microsoft Corporation) C:\WINDOWS\system32\localspl.dll

2015-03-24 01:47 - 2014-09-04 05:05 - 00836176 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmp4srcsnk.dll

2015-03-24 01:47 - 2014-09-04 04:22 - 00670384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll

2015-03-24 01:47 - 2014-09-04 03:01 - 00448512 _____ (Microsoft Corporation) C:\WINDOWS\system32\puiobj.dll

2015-03-24 01:47 - 2014-09-04 02:32 - 00334336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\puiobj.dll

2015-03-24 01:47 - 2014-09-04 02:10 - 00118272 _____ (Microsoft Corporation) C:\WINDOWS\system32\winbici.dll

2015-03-24 01:47 - 2014-08-31 02:17 - 00148800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBSTOR.SYS

2015-03-24 01:47 - 2014-08-31 00:05 - 00615424 _____ (Microsoft Corporation) C:\WINDOWS\system32\FXSCOMEX.dll

2015-03-24 01:47 - 2014-08-30 23:58 - 00275968 _____ (Microsoft Corporation) C:\WINDOWS\system32\FXSAPI.dll

2015-03-24 01:47 - 2014-08-30 23:04 - 00941568 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll

2015-03-24 01:47 - 2014-08-30 22:53 - 00239104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FXSAPI.dll

2015-03-24 01:47 - 2014-08-30 22:17 - 00799744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll

2015-03-24 01:47 - 2014-08-28 02:21 - 02480128 _____ (Microsoft Corporation) C:\WINDOWS\system32\WsmSvc.dll

2015-03-24 01:47 - 2014-08-28 02:06 - 02030592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WsmSvc.dll

2015-03-24 01:47 - 2014-08-23 07:14 - 13424128 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll

2015-03-24 01:47 - 2014-08-23 07:04 - 11820544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll

2015-03-24 01:47 - 2014-08-23 06:50 - 02714112 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers.dll

2015-03-24 01:47 - 2014-08-02 02:51 - 00545792 _____ (Microsoft Corporation) C:\WINDOWS\system32\untfs.dll

2015-03-24 01:47 - 2014-08-02 02:35 - 00485376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\untfs.dll

2015-03-24 01:44 - 2015-01-21 07:54 - 01384712 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctf.dll

2015-03-24 01:44 - 2015-01-21 07:15 - 01123848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctf.dll

2015-03-24 01:44 - 2014-07-24 05:20 - 00875688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvcr120_clr0400.dll

2015-03-24 01:44 - 2014-07-24 05:20 - 00869544 _____ (Microsoft Corporation) C:\WINDOWS\system32\msvcr120_clr0400.dll

2015-03-24 01:37 - 2015-03-24 01:38 - 00000000 ____D () C:\Users\Public\CyberLink

2015-03-24 01:37 - 2015-03-24 01:37 - 00000000 ____D () C:\Users\Winfried\Documents\CyberLink

2015-03-24 01:36 - 2015-03-24 01:36 - 00000000 ____D () C:\Users\Winfried\AppData\Roaming\CyberLink

2015-03-24 01:25 - 2015-04-04 09:52 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2015-03-24 01:25 - 2015-04-04 09:45 - 00001186 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

2015-03-24 01:25 - 2015-04-04 09:45 - 00001174 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk

2015-03-24 01:25 - 2015-03-24 01:25 - 00000000 ____D () C:\Users\Winfried\AppData\Roaming\Mozilla

2015-03-24 01:25 - 2015-03-24 01:25 - 00000000 ____D () C:\Users\Winfried\AppData\Local\Mozilla

2015-03-24 01:25 - 2015-03-24 01:25 - 00000000 ____D () C:\ProgramData\Mozilla

2015-03-24 01:25 - 2015-03-24 01:25 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

2015-03-24 01:22 - 2015-03-24 01:22 - 00000000 ____D () C:\Users\Winfried\AppData\Local\CyberLink

2015-03-24 01:02 - 2015-03-24 01:02 - 00000000 ____H () C:\WINDOWS\system32\Drivers\Msft_User_LocationProvider_01_11_00.Wdf

2015-03-23 20:00 - 2015-03-23 20:00 - 00000000 ____D () C:\Users\Winfried\AppData\Local\Macromedia

2015-03-23 19:54 - 2015-04-05 15:18 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job

2015-03-23 19:54 - 2015-03-23 19:54 - 00003772 _____ () C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater

2015-03-23 19:51 - 2015-03-23 19:58 - 00000000 ____D () C:\Users\Winfried\AppData\Local\Adobe

2015-03-23 19:39 - 2015-02-21 03:16 - 25021440 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll

2015-03-23 19:39 - 2015-02-21 02:41 - 12827648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll

2015-03-23 19:39 - 2015-02-21 02:27 - 00285696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll

2015-03-23 19:39 - 2015-02-21 02:27 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll

2015-03-23 19:39 - 2015-02-21 02:25 - 19720192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll

2015-03-23 19:39 - 2015-02-21 01:58 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll

2015-03-23 19:39 - 2015-02-21 01:32 - 00076288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll

2015-03-23 19:39 - 2015-02-20 04:49 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll

2015-03-23 19:39 - 2015-02-20 04:48 - 02886144 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll

2015-03-23 19:39 - 2015-02-20 04:47 - 00088064 _____ (Microsoft Corporation) C:\WINDOWS\system32\MshtmlDac.dll

2015-03-23 19:39 - 2015-02-20 04:35 - 00816128 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll

2015-03-23 19:39 - 2015-02-20 04:34 - 00814080 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll

2015-03-23 19:39 - 2015-02-20 04:32 - 06035456 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll

2015-03-23 19:39 - 2015-02-20 04:09 - 00503296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll

2015-03-23 19:39 - 2015-02-20 04:07 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll

2015-03-23 19:39 - 2015-02-20 04:06 - 00064000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MshtmlDac.dll

2015-03-23 19:39 - 2015-02-20 04:05 - 00316928 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll

2015-03-23 19:39 - 2015-02-20 04:03 - 02278400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll

2015-03-23 19:39 - 2015-02-20 03:59 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll

2015-03-23 19:39 - 2015-02-20 03:56 - 00664064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll

2015-03-23 19:39 - 2015-02-20 03:52 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll

2015-03-23 19:39 - 2015-02-20 03:49 - 00801280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll

2015-03-23 19:39 - 2015-02-20 03:49 - 00374272 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll

2015-03-23 19:39 - 2015-02-20 03:46 - 02125824 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl

2015-03-23 19:39 - 2015-02-20 03:43 - 14398976 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll

2015-03-23 19:39 - 2015-02-20 03:30 - 04300288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll

2015-03-23 19:39 - 2015-02-20 03:30 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll

2015-03-23 19:39 - 2015-02-20 03:29 - 02865152 _____ (Microsoft Corporation) C:\WINDOWS\system32\actxprxy.dll

2015-03-23 19:39 - 2015-02-20 03:28 - 02358784 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll

2015-03-23 19:39 - 2015-02-20 03:26 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll

2015-03-23 19:39 - 2015-02-20 03:24 - 02052608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl

2015-03-23 19:39 - 2015-02-20 03:24 - 00689152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll

2015-03-23 19:39 - 2015-02-20 03:16 - 01548288 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll

2015-03-23 19:39 - 2015-02-20 03:03 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll

2015-03-23 19:39 - 2015-02-20 03:01 - 01888256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll

2015-03-23 19:39 - 2015-02-20 02:57 - 01311232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll

2015-03-23 19:39 - 2015-02-20 02:55 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll

2015-03-23 19:39 - 2015-01-12 04:21 - 00490496 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtmsft.dll

2015-03-23 19:39 - 2015-01-12 03:48 - 00718848 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe

2015-03-23 19:39 - 2015-01-12 03:45 - 00418304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtmsft.dll

2015-03-23 19:39 - 2015-01-12 03:23 - 00327168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll

2015-03-23 19:39 - 2014-11-22 04:49 - 00417280 _____ (Microsoft Corporation) C:\WINDOWS\system32\html.iec

2015-03-23 19:39 - 2014-11-22 04:06 - 00340992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\html.iec

2015-03-23 19:39 - 2014-10-31 07:12 - 00143872 _____ (Microsoft Corporation) C:\WINDOWS\system32\wextract.exe

2015-03-23 19:39 - 2014-10-31 07:12 - 00013824 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshta.exe

2015-03-23 19:39 - 2014-10-31 07:10 - 00167424 _____ (Microsoft Corporation) C:\WINDOWS\system32\iexpress.exe

2015-03-23 19:39 - 2014-10-31 07:09 - 00064512 _____ (Microsoft Corporation) C:\WINDOWS\system32\pngfilt.dll

2015-03-23 19:39 - 2014-10-31 07:08 - 00012800 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeedssync.exe

2015-03-23 19:39 - 2014-10-31 07:06 - 00237568 _____ (Microsoft Corporation) C:\WINDOWS\system32\url.dll

2015-03-23 19:39 - 2014-10-31 07:06 - 00066560 _____ (Microsoft Corporation) C:\WINDOWS\system32\iesetup.dll

2015-03-23 19:39 - 2014-10-31 07:06 - 00048640 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieetwproxystub.dll

2015-03-23 19:39 - 2014-10-31 06:57 - 00054784 _____ (Microsoft Corporation) C:\WINDOWS\system32\jsproxy.dll

2015-03-23 19:39 - 2014-10-31 06:56 - 00034304 _____ (Microsoft Corporation) C:\WINDOWS\system32\iernonce.dll

2015-03-23 19:39 - 2014-10-31 06:54 - 00132096 _____ (Microsoft Corporation) C:\WINDOWS\system32\IEAdvpack.dll

2015-03-23 19:39 - 2014-10-31 06:53 - 00633856 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieui.dll

2015-03-23 19:39 - 2014-10-31 06:52 - 00108544 _____ (Microsoft Corporation) C:\WINDOWS\system32\hlink.dll

2015-03-23 19:39 - 2014-10-31 06:51 - 00144384 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieUnatt.exe

2015-03-23 19:39 - 2014-10-31 06:51 - 00114688 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieetwcollector.exe

2015-03-23 19:39 - 2014-10-31 06:40 - 00033280 _____ (Microsoft Corporation) C:\WINDOWS\system32\licmgr10.dll

2015-03-23 19:39 - 2014-10-31 06:30 - 00077824 _____ (Microsoft Corporation) C:\WINDOWS\system32\JavaScriptCollectionAgent.dll

2015-03-23 19:39 - 2014-10-31 06:29 - 00111616 _____ (Microsoft Corporation) C:\WINDOWS\system32\iesysprep.dll

2015-03-23 19:39 - 2014-10-31 06:29 - 00087552 _____ (Microsoft Corporation) C:\WINDOWS\system32\tdc.ocx

2015-03-23 19:39 - 2014-10-31 06:28 - 00107520 _____ (Microsoft Corporation) C:\WINDOWS\system32\inseng.dll

2015-03-23 19:39 - 2014-10-31 06:25 - 00199680 _____ (Microsoft Corporation) C:\WINDOWS\system32\msrating.dll

2015-03-23 19:39 - 2014-10-31 06:24 - 00060416 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeedsbs.dll

2015-03-23 19:39 - 2014-10-31 06:19 - 00152064 _____ (Microsoft Corporation) C:\WINDOWS\system32\occache.dll

2015-03-23 19:39 - 2014-10-31 05:42 - 00051200 _____ (Microsoft Corporation) C:\WINDOWS\system32\imgutil.dll

2015-03-23 19:39 - 2014-10-31 05:28 - 00137728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wextract.exe

2015-03-23 19:39 - 2014-10-31 05:28 - 00012800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshta.exe

2015-03-23 19:39 - 2014-10-31 05:27 - 00152064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iexpress.exe

2015-03-23 19:39 - 2014-10-31 05:26 - 00057344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\pngfilt.dll

2015-03-23 19:39 - 2014-10-31 05:25 - 00011264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeedssync.exe

2015-03-23 19:39 - 2014-10-31 05:24 - 00235520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\url.dll

2015-03-23 19:39 - 2014-10-31 05:24 - 00062464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iesetup.dll

2015-03-23 19:39 - 2014-10-31 05:23 - 00047616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieetwproxystub.dll

2015-03-23 19:39 - 2014-10-31 05:16 - 00047104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jsproxy.dll

2015-03-23 19:39 - 2014-10-31 05:15 - 00030720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iernonce.dll

2015-03-23 19:39 - 2014-10-31 05:14 - 00112128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\IEAdvpack.dll

2015-03-23 19:39 - 2014-10-31 05:13 - 00478208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieui.dll

2015-03-23 19:39 - 2014-10-31 05:13 - 00099328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\hlink.dll

2015-03-23 19:39 - 2014-10-31 05:12 - 00115712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieUnatt.exe

2015-03-23 19:39 - 2014-10-31 05:11 - 00620032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9diag.dll

2015-03-23 19:39 - 2014-10-31 05:03 - 00027136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\licmgr10.dll

2015-03-23 19:39 - 2014-10-31 04:57 - 00060416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\JavaScriptCollectionAgent.dll

2015-03-23 19:39 - 2014-10-31 04:56 - 00091136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inseng.dll

2015-03-23 19:39 - 2014-10-31 04:56 - 00090624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iesysprep.dll

2015-03-23 19:39 - 2014-10-31 04:56 - 00073216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tdc.ocx

2015-03-23 19:39 - 2014-10-31 04:53 - 00168960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msrating.dll

2015-03-23 19:39 - 2014-10-31 04:53 - 00052736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeedsbs.dll

2015-03-23 19:39 - 2014-10-31 04:48 - 00130048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\occache.dll

2015-03-23 19:39 - 2014-10-31 04:26 - 01042944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\actxprxy.dll

2015-03-23 19:39 - 2014-10-31 04:24 - 00040448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\imgutil.dll

2015-03-23 19:13 - 2015-03-06 04:53 - 00430080 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll

2015-03-23 19:13 - 2015-03-06 04:33 - 00358912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll

2015-03-23 19:13 - 2015-02-26 01:26 - 04178944 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys

2015-03-23 19:13 - 2015-01-16 00:43 - 00563504 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys

2015-03-23 19:13 - 2015-01-16 00:43 - 00177984 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys

2015-03-23 19:13 - 2015-01-14 06:22 - 00445440 _____ (Microsoft Corporation) C:\WINDOWS\system32\certcli.dll

2015-03-23 19:13 - 2015-01-14 05:53 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certcli.dll

2015-03-23 19:13 - 2014-12-09 03:50 - 00225280 _____ (Microsoft Corporation) C:\WINDOWS\system32\profsvc.dll

2015-03-23 19:13 - 2014-10-29 04:51 - 00154112 _____ (Microsoft Corporation) C:\WINDOWS\system32\msaudite.dll

2015-03-23 19:13 - 2014-10-29 04:50 - 00736768 _____ (Microsoft Corporation) C:\WINDOWS\system32\adtschema.dll

2015-03-23 19:13 - 2014-10-29 04:06 - 00736768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\adtschema.dll

2015-03-23 19:13 - 2014-10-29 04:06 - 00154112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msaudite.dll

2015-03-23 19:13 - 2014-10-29 03:31 - 01441792 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll

2015-03-23 19:12 - 2014-12-09 05:45 - 00393728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\scesrv.dll

2015-03-23 19:12 - 2014-12-09 03:56 - 00538624 _____ (Microsoft Corporation) C:\WINDOWS\system32\scesrv.dll

2015-03-23 19:12 - 2014-09-27 09:13 - 00104336 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncryptsslp.dll

2015-03-23 19:12 - 2014-09-27 07:24 - 00088800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ncryptsslp.dll

2015-03-23 19:12 - 2014-09-27 05:30 - 00185856 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpapisrv.dll

2015-03-21 23:00 - 2015-03-24 10:46 - 00000000 ____D () C:\Users\Winfried\AppData\Local\Lenovo

2015-03-21 22:56 - 2015-04-05 19:08 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1872664996-1993104736-2441894966-1001

2015-03-21 22:55 - 2015-04-05 13:48 - 00003962 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{083CACEA-2800-4375-A9CE-E755E8D02B7A}

2015-03-21 22:55 - 2015-03-21 22:55 - 00000000 __SHD () C:\Users\Winfried\AppData\Local\EmieUserList

2015-03-21 22:55 - 2015-03-21 22:55 - 00000000 __SHD () C:\Users\Winfried\AppData\Local\EmieSiteList

2015-03-21 22:55 - 2015-03-21 22:55 - 00000000 ____D () C:\ProgramData\OneKey Optimizer

2015-03-21 22:52 - 2015-04-05 19:08 - 01532662 _____ () C:\Users\Public\Documents\TestPicksStart.txt

2015-03-21 22:52 - 2015-04-05 18:59 - 00002262 _____ () C:\Users\Winfried\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Harmony Picks Introduction.lnk

2015-03-21 22:52 - 2015-04-05 18:59 - 00001366 _____ () C:\Users\Winfried\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Harmony Settings Introduction.lnk

2015-03-21 22:52 - 2015-04-05 18:59 - 00000000 ___RD () C:\Users\Winfried\OneDrive

2015-03-21 22:52 - 2015-03-21 22:52 - 00000000 ____D () C:\Users\Winfried\AppData\Roaming\Macromedia

2015-03-21 22:52 - 2015-03-21 22:52 - 00000000 ____D () C:\Users\Winfried\AppData\Roaming\Intel Corporation

2015-03-21 22:51 - 2015-04-04 09:45 - 00001465 _____ () C:\Users\Winfried\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

2015-03-21 22:51 - 2015-03-23 20:17 - 00000000 ____D () C:\Users\Winfried\AppData\Local\Packages

2015-03-21 22:51 - 2015-03-21 22:51 - 00000118 _____ () C:\WINDOWS\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat

2015-03-21 22:51 - 2015-03-21 22:51 - 00000020 ___SH () C:\Users\Winfried\ntuser.ini

2015-03-21 22:51 - 2015-03-21 22:51 - 00000000 _SHDL () C:\Users\Winfried\Vorlagen

2015-03-21 22:51 - 2015-03-21 22:51 - 00000000 _SHDL () C:\Users\Winfried\Startmenü

2015-03-21 22:51 - 2015-03-21 22:51 - 00000000 _SHDL () C:\Users\Winfried\Netzwerkumgebung

2015-03-21 22:51 - 2015-03-21 22:51 - 00000000 _SHDL () C:\Users\Winfried\Lokale Einstellungen

2015-03-21 22:51 - 2015-03-21 22:51 - 00000000 _SHDL () C:\Users\Winfried\Eigene Dateien

2015-03-21 22:51 - 2015-03-21 22:51 - 00000000 _SHDL () C:\Users\Winfried\Druckumgebung

2015-03-21 22:51 - 2015-03-21 22:51 - 00000000 _SHDL () C:\Users\Winfried\Documents\Eigene Musik

2015-03-21 22:51 - 2015-03-21 22:51 - 00000000 _SHDL () C:\Users\Winfried\Documents\Eigene Bilder

2015-03-21 22:51 - 2015-03-21 22:51 - 00000000 _SHDL () C:\Users\Winfried\AppData\Roaming\Microsoft\Windows\Start Menu\Programme

2015-03-21 22:51 - 2015-03-21 22:51 - 00000000 _SHDL () C:\Users\Winfried\AppData\Local\Verlauf

2015-03-21 22:51 - 2015-03-21 22:51 - 00000000 _SHDL () C:\Users\Winfried\AppData\Local\Anwendungsdaten

2015-03-21 22:51 - 2015-03-21 22:51 - 00000000 _SHDL () C:\Users\Winfried\Anwendungsdaten

2015-03-21 22:51 - 2015-03-21 22:51 - 00000000 ____D () C:\WINDOWS\System32\Tasks\WPD

2015-03-21 22:51 - 2015-03-21 22:51 - 00000000 ____D () C:\Users\Winfried\AppData\Roaming\Intel

2015-03-21 22:51 - 2015-03-21 22:51 - 00000000 ____D () C:\Users\Winfried\AppData\Roaming\Adobe

2015-03-21 22:51 - 2015-03-21 22:51 - 00000000 ____D () C:\Users\Winfried\AppData\Local\VirtualStore

2015-03-21 22:50 - 2015-04-04 16:33 - 00000000 ____D () C:\Users\Winfried

2015-03-21 22:50 - 2015-02-26 19:05 - 00000000 ___RD () C:\Users\Winfried\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility

2015-03-21 22:50 - 2014-08-23 23:39 - 00000000 ___RD () C:\Users\Winfried\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools

2015-03-21 22:50 - 2014-03-18 11:55 - 00000369 _____ () C:\Users\Winfried\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pictures.lnk

2015-03-21 22:50 - 2014-03-18 11:55 - 00000369 _____ () C:\Users\Winfried\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Documents.lnk

2015-03-21 22:50 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Winfried\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories

2015-03-21 22:50 - 2013-08-22 17:36 - 00000000 ____D () C:\Users\Winfried\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Public\Documents\Eigene Musik

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Public\Documents\Eigene Bilder

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default\Vorlagen

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default\Startmenü

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default\Netzwerkumgebung

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default\Lokale Einstellungen

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default\Eigene Dateien

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default\Druckumgebung

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default\Documents\Eigene Musik

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default\Documents\Eigene Bilder

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programme

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default\AppData\Local\Verlauf

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default\AppData\Local\Anwendungsdaten

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default\Anwendungsdaten

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default User\Documents\Eigene Musik

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default User\Documents\Eigene Bilder

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programme

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default User\AppData\Local\Verlauf

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default User\AppData\Local\Anwendungsdaten

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Programme

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\ProgramData\Vorlagen

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\ProgramData\Startmenü

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\ProgramData\Microsoft\Windows\Start Menu\Programme

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\ProgramData\Dokumente

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\ProgramData\Anwendungsdaten

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Program Files\Gemeinsame Dateien

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Dokumente und Einstellungen
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2015-04-05 19:05 - 2015-02-27 03:53 - 00768056 _____ () C:\WINDOWS\system32\perfh007.dat

2015-04-05 19:05 - 2015-02-27 03:53 - 00160322 _____ () C:\WINDOWS\system32\perfc007.dat

2015-04-05 19:05 - 2014-03-18 11:53 - 01780340 _____ () C:\WINDOWS\system32\PerfStringBackup.INI

2015-04-05 19:02 - 2015-02-26 19:01 - 00000840 _____ () C:\WINDOWS\lupdate.log

2015-04-05 19:01 - 2015-02-26 19:17 - 00006469 _____ () C:\WINDOWS\SysWOW64\Gms.log

2015-04-05 19:00 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\sru

2015-04-05 18:58 - 2015-02-26 19:34 - 00002560 _____ () C:\WINDOWS\system32\VfService.trf

2015-04-05 18:58 - 2015-02-26 19:11 - 00450112 _____ () C:\Users\Public\CAFADEBUG.log

2015-04-05 18:58 - 2015-02-26 18:58 - 01243535 _____ () C:\WINDOWS\WindowsUpdate.log

2015-04-05 18:58 - 2015-02-26 18:56 - 00153336 _____ () C:\WINDOWS\system32\wpbbin.exe

2015-04-05 18:58 - 2015-02-26 18:56 - 00111088 _____ (Lenovo (Beijing) Limited) C:\WINDOWS\system32\LenovoCheck.exe

2015-04-05 18:58 - 2015-02-26 18:56 - 00026608 _____ (Lenovo) C:\WINDOWS\system32\LenovoUpdate.exe

2015-04-05 18:58 - 2013-08-22 16:46 - 00026555 _____ () C:\WINDOWS\setupact.log

2015-04-05 18:58 - 2013-08-22 16:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT

2015-04-05 18:58 - 2013-08-22 15:25 - 00262144 ___SH () C:\WINDOWS\system32\config\BBI

2015-04-04 14:20 - 2014-03-18 11:44 - 00282522 _____ () C:\WINDOWS\PFRO.log

2015-04-04 14:01 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\AppReadiness

2015-04-04 13:50 - 2013-08-22 17:36 - 00000000 ___RD () C:\WINDOWS\ImmersiveControlPanel

2015-04-04 12:15 - 2013-08-22 17:20 - 00000000 ____D () C:\WINDOWS\CbsTemp

2015-04-04 12:01 - 2015-02-26 19:10 - 00003718 _____ () C:\WINDOWS\System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473

2015-04-04 11:54 - 2015-02-26 19:35 - 00000000 ____D () C:\ProgramData\McAfee

2015-04-04 11:54 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools

2015-04-04 11:54 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools

2015-04-04 11:54 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files\Windows Defender

2015-04-04 11:54 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files (x86)\Windows Defender

2015-04-04 11:53 - 2015-02-26 19:06 - 00000000 ____D () C:\ProgramData\Package Cache

2015-04-04 11:51 - 2013-08-22 17:36 - 00000000 ___HD () C:\WINDOWS\ELAMBKUP

2015-04-04 11:39 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files\Common Files\microsoft shared

2015-04-04 11:38 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\rescache

2015-04-04 11:00 - 2013-08-22 17:43 - 00000000 ____D () C:\WINDOWS\DigitalLocker

2015-04-03 14:55 - 2013-08-22 15:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM

2015-03-24 02:09 - 2015-02-26 19:34 - 00000000 ____D () C:\WINDOWS\System32\Tasks\Lenovo

2015-03-24 01:22 - 2015-02-26 19:39 - 00000000 ____D () C:\ProgramData\CyberLink

2015-03-23 20:58 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\PolicyDefinitions

2015-03-23 20:57 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\sr-Latn-RS

2015-03-23 20:57 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\sr-Latn-CS

2015-03-23 19:41 - 2013-08-22 16:44 - 00346960 _____ () C:\WINDOWS\system32\FNTCACHE.DAT

2015-03-23 19:40 - 2013-08-22 17:36 - 00000000 ___RD () C:\WINDOWS\ToastData

2015-03-23 19:40 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\MediaViewer

2015-03-23 19:40 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\FileManager

2015-03-23 19:40 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\Camera

2015-03-23 19:17 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\Help

2015-03-21 23:09 - 2015-02-26 19:18 - 00000000 ____D () C:\ProgramData\Lenovo

2015-03-21 22:58 - 2015-02-26 19:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lenovo

2015-03-21 22:58 - 2015-02-26 19:23 - 00000000 ____D () C:\Program Files (x86)\Lenovo

2015-03-21 22:56 - 2015-02-26 19:08 - 00000000 ____D () C:\ProgramData\Intel

2015-03-21 22:52 - 2015-02-26 19:36 - 00000000 ____D () C:\Users\Public\Documents\Lenovo

2015-03-21 22:51 - 2015-02-27 04:47 - 00149785 ____H () C:\WINDOWS\modules.log

2015-03-21 22:51 - 2014-04-03 21:15 - 00000000 ____D () C:\WINDOWS\Panther

2015-03-20 07:01 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files\Windows NT

2015-03-20 07:01 - 2013-08-22 15:36 - 00000000 ___HD () C:\Users\Default
 

==================== Files in the root of some directories =======
 

2015-03-26 21:14 - 2015-03-26 21:14 - 0005542 _____ () C:\Users\Winfried\AppData\Roaming\AXDGX

2015-03-31 10:14 - 2015-03-31 10:14 - 0004387 _____ () C:\Users\Winfried\AppData\Roaming\oDweklayyunBXthwbuHX

2015-03-26 21:14 - 2015-03-26 21:14 - 0004185 _____ () C:\Users\Winfried\AppData\Roaming\XLA
 

Some content of TEMP:

====================

C:\Users\Winfried\AppData\Local\Temp\avgnt.exe

C:\Users\Winfried\AppData\Local\Temp\mccspuninstall.exe

C:\Users\Winfried\AppData\Local\Temp\Quarantine.exe

C:\Users\Winfried\AppData\Local\Temp\sqlite3.dll
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-08-23 23:30
 

==================== End Of Log ============================

--- --- ---

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)

Eset:

Code:

ESETSmartInstaller@High as downloader log:

all ok

# product=EOS

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.7623

# api_version=3.0.2

# EOSSerial=6dfe960857403e47882724e8ae6c9f39

# engine=23250

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2015-04-06 11:00:10

# local_time=2015-04-06 01:00:10 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1031

# osver=6.2.9200 NT 

# compatibility_mode_1=''

# compatibility_mode=5893 16776574 100 94 176752 5400402 0 0

# scanned=217507

# found=11

# cleaned=0

# scan_time=1442

sh=5D628376391A827A818B0A079B64EE457AE9B82A ft=1 fh=c71c0011e2e7a7a5 vn="Variante von Win32/ELEX.BM evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\BrowserAction.dll.vir"

sh=D62E826B13E242DC0BABCAD05E3A4613795A024F ft=0 fh=0000000000000000 vn="Win32/Toolbar.TNT2.I evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\ffsearch_toolbar!1.0.0.1025.xpi.vir"

sh=E159ED240A1CF62ABCEDD8EB0C62D81653D08BC1 ft=1 fh=2074d72608e2a61c vn="Win32/OutBrowse.BU evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Winfried\AppData\Local\Microsoft\Windows\INetCache\IE\HT0OSLKQ\Reimage[1].exe"

sh=1A0C307780840984E88B114BF038910A91D61F7F ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Winfried\AppData\Local\Microsoft\Windows\INetCache\IE\T7J7BXCZ\91[1].js"

sh=47B19AB97028D8925579BED54EFEE88C8107D6B6 ft=1 fh=34f71966959b3eb8 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Winfried\AppData\Local\Temp\DMR\dmr_72.exe"

sh=D857C664CE9D248816CDB2E9BCA065343657502A ft=1 fh=a85b5fee098ab53d vn="Win32/Somoto.E evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Winfried\AppData\Local\Temp\DMR\Downloads\fc14996dfa99adfc7baae624196888c5\5b06e73c66b13128cd03586177ce6642\m4a-to-mp3-83converter.exe"

sh=147E7AEBDEBB6E9F8FF6421745782501C2C5B245 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Winfried\AppData\Roaming\AXDGX"

sh=171D0DFAD4ABC8BFCFC3DE6AD9EB03DBA9CB60AC ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Winfried\AppData\Roaming\oDweklayyunBXthwbuHX"

sh=244EA60E7D5D45DE10670B877D24A480419F30A3 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Winfried\AppData\Roaming\XLA"

sh=263F0ECF552C20C2183EBBC33CC3425710C908F1 ft=1 fh=88af93408e2ecc46 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Winfried\Downloads\Free M4a to MP3 Converter - CHIP-Installer.exe"

sh=DF6372096ED21FAD82874413CA19A95AFDDD58B7 ft=1 fh=bb4aa5411dce55b2 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Winfried\Downloads\Malwarebytes Anti Malware Malware Scanner - CHIP-Installer.exe"

Security Check

Code:

 Results of screen317's Security Check version 0.99.99  

   x64 (UAC is enabled)  

 Internet Explorer 11  
 ``````````````Antivirus/Firewall Check:`````````````` 

Avira Desktop      

Windows Defender   

 Antivirus up to date!  (On Access scanning disabled!) 
 `````````Anti-malware/Other Utilities Check:````````` 

 Adobe Flash Player         17.0.0.134  

 Mozilla Firefox (36.0.4) 
 ````````Process Check: objlist.exe by Laurent````````  

 Malwarebytes Anti-Malware mbamservice.exe  

 Malwarebytes Anti-Malware mbam.exe  

 Avira Antivir avgnt.exe 

 Avira Antivir avguard.exe 

 Malwarebytes Anti-Malware mbamscheduler.exe   
 `````````````````System Health check````````````````` 

 Total Fragmentation on Drive C:  % 
 ````````````````````End of Log``````````````````````

FRST

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015

Ran by Winfried (administrator) on KLEINERPCANDI on 06-04-2015 13:06:20

Running from C:\Users\Winfried\Desktop

Loaded Profiles: Winfried (Available profiles: Winfried)

Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11 (Default browser: FF)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(Intel Corporation) C:\Windows\System32\igfxCUIService.exe

(Microsoft Corporation) C:\Windows\System32\wlanext.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe

(Intel Corporation) C:\Windows\SysWOW64\esif_uf.exe

(Microsoft Corporation) C:\Windows\System32\dasHost.exe

(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe

(Lenovo) C:\Program Files\Lenovo\OneKey Optimizer\bin\FbService.exe

() C:\Program Files (x86)\Lenovo\Harmony\Picks\HarmonyPicksService.exe

() C:\Program Files (x86)\Lenovo\Harmony\Setting\HarmonySettingService.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\utilities\ibtsiva.exe

(Lenovo(beijing) Limited) C:\Program Files\Lenovo\OneKey Optimizer\bin\OKOUpdataService.exe

(Lenovo Group Limited) C:\Program Files\Lenovo\SettingsDependency\SettingsService.exe

(LENOVO INCORPORATED.) C:\Program Files\Lenovo\iMController\SystemAgentService.exe

() C:\Program Files\Lenovo PhoneCompanion\LPAWDService.exe

(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Lenovo Settings\x86\LenovoSetSvr.exe

(Lenovo(beijing) Limited) C:\Windows\System32\LenovoWiFiHotspotSvr.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe

(Nitro PDF Software) C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe

(Nalpeiron Ltd.) C:\Windows\SysWOW64\NLSSRV32.EXE

(Lenovo(beijing) Limited) C:\Program Files\Lenovo\OneKey Optimizer\bin\OKOControlSvc.exe

(Lenovo) C:\Program Files (x86)\Lenovo\PaperDisplay\x86\PaperLookingSrv.exe

(PointGrab LTD) C:\Program Files (x86)\Lenovo\Motion Control\PGService.exe

(PointGrab LTD) C:\Program Files (x86)\Lenovo\Motion Control\PG_Service_Launcher.exe

(Lenovo) C:\Program Files\Lenovo PhoneCompanion\PhoneCompanionPusher.exe

() C:\Program Files (x86)\Lenovo\PaperDisplay\x86\PLHotkeyService.exe

(PointGrab LTD) C:\Program Files (x86)\Lenovo\Motion Control\WebcamSplitterServer.exe

() C:\Program Files\CyberLink\Shared files\RichVideo64.exe

(Conexant Systems, Inc.) C:\Windows\SysWOW64\SASrv.exe

() C:\Program Files (x86)\Lenovo\Lenovo VeriFace Pro\VfConnectorService.exe

(Lenovo) C:\ProgramData\LenovoTransition\Server\x64\ymc.exe

(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe

(Lenovo) C:\Windows\System32\LenovoUpdate.exe

() C:\Program Files\Lenovo PhoneCompanion\adb.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

() C:\Program Files (x86)\Lenovo\CCSDK\CCSDK.exe

(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe

(Intel Corporation) C:\Windows\System32\igfxEM.exe

(Intel Corporation) C:\Windows\System32\igfxHK.exe

() C:\Windows\System32\igfxTray.exe

(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe

(Intel Corporation) C:\Windows\Temp\DPTF\esif_assist.exe

() C:\Program Files (x86)\Lenovo\CCSDK\WinGather.exe

() C:\Program Files\CONEXANT\ForteConfig\fmapp.exe

(Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe

(Waves Audio Ltd.) C:\Program Files\Waves\MaxxAudio\WavesSvc64.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

() C:\Program Files\Lenovo\LenovoUtility\utility.exe

() C:\Program Files (x86)\Lenovo\LenovoTransition\TransitionServer.exe

(Lenovo) C:\Program Files\Lenovo PhoneCompanion\Phone Companion.exe

(Lenovo(beijing) Limited) C:\Program Files\Lenovo\OneKey Optimizer\bin\OneKeyOptimizerTray.exe

(Lenovo(beijing) Limited) C:\Program Files\Lenovo\OneKey Optimizer\bin\OnekeyOptimizerUpdata.exe

(Lenovo) C:\Program Files (x86)\Lenovo\Harmony\Picks\Lenovo.HarmonyPicks.exe

(Lenovo) C:\Program Files (x86)\Lenovo\Harmony\Setting\Lenovo.HarmonySetting.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe

(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe

(Lenovo Corporation) C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe

(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_6.3.9600.20280_x64__8wekyb3d8bbwe\soundrec.exe

(Microsoft Corporation) C:\Windows\WinStore\WSHost.exe

(Lenovo(beijing) Limited) C:\Program Files\Lenovo\OneKey Optimizer\bin\OneKeyOptimizer.exe

(Microsoft Corporation) C:\Windows\System32\WWAHost.exe

(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20689_x64__8wekyb3d8bbwe\livecomm.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_17_0_0_134.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_17_0_0_134.exe

() C:\Users\Winfried\Desktop\SecurityCheck.exe

(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe

(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [322712 2014-10-09] (Intel Corporation)

HKLM\...\Run: [ForteConfig] => C:\Program Files\Conexant\ForteConfig\fmapp.exe [49056 2010-10-26] ()

HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SACpl.exe [1830616 2014-04-10] (Conexant Systems, Inc.)

HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [919768 2014-11-20] (Conexant Systems, Inc.)

HKLM\...\Run: [WavesSvc] => C:\Program Files\Waves\MaxxAudio\WavesSvc64.exe [606296 2014-10-02] (Waves Audio Ltd.)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2809072 2014-09-19] (Synaptics Incorporated)

HKLM\...\Run: [LENOVO.TPKNRRES] => rundll32.exe "C:\Program Files\Lenovo\Communications Utility\LibStartStub.dll",AVStartupStub

HKLM\...\Run: [LenovoUtility] => C:\Program Files\Lenovo\LenovoUtility\utility.exe [791368 2015-02-26] ()

HKLM\...\Run: [AutoStartTransition] => C:\Program Files (x86)\Lenovo\LenovoTransition\TransitionServer.exe [109840 2014-08-14] ()

HKLM\...\Run: [PhoneCompanion] => C:\Program Files\Lenovo PhoneCompanion\Phone Companion.exe [802800 2015-02-26] (Lenovo)

HKLM\...\Run: [OneKeyOptimizer] => C:\Program Files\Lenovo\OneKey Optimizer\bin\OneKeyOptimizerTray.exe [559896 2014-11-18] (Lenovo(beijing) Limited)

HKLM\...\Run: [3D BubbleSound] => "C:\Program Files\BubbleSound\3D BubbleSound.exe"

HKLM-x32\...\Run: [HarmonyPicks] => C:\Program Files (x86)\Lenovo\Harmony\Picks\Lenovo.HarmonyPicks.exe [1221912 2014-09-28] (Lenovo)

HKLM-x32\...\Run: [HarmonySetting] => C:\Program Files (x86)\Lenovo\Harmony\Setting\Lenovo.HarmonySetting.exe [2696472 2014-09-28] (Lenovo)

HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [704512 2015-03-17] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [126712 2015-01-19] (Avira Operations GmbH & Co. KG)

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = www.google.com

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com

HKU\S-1-5-21-1872664996-1993104736-2441894966-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-21-1872664996-1993104736-2441894966-1001 -> {015DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = 

SearchScopes: HKU\S-1-5-21-1872664996-1993104736-2441894966-1001 -> {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = 

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

StartMenuInternet: IEXPLORE.EXE - iexplore.exe
 

FireFox:

========

FF ProfilePath: C:\Users\Winfried\AppData\Roaming\Mozilla\Firefox\Profiles\4dr5421m.default

FF SelectedSearchEngine: Google

FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_17_0_0_134.dll [2015-03-23] ()

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_134.dll [2015-03-23] ()

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.56 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2014-10-10] (Intel Corporation)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2014-10-10] (Intel Corporation)

FF Plugin-x32: @nitropdf.com/NitroPDF -> C:\Program Files (x86)\Nitro\Pro 9\npnitromozilla.dll [2013-12-12] (Nitro PDF)

FF Extension: Adblock Plus - C:\Users\Winfried\AppData\Roaming\Mozilla\Firefox\Profiles\4dr5421m.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-03-24]
 

==================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [432888 2015-03-17] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [432888 2015-03-17] (Avira Operations GmbH & Co. KG)

S3 AVControlCenter; C:\Program Files\Lenovo\Communications Utility\AVControlCenter32.exe [599024 2014-08-05] (Lenovo Corporation)

R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [182520 2015-01-19] (Avira Operations GmbH & Co. KG)

R2 CCSDK; C:\Program Files (x86)\Lenovo\CCSDK\CCSDK.exe [644080 2014-10-22] ()

R2 esifsvc; C:\WINDOWS\SysWOW64\esif_uf.exe [1037568 2014-09-18] (Intel Corporation)

R2 FastbootService; C:\Program Files\Lenovo\OneKey Optimizer\bin\FbService.exe [191512 2014-11-20] (Lenovo)

R2 HarmonyPicksService; C:\Program Files (x86)\Lenovo\Harmony\Picks\HarmonyPicksService.exe [17176 2014-08-25] ()

R2 HarmonySettingService; C:\Program Files (x86)\Lenovo\Harmony\Setting\HarmonySettingService.exe [17688 2014-09-04] ()

R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [18584 2014-10-09] (Intel Corporation)

R2 ibtsiva.exe; C:\Program Files (x86)\Intel\Bluetooth\utilities\ibtsiva.exe [121288 2014-08-13] (Intel Corporation)

R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [328296 2014-11-21] (Intel Corporation)

S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [887256 2014-05-13] (Intel(R) Corporation)

R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [132896 2014-10-10] (Intel Corporation)

S3 iumsvc; C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [174368 2014-04-09] ()

R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [158496 2014-10-10] (Intel Corporation)

S3 Lenovo EasyPlus Hotspot; C:\Program Files (x86)\Common Files\lenovo\easyplussdk\bin\EPHotspot64.exe [561408 2014-09-22] (Lenovo)

R2 Lenovo OKO Service; C:\Program Files\Lenovo\OneKey Optimizer\bin\OKOUpdataService.exe [2544408 2014-11-18] (Lenovo(beijing) Limited)

R2 Lenovo Settings Service; C:\Program Files\Lenovo\SettingsDependency\SettingsService.exe [2005320 2014-10-13] (Lenovo Group Limited)

R2 Lenovo System Agent Service; C:\Program Files\Lenovo\iMController\SystemAgentService.exe [584632 2015-03-06] (LENOVO INCORPORATED.)

S3 LENOVO.TVTVCAM; C:\Program Files\Lenovo\Communications Utility\vcamsvc.exe [727536 2014-08-05] (Lenovo Corporation)

R2 LenovoPAWDService; C:\Program Files\Lenovo PhoneCompanion\LPAWDService.exe [133440 2015-02-26] ()

R2 LenovoSetSvr; C:\Program Files (x86)\Lenovo\Lenovo Settings\x86\LenovoSetSvr.exe [258544 2014-06-19] (Lenovo(beijing) Limited)

R3 LenovoUpdate; C:\Windows\System32\LenovoUpdate.exe [26608 2015-04-05] (Lenovo)

R2 LenovoWiFiHotspotSvr; C:\Windows\System32\LenovoWiFiHotspotSvr.exe [218952 2014-08-25] (Lenovo(beijing) Limited)

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2015-03-17] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1080120 2015-03-17] (Malwarebytes Corporation)

S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [265936 2014-10-29] ()

R2 NitroDriverReadSpool9; C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe [230920 2013-12-12] (Nitro PDF Software)

R2 OKOControlSvc; C:\Program Files\Lenovo\OneKey Optimizer\bin\OKOControlSvc.exe [113944 2014-11-17] (Lenovo(beijing) Limited)

R2 PaperLookingSrv; C:\Program Files (x86)\Lenovo\PaperDisplay\x86\PaperLookingSrv.exe [173848 2014-11-25] (Lenovo)

R2 PGService; C:\Program Files (x86)\Lenovo\Motion Control\PGService.exe [167176 2014-05-28] (PointGrab LTD)

R2 PG_Service_Launcher; C:\Program Files (x86)\Lenovo\Motion Control\PG_Service_Launcher.exe [524552 2014-05-28] (PointGrab LTD)

R2 PhoneCompanionPusher; C:\Program Files\Lenovo PhoneCompanion\PhoneCompanionPusher.exe [321520 2015-02-26] (Lenovo)

S3 PhoneCompanionVap; C:\Program Files\Lenovo PhoneCompanion\PhoneCompanionVap.exe [338416 2015-02-26] (Lenovo)

R2 PLHotkeyService; C:\Program Files (x86)\Lenovo\PaperDisplay\x86\PLHotkeyService.exe [26392 2014-11-25] ()

R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [390632 2012-04-24] ()

R2 VeriFaceSrv; C:\Program Files (x86)\Lenovo\Lenovo VeriFace Pro\VfConnectorService.exe [68880 2015-02-26] ()

S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-04] (Microsoft Corporation)

S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-04] (Microsoft Corporation)

R2 ymc; C:\ProgramData\LenovoTransition\Server\x64\ymc.exe [34576 2014-09-03] (Lenovo)

R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3818704 2014-10-29] (Intel® Corporation)
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [128536 2015-03-17] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [132120 2015-03-17] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2015-03-17] (Avira Operations GmbH & Co. KG)

S3 AX88772; C:\Windows\system32\DRIVERS\ax88772.sys [113864 2013-07-18] (ASIX Electronics Corp.)

R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-03-18] (Microsoft Corporation)

R3 dptf_cpu; C:\Windows\System32\drivers\dptf_cpu.sys [38720 2014-09-18] (Intel Corporation)

R3 esif_lf; C:\Windows\System32\drivers\esif_lf.sys [216360 2014-09-18] (Intel Corporation)

R0 Fastboot; C:\Windows\System32\DRIVERS\Fastboot.sys [70168 2014-11-20] (Windows (R) Win 7 DDK provider)

R3 ibtusb; C:\Windows\system32\DRIVERS\ibtusb.sys [219592 2014-08-13] (Intel Corporation)

R0 IntelHSWPcc; C:\Windows\System32\drivers\IntelPcc.sys [79528 2014-09-05] (Intel Corporation)

R3 KMDFVirtualKbd; C:\Windows\System32\drivers\KMDFVirtualKbd.sys [22264 2014-08-04] ()

R3 KMDFVirtualMouse; C:\Windows\System32\drivers\KMDFVirtualMouse.sys [21240 2014-08-04] ()

R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2015-03-17] (Malwarebytes Corporation)

R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [136408 2015-04-06] (Malwarebytes Corporation)

R3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2015-03-17] (Malwarebytes Corporation)

R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [129312 2014-10-10] (Intel Corporation)

R3 NETwNb64; C:\Windows\system32\DRIVERS\Netwbw02.sys [3482600 2014-11-06] (Intel Corporation)

S3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew02.sys [4649440 2013-06-18] (Intel Corporation)

R3 rtsuvc; C:\Windows\system32\DRIVERS\rtsuvc.sys [2803416 2014-10-09] (Realtek Semiconductor Corp.)

R3 SensorsHIDClassDriver; C:\Windows\system32\DRIVERS\WUDFRd.sys [227840 2014-05-31] (Microsoft Corporation)

R3 SensorsServiceDriver; C:\Windows\system32\DRIVERS\WUDFRd.sys [227840 2014-05-31] (Microsoft Corporation)

R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [31472 2014-09-19] (Synaptics Incorporated)

S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-04] (Microsoft Corporation)

S3 wsvd; C:\Windows\system32\DRIVERS\wsvd.sys [102376 2012-06-13] ("CyberLink)
 

==================== NetSvcs (Whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2015-04-06 13:02 - 2015-04-06 13:02 - 00852607 _____ () C:\Users\Winfried\Desktop\SecurityCheck.exe

2015-04-06 12:25 - 2015-04-06 12:25 - 00000000 ____D () C:\Program Files (x86)\ESET

2015-04-06 12:21 - 2015-04-06 12:22 - 02347384 _____ (ESET) C:\Users\Winfried\Desktop\esetsmartinstaller_deu.exe

2015-04-05 19:05 - 2015-04-05 19:05 - 00001002 _____ () C:\Users\Winfried\Desktop\JRT.txt

2015-04-05 19:02 - 2015-04-05 19:02 - 00000207 _____ () C:\WINDOWS\tweaking.com-regbackup-KLEINERPCANDI-Windows-8.1-(64-bit).dat

2015-04-05 19:01 - 2015-04-05 19:01 - 02690981 _____ (Thisisu) C:\Users\Winfried\Desktop\JRT.exe

2015-04-05 19:01 - 2015-04-05 19:01 - 00000000 ____D () C:\RegBackup

2015-04-05 18:56 - 2015-04-05 18:56 - 02208768 _____ () C:\Users\Winfried\Desktop\AdwCleaner_4.200.exe

2015-04-05 14:21 - 2015-04-05 14:21 - 00001197 _____ () C:\Users\Winfried\Desktop\MBAM.txt

2015-04-05 14:13 - 2015-04-05 14:13 - 00380416 _____ () C:\Users\Winfried\Desktop\Gmer-19357.exe

2015-04-05 14:12 - 2015-04-05 14:12 - 00380416 _____ () C:\Users\Winfried\Desktop\kqmuntzg.exe

2015-04-05 14:11 - 2015-04-06 13:06 - 00020044 _____ () C:\Users\Winfried\Desktop\FRST.txt

2015-04-05 14:11 - 2015-04-06 13:06 - 00000000 ____D () C:\FRST

2015-04-05 14:11 - 2015-04-05 14:12 - 00027878 _____ () C:\Users\Winfried\Desktop\Addition.txt

2015-04-05 14:10 - 2015-04-05 14:10 - 02095616 _____ (Farbar) C:\Users\Winfried\Desktop\FRST64.exe

2015-04-04 14:20 - 2015-04-04 14:20 - 681778017 _____ () C:\WINDOWS\MEMORY.DMP

2015-04-04 14:20 - 2015-04-04 14:20 - 00289624 _____ () C:\WINDOWS\Minidump\040415-5984-01.dmp

2015-04-04 14:20 - 2015-04-04 14:20 - 00000000 ____D () C:\WINDOWS\Minidump

2015-04-04 13:59 - 2015-04-04 13:55 - 00043576 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avnetflt.sys

2015-04-04 12:28 - 2015-04-04 12:28 - 00001129 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2015-04-04 11:55 - 2015-04-04 11:55 - 00001164 _____ () C:\Users\Public\Desktop\Avira.lnk

2015-04-04 11:53 - 2015-04-04 11:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira

2015-04-04 11:53 - 2015-04-04 11:53 - 00000000 ____D () C:\Users\Winfried\AppData\Roaming\Avira

2015-04-04 11:52 - 2015-04-04 11:55 - 00000000 ____D () C:\ProgramData\Avira

2015-04-04 11:52 - 2015-04-04 11:55 - 00000000 ____D () C:\Program Files (x86)\Avira

2015-04-04 11:52 - 2015-03-17 13:01 - 00132120 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avipbb.sys

2015-04-04 11:52 - 2015-03-17 13:01 - 00128536 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avgntflt.sys

2015-04-04 11:52 - 2015-03-17 13:01 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avkmgr.sys

2015-04-04 11:45 - 2014-10-18 11:55 - 00055776 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe

2015-04-04 11:45 - 2014-10-18 10:09 - 00060416 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups.dll

2015-04-04 11:45 - 2014-10-18 10:09 - 00051712 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups2.dll

2015-04-04 11:45 - 2014-10-18 09:25 - 00025600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wups.dll

2015-04-04 11:45 - 2014-10-18 08:50 - 00017408 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaext.dll

2015-04-04 11:45 - 2014-10-18 08:38 - 03557376 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll

2015-04-04 11:45 - 2014-10-18 08:27 - 00035840 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapp.exe

2015-04-04 11:45 - 2014-10-18 08:26 - 00140288 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuwebv.dll

2015-04-04 11:45 - 2014-10-18 08:23 - 00407552 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUSettingsProvider.dll

2015-04-04 11:45 - 2014-10-18 08:23 - 00095744 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll

2015-04-04 11:45 - 2014-10-18 08:21 - 00894976 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll

2015-04-04 11:45 - 2014-10-18 08:20 - 01714176 _____ (Microsoft Corporation) C:\WINDOWS\system32\wucltux.dll

2015-04-04 11:45 - 2014-10-18 08:14 - 00124928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuwebv.dll

2015-04-04 11:45 - 2014-10-18 08:14 - 00029696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapp.exe

2015-04-04 11:45 - 2014-10-18 08:12 - 00081920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll

2015-04-04 11:45 - 2014-10-18 08:11 - 00723968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll

2015-04-04 11:32 - 2015-01-30 05:01 - 00097792 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hidbth.sys

2015-04-04 11:32 - 2015-01-30 05:00 - 00167424 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rfcomm.sys

2015-04-04 11:32 - 2014-10-29 04:46 - 00081920 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\BTHUSB.SYS

2015-04-04 11:32 - 2014-10-29 04:46 - 00053248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthenum.sys

2015-04-04 11:32 - 2014-10-29 04:45 - 01198080 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthport.sys

2015-04-04 11:32 - 2014-10-29 04:03 - 00241152 _____ (Microsoft Corporation) C:\WINDOWS\system32\fsquirt.exe

2015-04-04 11:22 - 2015-01-30 04:02 - 00102912 _____ (Microsoft Corporation) C:\WINDOWS\system32\eappgnui.dll

2015-04-04 11:22 - 2015-01-30 03:40 - 00091648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eappgnui.dll

2015-04-04 11:22 - 2015-01-30 03:37 - 00331776 _____ (Microsoft Corporation) C:\WINDOWS\system32\eapp3hst.dll

2015-04-04 11:22 - 2015-01-30 03:24 - 00339456 _____ (Microsoft Corporation) C:\WINDOWS\system32\eapphost.dll

2015-04-04 11:22 - 2015-01-30 03:24 - 00250880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eapp3hst.dll

2015-04-04 11:22 - 2015-01-30 03:16 - 00266752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eapphost.dll

2015-04-04 11:22 - 2015-01-30 03:08 - 00346112 _____ (Microsoft Corporation) C:\WINDOWS\system32\eappcfg.dll

2015-04-04 11:22 - 2015-01-30 03:06 - 00278016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eappcfg.dll

2015-04-04 11:22 - 2014-10-29 03:19 - 00070656 _____ (Microsoft Corporation) C:\WINDOWS\system32\eappprxy.dll

2015-04-04 11:22 - 2014-10-29 02:59 - 00056320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eappprxy.dll

2015-04-04 11:18 - 2015-04-04 11:18 - 02208768 _____ () C:\Users\Winfried\Downloads\adwcleaner_4.200.exe

2015-04-04 11:04 - 2015-04-04 11:44 - 165283560 _____ () C:\Users\Winfried\Downloads\avira_free_antivirus_de_15.0.9.504.exe

2015-04-04 09:52 - 2015-04-06 12:52 - 00001366 _____ () C:\WINDOWS\Tasks\disco_savings_notification_service.job

2015-04-04 09:52 - 2015-04-06 12:17 - 00001052 _____ () C:\WINDOWS\Tasks\oDweklayyunBXthwbuHX.job

2015-04-04 09:52 - 2015-04-04 09:53 - 00000000 ____D () C:\Program Files (x86)\disco savings

2015-04-04 09:52 - 2015-04-04 09:52 - 00004380 _____ () C:\WINDOWS\System32\Tasks\disco_savings_notification_service

2015-04-04 09:52 - 2015-04-04 09:52 - 00004076 _____ () C:\WINDOWS\System32\Tasks\oDweklayyunBXthwbuHX

2015-04-04 09:51 - 2015-04-04 12:13 - 00000000 ____D () C:\ProgramData\{47b36d71-bb6e-ffd8-47b3-36d71bb6b5c6}

2015-04-04 09:41 - 2015-04-04 09:41 - 00000004 _____ () C:\WINDOWS\SysWOW64\029B560A371F4E00AB32838EBC01B9E7

2015-04-03 21:45 - 2015-04-06 12:17 - 00001376 _____ () C:\WINDOWS\Tasks\AXDGX.job

2015-04-03 21:45 - 2015-04-06 12:17 - 00001372 _____ () C:\WINDOWS\Tasks\XLA.job

2015-04-03 21:45 - 2015-04-03 21:45 - 00004400 _____ () C:\WINDOWS\System32\Tasks\AXDGX

2015-04-03 21:45 - 2015-04-03 21:45 - 00004394 _____ () C:\WINDOWS\System32\Tasks\XLA

2015-04-03 15:33 - 2015-04-03 15:33 - 00000000 __SHD () C:\Users\Winfried\AppData\Local\EmieBrowserModeList

2015-04-03 15:15 - 2015-04-03 15:16 - 01203488 _____ () C:\Users\Winfried\Downloads\Free M4a to MP3 Converter - CHIP-Installer.exe

2015-03-31 10:14 - 2015-03-31 10:14 - 00004387 _____ () C:\Users\Winfried\AppData\Roaming\oDweklayyunBXthwbuHX

2015-03-26 21:14 - 2015-03-26 21:14 - 00005542 _____ () C:\Users\Winfried\AppData\Roaming\AXDGX

2015-03-26 21:14 - 2015-03-26 21:14 - 00004185 _____ () C:\Users\Winfried\AppData\Roaming\XLA

2015-03-24 10:54 - 2015-01-29 02:59 - 02773504 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll

2015-03-24 10:54 - 2015-01-29 02:49 - 02459136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll

2015-03-24 10:54 - 2015-01-28 04:24 - 00075264 _____ (Microsoft Corporation) C:\WINDOWS\system32\StorageContextHandler.dll

2015-03-24 10:54 - 2015-01-28 03:47 - 00060928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\StorageContextHandler.dll

2015-03-24 10:53 - 2015-02-04 01:58 - 00264000 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdFilter.sys

2015-03-24 10:53 - 2015-02-04 01:58 - 00114496 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdNisDrv.sys

2015-03-24 10:53 - 2015-02-04 01:58 - 00044024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdBoot.sys

2015-03-24 10:53 - 2015-02-03 02:03 - 03551744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DCompiler_47.dll

2015-03-24 10:53 - 2015-02-03 02:02 - 04298240 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_47.dll

2015-03-24 10:53 - 2015-02-03 01:53 - 00014848 _____ (Microsoft Corporation) C:\WINDOWS\system32\winshfhc.dll

2015-03-24 10:53 - 2015-02-03 01:53 - 00012800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winshfhc.dll

2015-03-24 10:53 - 2015-01-30 04:03 - 01488896 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfc42u.dll

2015-03-24 10:53 - 2015-01-30 04:03 - 01464832 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfc42.dll

2015-03-24 10:53 - 2015-01-30 03:44 - 01230336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfc42u.dll

2015-03-24 10:53 - 2015-01-30 03:42 - 01204224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfc42.dll

2015-03-24 10:53 - 2015-01-30 03:29 - 00035840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\atlthunk.dll

2015-03-24 10:53 - 2014-11-01 01:57 - 01091072 _____ (Microsoft Corporation) C:\WINDOWS\system32\MrmCoreR.dll

2015-03-24 10:53 - 2014-11-01 01:47 - 00790528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MrmCoreR.dll

2015-03-24 10:53 - 2014-10-29 03:28 - 00048128 _____ (Microsoft Corporation) C:\WINDOWS\system32\atlthunk.dll

2015-03-24 10:52 - 2015-01-31 01:42 - 03097600 _____ (Microsoft Corporation) C:\WINDOWS\system32\msftedit.dll

2015-03-24 10:52 - 2015-01-31 01:29 - 02484224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msftedit.dll

2015-03-24 10:52 - 2015-01-28 01:47 - 02501368 _____ (Microsoft Corporation) C:\WINDOWS\explorer.exe

2015-03-24 10:52 - 2015-01-28 01:41 - 02207488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe

2015-03-24 10:52 - 2014-12-11 07:36 - 00046456 _____ (Microsoft Corporation) C:\WINDOWS\system32\LockScreenContentServer.exe

2015-03-24 02:15 - 2015-02-20 05:03 - 00358912 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll

2015-03-24 02:15 - 2015-02-20 04:58 - 00044032 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll

2015-03-24 02:15 - 2015-02-20 04:20 - 00301056 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\atmfd.dll

2015-03-24 02:15 - 2015-02-20 04:15 - 00035840 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll

2015-03-24 02:15 - 2014-10-29 04:49 - 00003072 _____ (Microsoft Corporation) C:\WINDOWS\system32\lpk.dll

2015-03-24 02:15 - 2014-10-29 04:44 - 00096256 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontsub.dll

2015-03-24 02:15 - 2014-10-29 04:44 - 00014848 _____ (Microsoft Corporation) C:\WINDOWS\system32\dciman32.dll

2015-03-24 02:15 - 2014-10-29 04:04 - 00003072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\lpk.dll

2015-03-24 02:15 - 2014-10-29 04:00 - 00077824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontsub.dll

2015-03-24 02:15 - 2014-10-29 04:00 - 00011776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dciman32.dll

2015-03-24 02:13 - 2014-12-19 08:26 - 00140800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxdav.sys

2015-03-24 02:13 - 2014-12-12 04:04 - 00087040 _____ (Microsoft Corporation) C:\WINDOWS\system32\TSWbPrxy.exe

2015-03-24 02:13 - 2014-12-12 02:51 - 00075776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ahcache.sys

2015-03-24 02:13 - 2014-10-17 09:01 - 00789184 _____ (Microsoft Corporation) C:\WINDOWS\system32\oleaut32.dll

2015-03-24 02:13 - 2014-10-17 08:58 - 00602768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\oleaut32.dll

2015-03-24 02:13 - 2014-09-04 02:12 - 00590336 _____ (Microsoft Corporation) C:\WINDOWS\system32\rastls.dll

2015-03-24 02:13 - 2014-09-04 02:01 - 00514048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rastls.dll

2015-03-24 02:13 - 2014-08-23 07:18 - 02149376 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml3.dll

2015-03-24 02:13 - 2014-08-23 07:03 - 01346048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml3.dll

2015-03-24 02:13 - 2014-06-10 00:13 - 00035480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TsWpfWrp.exe

2015-03-24 02:13 - 2014-06-10 00:13 - 00035480 _____ (Microsoft Corporation) C:\WINDOWS\system32\TsWpfWrp.exe

2015-03-24 02:12 - 2015-01-28 17:41 - 07472960 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe

2015-03-24 02:12 - 2015-01-28 17:41 - 01733440 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll

2015-03-24 02:12 - 2015-01-28 17:41 - 01498360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll

2015-03-24 02:12 - 2014-10-29 04:02 - 00285184 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64.dll

2015-03-24 02:12 - 2014-10-29 04:02 - 00013312 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64cpu.dll

2015-03-24 02:12 - 2014-10-29 03:57 - 00016896 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntvdm64.dll

2015-03-24 02:12 - 2014-10-29 03:15 - 00014336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntvdm64.dll

2015-03-24 02:12 - 2014-10-29 03:15 - 00005632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wow32.dll

2015-03-24 02:12 - 2014-10-29 03:14 - 00004096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\user.exe

2015-03-24 02:12 - 2014-10-29 03:13 - 00025600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\setup16.exe

2015-03-24 02:12 - 2014-10-29 03:13 - 00008704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\instnm.exe

2015-03-24 02:12 - 2014-10-23 07:48 - 00081408 _____ (Microsoft Corporation) C:\WINDOWS\system32\packager.dll

2015-03-24 02:12 - 2014-10-23 07:05 - 00072192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\packager.dll

2015-03-24 02:12 - 2014-10-13 04:43 - 00238912 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdbus.sys

2015-03-24 02:12 - 2014-10-13 04:43 - 00153920 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dumpsd.sys

2015-03-24 02:12 - 2014-10-13 04:43 - 00086336 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pdc.sys

2015-03-24 02:12 - 2014-10-13 04:43 - 00039744 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\intelpep.sys

2015-03-24 02:12 - 2014-05-19 08:31 - 00057856 _____ (Microsoft Corporation) C:\WINDOWS\system32\drvcfg.exe

2015-03-24 02:12 - 2014-05-19 08:21 - 00110592 _____ (Microsoft Corporation) C:\WINDOWS\system32\drvinst.exe

2015-03-24 02:12 - 2014-05-19 07:23 - 00098816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\drvinst.exe

2015-03-24 02:11 - 2015-01-31 01:20 - 00203264 _____ (Microsoft Corporation) C:\WINDOWS\system32\ubpm.dll

2015-03-24 02:11 - 2015-01-27 06:22 - 00131584 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll

2015-03-24 02:11 - 2015-01-27 04:11 - 03547648 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll

2015-03-24 02:11 - 2014-12-06 05:17 - 00360448 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncsi.dll

2015-03-24 02:11 - 2014-12-06 03:41 - 00391680 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlasvc.dll

2015-03-24 02:11 - 2014-10-29 05:56 - 00027456 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rdpvideominiport.sys

2015-03-24 02:11 - 2014-10-29 04:37 - 00040448 _____ (Microsoft Corporation) C:\WINDOWS\system32\rfxvmt.dll

2015-03-24 02:11 - 2014-10-29 03:24 - 00086016 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlaapi.dll

2015-03-24 02:11 - 2014-10-29 03:01 - 00065536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nlaapi.dll

2015-03-24 02:09 - 2015-03-24 02:09 - 00000000 ____D () C:\Users\Winfried\AppData\Roaming\Nitro

2015-03-24 02:07 - 2015-04-06 12:17 - 00136408 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys

2015-03-24 02:07 - 2015-04-04 12:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2015-03-24 02:07 - 2015-04-04 12:28 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2015-03-24 02:07 - 2015-03-24 02:07 - 00000000 ____D () C:\ProgramData\Malwarebytes

2015-03-24 02:07 - 2015-03-17 06:15 - 00107736 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys

2015-03-24 02:07 - 2015-03-17 06:15 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys

2015-03-24 02:07 - 2015-03-17 06:15 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys

2015-03-24 01:58 - 2015-03-24 01:58 - 00000000 ____D () C:\Users\Public\Pokki

2015-03-24 01:55 - 2015-04-05 18:58 - 00000000 ____D () C:\AdwCleaner

2015-03-24 01:54 - 2015-03-24 01:55 - 01203488 _____ () C:\Users\Winfried\Downloads\Malwarebytes Anti Malware Malware Scanner - CHIP-Installer.exe

2015-03-24 01:52 - 2014-10-31 00:37 - 00129536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\poqexec.exe

2015-03-24 01:52 - 2014-10-31 00:34 - 00146432 _____ (Microsoft Corporation) C:\WINDOWS\system32\poqexec.exe

2015-03-24 01:50 - 2015-01-29 20:45 - 01763352 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecs.dll

2015-03-24 01:50 - 2015-01-29 20:34 - 01488040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WindowsCodecs.dll

2015-03-24 01:49 - 2015-02-12 19:40 - 22291584 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll

2015-03-24 01:49 - 2015-02-12 19:34 - 19731824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll

2015-03-24 01:47 - 2015-01-28 03:31 - 00402432 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMPhoto.dll

2015-03-24 01:47 - 2015-01-28 03:11 - 00357376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WMPhoto.dll

2015-03-24 01:47 - 2014-12-08 21:42 - 00535640 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll

2015-03-24 01:47 - 2014-12-08 21:42 - 00531616 _____ (Microsoft Corporation) C:\WINDOWS\system32\ci.dll

2015-03-24 01:47 - 2014-12-08 21:42 - 00448792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wer.dll

2015-03-24 01:47 - 2014-12-08 21:42 - 00413248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Faultrep.dll

2015-03-24 01:47 - 2014-12-08 21:42 - 00372408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Faultrep.dll

2015-03-24 01:47 - 2014-12-08 21:42 - 00108944 _____ (Microsoft Corporation) C:\WINDOWS\system32\EncDump.dll

2015-03-24 01:47 - 2014-12-08 21:42 - 00038264 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFaultSecure.exe

2015-03-24 01:47 - 2014-12-08 21:42 - 00033584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFaultSecure.exe

2015-03-24 01:47 - 2014-12-06 03:35 - 00229888 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll

2015-03-24 01:47 - 2014-11-10 01:19 - 00991232 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll

2015-03-24 01:47 - 2014-11-10 01:19 - 00806400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll

2015-03-24 01:47 - 2014-11-10 01:18 - 00259584 _____ (Microsoft Corporation) C:\WINDOWS\system32\pku2u.dll

2015-03-24 01:47 - 2014-11-10 01:18 - 00208896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\pku2u.dll

2015-03-24 01:47 - 2014-10-29 06:00 - 00465320 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFault.exe

2015-03-24 01:47 - 2014-10-29 06:00 - 00139984 _____ (Microsoft Corporation) C:\WINDOWS\system32\wermgr.exe

2015-03-24 01:47 - 2014-10-29 05:52 - 00500016 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll

2015-03-24 01:47 - 2014-10-29 05:52 - 00482872 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll

2015-03-24 01:47 - 2014-10-29 05:52 - 00394120 _____ (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll

2015-03-24 01:47 - 2014-10-29 05:52 - 00272248 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiodg.exe

2015-03-24 01:47 - 2014-10-29 05:12 - 00413136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFault.exe

2015-03-24 01:47 - 2014-10-29 05:12 - 00136296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wermgr.exe

2015-03-24 01:47 - 2014-10-29 05:07 - 00424544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioEng.dll

2015-03-24 01:47 - 2014-10-29 05:07 - 00370424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll

2015-03-24 01:47 - 2014-10-29 05:07 - 00344536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AUDIOKSE.dll

2015-03-24 01:47 - 2014-10-29 04:44 - 00037888 _____ (Microsoft Corporation) C:\WINDOWS\system32\werdiagcontroller.dll

2015-03-24 01:47 - 2014-10-29 03:59 - 00033280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\werdiagcontroller.dll

2015-03-24 01:47 - 2014-10-29 03:02 - 00911360 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll

2015-03-24 01:47 - 2014-09-10 08:25 - 00474432 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\netio.sys

2015-03-24 01:47 - 2014-09-08 05:07 - 02497344 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys

2015-03-24 01:47 - 2014-09-08 05:07 - 00428864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\FWPKCLNT.SYS

2015-03-24 01:47 - 2014-09-08 00:08 - 00389176 _____ () C:\WINDOWS\system32\ApnDatabase.xml

2015-03-24 01:47 - 2014-09-05 00:30 - 00822272 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32spl.dll

2015-03-24 01:47 - 2014-09-05 00:21 - 01053184 _____ (Microsoft Corporation) C:\WINDOWS\system32\localspl.dll

2015-03-24 01:47 - 2014-09-04 05:05 - 00836176 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmp4srcsnk.dll

2015-03-24 01:47 - 2014-09-04 04:22 - 00670384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll

2015-03-24 01:47 - 2014-09-04 03:01 - 00448512 _____ (Microsoft Corporation) C:\WINDOWS\system32\puiobj.dll

2015-03-24 01:47 - 2014-09-04 02:32 - 00334336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\puiobj.dll

2015-03-24 01:47 - 2014-09-04 02:10 - 00118272 _____ (Microsoft Corporation) C:\WINDOWS\system32\winbici.dll

2015-03-24 01:47 - 2014-08-31 02:17 - 00148800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBSTOR.SYS

2015-03-24 01:47 - 2014-08-31 00:05 - 00615424 _____ (Microsoft Corporation) C:\WINDOWS\system32\FXSCOMEX.dll

2015-03-24 01:47 - 2014-08-30 23:58 - 00275968 _____ (Microsoft Corporation) C:\WINDOWS\system32\FXSAPI.dll

2015-03-24 01:47 - 2014-08-30 23:04 - 00941568 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll

2015-03-24 01:47 - 2014-08-30 22:53 - 00239104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FXSAPI.dll

2015-03-24 01:47 - 2014-08-30 22:17 - 00799744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll

2015-03-24 01:47 - 2014-08-28 02:21 - 02480128 _____ (Microsoft Corporation) C:\WINDOWS\system32\WsmSvc.dll

2015-03-24 01:47 - 2014-08-28 02:06 - 02030592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WsmSvc.dll

2015-03-24 01:47 - 2014-08-23 07:14 - 13424128 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll

2015-03-24 01:47 - 2014-08-23 07:04 - 11820544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll

2015-03-24 01:47 - 2014-08-23 06:50 - 02714112 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers.dll

2015-03-24 01:47 - 2014-08-02 02:51 - 00545792 _____ (Microsoft Corporation) C:\WINDOWS\system32\untfs.dll

2015-03-24 01:47 - 2014-08-02 02:35 - 00485376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\untfs.dll

2015-03-24 01:44 - 2015-01-21 07:54 - 01384712 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctf.dll

2015-03-24 01:44 - 2015-01-21 07:15 - 01123848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctf.dll

2015-03-24 01:44 - 2014-07-24 05:20 - 00875688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvcr120_clr0400.dll

2015-03-24 01:44 - 2014-07-24 05:20 - 00869544 _____ (Microsoft Corporation) C:\WINDOWS\system32\msvcr120_clr0400.dll

2015-03-24 01:37 - 2015-03-24 01:38 - 00000000 ____D () C:\Users\Public\CyberLink

2015-03-24 01:37 - 2015-03-24 01:37 - 00000000 ____D () C:\Users\Winfried\Documents\CyberLink

2015-03-24 01:36 - 2015-03-24 01:36 - 00000000 ____D () C:\Users\Winfried\AppData\Roaming\CyberLink

2015-03-24 01:25 - 2015-04-04 09:52 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2015-03-24 01:25 - 2015-04-04 09:45 - 00001186 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

2015-03-24 01:25 - 2015-04-04 09:45 - 00001174 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk

2015-03-24 01:25 - 2015-03-24 01:25 - 00000000 ____D () C:\Users\Winfried\AppData\Roaming\Mozilla

2015-03-24 01:25 - 2015-03-24 01:25 - 00000000 ____D () C:\Users\Winfried\AppData\Local\Mozilla

2015-03-24 01:25 - 2015-03-24 01:25 - 00000000 ____D () C:\ProgramData\Mozilla

2015-03-24 01:25 - 2015-03-24 01:25 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

2015-03-24 01:22 - 2015-03-24 01:22 - 00000000 ____D () C:\Users\Winfried\AppData\Local\CyberLink

2015-03-24 01:02 - 2015-03-24 01:02 - 00000000 ____H () C:\WINDOWS\system32\Drivers\Msft_User_LocationProvider_01_11_00.Wdf

2015-03-23 20:00 - 2015-03-23 20:00 - 00000000 ____D () C:\Users\Winfried\AppData\Local\Macromedia

2015-03-23 19:54 - 2015-04-06 12:18 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job

2015-03-23 19:54 - 2015-03-23 19:54 - 00003772 _____ () C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater

2015-03-23 19:51 - 2015-03-23 19:58 - 00000000 ____D () C:\Users\Winfried\AppData\Local\Adobe

2015-03-23 19:39 - 2015-02-21 03:16 - 25021440 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll

2015-03-23 19:39 - 2015-02-21 02:41 - 12827648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll

2015-03-23 19:39 - 2015-02-21 02:27 - 00285696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll

2015-03-23 19:39 - 2015-02-21 02:27 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll

2015-03-23 19:39 - 2015-02-21 02:25 - 19720192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll

2015-03-23 19:39 - 2015-02-21 01:58 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll

2015-03-23 19:39 - 2015-02-21 01:32 - 00076288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll

2015-03-23 19:39 - 2015-02-20 04:49 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll

2015-03-23 19:39 - 2015-02-20 04:48 - 02886144 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll

2015-03-23 19:39 - 2015-02-20 04:47 - 00088064 _____ (Microsoft Corporation) C:\WINDOWS\system32\MshtmlDac.dll

2015-03-23 19:39 - 2015-02-20 04:35 - 00816128 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll

2015-03-23 19:39 - 2015-02-20 04:34 - 00814080 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll

2015-03-23 19:39 - 2015-02-20 04:32 - 06035456 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll

2015-03-23 19:39 - 2015-02-20 04:09 - 00503296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll

2015-03-23 19:39 - 2015-02-20 04:07 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll

2015-03-23 19:39 - 2015-02-20 04:06 - 00064000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MshtmlDac.dll

2015-03-23 19:39 - 2015-02-20 04:05 - 00316928 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll

2015-03-23 19:39 - 2015-02-20 04:03 - 02278400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll

2015-03-23 19:39 - 2015-02-20 03:59 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll

2015-03-23 19:39 - 2015-02-20 03:56 - 00664064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll

2015-03-23 19:39 - 2015-02-20 03:52 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll

2015-03-23 19:39 - 2015-02-20 03:49 - 00801280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll

2015-03-23 19:39 - 2015-02-20 03:49 - 00374272 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll

2015-03-23 19:39 - 2015-02-20 03:46 - 02125824 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl

2015-03-23 19:39 - 2015-02-20 03:43 - 14398976 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll

2015-03-23 19:39 - 2015-02-20 03:30 - 04300288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll

2015-03-23 19:39 - 2015-02-20 03:30 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll

2015-03-23 19:39 - 2015-02-20 03:29 - 02865152 _____ (Microsoft Corporation) C:\WINDOWS\system32\actxprxy.dll

2015-03-23 19:39 - 2015-02-20 03:28 - 02358784 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll

2015-03-23 19:39 - 2015-02-20 03:26 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll

2015-03-23 19:39 - 2015-02-20 03:24 - 02052608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl

2015-03-23 19:39 - 2015-02-20 03:24 - 00689152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll

2015-03-23 19:39 - 2015-02-20 03:16 - 01548288 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll

2015-03-23 19:39 - 2015-02-20 03:03 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll

2015-03-23 19:39 - 2015-02-20 03:01 - 01888256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll

2015-03-23 19:39 - 2015-02-20 02:57 - 01311232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll

2015-03-23 19:39 - 2015-02-20 02:55 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll

2015-03-23 19:39 - 2015-01-12 04:21 - 00490496 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtmsft.dll

2015-03-23 19:39 - 2015-01-12 03:48 - 00718848 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe

2015-03-23 19:39 - 2015-01-12 03:45 - 00418304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtmsft.dll

2015-03-23 19:39 - 2015-01-12 03:23 - 00327168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll

2015-03-23 19:39 - 2014-11-22 04:49 - 00417280 _____ (Microsoft Corporation) C:\WINDOWS\system32\html.iec

2015-03-23 19:39 - 2014-11-22 04:06 - 00340992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\html.iec

2015-03-23 19:39 - 2014-10-31 07:12 - 00143872 _____ (Microsoft Corporation) C:\WINDOWS\system32\wextract.exe

2015-03-23 19:39 - 2014-10-31 07:12 - 00013824 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshta.exe

2015-03-23 19:39 - 2014-10-31 07:10 - 00167424 _____ (Microsoft Corporation) C:\WINDOWS\system32\iexpress.exe

2015-03-23 19:39 - 2014-10-31 07:09 - 00064512 _____ (Microsoft Corporation) C:\WINDOWS\system32\pngfilt.dll

2015-03-23 19:39 - 2014-10-31 07:08 - 00012800 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeedssync.exe

2015-03-23 19:39 - 2014-10-31 07:06 - 00237568 _____ (Microsoft Corporation) C:\WINDOWS\system32\url.dll

2015-03-23 19:39 - 2014-10-31 07:06 - 00066560 _____ (Microsoft Corporation) C:\WINDOWS\system32\iesetup.dll

2015-03-23 19:39 - 2014-10-31 07:06 - 00048640 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieetwproxystub.dll

2015-03-23 19:39 - 2014-10-31 06:57 - 00054784 _____ (Microsoft Corporation) C:\WINDOWS\system32\jsproxy.dll

2015-03-23 19:39 - 2014-10-31 06:56 - 00034304 _____ (Microsoft Corporation) C:\WINDOWS\system32\iernonce.dll

2015-03-23 19:39 - 2014-10-31 06:54 - 00132096 _____ (Microsoft Corporation) C:\WINDOWS\system32\IEAdvpack.dll

2015-03-23 19:39 - 2014-10-31 06:53 - 00633856 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieui.dll

2015-03-23 19:39 - 2014-10-31 06:52 - 00108544 _____ (Microsoft Corporation) C:\WINDOWS\system32\hlink.dll

2015-03-23 19:39 - 2014-10-31 06:51 - 00144384 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieUnatt.exe

2015-03-23 19:39 - 2014-10-31 06:51 - 00114688 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieetwcollector.exe

2015-03-23 19:39 - 2014-10-31 06:40 - 00033280 _____ (Microsoft Corporation) C:\WINDOWS\system32\licmgr10.dll

2015-03-23 19:39 - 2014-10-31 06:30 - 00077824 _____ (Microsoft Corporation) C:\WINDOWS\system32\JavaScriptCollectionAgent.dll

2015-03-23 19:39 - 2014-10-31 06:29 - 00111616 _____ (Microsoft Corporation) C:\WINDOWS\system32\iesysprep.dll

2015-03-23 19:39 - 2014-10-31 06:29 - 00087552 _____ (Microsoft Corporation) C:\WINDOWS\system32\tdc.ocx

2015-03-23 19:39 - 2014-10-31 06:28 - 00107520 _____ (Microsoft Corporation) C:\WINDOWS\system32\inseng.dll

2015-03-23 19:39 - 2014-10-31 06:25 - 00199680 _____ (Microsoft Corporation) C:\WINDOWS\system32\msrating.dll

2015-03-23 19:39 - 2014-10-31 06:24 - 00060416 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeedsbs.dll

2015-03-23 19:39 - 2014-10-31 06:19 - 00152064 _____ (Microsoft Corporation) C:\WINDOWS\system32\occache.dll

2015-03-23 19:39 - 2014-10-31 05:42 - 00051200 _____ (Microsoft Corporation) C:\WINDOWS\system32\imgutil.dll

2015-03-23 19:39 - 2014-10-31 05:28 - 00137728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wextract.exe

2015-03-23 19:39 - 2014-10-31 05:28 - 00012800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshta.exe

2015-03-23 19:39 - 2014-10-31 05:27 - 00152064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iexpress.exe

2015-03-23 19:39 - 2014-10-31 05:26 - 00057344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\pngfilt.dll

2015-03-23 19:39 - 2014-10-31 05:25 - 00011264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeedssync.exe

2015-03-23 19:39 - 2014-10-31 05:24 - 00235520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\url.dll

2015-03-23 19:39 - 2014-10-31 05:24 - 00062464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iesetup.dll

2015-03-23 19:39 - 2014-10-31 05:23 - 00047616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieetwproxystub.dll

2015-03-23 19:39 - 2014-10-31 05:16 - 00047104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jsproxy.dll

2015-03-23 19:39 - 2014-10-31 05:15 - 00030720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iernonce.dll

2015-03-23 19:39 - 2014-10-31 05:14 - 00112128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\IEAdvpack.dll

2015-03-23 19:39 - 2014-10-31 05:13 - 00478208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieui.dll

2015-03-23 19:39 - 2014-10-31 05:13 - 00099328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\hlink.dll

2015-03-23 19:39 - 2014-10-31 05:12 - 00115712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieUnatt.exe

2015-03-23 19:39 - 2014-10-31 05:11 - 00620032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9diag.dll

2015-03-23 19:39 - 2014-10-31 05:03 - 00027136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\licmgr10.dll

2015-03-23 19:39 - 2014-10-31 04:57 - 00060416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\JavaScriptCollectionAgent.dll

2015-03-23 19:39 - 2014-10-31 04:56 - 00091136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inseng.dll

2015-03-23 19:39 - 2014-10-31 04:56 - 00090624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iesysprep.dll

2015-03-23 19:39 - 2014-10-31 04:56 - 00073216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tdc.ocx

2015-03-23 19:39 - 2014-10-31 04:53 - 00168960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msrating.dll

2015-03-23 19:39 - 2014-10-31 04:53 - 00052736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeedsbs.dll

2015-03-23 19:39 - 2014-10-31 04:48 - 00130048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\occache.dll

2015-03-23 19:39 - 2014-10-31 04:26 - 01042944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\actxprxy.dll

2015-03-23 19:39 - 2014-10-31 04:24 - 00040448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\imgutil.dll

2015-03-23 19:13 - 2015-03-06 04:53 - 00430080 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll

2015-03-23 19:13 - 2015-03-06 04:33 - 00358912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll

2015-03-23 19:13 - 2015-02-26 01:26 - 04178944 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys

2015-03-23 19:13 - 2015-01-16 00:43 - 00563504 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys

2015-03-23 19:13 - 2015-01-16 00:43 - 00177984 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys

2015-03-23 19:13 - 2015-01-14 06:22 - 00445440 _____ (Microsoft Corporation) C:\WINDOWS\system32\certcli.dll

2015-03-23 19:13 - 2015-01-14 05:53 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certcli.dll

2015-03-23 19:13 - 2014-12-09 03:50 - 00225280 _____ (Microsoft Corporation) C:\WINDOWS\system32\profsvc.dll

2015-03-23 19:13 - 2014-10-29 04:51 - 00154112 _____ (Microsoft Corporation) C:\WINDOWS\system32\msaudite.dll

2015-03-23 19:13 - 2014-10-29 04:50 - 00736768 _____ (Microsoft Corporation) C:\WINDOWS\system32\adtschema.dll

2015-03-23 19:13 - 2014-10-29 04:06 - 00736768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\adtschema.dll

2015-03-23 19:13 - 2014-10-29 04:06 - 00154112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msaudite.dll

2015-03-23 19:13 - 2014-10-29 03:31 - 01441792 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll

2015-03-23 19:12 - 2014-12-09 05:45 - 00393728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\scesrv.dll

2015-03-23 19:12 - 2014-12-09 03:56 - 00538624 _____ (Microsoft Corporation) C:\WINDOWS\system32\scesrv.dll

2015-03-23 19:12 - 2014-09-27 09:13 - 00104336 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncryptsslp.dll

2015-03-23 19:12 - 2014-09-27 07:24 - 00088800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ncryptsslp.dll

2015-03-23 19:12 - 2014-09-27 05:30 - 00185856 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpapisrv.dll

2015-03-21 23:00 - 2015-03-24 10:46 - 00000000 ____D () C:\Users\Winfried\AppData\Local\Lenovo

2015-03-21 22:56 - 2015-04-06 12:35 - 00003600 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1872664996-1993104736-2441894966-1001

2015-03-21 22:55 - 2015-04-06 12:20 - 00003962 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{083CACEA-2800-4375-A9CE-E755E8D02B7A}

2015-03-21 22:55 - 2015-03-21 22:55 - 00000000 __SHD () C:\Users\Winfried\AppData\Local\EmieUserList

2015-03-21 22:55 - 2015-03-21 22:55 - 00000000 __SHD () C:\Users\Winfried\AppData\Local\EmieSiteList

2015-03-21 22:55 - 2015-03-21 22:55 - 00000000 ____D () C:\ProgramData\OneKey Optimizer

2015-03-21 22:52 - 2015-04-06 13:06 - 01631204 _____ () C:\Users\Public\Documents\TestPicksStart.txt

2015-03-21 22:52 - 2015-04-06 12:17 - 00002262 _____ () C:\Users\Winfried\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Harmony Picks Introduction.lnk

2015-03-21 22:52 - 2015-04-06 12:17 - 00001366 _____ () C:\Users\Winfried\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Harmony Settings Introduction.lnk

2015-03-21 22:52 - 2015-04-06 12:17 - 00000000 ____D () C:\Users\Winfried\OneDrive

2015-03-21 22:52 - 2015-03-21 22:52 - 00000000 ____D () C:\Users\Winfried\AppData\Roaming\Macromedia

2015-03-21 22:52 - 2015-03-21 22:52 - 00000000 ____D () C:\Users\Winfried\AppData\Roaming\Intel Corporation

2015-03-21 22:51 - 2015-04-04 09:45 - 00001465 _____ () C:\Users\Winfried\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

2015-03-21 22:51 - 2015-03-23 20:17 - 00000000 ____D () C:\Users\Winfried\AppData\Local\Packages

2015-03-21 22:51 - 2015-03-21 22:51 - 00000118 _____ () C:\WINDOWS\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat

2015-03-21 22:51 - 2015-03-21 22:51 - 00000020 ___SH () C:\Users\Winfried\ntuser.ini

2015-03-21 22:51 - 2015-03-21 22:51 - 00000000 _SHDL () C:\Users\Winfried\Vorlagen

2015-03-21 22:51 - 2015-03-21 22:51 - 00000000 _SHDL () C:\Users\Winfried\Startmenü

2015-03-21 22:51 - 2015-03-21 22:51 - 00000000 _SHDL () C:\Users\Winfried\Netzwerkumgebung

2015-03-21 22:51 - 2015-03-21 22:51 - 00000000 _SHDL () C:\Users\Winfried\Lokale Einstellungen

2015-03-21 22:51 - 2015-03-21 22:51 - 00000000 _SHDL () C:\Users\Winfried\Eigene Dateien

2015-03-21 22:51 - 2015-03-21 22:51 - 00000000 _SHDL () C:\Users\Winfried\Druckumgebung

2015-03-21 22:51 - 2015-03-21 22:51 - 00000000 _SHDL () C:\Users\Winfried\Documents\Eigene Musik

2015-03-21 22:51 - 2015-03-21 22:51 - 00000000 _SHDL () C:\Users\Winfried\Documents\Eigene Bilder

2015-03-21 22:51 - 2015-03-21 22:51 - 00000000 _SHDL () C:\Users\Winfried\AppData\Roaming\Microsoft\Windows\Start Menu\Programme

2015-03-21 22:51 - 2015-03-21 22:51 - 00000000 _SHDL () C:\Users\Winfried\AppData\Local\Verlauf

2015-03-21 22:51 - 2015-03-21 22:51 - 00000000 _SHDL () C:\Users\Winfried\AppData\Local\Anwendungsdaten

2015-03-21 22:51 - 2015-03-21 22:51 - 00000000 _SHDL () C:\Users\Winfried\Anwendungsdaten

2015-03-21 22:51 - 2015-03-21 22:51 - 00000000 ____D () C:\WINDOWS\System32\Tasks\WPD

2015-03-21 22:51 - 2015-03-21 22:51 - 00000000 ____D () C:\Users\Winfried\AppData\Roaming\Intel

2015-03-21 22:51 - 2015-03-21 22:51 - 00000000 ____D () C:\Users\Winfried\AppData\Roaming\Adobe

2015-03-21 22:51 - 2015-03-21 22:51 - 00000000 ____D () C:\Users\Winfried\AppData\Local\VirtualStore

2015-03-21 22:50 - 2015-04-04 16:33 - 00000000 ____D () C:\Users\Winfried

2015-03-21 22:50 - 2015-02-26 19:05 - 00000000 ___RD () C:\Users\Winfried\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility

2015-03-21 22:50 - 2014-08-23 23:39 - 00000000 ___RD () C:\Users\Winfried\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools

2015-03-21 22:50 - 2014-03-18 11:55 - 00000369 _____ () C:\Users\Winfried\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pictures.lnk

2015-03-21 22:50 - 2014-03-18 11:55 - 00000369 _____ () C:\Users\Winfried\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Documents.lnk

2015-03-21 22:50 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Winfried\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories

2015-03-21 22:50 - 2013-08-22 17:36 - 00000000 ____D () C:\Users\Winfried\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Public\Documents\Eigene Musik

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Public\Documents\Eigene Bilder

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default\Vorlagen

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default\Startmenü

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default\Netzwerkumgebung

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default\Lokale Einstellungen

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default\Eigene Dateien

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default\Druckumgebung

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default\Documents\Eigene Musik

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default\Documents\Eigene Bilder

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programme

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default\AppData\Local\Verlauf

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default\AppData\Local\Anwendungsdaten

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default\Anwendungsdaten

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default User\Documents\Eigene Musik

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default User\Documents\Eigene Bilder

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programme

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default User\AppData\Local\Verlauf

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default User\AppData\Local\Anwendungsdaten

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Programme

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\ProgramData\Vorlagen

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\ProgramData\Startmenü

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\ProgramData\Microsoft\Windows\Start Menu\Programme

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\ProgramData\Dokumente

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\ProgramData\Anwendungsdaten

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Program Files\Gemeinsame Dateien

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Dokumente und Einstellungen
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2015-04-06 13:00 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\sru

2015-04-06 12:58 - 2013-08-22 17:20 - 00000000 ____D () C:\WINDOWS\CbsTemp

2015-04-06 12:38 - 2015-02-26 18:58 - 01385618 _____ () C:\WINDOWS\WindowsUpdate.log

2015-04-06 12:17 - 2015-02-26 19:17 - 00011724 _____ () C:\WINDOWS\SysWOW64\Gms.log

2015-04-05 19:35 - 2015-02-26 19:11 - 00456940 _____ () C:\Users\Public\CAFADEBUG.log

2015-04-05 19:12 - 2015-02-26 19:01 - 00000868 _____ () C:\WINDOWS\lupdate.log

2015-04-05 19:05 - 2015-02-27 03:53 - 00768056 _____ () C:\WINDOWS\system32\perfh007.dat

2015-04-05 19:05 - 2015-02-27 03:53 - 00160322 _____ () C:\WINDOWS\system32\perfc007.dat

2015-04-05 19:05 - 2014-03-18 11:53 - 01780340 _____ () C:\WINDOWS\system32\PerfStringBackup.INI

2015-04-05 18:58 - 2015-02-26 19:34 - 00002560 _____ () C:\WINDOWS\system32\VfService.trf

2015-04-05 18:58 - 2015-02-26 18:56 - 00153336 _____ () C:\WINDOWS\system32\wpbbin.exe

2015-04-05 18:58 - 2015-02-26 18:56 - 00111088 _____ (Lenovo (Beijing) Limited) C:\WINDOWS\system32\LenovoCheck.exe

2015-04-05 18:58 - 2015-02-26 18:56 - 00026608 _____ (Lenovo) C:\WINDOWS\system32\LenovoUpdate.exe

2015-04-05 18:58 - 2013-08-22 16:46 - 00026555 _____ () C:\WINDOWS\setupact.log

2015-04-05 18:58 - 2013-08-22 16:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT

2015-04-05 18:58 - 2013-08-22 15:25 - 00262144 ___SH () C:\WINDOWS\system32\config\BBI

2015-04-04 14:20 - 2014-03-18 11:44 - 00282522 _____ () C:\WINDOWS\PFRO.log

2015-04-04 14:01 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\AppReadiness

2015-04-04 13:50 - 2013-08-22 17:36 - 00000000 ___RD () C:\WINDOWS\ImmersiveControlPanel

2015-04-04 12:01 - 2015-02-26 19:10 - 00003718 _____ () C:\WINDOWS\System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473

2015-04-04 11:54 - 2015-02-26 19:35 - 00000000 ____D () C:\ProgramData\McAfee

2015-04-04 11:54 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools

2015-04-04 11:54 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools

2015-04-04 11:54 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files\Windows Defender

2015-04-04 11:54 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files (x86)\Windows Defender

2015-04-04 11:53 - 2015-02-26 19:06 - 00000000 ____D () C:\ProgramData\Package Cache

2015-04-04 11:51 - 2013-08-22 17:36 - 00000000 ___HD () C:\WINDOWS\ELAMBKUP

2015-04-04 11:39 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files\Common Files\microsoft shared

2015-04-04 11:38 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\rescache

2015-04-04 11:00 - 2013-08-22 17:43 - 00000000 ____D () C:\WINDOWS\DigitalLocker

2015-04-03 14:55 - 2013-08-22 15:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM

2015-03-24 02:09 - 2015-02-26 19:34 - 00000000 ____D () C:\WINDOWS\System32\Tasks\Lenovo

2015-03-24 01:22 - 2015-02-26 19:39 - 00000000 ____D () C:\ProgramData\CyberLink

2015-03-23 20:58 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\PolicyDefinitions

2015-03-23 20:57 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\sr-Latn-RS

2015-03-23 20:57 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\sr-Latn-CS

2015-03-23 19:41 - 2013-08-22 16:44 - 00346960 _____ () C:\WINDOWS\system32\FNTCACHE.DAT

2015-03-23 19:40 - 2013-08-22 17:36 - 00000000 ___RD () C:\WINDOWS\ToastData

2015-03-23 19:40 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\MediaViewer

2015-03-23 19:40 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\FileManager

2015-03-23 19:40 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\Camera

2015-03-23 19:17 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\Help

2015-03-21 23:09 - 2015-02-26 19:18 - 00000000 ____D () C:\ProgramData\Lenovo

2015-03-21 22:58 - 2015-02-26 19:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lenovo

2015-03-21 22:58 - 2015-02-26 19:23 - 00000000 ____D () C:\Program Files (x86)\Lenovo

2015-03-21 22:56 - 2015-02-26 19:08 - 00000000 ____D () C:\ProgramData\Intel

2015-03-21 22:52 - 2015-02-26 19:36 - 00000000 ____D () C:\Users\Public\Documents\Lenovo

2015-03-21 22:51 - 2015-02-27 04:47 - 00149785 ____H () C:\WINDOWS\modules.log

2015-03-21 22:51 - 2014-04-03 21:15 - 00000000 ____D () C:\WINDOWS\Panther

2015-03-20 07:01 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files\Windows NT

2015-03-20 07:01 - 2013-08-22 15:36 - 00000000 ___HD () C:\Users\Default
 

==================== Files in the root of some directories =======
 

2015-03-26 21:14 - 2015-03-26 21:14 - 0005542 _____ () C:\Users\Winfried\AppData\Roaming\AXDGX

2015-03-31 10:14 - 2015-03-31 10:14 - 0004387 _____ () C:\Users\Winfried\AppData\Roaming\oDweklayyunBXthwbuHX

2015-03-26 21:14 - 2015-03-26 21:14 - 0004185 _____ () C:\Users\Winfried\AppData\Roaming\XLA
 

Some content of TEMP:

====================

C:\Users\Winfried\AppData\Local\Temp\avgnt.exe

C:\Users\Winfried\AppData\Local\Temp\mccspuninstall.exe

C:\Users\Winfried\AppData\Local\Temp\Quarantine.exe

C:\Users\Winfried\AppData\Local\Temp\sqlite3.dll
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-08-23 23:30
 

==================== End Of Log ============================

--- --- ---

--- --- ---

Probleme?

Es werden weiterhin ungefragt irgendwelche kleinen Popup-Fenster geöffnet. Manchmal öffnet sich ein komplettes Browserfenster oder der Browser geht sogar aus, wenn man ein Werbefenster schließt.

MBAM liefert ständig eine Warnung, das eine Website blockiert wurde.

Revo Uninstaller - Download - Filepony
damit Firefox deinstallieren, keine Daten behalten, Reste entfernen lassen, neu installieren.

Dann:
https://support.mozilla.org/de/kb/fi...einfach-loesen

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

C:\Users\Winfried\AppData\Local\Microsoft\Windows\INetCache\IE\HT0OSLKQ\Reimage[1].exe
 

C:\Users\Winfried\AppData\Local\Microsoft\Windows\INetCache\IE\T7J7BXCZ\91[1].js
 

C:\Users\Winfried\AppData\Local\Temp\DMR\dmr_72.exe
 

C:\Users\Winfried\AppData\Local\Temp\DMR\Downloads\fc14996dfa99adfc7baae624196888c5\5b06e73c66b13128cd03586177ce6642\m4a-to-mp3-83converter.exe
 

C:\Users\Winfried\AppData\Roaming\AXDGX
 

C:\Users\Winfried\AppData\Roaming\oDweklayyunBXthwbuHX
 

C:\Users\Winfried\AppData\Roaming\XLA
 

C:\Users\Winfried\Downloads\Free M4a to MP3 Converter - CHIP-Installer.exe
 

C:\Users\Winfried\Downloads\Malwarebytes Anti Malware Malware Scanner - CHIP-Installer.exe

Task: {10635313-837A-4988-8E43-C5C1F66D3101} - System32\Tasks\AXDGX => C:\Users\Winfried\AppData\Roaming\AXDGX.exe <==== ATTENTION
 

Task: {109FF231-DBF9-4736-BDC2-A51BD10357FC} - System32\Tasks\XLA => C:\Users\Winfried\AppData\Roaming\XLA.exe <==== ATTENTION
 

Task: {82351605-5B54-49EC-9642-1448F014DCC9} - \7b4ca387-5551-400b-9a35-fa2d32f182c9-4 No Task File <==== ATTENTION
 

Task: C:\WINDOWS\Tasks\AXDGX.job => C:\Users\Winfried\AppData\Roaming\AXDGX.exe <==== ATTENTION
 

Task: C:\WINDOWS\Tasks\XLA.job => C:\Users\Winfried\AppData\Roaming\XLA.exe <==== ATTENTION

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-21-1872664996-1993104736-2441894966-1001 -> {015DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = 

SearchScopes: HKU\S-1-5-21-1872664996-1993104736-2441894966-1001 -> {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = 

2015-03-26 21:14 - 2015-03-26 21:14 - 0005542 _____ () C:\Users\Winfried\AppData\Roaming\AXDGX

2015-03-31 10:14 - 2015-03-31 10:14 - 0004387 _____ () C:\Users\Winfried\AppData\Roaming\oDweklayyunBXthwbuHX

2015-03-26 21:14 - 2015-03-26 21:14 - 0004185 _____ () C:\Users\Winfried\AppData\Roaming\XLA

Emptytemp:

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

FRST öffnen, Haken setzen bei Addition und scannen, poste bitte beide Logfiles.

Fixlog:

Code:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 11-03-2015

Ran by Winfried at 2015-04-06 18:42:11 Run:1

Running from C:\Users\Winfried\Desktop

Loaded Profiles: Winfried (Available profiles: Winfried)

Boot Mode: Normal

==============================================
 

Content of fixlist:

*****************
 

ATTFilter
 

C:\Users\Winfried\AppData\Local\Microsoft\Windows\INetCache\IE\HT0OSLKQ\Reimage[1].exe
 

C:\Users\Winfried\AppData\Local\Microsoft\Windows\INetCache\IE\T7J7BXCZ\91[1].js
 

C:\Users\Winfried\AppData\Local\Temp\DMR\dmr_72.exe
 

C:\Users\Winfried\AppData\Local\Temp\DMR\Downloads\fc14996dfa99adfc7baae624196888c5\5b06e73c66b13128cd03586177ce6642\m4a-to-mp3-83converter.exe
 

C:\Users\Winfried\AppData\Roaming\AXDGX
 

C:\Users\Winfried\AppData\Roaming\oDweklayyunBXthwbuHX
 

C:\Users\Winfried\AppData\Roaming\XLA
 

C:\Users\Winfried\Downloads\Free M4a to MP3 Converter - CHIP-Installer.exe
 

C:\Users\Winfried\Downloads\Malwarebytes Anti Malware Malware Scanner - CHIP-Installer.exe

Task: {10635313-837A-4988-8E43-C5C1F66D3101} - System32\Tasks\AXDGX => C:\Users\Winfried\AppData\Roaming\AXDGX.exe <==== ATTENTION
 

Task: {109FF231-DBF9-4736-BDC2-A51BD10357FC} - System32\Tasks\XLA => C:\Users\Winfried\AppData\Roaming\XLA.exe <==== ATTENTION
 

Task: {82351605-5B54-49EC-9642-1448F014DCC9} - \7b4ca387-5551-400b-9a35-fa2d32f182c9-4 No Task File <==== ATTENTION
 

Task: C:\WINDOWS\Tasks\AXDGX.job => C:\Users\Winfried\AppData\Roaming\AXDGX.exe <==== ATTENTION
 

Task: C:\WINDOWS\Tasks\XLA.job => C:\Users\Winfried\AppData\Roaming\XLA.exe <==== ATTENTION

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-21-1872664996-1993104736-2441894966-1001 -> {015DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = 

SearchScopes: HKU\S-1-5-21-1872664996-1993104736-2441894966-1001 -> {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = 

2015-03-26 21:14 - 2015-03-26 21:14 - 0005542 _____ () C:\Users\Winfried\AppData\Roaming\AXDGX

2015-03-31 10:14 - 2015-03-31 10:14 - 0004387 _____ () C:\Users\Winfried\AppData\Roaming\oDweklayyunBXthwbuHX

2015-03-26 21:14 - 2015-03-26 21:14 - 0004185 _____ () C:\Users\Winfried\AppData\Roaming\XLA

Emptytemp:

         

*****************
 

ATTFilter => Error: No automatic fix found for this entry.

C:\Users\Winfried\AppData\Local\Microsoft\Windows\INetCache\IE\HT0OSLKQ\Reimage[1].exe => Moved successfully.

C:\Users\Winfried\AppData\Local\Microsoft\Windows\INetCache\IE\T7J7BXCZ\91[1].js => Moved successfully.

C:\Users\Winfried\AppData\Local\Temp\DMR\dmr_72.exe => Moved successfully.

C:\Users\Winfried\AppData\Local\Temp\DMR\Downloads\fc14996dfa99adfc7baae624196888c5\5b06e73c66b13128cd03586177ce6642\m4a-to-mp3-83converter.exe => Moved successfully.

C:\Users\Winfried\AppData\Roaming\AXDGX => Moved successfully.

C:\Users\Winfried\AppData\Roaming\oDweklayyunBXthwbuHX => Moved successfully.

C:\Users\Winfried\AppData\Roaming\XLA => Moved successfully.

C:\Users\Winfried\Downloads\Free M4a to MP3 Converter - CHIP-Installer.exe => Moved successfully.

C:\Users\Winfried\Downloads\Malwarebytes Anti Malware Malware Scanner - CHIP-Installer.exe => Moved successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{10635313-837A-4988-8E43-C5C1F66D3101}" => Key deleted successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{10635313-837A-4988-8E43-C5C1F66D3101}" => Key deleted successfully.

C:\Windows\System32\Tasks\AXDGX => Moved successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AXDGX" => Key deleted successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{109FF231-DBF9-4736-BDC2-A51BD10357FC}" => Key deleted successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{109FF231-DBF9-4736-BDC2-A51BD10357FC}" => Key deleted successfully.

C:\Windows\System32\Tasks\XLA => Moved successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\XLA" => Key deleted successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{82351605-5B54-49EC-9642-1448F014DCC9}" => Key deleted successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{82351605-5B54-49EC-9642-1448F014DCC9}" => Key deleted successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\7b4ca387-5551-400b-9a35-fa2d32f182c9-4" => Key deleted successfully.

C:\WINDOWS\Tasks\AXDGX.job => Moved successfully.

C:\WINDOWS\Tasks\XLA.job => Moved successfully.

"HKLM\SOFTWARE\Policies\Google" => Key deleted successfully.

HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.

HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.

HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.

"HKU\S-1-5-21-1872664996-1993104736-2441894966-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{015DB5FA-EAFB-4592-A95B-F44D3EE87FA9}" => Key deleted successfully.

HKCR\CLSID\{015DB5FA-EAFB-4592-A95B-F44D3EE87FA9} => Key not found. 

"HKU\S-1-5-21-1872664996-1993104736-2441894966-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}" => Key deleted successfully.

HKCR\CLSID\{E733165D-CBCF-4FDA-883E-ADEF965B476C} => Key not found. 

"C:\Users\Winfried\AppData\Roaming\AXDGX" => File/Directory not found.

"C:\Users\Winfried\AppData\Roaming\oDweklayyunBXthwbuHX" => File/Directory not found.

"C:\Users\Winfried\AppData\Roaming\XLA" => File/Directory not found.

EmptyTemp: => Removed 755.2 MB temporary data.
 
 

The system needed a reboot. 
 

==== End of Fixlog 18:42:29 ====

FRST

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015

Ran by Winfried (administrator) on KLEINERPCANDI on 06-04-2015 18:43:48

Running from C:\Users\Winfried\Desktop

Loaded Profiles: Winfried (Available profiles: Winfried)

Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11 (Default browser: FF)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(Intel Corporation) C:\Windows\System32\igfxCUIService.exe

(Microsoft Corporation) C:\Windows\System32\wlanext.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe

(Intel Corporation) C:\Windows\SysWOW64\esif_uf.exe

(Microsoft Corporation) C:\Windows\System32\dasHost.exe

(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe

(Lenovo) C:\Program Files\Lenovo\OneKey Optimizer\bin\FbService.exe

() C:\Program Files (x86)\Lenovo\Harmony\Picks\HarmonyPicksService.exe

() C:\Program Files (x86)\Lenovo\Harmony\Setting\HarmonySettingService.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\utilities\ibtsiva.exe

(Lenovo(beijing) Limited) C:\Program Files\Lenovo\OneKey Optimizer\bin\OKOUpdataService.exe

(Lenovo Group Limited) C:\Program Files\Lenovo\SettingsDependency\SettingsService.exe

(LENOVO INCORPORATED.) C:\Program Files\Lenovo\iMController\SystemAgentService.exe

() C:\Program Files\Lenovo PhoneCompanion\LPAWDService.exe

(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Lenovo Settings\x86\LenovoSetSvr.exe

(Lenovo(beijing) Limited) C:\Windows\System32\LenovoWiFiHotspotSvr.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe

(Nitro PDF Software) C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe

(Nalpeiron Ltd.) C:\Windows\SysWOW64\NLSSRV32.EXE

(Lenovo(beijing) Limited) C:\Program Files\Lenovo\OneKey Optimizer\bin\OKOControlSvc.exe

(Lenovo) C:\Program Files (x86)\Lenovo\PaperDisplay\x86\PaperLookingSrv.exe

(PointGrab LTD) C:\Program Files (x86)\Lenovo\Motion Control\PGService.exe

(PointGrab LTD) C:\Program Files (x86)\Lenovo\Motion Control\PG_Service_Launcher.exe

(Lenovo) C:\Program Files\Lenovo PhoneCompanion\PhoneCompanionPusher.exe

() C:\Program Files (x86)\Lenovo\PaperDisplay\x86\PLHotkeyService.exe

(PointGrab LTD) C:\Program Files (x86)\Lenovo\Motion Control\WebcamSplitterServer.exe

(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe

() C:\Program Files\CyberLink\Shared files\RichVideo64.exe

(Conexant Systems, Inc.) C:\Windows\SysWOW64\SASrv.exe

() C:\Program Files (x86)\Lenovo\Lenovo VeriFace Pro\VfConnectorService.exe

(Lenovo) C:\ProgramData\LenovoTransition\Server\x64\ymc.exe

(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe

(Intel Corporation) C:\Windows\Temp\DPTF\esif_assist.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe

(Lenovo) C:\Windows\System32\LenovoUpdate.exe

(Intel Corporation) C:\Windows\System32\igfxEM.exe

(Intel Corporation) C:\Windows\System32\igfxHK.exe

() C:\Windows\System32\igfxTray.exe

(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe

(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20689_x64__8wekyb3d8bbwe\livecomm.exe

(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe

() C:\Program Files\CONEXANT\ForteConfig\fmapp.exe

(Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe

(Waves Audio Ltd.) C:\Program Files\Waves\MaxxAudio\WavesSvc64.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Microsoft Corporation) C:\Windows\System32\rundll32.exe

(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe

() C:\Program Files\Lenovo\LenovoUtility\utility.exe

() C:\Program Files (x86)\Lenovo\LenovoTransition\TransitionServer.exe

(Lenovo) C:\Program Files\Lenovo PhoneCompanion\Phone Companion.exe

(Lenovo(beijing) Limited) C:\Program Files\Lenovo\OneKey Optimizer\bin\OneKeyOptimizerTray.exe

(Lenovo(beijing) Limited) C:\Program Files\Lenovo\OneKey Optimizer\bin\OnekeyOptimizerUpdata.exe

(Microsoft Corporation) C:\Windows\SysWOW64\runonce.exe

(Lenovo) C:\Program Files (x86)\Lenovo\Harmony\Picks\Lenovo.HarmonyPicks.exe

(Lenovo) C:\Program Files (x86)\Lenovo\Harmony\Setting\Lenovo.HarmonySetting.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [322712 2014-10-09] (Intel Corporation)

HKLM\...\Run: [ForteConfig] => C:\Program Files\Conexant\ForteConfig\fmapp.exe [49056 2010-10-26] ()

HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SACpl.exe [1830616 2014-04-10] (Conexant Systems, Inc.)

HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [919768 2014-11-20] (Conexant Systems, Inc.)

HKLM\...\Run: [WavesSvc] => C:\Program Files\Waves\MaxxAudio\WavesSvc64.exe [606296 2014-10-02] (Waves Audio Ltd.)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2809072 2014-09-19] (Synaptics Incorporated)

HKLM\...\Run: [LENOVO.TPKNRRES] => rundll32.exe "C:\Program Files\Lenovo\Communications Utility\LibStartStub.dll",AVStartupStub

HKLM\...\Run: [LenovoUtility] => C:\Program Files\Lenovo\LenovoUtility\utility.exe [791368 2015-02-26] ()

HKLM\...\Run: [AutoStartTransition] => C:\Program Files (x86)\Lenovo\LenovoTransition\TransitionServer.exe [109840 2014-08-14] ()

HKLM\...\Run: [PhoneCompanion] => C:\Program Files\Lenovo PhoneCompanion\Phone Companion.exe [802800 2015-02-26] (Lenovo)

HKLM\...\Run: [OneKeyOptimizer] => C:\Program Files\Lenovo\OneKey Optimizer\bin\OneKeyOptimizerTray.exe [559896 2014-11-18] (Lenovo(beijing) Limited)

HKLM\...\Run: [3D BubbleSound] => "C:\Program Files\BubbleSound\3D BubbleSound.exe"

HKLM-x32\...\Run: [HarmonyPicks] => C:\Program Files (x86)\Lenovo\Harmony\Picks\Lenovo.HarmonyPicks.exe [1221912 2014-09-28] (Lenovo)

HKLM-x32\...\Run: [HarmonySetting] => C:\Program Files (x86)\Lenovo\Harmony\Setting\Lenovo.HarmonySetting.exe [2696472 2014-09-28] (Lenovo)

HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [704512 2015-03-17] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [126712 2015-01-19] (Avira Operations GmbH & Co. KG)
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = www.google.com

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com

HKU\S-1-5-21-1872664996-1993104736-2441894966-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

StartMenuInternet: IEXPLORE.EXE - iexplore.exe
 

FireFox:

========

FF ProfilePath: C:\Users\Winfried\AppData\Roaming\Mozilla\Firefox\Profiles\llcuuxk7.default-1428338392026

FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_17_0_0_134.dll [2015-03-23] ()

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_134.dll [2015-03-23] ()

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.56 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2014-10-10] (Intel Corporation)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2014-10-10] (Intel Corporation)

FF Plugin-x32: @nitropdf.com/NitroPDF -> C:\Program Files (x86)\Nitro\Pro 9\npnitromozilla.dll [2013-12-12] (Nitro PDF)
 

==================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [432888 2015-03-17] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [432888 2015-03-17] (Avira Operations GmbH & Co. KG)

S3 AVControlCenter; C:\Program Files\Lenovo\Communications Utility\AVControlCenter32.exe [599024 2014-08-05] (Lenovo Corporation)

R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [182520 2015-01-19] (Avira Operations GmbH & Co. KG)

S2 CCSDK; C:\Program Files (x86)\Lenovo\CCSDK\CCSDK.exe [644080 2014-10-22] ()

R2 esifsvc; C:\WINDOWS\SysWOW64\esif_uf.exe [1037568 2014-09-18] (Intel Corporation)

R2 FastbootService; C:\Program Files\Lenovo\OneKey Optimizer\bin\FbService.exe [191512 2014-11-20] (Lenovo)

R2 HarmonyPicksService; C:\Program Files (x86)\Lenovo\Harmony\Picks\HarmonyPicksService.exe [17176 2014-08-25] ()

R2 HarmonySettingService; C:\Program Files (x86)\Lenovo\Harmony\Setting\HarmonySettingService.exe [17688 2014-09-04] ()

S2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [18584 2014-10-09] (Intel Corporation)

R2 ibtsiva.exe; C:\Program Files (x86)\Intel\Bluetooth\utilities\ibtsiva.exe [121288 2014-08-13] (Intel Corporation)

R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [328296 2014-11-21] (Intel Corporation)

S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [887256 2014-05-13] (Intel(R) Corporation)

S2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [132896 2014-10-10] (Intel Corporation)

S3 iumsvc; C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [174368 2014-04-09] ()

S2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [158496 2014-10-10] (Intel Corporation)

S3 Lenovo EasyPlus Hotspot; C:\Program Files (x86)\Common Files\lenovo\easyplussdk\bin\EPHotspot64.exe [561408 2014-09-22] (Lenovo)

R2 Lenovo OKO Service; C:\Program Files\Lenovo\OneKey Optimizer\bin\OKOUpdataService.exe [2544408 2014-11-18] (Lenovo(beijing) Limited)

R2 Lenovo Settings Service; C:\Program Files\Lenovo\SettingsDependency\SettingsService.exe [2005320 2014-10-13] (Lenovo Group Limited)

R2 Lenovo System Agent Service; C:\Program Files\Lenovo\iMController\SystemAgentService.exe [584632 2015-03-06] (LENOVO INCORPORATED.)

S3 LENOVO.TVTVCAM; C:\Program Files\Lenovo\Communications Utility\vcamsvc.exe [727536 2014-08-05] (Lenovo Corporation)

R2 LenovoPAWDService; C:\Program Files\Lenovo PhoneCompanion\LPAWDService.exe [133440 2015-02-26] ()

R2 LenovoSetSvr; C:\Program Files (x86)\Lenovo\Lenovo Settings\x86\LenovoSetSvr.exe [258544 2014-06-19] (Lenovo(beijing) Limited)

R3 LenovoUpdate; C:\Windows\System32\LenovoUpdate.exe [26608 2015-04-06] (Lenovo)

R2 LenovoWiFiHotspotSvr; C:\Windows\System32\LenovoWiFiHotspotSvr.exe [218952 2014-08-25] (Lenovo(beijing) Limited)

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2015-03-17] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1080120 2015-03-17] (Malwarebytes Corporation)

S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [265936 2014-10-29] ()

R2 NitroDriverReadSpool9; C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe [230920 2013-12-12] (Nitro PDF Software)

R2 OKOControlSvc; C:\Program Files\Lenovo\OneKey Optimizer\bin\OKOControlSvc.exe [113944 2014-11-17] (Lenovo(beijing) Limited)

R2 PaperLookingSrv; C:\Program Files (x86)\Lenovo\PaperDisplay\x86\PaperLookingSrv.exe [173848 2014-11-25] (Lenovo)

R2 PGService; C:\Program Files (x86)\Lenovo\Motion Control\PGService.exe [167176 2014-05-28] (PointGrab LTD)

R2 PG_Service_Launcher; C:\Program Files (x86)\Lenovo\Motion Control\PG_Service_Launcher.exe [524552 2014-05-28] (PointGrab LTD)

R2 PhoneCompanionPusher; C:\Program Files\Lenovo PhoneCompanion\PhoneCompanionPusher.exe [321520 2015-02-26] (Lenovo)

S3 PhoneCompanionVap; C:\Program Files\Lenovo PhoneCompanion\PhoneCompanionVap.exe [338416 2015-02-26] (Lenovo)

R2 PLHotkeyService; C:\Program Files (x86)\Lenovo\PaperDisplay\x86\PLHotkeyService.exe [26392 2014-11-25] ()

R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [390632 2012-04-24] ()

R2 VeriFaceSrv; C:\Program Files (x86)\Lenovo\Lenovo VeriFace Pro\VfConnectorService.exe [68880 2015-02-26] ()

S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-04] (Microsoft Corporation)

S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-04] (Microsoft Corporation)

R2 ymc; C:\ProgramData\LenovoTransition\Server\x64\ymc.exe [34576 2014-09-03] (Lenovo)

R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3818704 2014-10-29] (Intel® Corporation)
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [128536 2015-03-17] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [132120 2015-03-17] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2015-03-17] (Avira Operations GmbH & Co. KG)

S3 AX88772; C:\Windows\system32\DRIVERS\ax88772.sys [113864 2013-07-18] (ASIX Electronics Corp.)

R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-03-18] (Microsoft Corporation)

R3 dptf_cpu; C:\Windows\System32\drivers\dptf_cpu.sys [38720 2014-09-18] (Intel Corporation)

R3 esif_lf; C:\Windows\System32\drivers\esif_lf.sys [216360 2014-09-18] (Intel Corporation)

R0 Fastboot; C:\Windows\System32\DRIVERS\Fastboot.sys [70168 2014-11-20] (Windows (R) Win 7 DDK provider)

R3 ibtusb; C:\Windows\system32\DRIVERS\ibtusb.sys [219592 2014-08-13] (Intel Corporation)

R0 IntelHSWPcc; C:\Windows\System32\drivers\IntelPcc.sys [79528 2014-09-05] (Intel Corporation)

R3 KMDFVirtualKbd; C:\Windows\System32\drivers\KMDFVirtualKbd.sys [22264 2014-08-04] ()

R3 KMDFVirtualMouse; C:\Windows\System32\drivers\KMDFVirtualMouse.sys [21240 2014-08-04] ()

R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2015-03-17] (Malwarebytes Corporation)

R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [136408 2015-04-06] (Malwarebytes Corporation)

R3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2015-03-17] (Malwarebytes Corporation)

R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [129312 2014-10-10] (Intel Corporation)

R3 NETwNb64; C:\Windows\system32\DRIVERS\Netwbw02.sys [3482600 2014-11-06] (Intel Corporation)

S3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew02.sys [4649440 2013-06-18] (Intel Corporation)

R3 rtsuvc; C:\Windows\system32\DRIVERS\rtsuvc.sys [2803416 2014-10-09] (Realtek Semiconductor Corp.)

R3 SensorsHIDClassDriver; C:\Windows\system32\DRIVERS\WUDFRd.sys [227840 2014-05-31] (Microsoft Corporation)

R3 SensorsServiceDriver; C:\Windows\system32\DRIVERS\WUDFRd.sys [227840 2014-05-31] (Microsoft Corporation)

R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [31472 2014-09-19] (Synaptics Incorporated)

S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-04] (Microsoft Corporation)

S3 wsvd; C:\Windows\system32\DRIVERS\wsvd.sys [102376 2012-06-13] ("CyberLink)
 

==================== NetSvcs (Whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2015-04-06 18:39 - 2015-04-06 18:39 - 00000000 ____D () C:\Users\Winfried\Desktop\Alte Firefox-Daten

2015-04-06 18:36 - 2015-04-06 18:36 - 00001186 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

2015-04-06 18:36 - 2015-04-06 18:36 - 00001174 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk

2015-04-06 18:36 - 2015-04-06 18:36 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

2015-04-06 18:36 - 2015-04-06 18:36 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2015-04-06 18:24 - 2015-04-06 18:24 - 00001295 _____ () C:\Users\Winfried\Desktop\Revo Uninstaller.lnk

2015-04-06 18:24 - 2015-04-06 18:24 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group

2015-04-06 18:23 - 2015-04-06 18:24 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Winfried\Desktop\revosetup95.exe

2015-04-06 13:02 - 2015-04-06 13:02 - 00852607 _____ () C:\Users\Winfried\Desktop\SecurityCheck.exe

2015-04-06 12:25 - 2015-04-06 12:25 - 00000000 ____D () C:\Program Files (x86)\ESET

2015-04-06 12:21 - 2015-04-06 12:22 - 02347384 _____ (ESET) C:\Users\Winfried\Desktop\esetsmartinstaller_deu.exe

2015-04-05 19:05 - 2015-04-05 19:05 - 00001002 _____ () C:\Users\Winfried\Desktop\JRT.txt

2015-04-05 19:02 - 2015-04-05 19:02 - 00000207 _____ () C:\WINDOWS\tweaking.com-regbackup-KLEINERPCANDI-Windows-8.1-(64-bit).dat

2015-04-05 19:01 - 2015-04-05 19:01 - 02690981 _____ (Thisisu) C:\Users\Winfried\Desktop\JRT.exe

2015-04-05 19:01 - 2015-04-05 19:01 - 00000000 ____D () C:\RegBackup

2015-04-05 18:56 - 2015-04-05 18:56 - 02208768 _____ () C:\Users\Winfried\Desktop\AdwCleaner_4.200.exe

2015-04-05 14:21 - 2015-04-05 14:21 - 00001197 _____ () C:\Users\Winfried\Desktop\MBAM.txt

2015-04-05 14:13 - 2015-04-05 14:13 - 00380416 _____ () C:\Users\Winfried\Desktop\Gmer-19357.exe

2015-04-05 14:12 - 2015-04-05 14:12 - 00380416 _____ () C:\Users\Winfried\Desktop\kqmuntzg.exe

2015-04-05 14:11 - 2015-04-06 18:44 - 00017690 _____ () C:\Users\Winfried\Desktop\FRST.txt

2015-04-05 14:11 - 2015-04-06 18:43 - 00000000 ____D () C:\FRST

2015-04-05 14:11 - 2015-04-05 14:12 - 00027878 _____ () C:\Users\Winfried\Desktop\Addition.txt

2015-04-05 14:10 - 2015-04-05 14:10 - 02095616 _____ (Farbar) C:\Users\Winfried\Desktop\FRST64.exe

2015-04-04 14:20 - 2015-04-04 14:20 - 681778017 _____ () C:\WINDOWS\MEMORY.DMP

2015-04-04 14:20 - 2015-04-04 14:20 - 00289624 _____ () C:\WINDOWS\Minidump\040415-5984-01.dmp

2015-04-04 14:20 - 2015-04-04 14:20 - 00000000 ____D () C:\WINDOWS\Minidump

2015-04-04 13:59 - 2015-04-04 13:55 - 00043576 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avnetflt.sys

2015-04-04 12:28 - 2015-04-04 12:28 - 00001129 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2015-04-04 11:55 - 2015-04-04 11:55 - 00001164 _____ () C:\Users\Public\Desktop\Avira.lnk

2015-04-04 11:53 - 2015-04-04 11:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira

2015-04-04 11:53 - 2015-04-04 11:53 - 00000000 ____D () C:\Users\Winfried\AppData\Roaming\Avira

2015-04-04 11:52 - 2015-04-04 11:55 - 00000000 ____D () C:\ProgramData\Avira

2015-04-04 11:52 - 2015-04-04 11:55 - 00000000 ____D () C:\Program Files (x86)\Avira

2015-04-04 11:52 - 2015-03-17 13:01 - 00132120 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avipbb.sys

2015-04-04 11:52 - 2015-03-17 13:01 - 00128536 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avgntflt.sys

2015-04-04 11:52 - 2015-03-17 13:01 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avkmgr.sys

2015-04-04 11:45 - 2014-10-18 11:55 - 00055776 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe

2015-04-04 11:45 - 2014-10-18 10:09 - 00060416 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups.dll

2015-04-04 11:45 - 2014-10-18 10:09 - 00051712 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups2.dll

2015-04-04 11:45 - 2014-10-18 09:25 - 00025600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wups.dll

2015-04-04 11:45 - 2014-10-18 08:50 - 00017408 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaext.dll

2015-04-04 11:45 - 2014-10-18 08:38 - 03557376 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll

2015-04-04 11:45 - 2014-10-18 08:27 - 00035840 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapp.exe

2015-04-04 11:45 - 2014-10-18 08:26 - 00140288 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuwebv.dll

2015-04-04 11:45 - 2014-10-18 08:23 - 00407552 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUSettingsProvider.dll

2015-04-04 11:45 - 2014-10-18 08:23 - 00095744 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll

2015-04-04 11:45 - 2014-10-18 08:21 - 00894976 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll

2015-04-04 11:45 - 2014-10-18 08:20 - 01714176 _____ (Microsoft Corporation) C:\WINDOWS\system32\wucltux.dll

2015-04-04 11:45 - 2014-10-18 08:14 - 00124928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuwebv.dll

2015-04-04 11:45 - 2014-10-18 08:14 - 00029696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapp.exe

2015-04-04 11:45 - 2014-10-18 08:12 - 00081920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll

2015-04-04 11:45 - 2014-10-18 08:11 - 00723968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll

2015-04-04 11:32 - 2015-01-30 05:01 - 00097792 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hidbth.sys

2015-04-04 11:32 - 2015-01-30 05:00 - 00167424 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rfcomm.sys

2015-04-04 11:32 - 2014-10-29 04:46 - 00081920 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\BTHUSB.SYS

2015-04-04 11:32 - 2014-10-29 04:46 - 00053248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthenum.sys

2015-04-04 11:32 - 2014-10-29 04:45 - 01198080 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthport.sys

2015-04-04 11:32 - 2014-10-29 04:03 - 00241152 _____ (Microsoft Corporation) C:\WINDOWS\system32\fsquirt.exe

2015-04-04 11:22 - 2015-01-30 04:02 - 00102912 _____ (Microsoft Corporation) C:\WINDOWS\system32\eappgnui.dll

2015-04-04 11:22 - 2015-01-30 03:40 - 00091648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eappgnui.dll

2015-04-04 11:22 - 2015-01-30 03:37 - 00331776 _____ (Microsoft Corporation) C:\WINDOWS\system32\eapp3hst.dll

2015-04-04 11:22 - 2015-01-30 03:24 - 00339456 _____ (Microsoft Corporation) C:\WINDOWS\system32\eapphost.dll

2015-04-04 11:22 - 2015-01-30 03:24 - 00250880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eapp3hst.dll

2015-04-04 11:22 - 2015-01-30 03:16 - 00266752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eapphost.dll

2015-04-04 11:22 - 2015-01-30 03:08 - 00346112 _____ (Microsoft Corporation) C:\WINDOWS\system32\eappcfg.dll

2015-04-04 11:22 - 2015-01-30 03:06 - 00278016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eappcfg.dll

2015-04-04 11:22 - 2014-10-29 03:19 - 00070656 _____ (Microsoft Corporation) C:\WINDOWS\system32\eappprxy.dll

2015-04-04 11:22 - 2014-10-29 02:59 - 00056320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eappprxy.dll

2015-04-04 11:18 - 2015-04-04 11:18 - 02208768 _____ () C:\Users\Winfried\Downloads\adwcleaner_4.200.exe

2015-04-04 11:04 - 2015-04-04 11:44 - 165283560 _____ () C:\Users\Winfried\Downloads\avira_free_antivirus_de_15.0.9.504.exe

2015-04-04 09:52 - 2015-04-06 18:43 - 00001366 _____ () C:\WINDOWS\Tasks\disco_savings_notification_service.job

2015-04-04 09:52 - 2015-04-06 18:43 - 00001052 _____ () C:\WINDOWS\Tasks\oDweklayyunBXthwbuHX.job

2015-04-04 09:52 - 2015-04-04 09:53 - 00000000 ____D () C:\Program Files (x86)\disco savings

2015-04-04 09:52 - 2015-04-04 09:52 - 00004380 _____ () C:\WINDOWS\System32\Tasks\disco_savings_notification_service

2015-04-04 09:52 - 2015-04-04 09:52 - 00004076 _____ () C:\WINDOWS\System32\Tasks\oDweklayyunBXthwbuHX

2015-04-04 09:51 - 2015-04-04 12:13 - 00000000 ____D () C:\ProgramData\{47b36d71-bb6e-ffd8-47b3-36d71bb6b5c6}

2015-04-04 09:41 - 2015-04-04 09:41 - 00000004 _____ () C:\WINDOWS\SysWOW64\029B560A371F4E00AB32838EBC01B9E7

2015-04-03 15:33 - 2015-04-03 15:33 - 00000000 __SHD () C:\Users\Winfried\AppData\Local\EmieBrowserModeList

2015-03-24 10:54 - 2015-01-29 02:59 - 02773504 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll

2015-03-24 10:54 - 2015-01-29 02:49 - 02459136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll

2015-03-24 10:54 - 2015-01-28 04:24 - 00075264 _____ (Microsoft Corporation) C:\WINDOWS\system32\StorageContextHandler.dll

2015-03-24 10:54 - 2015-01-28 03:47 - 00060928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\StorageContextHandler.dll

2015-03-24 10:53 - 2015-02-04 01:58 - 00264000 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdFilter.sys

2015-03-24 10:53 - 2015-02-04 01:58 - 00114496 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdNisDrv.sys

2015-03-24 10:53 - 2015-02-04 01:58 - 00044024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdBoot.sys

2015-03-24 10:53 - 2015-02-03 02:03 - 03551744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DCompiler_47.dll

2015-03-24 10:53 - 2015-02-03 02:02 - 04298240 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_47.dll

2015-03-24 10:53 - 2015-02-03 01:53 - 00014848 _____ (Microsoft Corporation) C:\WINDOWS\system32\winshfhc.dll

2015-03-24 10:53 - 2015-02-03 01:53 - 00012800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winshfhc.dll

2015-03-24 10:53 - 2015-01-30 04:03 - 01488896 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfc42u.dll

2015-03-24 10:53 - 2015-01-30 04:03 - 01464832 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfc42.dll

2015-03-24 10:53 - 2015-01-30 03:44 - 01230336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfc42u.dll

2015-03-24 10:53 - 2015-01-30 03:42 - 01204224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfc42.dll

2015-03-24 10:53 - 2015-01-30 03:29 - 00035840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\atlthunk.dll

2015-03-24 10:53 - 2014-11-01 01:57 - 01091072 _____ (Microsoft Corporation) C:\WINDOWS\system32\MrmCoreR.dll

2015-03-24 10:53 - 2014-11-01 01:47 - 00790528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MrmCoreR.dll

2015-03-24 10:53 - 2014-10-29 03:28 - 00048128 _____ (Microsoft Corporation) C:\WINDOWS\system32\atlthunk.dll

2015-03-24 10:52 - 2015-01-31 01:42 - 03097600 _____ (Microsoft Corporation) C:\WINDOWS\system32\msftedit.dll

2015-03-24 10:52 - 2015-01-31 01:29 - 02484224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msftedit.dll

2015-03-24 10:52 - 2015-01-28 01:47 - 02501368 _____ (Microsoft Corporation) C:\WINDOWS\explorer.exe

2015-03-24 10:52 - 2015-01-28 01:41 - 02207488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe

2015-03-24 10:52 - 2014-12-11 07:36 - 00046456 _____ (Microsoft Corporation) C:\WINDOWS\system32\LockScreenContentServer.exe

2015-03-24 02:15 - 2015-02-20 05:03 - 00358912 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll

2015-03-24 02:15 - 2015-02-20 04:58 - 00044032 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll

2015-03-24 02:15 - 2015-02-20 04:20 - 00301056 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\atmfd.dll

2015-03-24 02:15 - 2015-02-20 04:15 - 00035840 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll

2015-03-24 02:15 - 2014-10-29 04:49 - 00003072 _____ (Microsoft Corporation) C:\WINDOWS\system32\lpk.dll

2015-03-24 02:15 - 2014-10-29 04:44 - 00096256 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontsub.dll

2015-03-24 02:15 - 2014-10-29 04:44 - 00014848 _____ (Microsoft Corporation) C:\WINDOWS\system32\dciman32.dll

2015-03-24 02:15 - 2014-10-29 04:04 - 00003072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\lpk.dll

2015-03-24 02:15 - 2014-10-29 04:00 - 00077824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontsub.dll

2015-03-24 02:15 - 2014-10-29 04:00 - 00011776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dciman32.dll

2015-03-24 02:13 - 2014-12-19 08:26 - 00140800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxdav.sys

2015-03-24 02:13 - 2014-12-12 04:04 - 00087040 _____ (Microsoft Corporation) C:\WINDOWS\system32\TSWbPrxy.exe

2015-03-24 02:13 - 2014-12-12 02:51 - 00075776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ahcache.sys

2015-03-24 02:13 - 2014-10-17 09:01 - 00789184 _____ (Microsoft Corporation) C:\WINDOWS\system32\oleaut32.dll

2015-03-24 02:13 - 2014-10-17 08:58 - 00602768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\oleaut32.dll

2015-03-24 02:13 - 2014-09-04 02:12 - 00590336 _____ (Microsoft Corporation) C:\WINDOWS\system32\rastls.dll

2015-03-24 02:13 - 2014-09-04 02:01 - 00514048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rastls.dll

2015-03-24 02:13 - 2014-08-23 07:18 - 02149376 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml3.dll

2015-03-24 02:13 - 2014-08-23 07:03 - 01346048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml3.dll

2015-03-24 02:13 - 2014-06-10 00:13 - 00035480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TsWpfWrp.exe

2015-03-24 02:13 - 2014-06-10 00:13 - 00035480 _____ (Microsoft Corporation) C:\WINDOWS\system32\TsWpfWrp.exe

2015-03-24 02:12 - 2015-01-28 17:41 - 07472960 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe

2015-03-24 02:12 - 2015-01-28 17:41 - 01733440 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll

2015-03-24 02:12 - 2015-01-28 17:41 - 01498360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll

2015-03-24 02:12 - 2014-10-29 04:02 - 00285184 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64.dll

2015-03-24 02:12 - 2014-10-29 04:02 - 00013312 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64cpu.dll

2015-03-24 02:12 - 2014-10-29 03:57 - 00016896 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntvdm64.dll

2015-03-24 02:12 - 2014-10-29 03:15 - 00014336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntvdm64.dll

2015-03-24 02:12 - 2014-10-29 03:15 - 00005632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wow32.dll

2015-03-24 02:12 - 2014-10-29 03:14 - 00004096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\user.exe

2015-03-24 02:12 - 2014-10-29 03:13 - 00025600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\setup16.exe

2015-03-24 02:12 - 2014-10-29 03:13 - 00008704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\instnm.exe

2015-03-24 02:12 - 2014-10-23 07:48 - 00081408 _____ (Microsoft Corporation) C:\WINDOWS\system32\packager.dll

2015-03-24 02:12 - 2014-10-23 07:05 - 00072192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\packager.dll

2015-03-24 02:12 - 2014-10-13 04:43 - 00238912 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdbus.sys

2015-03-24 02:12 - 2014-10-13 04:43 - 00153920 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dumpsd.sys

2015-03-24 02:12 - 2014-10-13 04:43 - 00086336 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pdc.sys

2015-03-24 02:12 - 2014-10-13 04:43 - 00039744 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\intelpep.sys

2015-03-24 02:12 - 2014-05-19 08:31 - 00057856 _____ (Microsoft Corporation) C:\WINDOWS\system32\drvcfg.exe

2015-03-24 02:12 - 2014-05-19 08:21 - 00110592 _____ (Microsoft Corporation) C:\WINDOWS\system32\drvinst.exe

2015-03-24 02:12 - 2014-05-19 07:23 - 00098816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\drvinst.exe

2015-03-24 02:11 - 2015-01-31 01:20 - 00203264 _____ (Microsoft Corporation) C:\WINDOWS\system32\ubpm.dll

2015-03-24 02:11 - 2015-01-27 06:22 - 00131584 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll

2015-03-24 02:11 - 2015-01-27 04:11 - 03547648 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll

2015-03-24 02:11 - 2014-12-06 05:17 - 00360448 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncsi.dll

2015-03-24 02:11 - 2014-12-06 03:41 - 00391680 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlasvc.dll

2015-03-24 02:11 - 2014-10-29 05:56 - 00027456 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rdpvideominiport.sys

2015-03-24 02:11 - 2014-10-29 04:37 - 00040448 _____ (Microsoft Corporation) C:\WINDOWS\system32\rfxvmt.dll

2015-03-24 02:11 - 2014-10-29 03:24 - 00086016 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlaapi.dll

2015-03-24 02:11 - 2014-10-29 03:01 - 00065536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nlaapi.dll

2015-03-24 02:09 - 2015-03-24 02:09 - 00000000 ____D () C:\Users\Winfried\AppData\Roaming\Nitro

2015-03-24 02:07 - 2015-04-06 18:43 - 00136408 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys

2015-03-24 02:07 - 2015-04-04 12:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2015-03-24 02:07 - 2015-04-04 12:28 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2015-03-24 02:07 - 2015-03-24 02:07 - 00000000 ____D () C:\ProgramData\Malwarebytes

2015-03-24 02:07 - 2015-03-17 06:15 - 00107736 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys

2015-03-24 02:07 - 2015-03-17 06:15 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys

2015-03-24 02:07 - 2015-03-17 06:15 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys

2015-03-24 01:58 - 2015-03-24 01:58 - 00000000 ____D () C:\Users\Public\Pokki

2015-03-24 01:55 - 2015-04-05 18:58 - 00000000 ____D () C:\AdwCleaner

2015-03-24 01:52 - 2014-10-31 00:37 - 00129536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\poqexec.exe

2015-03-24 01:52 - 2014-10-31 00:34 - 00146432 _____ (Microsoft Corporation) C:\WINDOWS\system32\poqexec.exe

2015-03-24 01:50 - 2015-01-29 20:45 - 01763352 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecs.dll

2015-03-24 01:50 - 2015-01-29 20:34 - 01488040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WindowsCodecs.dll

2015-03-24 01:49 - 2015-02-12 19:40 - 22291584 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll

2015-03-24 01:49 - 2015-02-12 19:34 - 19731824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll

2015-03-24 01:47 - 2015-01-28 03:31 - 00402432 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMPhoto.dll

2015-03-24 01:47 - 2015-01-28 03:11 - 00357376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WMPhoto.dll

2015-03-24 01:47 - 2014-12-08 21:42 - 00535640 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll

2015-03-24 01:47 - 2014-12-08 21:42 - 00531616 _____ (Microsoft Corporation) C:\WINDOWS\system32\ci.dll

2015-03-24 01:47 - 2014-12-08 21:42 - 00448792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wer.dll

2015-03-24 01:47 - 2014-12-08 21:42 - 00413248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Faultrep.dll

2015-03-24 01:47 - 2014-12-08 21:42 - 00372408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Faultrep.dll

2015-03-24 01:47 - 2014-12-08 21:42 - 00108944 _____ (Microsoft Corporation) C:\WINDOWS\system32\EncDump.dll

2015-03-24 01:47 - 2014-12-08 21:42 - 00038264 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFaultSecure.exe

2015-03-24 01:47 - 2014-12-08 21:42 - 00033584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFaultSecure.exe

2015-03-24 01:47 - 2014-12-06 03:35 - 00229888 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll

2015-03-24 01:47 - 2014-11-10 01:19 - 00991232 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll

2015-03-24 01:47 - 2014-11-10 01:19 - 00806400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll

2015-03-24 01:47 - 2014-11-10 01:18 - 00259584 _____ (Microsoft Corporation) C:\WINDOWS\system32\pku2u.dll

2015-03-24 01:47 - 2014-11-10 01:18 - 00208896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\pku2u.dll

2015-03-24 01:47 - 2014-10-29 06:00 - 00465320 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFault.exe

2015-03-24 01:47 - 2014-10-29 06:00 - 00139984 _____ (Microsoft Corporation) C:\WINDOWS\system32\wermgr.exe

2015-03-24 01:47 - 2014-10-29 05:52 - 00500016 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll

2015-03-24 01:47 - 2014-10-29 05:52 - 00482872 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll

2015-03-24 01:47 - 2014-10-29 05:52 - 00394120 _____ (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll

2015-03-24 01:47 - 2014-10-29 05:52 - 00272248 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiodg.exe

2015-03-24 01:47 - 2014-10-29 05:12 - 00413136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFault.exe

2015-03-24 01:47 - 2014-10-29 05:12 - 00136296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wermgr.exe

2015-03-24 01:47 - 2014-10-29 05:07 - 00424544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioEng.dll

2015-03-24 01:47 - 2014-10-29 05:07 - 00370424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll

2015-03-24 01:47 - 2014-10-29 05:07 - 00344536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AUDIOKSE.dll

2015-03-24 01:47 - 2014-10-29 04:44 - 00037888 _____ (Microsoft Corporation) C:\WINDOWS\system32\werdiagcontroller.dll

2015-03-24 01:47 - 2014-10-29 03:59 - 00033280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\werdiagcontroller.dll

2015-03-24 01:47 - 2014-10-29 03:02 - 00911360 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll

2015-03-24 01:47 - 2014-09-10 08:25 - 00474432 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\netio.sys

2015-03-24 01:47 - 2014-09-08 05:07 - 02497344 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys

2015-03-24 01:47 - 2014-09-08 05:07 - 00428864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\FWPKCLNT.SYS

2015-03-24 01:47 - 2014-09-08 00:08 - 00389176 _____ () C:\WINDOWS\system32\ApnDatabase.xml

2015-03-24 01:47 - 2014-09-05 00:30 - 00822272 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32spl.dll

2015-03-24 01:47 - 2014-09-05 00:21 - 01053184 _____ (Microsoft Corporation) C:\WINDOWS\system32\localspl.dll

2015-03-24 01:47 - 2014-09-04 05:05 - 00836176 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmp4srcsnk.dll

2015-03-24 01:47 - 2014-09-04 04:22 - 00670384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll

2015-03-24 01:47 - 2014-09-04 03:01 - 00448512 _____ (Microsoft Corporation) C:\WINDOWS\system32\puiobj.dll

2015-03-24 01:47 - 2014-09-04 02:32 - 00334336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\puiobj.dll

2015-03-24 01:47 - 2014-09-04 02:10 - 00118272 _____ (Microsoft Corporation) C:\WINDOWS\system32\winbici.dll

2015-03-24 01:47 - 2014-08-31 02:17 - 00148800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBSTOR.SYS

2015-03-24 01:47 - 2014-08-31 00:05 - 00615424 _____ (Microsoft Corporation) C:\WINDOWS\system32\FXSCOMEX.dll

2015-03-24 01:47 - 2014-08-30 23:58 - 00275968 _____ (Microsoft Corporation) C:\WINDOWS\system32\FXSAPI.dll

2015-03-24 01:47 - 2014-08-30 23:04 - 00941568 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll

2015-03-24 01:47 - 2014-08-30 22:53 - 00239104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FXSAPI.dll

2015-03-24 01:47 - 2014-08-30 22:17 - 00799744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll

2015-03-24 01:47 - 2014-08-28 02:21 - 02480128 _____ (Microsoft Corporation) C:\WINDOWS\system32\WsmSvc.dll

2015-03-24 01:47 - 2014-08-28 02:06 - 02030592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WsmSvc.dll

2015-03-24 01:47 - 2014-08-23 07:14 - 13424128 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll

2015-03-24 01:47 - 2014-08-23 07:04 - 11820544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll

2015-03-24 01:47 - 2014-08-23 06:50 - 02714112 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers.dll

2015-03-24 01:47 - 2014-08-02 02:51 - 00545792 _____ (Microsoft Corporation) C:\WINDOWS\system32\untfs.dll

2015-03-24 01:47 - 2014-08-02 02:35 - 00485376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\untfs.dll

2015-03-24 01:44 - 2015-01-21 07:54 - 01384712 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctf.dll

2015-03-24 01:44 - 2015-01-21 07:15 - 01123848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctf.dll

2015-03-24 01:44 - 2014-07-24 05:20 - 00875688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvcr120_clr0400.dll

2015-03-24 01:44 - 2014-07-24 05:20 - 00869544 _____ (Microsoft Corporation) C:\WINDOWS\system32\msvcr120_clr0400.dll

2015-03-24 01:37 - 2015-03-24 01:38 - 00000000 ____D () C:\Users\Public\CyberLink

2015-03-24 01:37 - 2015-03-24 01:37 - 00000000 ____D () C:\Users\Winfried\Documents\CyberLink

2015-03-24 01:36 - 2015-03-24 01:36 - 00000000 ____D () C:\Users\Winfried\AppData\Roaming\CyberLink

2015-03-24 01:25 - 2015-03-24 01:25 - 00000000 ____D () C:\Users\Winfried\AppData\Roaming\Mozilla

2015-03-24 01:25 - 2015-03-24 01:25 - 00000000 ____D () C:\Users\Winfried\AppData\Local\Mozilla

2015-03-24 01:25 - 2015-03-24 01:25 - 00000000 ____D () C:\ProgramData\Mozilla

2015-03-24 01:22 - 2015-03-24 01:22 - 00000000 ____D () C:\Users\Winfried\AppData\Local\CyberLink

2015-03-24 01:02 - 2015-03-24 01:02 - 00000000 ____H () C:\WINDOWS\system32\Drivers\Msft_User_LocationProvider_01_11_00.Wdf

2015-03-23 20:00 - 2015-03-23 20:00 - 00000000 ____D () C:\Users\Winfried\AppData\Local\Macromedia

2015-03-23 19:54 - 2015-04-06 13:18 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job

2015-03-23 19:54 - 2015-03-23 19:54 - 00003772 _____ () C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater

2015-03-23 19:51 - 2015-03-23 19:58 - 00000000 ____D () C:\Users\Winfried\AppData\Local\Adobe

2015-03-23 19:39 - 2015-02-21 03:16 - 25021440 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll

2015-03-23 19:39 - 2015-02-21 02:41 - 12827648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll

2015-03-23 19:39 - 2015-02-21 02:27 - 00285696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll

2015-03-23 19:39 - 2015-02-21 02:27 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll

2015-03-23 19:39 - 2015-02-21 02:25 - 19720192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll

2015-03-23 19:39 - 2015-02-21 01:58 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll

2015-03-23 19:39 - 2015-02-21 01:32 - 00076288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll

2015-03-23 19:39 - 2015-02-20 04:49 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll

2015-03-23 19:39 - 2015-02-20 04:48 - 02886144 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll

2015-03-23 19:39 - 2015-02-20 04:47 - 00088064 _____ (Microsoft Corporation) C:\WINDOWS\system32\MshtmlDac.dll

2015-03-23 19:39 - 2015-02-20 04:35 - 00816128 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll

2015-03-23 19:39 - 2015-02-20 04:34 - 00814080 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll

2015-03-23 19:39 - 2015-02-20 04:32 - 06035456 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll

2015-03-23 19:39 - 2015-02-20 04:09 - 00503296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll

2015-03-23 19:39 - 2015-02-20 04:07 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll

2015-03-23 19:39 - 2015-02-20 04:06 - 00064000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MshtmlDac.dll

2015-03-23 19:39 - 2015-02-20 04:05 - 00316928 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll

2015-03-23 19:39 - 2015-02-20 04:03 - 02278400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll

2015-03-23 19:39 - 2015-02-20 03:59 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll

2015-03-23 19:39 - 2015-02-20 03:56 - 00664064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll

2015-03-23 19:39 - 2015-02-20 03:52 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll

2015-03-23 19:39 - 2015-02-20 03:49 - 00801280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll

2015-03-23 19:39 - 2015-02-20 03:49 - 00374272 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll

2015-03-23 19:39 - 2015-02-20 03:46 - 02125824 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl

2015-03-23 19:39 - 2015-02-20 03:43 - 14398976 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll

2015-03-23 19:39 - 2015-02-20 03:30 - 04300288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll

2015-03-23 19:39 - 2015-02-20 03:30 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll

2015-03-23 19:39 - 2015-02-20 03:29 - 02865152 _____ (Microsoft Corporation) C:\WINDOWS\system32\actxprxy.dll

2015-03-23 19:39 - 2015-02-20 03:28 - 02358784 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll

2015-03-23 19:39 - 2015-02-20 03:26 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll

2015-03-23 19:39 - 2015-02-20 03:24 - 02052608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl

2015-03-23 19:39 - 2015-02-20 03:24 - 00689152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll

2015-03-23 19:39 - 2015-02-20 03:16 - 01548288 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll

2015-03-23 19:39 - 2015-02-20 03:03 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll

2015-03-23 19:39 - 2015-02-20 03:01 - 01888256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll

2015-03-23 19:39 - 2015-02-20 02:57 - 01311232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll

2015-03-23 19:39 - 2015-02-20 02:55 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll

2015-03-23 19:39 - 2015-01-12 04:21 - 00490496 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtmsft.dll

2015-03-23 19:39 - 2015-01-12 03:48 - 00718848 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe

2015-03-23 19:39 - 2015-01-12 03:45 - 00418304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtmsft.dll

2015-03-23 19:39 - 2015-01-12 03:23 - 00327168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll

2015-03-23 19:39 - 2014-11-22 04:49 - 00417280 _____ (Microsoft Corporation) C:\WINDOWS\system32\html.iec

2015-03-23 19:39 - 2014-11-22 04:06 - 00340992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\html.iec

2015-03-23 19:39 - 2014-10-31 07:12 - 00143872 _____ (Microsoft Corporation) C:\WINDOWS\system32\wextract.exe

2015-03-23 19:39 - 2014-10-31 07:12 - 00013824 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshta.exe

2015-03-23 19:39 - 2014-10-31 07:10 - 00167424 _____ (Microsoft Corporation) C:\WINDOWS\system32\iexpress.exe

2015-03-23 19:39 - 2014-10-31 07:09 - 00064512 _____ (Microsoft Corporation) C:\WINDOWS\system32\pngfilt.dll

2015-03-23 19:39 - 2014-10-31 07:08 - 00012800 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeedssync.exe

2015-03-23 19:39 - 2014-10-31 07:06 - 00237568 _____ (Microsoft Corporation) C:\WINDOWS\system32\url.dll

2015-03-23 19:39 - 2014-10-31 07:06 - 00066560 _____ (Microsoft Corporation) C:\WINDOWS\system32\iesetup.dll

2015-03-23 19:39 - 2014-10-31 07:06 - 00048640 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieetwproxystub.dll

2015-03-23 19:39 - 2014-10-31 06:57 - 00054784 _____ (Microsoft Corporation) C:\WINDOWS\system32\jsproxy.dll

2015-03-23 19:39 - 2014-10-31 06:56 - 00034304 _____ (Microsoft Corporation) C:\WINDOWS\system32\iernonce.dll

2015-03-23 19:39 - 2014-10-31 06:54 - 00132096 _____ (Microsoft Corporation) C:\WINDOWS\system32\IEAdvpack.dll

2015-03-23 19:39 - 2014-10-31 06:53 - 00633856 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieui.dll

2015-03-23 19:39 - 2014-10-31 06:52 - 00108544 _____ (Microsoft Corporation) C:\WINDOWS\system32\hlink.dll

2015-03-23 19:39 - 2014-10-31 06:51 - 00144384 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieUnatt.exe

2015-03-23 19:39 - 2014-10-31 06:51 - 00114688 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieetwcollector.exe

2015-03-23 19:39 - 2014-10-31 06:40 - 00033280 _____ (Microsoft Corporation) C:\WINDOWS\system32\licmgr10.dll

2015-03-23 19:39 - 2014-10-31 06:30 - 00077824 _____ (Microsoft Corporation) C:\WINDOWS\system32\JavaScriptCollectionAgent.dll

2015-03-23 19:39 - 2014-10-31 06:29 - 00111616 _____ (Microsoft Corporation) C:\WINDOWS\system32\iesysprep.dll

2015-03-23 19:39 - 2014-10-31 06:29 - 00087552 _____ (Microsoft Corporation) C:\WINDOWS\system32\tdc.ocx

2015-03-23 19:39 - 2014-10-31 06:28 - 00107520 _____ (Microsoft Corporation) C:\WINDOWS\system32\inseng.dll

2015-03-23 19:39 - 2014-10-31 06:25 - 00199680 _____ (Microsoft Corporation) C:\WINDOWS\system32\msrating.dll

2015-03-23 19:39 - 2014-10-31 06:24 - 00060416 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeedsbs.dll

2015-03-23 19:39 - 2014-10-31 06:19 - 00152064 _____ (Microsoft Corporation) C:\WINDOWS\system32\occache.dll

2015-03-23 19:39 - 2014-10-31 05:42 - 00051200 _____ (Microsoft Corporation) C:\WINDOWS\system32\imgutil.dll

2015-03-23 19:39 - 2014-10-31 05:28 - 00137728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wextract.exe

2015-03-23 19:39 - 2014-10-31 05:28 - 00012800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshta.exe

2015-03-23 19:39 - 2014-10-31 05:27 - 00152064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iexpress.exe

2015-03-23 19:39 - 2014-10-31 05:26 - 00057344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\pngfilt.dll

2015-03-23 19:39 - 2014-10-31 05:25 - 00011264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeedssync.exe

2015-03-23 19:39 - 2014-10-31 05:24 - 00235520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\url.dll

2015-03-23 19:39 - 2014-10-31 05:24 - 00062464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iesetup.dll

2015-03-23 19:39 - 2014-10-31 05:23 - 00047616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieetwproxystub.dll

2015-03-23 19:39 - 2014-10-31 05:16 - 00047104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jsproxy.dll

2015-03-23 19:39 - 2014-10-31 05:15 - 00030720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iernonce.dll

2015-03-23 19:39 - 2014-10-31 05:14 - 00112128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\IEAdvpack.dll

2015-03-23 19:39 - 2014-10-31 05:13 - 00478208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieui.dll

2015-03-23 19:39 - 2014-10-31 05:13 - 00099328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\hlink.dll

2015-03-23 19:39 - 2014-10-31 05:12 - 00115712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieUnatt.exe

2015-03-23 19:39 - 2014-10-31 05:11 - 00620032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9diag.dll

2015-03-23 19:39 - 2014-10-31 05:03 - 00027136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\licmgr10.dll

2015-03-23 19:39 - 2014-10-31 04:57 - 00060416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\JavaScriptCollectionAgent.dll

2015-03-23 19:39 - 2014-10-31 04:56 - 00091136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inseng.dll

2015-03-23 19:39 - 2014-10-31 04:56 - 00090624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iesysprep.dll

2015-03-23 19:39 - 2014-10-31 04:56 - 00073216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tdc.ocx

2015-03-23 19:39 - 2014-10-31 04:53 - 00168960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msrating.dll

2015-03-23 19:39 - 2014-10-31 04:53 - 00052736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeedsbs.dll

2015-03-23 19:39 - 2014-10-31 04:48 - 00130048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\occache.dll

2015-03-23 19:39 - 2014-10-31 04:26 - 01042944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\actxprxy.dll

2015-03-23 19:39 - 2014-10-31 04:24 - 00040448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\imgutil.dll

2015-03-23 19:13 - 2015-03-06 04:53 - 00430080 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll

2015-03-23 19:13 - 2015-03-06 04:33 - 00358912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll

2015-03-23 19:13 - 2015-02-26 01:26 - 04178944 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys

2015-03-23 19:13 - 2015-01-16 00:43 - 00563504 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys

2015-03-23 19:13 - 2015-01-16 00:43 - 00177984 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys

2015-03-23 19:13 - 2015-01-14 06:22 - 00445440 _____ (Microsoft Corporation) C:\WINDOWS\system32\certcli.dll

2015-03-23 19:13 - 2015-01-14 05:53 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certcli.dll

2015-03-23 19:13 - 2014-12-09 03:50 - 00225280 _____ (Microsoft Corporation) C:\WINDOWS\system32\profsvc.dll

2015-03-23 19:13 - 2014-10-29 04:51 - 00154112 _____ (Microsoft Corporation) C:\WINDOWS\system32\msaudite.dll

2015-03-23 19:13 - 2014-10-29 04:50 - 00736768 _____ (Microsoft Corporation) C:\WINDOWS\system32\adtschema.dll

2015-03-23 19:13 - 2014-10-29 04:06 - 00736768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\adtschema.dll

2015-03-23 19:13 - 2014-10-29 04:06 - 00154112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msaudite.dll

2015-03-23 19:13 - 2014-10-29 03:31 - 01441792 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll

2015-03-23 19:12 - 2014-12-09 05:45 - 00393728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\scesrv.dll

2015-03-23 19:12 - 2014-12-09 03:56 - 00538624 _____ (Microsoft Corporation) C:\WINDOWS\system32\scesrv.dll

2015-03-23 19:12 - 2014-09-27 09:13 - 00104336 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncryptsslp.dll

2015-03-23 19:12 - 2014-09-27 07:24 - 00088800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ncryptsslp.dll

2015-03-23 19:12 - 2014-09-27 05:30 - 00185856 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpapisrv.dll

2015-03-21 23:00 - 2015-03-24 10:46 - 00000000 ____D () C:\Users\Winfried\AppData\Local\Lenovo

2015-03-21 22:56 - 2015-04-06 18:41 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1872664996-1993104736-2441894966-1001

2015-03-21 22:55 - 2015-04-06 18:37 - 00003962 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{083CACEA-2800-4375-A9CE-E755E8D02B7A}

2015-03-21 22:55 - 2015-03-21 22:55 - 00000000 __SHD () C:\Users\Winfried\AppData\Local\EmieUserList

2015-03-21 22:55 - 2015-03-21 22:55 - 00000000 __SHD () C:\Users\Winfried\AppData\Local\EmieSiteList

2015-03-21 22:55 - 2015-03-21 22:55 - 00000000 ____D () C:\ProgramData\OneKey Optimizer

2015-03-21 22:52 - 2015-04-06 18:44 - 01788918 _____ () C:\Users\Public\Documents\TestPicksStart.txt

2015-03-21 22:52 - 2015-04-06 18:43 - 00002262 _____ () C:\Users\Winfried\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Harmony Picks Introduction.lnk

2015-03-21 22:52 - 2015-04-06 18:43 - 00001366 _____ () C:\Users\Winfried\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Harmony Settings Introduction.lnk

2015-03-21 22:52 - 2015-04-06 18:43 - 00000000 ____D () C:\Users\Winfried\OneDrive

2015-03-21 22:52 - 2015-03-21 22:52 - 00000000 ____D () C:\Users\Winfried\AppData\Roaming\Macromedia

2015-03-21 22:52 - 2015-03-21 22:52 - 00000000 ____D () C:\Users\Winfried\AppData\Roaming\Intel Corporation

2015-03-21 22:51 - 2015-04-04 09:45 - 00001465 _____ () C:\Users\Winfried\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

2015-03-21 22:51 - 2015-03-23 20:17 - 00000000 ____D () C:\Users\Winfried\AppData\Local\Packages

2015-03-21 22:51 - 2015-03-21 22:51 - 00000118 _____ () C:\WINDOWS\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat

2015-03-21 22:51 - 2015-03-21 22:51 - 00000020 ___SH () C:\Users\Winfried\ntuser.ini

2015-03-21 22:51 - 2015-03-21 22:51 - 00000000 _SHDL () C:\Users\Winfried\Vorlagen

2015-03-21 22:51 - 2015-03-21 22:51 - 00000000 _SHDL () C:\Users\Winfried\Startmenü

2015-03-21 22:51 - 2015-03-21 22:51 - 00000000 _SHDL () C:\Users\Winfried\Netzwerkumgebung

2015-03-21 22:51 - 2015-03-21 22:51 - 00000000 _SHDL () C:\Users\Winfried\Lokale Einstellungen

2015-03-21 22:51 - 2015-03-21 22:51 - 00000000 _SHDL () C:\Users\Winfried\Eigene Dateien

2015-03-21 22:51 - 2015-03-21 22:51 - 00000000 _SHDL () C:\Users\Winfried\Druckumgebung

2015-03-21 22:51 - 2015-03-21 22:51 - 00000000 _SHDL () C:\Users\Winfried\Documents\Eigene Musik

2015-03-21 22:51 - 2015-03-21 22:51 - 00000000 _SHDL () C:\Users\Winfried\Documents\Eigene Bilder

2015-03-21 22:51 - 2015-03-21 22:51 - 00000000 _SHDL () C:\Users\Winfried\AppData\Roaming\Microsoft\Windows\Start Menu\Programme

2015-03-21 22:51 - 2015-03-21 22:51 - 00000000 _SHDL () C:\Users\Winfried\AppData\Local\Verlauf

2015-03-21 22:51 - 2015-03-21 22:51 - 00000000 _SHDL () C:\Users\Winfried\AppData\Local\Anwendungsdaten

2015-03-21 22:51 - 2015-03-21 22:51 - 00000000 _SHDL () C:\Users\Winfried\Anwendungsdaten

2015-03-21 22:51 - 2015-03-21 22:51 - 00000000 ____D () C:\WINDOWS\System32\Tasks\WPD

2015-03-21 22:51 - 2015-03-21 22:51 - 00000000 ____D () C:\Users\Winfried\AppData\Roaming\Intel

2015-03-21 22:51 - 2015-03-21 22:51 - 00000000 ____D () C:\Users\Winfried\AppData\Roaming\Adobe

2015-03-21 22:51 - 2015-03-21 22:51 - 00000000 ____D () C:\Users\Winfried\AppData\Local\VirtualStore

2015-03-21 22:50 - 2015-04-04 16:33 - 00000000 ____D () C:\Users\Winfried

2015-03-21 22:50 - 2015-02-26 19:05 - 00000000 ___RD () C:\Users\Winfried\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility

2015-03-21 22:50 - 2014-08-23 23:39 - 00000000 ___RD () C:\Users\Winfried\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools

2015-03-21 22:50 - 2014-03-18 11:55 - 00000369 _____ () C:\Users\Winfried\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pictures.lnk

2015-03-21 22:50 - 2014-03-18 11:55 - 00000369 _____ () C:\Users\Winfried\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Documents.lnk

2015-03-21 22:50 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Winfried\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories

2015-03-21 22:50 - 2013-08-22 17:36 - 00000000 ____D () C:\Users\Winfried\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Public\Documents\Eigene Musik

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Public\Documents\Eigene Bilder

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default\Vorlagen

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default\Startmenü

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default\Netzwerkumgebung

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default\Lokale Einstellungen

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default\Eigene Dateien

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default\Druckumgebung

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default\Documents\Eigene Musik

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default\Documents\Eigene Bilder

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programme

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default\AppData\Local\Verlauf

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default\AppData\Local\Anwendungsdaten

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default\Anwendungsdaten

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default User\Documents\Eigene Musik

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default User\Documents\Eigene Bilder

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programme

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default User\AppData\Local\Verlauf

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Users\Default User\AppData\Local\Anwendungsdaten

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Programme

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\ProgramData\Vorlagen

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\ProgramData\Startmenü

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\ProgramData\Microsoft\Windows\Start Menu\Programme

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\ProgramData\Dokumente

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\ProgramData\Anwendungsdaten

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Program Files\Gemeinsame Dateien

2015-03-20 07:01 - 2015-03-20 07:01 - 00000000 _SHDL () C:\Dokumente und Einstellungen
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2015-04-06 18:42 - 2015-02-26 19:34 - 00002560 _____ () C:\WINDOWS\system32\VfService.trf

2015-04-06 18:42 - 2015-02-26 19:17 - 00030755 _____ () C:\WINDOWS\SysWOW64\Gms.log

2015-04-06 18:42 - 2015-02-26 19:11 - 00483706 _____ () C:\Users\Public\CAFADEBUG.log

2015-04-06 18:42 - 2015-02-26 18:58 - 01462511 _____ () C:\WINDOWS\WindowsUpdate.log

2015-04-06 18:42 - 2015-02-26 18:56 - 00153336 _____ () C:\WINDOWS\system32\wpbbin.exe

2015-04-06 18:42 - 2015-02-26 18:56 - 00111088 _____ (Lenovo (Beijing) Limited) C:\WINDOWS\system32\LenovoCheck.exe

2015-04-06 18:42 - 2015-02-26 18:56 - 00026608 _____ (Lenovo) C:\WINDOWS\system32\LenovoUpdate.exe

2015-04-06 18:42 - 2014-03-18 11:44 - 00283578 _____ () C:\WINDOWS\PFRO.log

2015-04-06 18:42 - 2013-08-22 16:46 - 00026671 _____ () C:\WINDOWS\setupact.log

2015-04-06 18:42 - 2013-08-22 16:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT

2015-04-06 18:42 - 2013-08-22 15:25 - 00262144 ___SH () C:\WINDOWS\system32\config\BBI

2015-04-06 18:22 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\sru

2015-04-06 12:58 - 2013-08-22 17:20 - 00000000 ____D () C:\WINDOWS\CbsTemp

2015-04-05 19:12 - 2015-02-26 19:01 - 00000868 _____ () C:\WINDOWS\lupdate.log

2015-04-05 19:05 - 2015-02-27 03:53 - 00768056 _____ () C:\WINDOWS\system32\perfh007.dat

2015-04-05 19:05 - 2015-02-27 03:53 - 00160322 _____ () C:\WINDOWS\system32\perfc007.dat

2015-04-05 19:05 - 2014-03-18 11:53 - 01780340 _____ () C:\WINDOWS\system32\PerfStringBackup.INI

2015-04-04 14:01 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\AppReadiness

2015-04-04 13:50 - 2013-08-22 17:36 - 00000000 ___RD () C:\WINDOWS\ImmersiveControlPanel

2015-04-04 12:01 - 2015-02-26 19:10 - 00003718 _____ () C:\WINDOWS\System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473

2015-04-04 11:54 - 2015-02-26 19:35 - 00000000 ____D () C:\ProgramData\McAfee

2015-04-04 11:54 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools

2015-04-04 11:54 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools

2015-04-04 11:54 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files\Windows Defender

2015-04-04 11:54 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files (x86)\Windows Defender

2015-04-04 11:53 - 2015-02-26 19:06 - 00000000 ____D () C:\ProgramData\Package Cache

2015-04-04 11:51 - 2013-08-22 17:36 - 00000000 ___HD () C:\WINDOWS\ELAMBKUP

2015-04-04 11:39 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files\Common Files\microsoft shared

2015-04-04 11:38 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\rescache

2015-04-04 11:00 - 2013-08-22 17:43 - 00000000 ____D () C:\WINDOWS\DigitalLocker

2015-04-03 14:55 - 2013-08-22 15:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM

2015-03-24 02:09 - 2015-02-26 19:34 - 00000000 ____D () C:\WINDOWS\System32\Tasks\Lenovo

2015-03-24 01:22 - 2015-02-26 19:39 - 00000000 ____D () C:\ProgramData\CyberLink

2015-03-23 20:58 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\PolicyDefinitions

2015-03-23 20:57 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\sr-Latn-RS

2015-03-23 20:57 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\sr-Latn-CS

2015-03-23 19:41 - 2013-08-22 16:44 - 00346960 _____ () C:\WINDOWS\system32\FNTCACHE.DAT

2015-03-23 19:40 - 2013-08-22 17:36 - 00000000 ___RD () C:\WINDOWS\ToastData

2015-03-23 19:40 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\MediaViewer

2015-03-23 19:40 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\FileManager

2015-03-23 19:40 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\Camera

2015-03-23 19:17 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\Help

2015-03-21 23:09 - 2015-02-26 19:18 - 00000000 ____D () C:\ProgramData\Lenovo

2015-03-21 22:58 - 2015-02-26 19:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lenovo

2015-03-21 22:58 - 2015-02-26 19:23 - 00000000 ____D () C:\Program Files (x86)\Lenovo

2015-03-21 22:56 - 2015-02-26 19:08 - 00000000 ____D () C:\ProgramData\Intel

2015-03-21 22:52 - 2015-02-26 19:36 - 00000000 ____D () C:\Users\Public\Documents\Lenovo

2015-03-21 22:51 - 2015-02-27 04:47 - 00149785 ____H () C:\WINDOWS\modules.log

2015-03-21 22:51 - 2014-04-03 21:15 - 00000000 ____D () C:\WINDOWS\Panther

2015-03-20 07:01 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files\Windows NT

2015-03-20 07:01 - 2013-08-22 15:36 - 00000000 ___HD () C:\Users\Default
 

Some content of TEMP:

====================

C:\Users\Winfried\AppData\Local\Temp\avgnt.exe
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-08-23 23:30
 

==================== End Of Log ============================

--- --- ---

Addition.txt

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-03-2015

Ran by Winfried at 2015-04-06 18:44:18

Running from C:\Users\Winfried\Desktop

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

(If an entry is included in the fixlist, it will be removed.)
 

AV: Avira Desktop (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: Avira Desktop (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 

==================== Installed Programs ======================
 

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 

 Lenovo Photo Master (HKLM-x32\...\InstallShield_{BC94C56A-3649-420C-8756-2ADEBE399D33}) (Version: 1.5.2126.02 - CyberLink Corp.)

 Lenovo Photo Master (x32 Version: 1.5.2126.02 - CyberLink Corp.) Hidden

Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.134 - Adobe Systems Incorporated)

Avira (HKLM-x32\...\{bd538030-07d4-4999-a525-7fafa2483f56}) (Version: 1.1.30.21727 - Avira Operations & Co. KG)

Avira (x32 Version: 1.1.30.21727 - Avira Operations & Co. KG) Hidden

Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 15.0.8.656 - Avira)

Benutzerhandbücher (x32 Version: 3.0.0.3 - Lenovo) Hidden

CCSDK (HKLM-x32\...\{AE75190B-11B4-4F90-8254-DAB275CF2557}_is1) (Version: 1.1.0.7 - Lenovo)

Conexant HD Audio (HKLM\...\CNXT_AUDIO_HDA) (Version: 8.65.55.0 - Conexant)

CyberLink PowerDirector 10 (HKLM-x32\...\InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}) (Version: 10.0.0.2810 - CyberLink Corp.)

CyberLink PowerDirector 10 (Version: 10.0.0.2810 - CyberLink Corp.) Hidden

Dependency Package Update (Version: 1.6.29.00 - Lenovo Inc.) Hidden

Dependency Package Update (Version: 1.6.36.00 - Lenovo Inc.) Hidden

Dependency Package Update (x32 Version: 1.6.32.00 - Lenovo Group Limited) Hidden

ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version:  - )

Harmony (HKLM-x32\...\{D02D9427-507D-4912-9285-97FCD5417E72}) (Version: 1.0.0.0929 - Lenovo)

Harmony (x32 Version: 1.0.0.0929 - Lenovo) Hidden

Intel Collaborative Processor Performance Control (HKLM-x32\...\0E7DAF70-FB54-4B91-B192-7E771C25AEEB) (Version: 1.0.0.1018 - Intel Corporation)

Intel(R) Dynamic Platform and Thermal Framework (HKLM-x32\...\{654EE65D-FAA4-4EA6-8C07-DC94E6A304D4}) (Version: 8.0.10100.71 - Intel Corporation)

Intel(R) Management Engine Components (HKLM\...\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 10.0.30.1072 - Intel Corporation)

Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.14.4029 - Intel Corporation)

Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 13.5.0.1056 - Intel Corporation)

Intel(R) Update Manager (HKLM-x32\...\{84A2B59B-6A7B-4C01-8592-15C9BFE6AC36}) (Version: 2.4.3 - Intel Corporation)

Intel(R) Wireless Bluetooth(R) (HKLM-x32\...\{5BC2A343-DED5-40E8-8F64-472FD74D80EA}) (Version: 17.1.1433.02 - Intel Corporation)

Intel® Chipsatz-Gerätesoftware (x32 Version: 10.0.22 - Intel(R) Corporation) Hidden

Intel® PROSet/Wireless Software (HKLM-x32\...\{c78a13fd-4324-4ddb-a613-746d2461441d}) (Version: 17.13.1 - Intel Corporation)

Lenovo Dependency Package (HKLM\...\Lenovo Dependency Package_is1) (Version: 1.6.36.00 - Lenovo Group Limited)

Lenovo EasyCamera (HKLM-x32\...\{E399A5B3-ED53-4DEA-AF04-8011E1EB1EAC}) (Version: 6.3.9600.11064 - Realtek Semiconductor Corp.)

Lenovo Experience Improvement (HKLM\...\LenovoExperienceImprovement) (Version: 1.0.19.0 - Lenovo)

Lenovo FusionEngine  (HKLM-x32\...\Lenovo FusionEngine) (Version: 1.0.13.0 - Lenovo, Inc.)

Lenovo Mobile Phone Wireless Import (HKLM-x32\...\InstallShield_{DFB2E0D6-8DDE-49A4-B8F7-03C14DACCBA6}) (Version: 1.1.1.9 - Lenovo)

Lenovo Mobile Phone Wireless Import (x32 Version: 1.1.1.9 - Lenovo) Hidden

Lenovo Motion Control (HKLM-x32\...\InstallShield_{D3F38500-4C99-4E4F-9786-B907224E13A1}) (Version: 2.6.0.0528 - PointGrab)

Lenovo Motion Control (x32 Version: 2.6.0.0528 - PointGrab) Hidden

Lenovo OneKey Recovery (HKLM-x32\...\InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}) (Version: 8.1.0.2619 - CyberLink Corp.)

Lenovo OneKey Recovery (Version: 8.1.0.2619 - CyberLink Corp.) Hidden

Lenovo Paper Display (HKLM-x32\...\InstallShield_{B5E4B638-FFF0-408F-9FB6-732CAFC73063}) (Version: 2.0.0.035 - Lenovo)

Lenovo Paper Display (x32 Version: 2.0.0.035 - Lenovo) Hidden

Lenovo Patch Utility (x32 Version: 1.3.2.6 - Lenovo Group Limited) Hidden

Lenovo Patch Utility 64 bit (Version: 1.3.2.6 - Lenovo Group Limited) Hidden

Lenovo PhoneCompanion (HKLM-x32\...\InstallShield_{0F82EA83-B0C5-4AB9-9695-DFE92C5FD57B}) (Version: 2.0.0.19 - Lenovo)

Lenovo PhoneCompanion (x32 Version: 2.0.0.19 - Lenovo) Hidden

Lenovo Settings - Camera Audio (HKLM\...\{88C6A6D9-324C-46E8-BA87-563D14021442}_is1) (Version: 4.3.5.0 - Lenovo Corporation)

Lenovo Settings (HKLM\...\{D14CCBF5-1A3A-4C08-955B-BE6D519835C4}_is1) (Version: 2.0.0.5 - Lenovo)

Lenovo Settings Dependency Package (HKLM\...\{3694BA2E-BE31-4B7E-886B-A0B559E69D4D}_is1) (Version: 2.3.1.28 - Lenovo Group Limited)

Lenovo Settings Service (HKLM\...\{8C6F1EBA-17F1-4481-B688-9777E63E985F}_is1) (Version: 2.3.0.20 - Lenovo Group Limited)

Lenovo Settings UMDF driver (HKLM\...\{2BDC7413-65EA-4B99-8C4B-02F11075BE6D}_is1) (Version: 1.2.0.6 - Lenovo Group Limited)

Lenovo Settings WiFi (HKLM\...\{86045A6C-C156-4349-A3E2-47A88A42F5C2}_is1) (Version: 2.0.0.3 - Lenovo)

Lenovo VeriFace Pro (HKLM\...\Lenovo VeriFace) (Version: 5.1.14.6181 - Lenovo)

Lenovo Yoga 3 Demo (HKLM-x32\...\{9B02CB47-B0E8-4BC8-9BF3-8EFF3CDEA30E}) (Version: 2.0.2 - Lenovo)

LenovoUtility (HKLM-x32\...\InstallShield_{6ADA7E88-8D16-4D0D-BC90-2B93AC5E56DA}) (Version: 2.0.0.3 - Lenovo)

LenovoUtility (x32 Version: 2.0.0.3 - Lenovo) Hidden

Malwarebytes Anti-Malware Version 2.1.4.1018 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.4.1018 - Malwarebytes Corporation)

Maxx Audio Installer (x64) (Version: 1.6.4815.83 - Waves Audio Ltd.) Hidden

Metric Collection SDK 35 (x32 Version: 1.2.0006.00 - Lenovo Group Limited) Hidden

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)

Mozilla Firefox 37.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 37.0.1 (x86 de)) (Version: 37.0.1 - Mozilla)

Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 37.0.1 - Mozilla)

Nitro Pro 9 (HKLM\...\{4C32F7E8-A65F-4D3C-9153-9F3B57CB6872}) (Version: 9.0.5.9 - Nitro)

OneKey Optimizer (HKLM-x32\...\InstallShield_{D5D573DC-D989-4769-9B56-D6A7EA503D7F}) (Version: 1.1.20.16 - Lenovo)

OneKey Optimizer (x32 Version: 1.1.20.16 - Lenovo) Hidden

Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.3.9600.39060 - Realtek Semiconductor Corp.)

Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)

SHAREit (HKLM-x32\...\SHAREit_is1) (Version: 2.1.8.0 - Lenovo Group Limited)

Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 18.0.7.89 - Synaptics Incorporated)

User Manuals (HKLM-x32\...\InstallShield_{F07C2CF8-4C53-4EC3-8162-A6221E36EB88}) (Version: 3.0.0.3 - Lenovo)

Windows-Treiberpaket - Lenovo (ACPIVPC) System  (09/24/2013 19.29.2.34) (HKLM\...\EE9B1F2037C580F36D92FA431CC02BFF04C31F15) (Version: 09/24/2013 19.29.2.34 - Lenovo)

Windows-Treiberpaket - Lenovo (WUDFRd) LenovoVhid  (07/25/2013 10.30.0.288) (HKLM\...\6BCA401E9CBEED970D75F55FA5320F60D11984E9) (Version: 07/25/2013 10.30.0.288 - Lenovo)
 

==================== Custom CLSID (selected items): ==========================
 

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
 
 

==================== Restore Points  =========================
 

06-04-2015 18:25:56 Revo Uninstaller's restore point - Mozilla Firefox 36.0.4 (x86 de)
 

==================== Hosts content: ==========================
 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 

2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts
 

==================== Scheduled Tasks (whitelisted) =============
 

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
 

Task: {1CC7F122-A63D-47B3-9250-6CB00B5B0319} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473 => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [2014-04-09] ()

Task: {22C94394-D734-41DC-8A7E-E859D77628A6} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program 64 35 => C:\Program Files (x86)\Lenovo\Customer Feedback Program 35\Lenovo.TVT.CustomerFeedback.Agent35.exe [2014-09-10] (Lenovo)

Task: {269FBE55-C11D-446A-AF92-F49D575851EC} - System32\Tasks\oDweklayyunBXthwbuHX => C:\Users\Winfried\AppData\Roaming\oDweklayyunBXthwbuHX.exe

Task: {2FD9A8B3-9F46-48AF-BAAC-A808A4D7FDC7} - System32\Tasks\Lenovo\Experience Improvement => C:\Program Files\Lenovo\ExperienceImprovement\LenovoExperienceImprovement.exe [2015-03-21] (Lenovo)

Task: {4378E825-0D7A-4F9A-B061-5D10172E1712} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-03-23] (Adobe Systems Incorporated)

Task: {566F4469-2726-4A4E-B3C1-2CDD24B9158F} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473-Logon => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [2014-04-09] ()

Task: {6C8EB349-E5D0-467D-9956-A62A5D04324A} - System32\Tasks\Lenovo\Dependency Package Auto Update => C:\Program Files\Lenovo\iMController\AutoUpdate.exe [2015-03-06] ()

Task: {7752E575-2FA9-4CC6-B3DF-29BB9B0C01AF} - System32\Tasks\disco_savings_notification_service => C:\Program Files (x86)\disco savings\disco_savings_notification_service.exe

Task: {E6BB0C1A-F09D-4228-9C91-789445B8BCAA} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program 64 => C:\Program Files (x86)\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe [2014-09-02] (Lenovo)

Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\WINDOWS\Tasks\disco_savings_notification_service.job => C:\Program Files (x86)\disco savings\disco_savings_notification_service.exeé/url='http:/cdn.selectbestopt.com/notf_sys/index.html' /crregname='disco savings' /appid='73143' /srcid='2913' /bic='f443762ed80e68e9a05cdcfa979034b6' /verifier='fe5513bae41efa38680f32b84a75c913' /installerversion='1.50.3.10' /statsdomain='http:/stats.buildomserv.com/data.gif?' /errorsdomain='http:/stats.buildomserv.com/data.gif?' /monetizationdomain='http:/logs.buildomserv.com/monetization.gif

Task: C:\WINDOWS\Tasks\oDweklayyunBXthwbuHX.job => C:\Users\Winfried\AppData\Roaming\oDweklayyunBXthwbuHX.exe
 

==================== Loaded Modules (whitelisted) ==============
 

2015-02-26 19:36 - 2014-08-25 11:26 - 00017176 _____ () C:\Program Files (x86)\Lenovo\Harmony\Picks\HarmonyPicksService.exe

2015-02-26 19:36 - 2014-09-04 15:46 - 00017688 _____ () C:\Program Files (x86)\Lenovo\Harmony\Setting\HarmonySettingService.exe

2015-02-26 19:36 - 2014-09-28 17:29 - 00065304 _____ () C:\Program Files (x86)\Lenovo\Harmony\Setting\Util.dll

2015-04-04 13:30 - 2015-04-04 13:30 - 00632320 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\Windows.Security\c7f6d022c5d5aec4891cb6b3b9934336\Windows.Security.ni.dll

2015-02-26 19:38 - 2015-02-26 19:37 - 00133440 _____ () C:\Program Files\Lenovo PhoneCompanion\LPAWDService.exe

2014-11-25 15:54 - 2014-11-25 15:54 - 00026392 _____ () C:\Program Files (x86)\Lenovo\PaperDisplay\x86\PLHotkeyService.exe

2015-02-26 19:37 - 2012-04-24 12:43 - 00390632 ____N () C:\Program Files\CyberLink\Shared files\RichVideo64.exe

2015-02-26 19:34 - 2015-02-26 19:34 - 00068880 _____ () C:\Program Files (x86)\Lenovo\Lenovo VeriFace Pro\VfConnectorService.exe

2015-02-26 19:34 - 2015-02-26 19:34 - 00672016 _____ () C:\Program Files (x86)\Lenovo\Lenovo VeriFace Pro\VfDataStorageInterface.dll

2015-02-26 19:36 - 2014-05-20 17:16 - 00061200 _____ () C:\ProgramData\LenovoTransition\Server\x64\dptf.dll

2015-02-26 19:39 - 2014-11-17 16:35 - 00036632 _____ () C:\Program Files\Lenovo\OneKey Optimizer\bin\Metric.dll

2015-02-26 19:39 - 2014-11-17 16:35 - 00166680 _____ () C:\Program Files\Lenovo\OneKey Optimizer\bin\Lenovo.MetricCollectionMFCx64.dll

2014-12-08 05:10 - 2014-11-21 10:54 - 00456808 _____ () C:\WINDOWS\system32\igfxTray.exe

2015-02-26 19:10 - 2010-10-26 06:40 - 00049056 _____ () C:\Program Files\CONEXANT\ForteConfig\fmapp.exe

2015-02-26 19:34 - 2015-02-26 19:34 - 00791368 _____ () C:\Program Files\Lenovo\LenovoUtility\utility.exe

2015-02-26 19:34 - 2015-02-26 19:34 - 00097048 _____ () C:\Program Files\Lenovo\LenovoUtility\kbdhook.dll

2015-02-26 19:36 - 2014-08-14 11:47 - 00109840 _____ () C:\Program Files (x86)\Lenovo\LenovoTransition\TransitionServer.exe

2015-02-26 19:39 - 2014-11-17 16:35 - 00047896 _____ () C:\Program Files\Lenovo\OneKey Optimizer\bin\res_GR_German_DEU.dll

2015-02-26 19:36 - 2014-09-28 17:29 - 00065304 _____ () C:\Program Files (x86)\Lenovo\Harmony\Picks\Util.dll

2015-02-26 19:36 - 2014-09-15 13:21 - 00018200 _____ () C:\Program Files (x86)\Lenovo\Harmony\Picks\RemoteObject.dll

2015-04-04 13:30 - 2015-04-04 13:30 - 00207872 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\Windows.System\a4efa88b742703220e527956d8ab4e84\Windows.System.ni.dll

2015-04-04 13:30 - 2015-04-04 13:30 - 00363520 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\Windows.Foundation\6382e6f5ad8b7a9db4f5cd4817e70319\Windows.Foundation.ni.dll

2014-05-28 14:16 - 2014-05-28 14:16 - 00013576 _____ () C:\Program Files (x86)\Lenovo\Motion Control\PointGrabDeviceAPI.dll

2015-04-04 13:30 - 2015-04-04 13:30 - 00402432 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Windows.Security\ade4f25e9d8384f190ede9eb090281cb\Windows.Security.ni.dll

2015-04-04 13:30 - 2015-04-04 13:30 - 00797696 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Windows.Networking\e1a2f3f274995f1f847c00f962657943\Windows.Networking.ni.dll

2015-04-04 13:30 - 2015-04-04 13:30 - 00228864 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Windows.Foundation\f7e726805e56676bd7b8662a3d842b0e\Windows.Foundation.ni.dll

2015-04-04 13:30 - 2015-04-04 13:30 - 00133120 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Windows.System\7819e306c2c55c42f35a5fa10b93710f\Windows.System.ni.dll

2015-02-26 19:36 - 2014-08-25 11:32 - 00168216 _____ () C:\Program Files (x86)\Lenovo\Harmony\Setting\PG_SettingsLib.dll

2015-02-26 19:36 - 2014-08-25 11:30 - 00018200 _____ () C:\Program Files (x86)\Lenovo\Harmony\Setting\Lenovo.Harmonydll.dll
 

==================== Alternate Data Streams (whitelisted) =========
 

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
 

AlternateDataStreams: C:\Windows:nlsPreferences

AlternateDataStreams: C:\Users\Winfried\OneDrive:ms-properties
 

==================== Safe Mode (whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
 

==================== EXE Association (whitelisted) ===============
 

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
 
 

==================== Other Areas ============================
 

(Currently there is no automatic fix for this section.)
 

HKU\S-1-5-21-1872664996-1993104736-2441894966-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Winfried\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper

DNS Servers: 192.168.178.1
 

==================== MSCONFIG/TASK MANAGER disabled items ==
 

(Currently there is no automatic fix for this section.)
 
 

==================== Accounts: =============================
 

Administrator (S-1-5-21-1872664996-1993104736-2441894966-500 - Administrator - Disabled)

Gast (S-1-5-21-1872664996-1993104736-2441894966-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-1872664996-1993104736-2441894966-1003 - Limited - Enabled)

Winfried (S-1-5-21-1872664996-1993104736-2441894966-1001 - Administrator - Enabled) => C:\Users\Winfried
 

==================== Faulty Device Manager Devices =============
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (04/06/2015 06:43:06 PM) (Source: PLCoreService) (EventID: 0) (User: )

Description: PLCoreServicereg session lock = failed w/err 0x00000000
 

Error: (04/06/2015 06:43:06 PM) (Source: PLCoreService) (EventID: 0) (User: )

Description: PLCoreServicesession change id =  failed w/err 0x00000001
 

Error: (04/06/2015 06:42:57 PM) (Source: PLCoreService) (EventID: 0) (User: )

Description: PLCoreServiceevent type =  failed w/err 0x00008013
 

Error: (04/06/2015 06:42:57 PM) (Source: PLCoreService) (EventID: 0) (User: )

Description: PLCoreServiceevent type =  failed w/err 0x00008013
 

Error: (04/06/2015 06:42:57 PM) (Source: PLCoreService) (EventID: 0) (User: )

Description: PLCoreServiceget IsPDenable flag =  failed w/err 0x00000000
 

Error: (04/06/2015 06:42:39 PM) (Source: PLCoreService) (EventID: 0) (User: )

Description: PLCoreServicereg session lock = failed w/err 0x00000001
 

Error: (04/06/2015 06:42:39 PM) (Source: PLCoreService) (EventID: 0) (User: )

Description: PLCoreServicesession change id =  failed w/err 0x00000005
 

Error: (04/06/2015 06:42:38 PM) (Source: DPTF) (EventID: 256) (User: )

Description: Intel(R) Dynamic Platform and Thermal Framework : ESIF(8.0.10100.71) TYPE: ERROR FUNC: rsrc_app_start_app_in_active_user_session FILE: rsrc_app.c LINE: 328
 

Unable to start capture program. Error = 2
 

Error: (04/06/2015 06:42:11 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 37.0.1.5570, Zeitstempel: 0x551e23ee

Name des fehlerhaften Moduls: mozalloc.dll, Version: 37.0.1.5570, Zeitstempel: 0x551e1536

Ausnahmecode: 0x80000003

Fehleroffset: 0x00001aa1

ID des fehlerhaften Prozesses: 0x1eac

Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0

Pfad der fehlerhaften Anwendung: plugin-container.exe1

Pfad des fehlerhaften Moduls: plugin-container.exe2

Berichtskennung: plugin-container.exe3

Vollständiger Name des fehlerhaften Pakets: plugin-container.exe4

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: plugin-container.exe5
 

Error: (04/06/2015 06:22:17 PM) (Source: PLCoreService) (EventID: 0) (User: )

Description: PLCoreServicereg session lock = failed w/err 0x00000000
 
 

System errors:

=============

Error: (04/06/2015 06:43:29 PM) (Source: NetBT) (EventID: 4321) (User: )

Description: Der Name "WORKGROUP      :1d" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.178.24

registriert werden. Der Computer mit IP-Adresse 192.168.178.1 hat nicht

zugelassen, dass dieser Computer diesen Namen verwendet.
 

Error: (04/06/2015 02:51:46 PM) (Source: DCOM) (EventID: 10010) (User: KLEINERPCANDI)

Description: {03E64E17-B220-4052-9B9B-155F9CB8E016}
 

Error: (04/06/2015 02:51:45 PM) (Source: DCOM) (EventID: 10010) (User: KLEINERPCANDI)

Description: {03E64E17-B220-4052-9B9B-155F9CB8E016}
 

Error: (04/06/2015 02:51:45 PM) (Source: DCOM) (EventID: 10010) (User: KLEINERPCANDI)

Description: {03E64E17-B220-4052-9B9B-155F9CB8E016}
 

Error: (04/06/2015 02:51:43 PM) (Source: DCOM) (EventID: 10010) (User: KLEINERPCANDI)

Description: {03E64E17-B220-4052-9B9B-155F9CB8E016}
 

Error: (04/05/2015 07:08:34 PM) (Source: DCOM) (EventID: 10010) (User: KLEINERPCANDI)

Description: {9AA46009-3CE0-458A-A354-715610A075E6}
 

Error: (04/05/2015 07:08:04 PM) (Source: DCOM) (EventID: 10010) (User: KLEINERPCANDI)

Description: {9AA46009-3CE0-458A-A354-715610A075E6}
 

Error: (04/05/2015 07:07:34 PM) (Source: DCOM) (EventID: 10010) (User: KLEINERPCANDI)

Description: {9AA46009-3CE0-458A-A354-715610A075E6}
 
 

Microsoft Office Sessions:

=========================

Error: (04/06/2015 06:43:06 PM) (Source: PLCoreService) (EventID: 0) (User: )

Description: PLCoreServicereg session lock = failed w/err 0x00000000
 

Error: (04/06/2015 06:43:06 PM) (Source: PLCoreService) (EventID: 0) (User: )

Description: PLCoreServicesession change id =  failed w/err 0x00000001
 

Error: (04/06/2015 06:42:57 PM) (Source: PLCoreService) (EventID: 0) (User: )

Description: PLCoreServiceevent type =  failed w/err 0x00008013
 

Error: (04/06/2015 06:42:57 PM) (Source: PLCoreService) (EventID: 0) (User: )

Description: PLCoreServiceevent type =  failed w/err 0x00008013
 

Error: (04/06/2015 06:42:57 PM) (Source: PLCoreService) (EventID: 0) (User: )

Description: PLCoreServiceget IsPDenable flag =  failed w/err 0x00000000
 

Error: (04/06/2015 06:42:39 PM) (Source: PLCoreService) (EventID: 0) (User: )

Description: PLCoreServicereg session lock = failed w/err 0x00000001
 

Error: (04/06/2015 06:42:39 PM) (Source: PLCoreService) (EventID: 0) (User: )

Description: PLCoreServicesession change id =  failed w/err 0x00000005
 

Error: (04/06/2015 06:42:38 PM) (Source: DPTF) (EventID: 256) (User: )

Description: Intel(R) Dynamic Platform and Thermal FrameworkESIF(8.0.10100.71) TYPE: ERROR FUNC: rsrc_app_start_app_in_active_user_session FILE: rsrc_app.c LINE: 328
 

Unable to start capture program. Error = 2
 

Error: (04/06/2015 06:42:11 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: plugin-container.exe37.0.1.5570551e23eemozalloc.dll37.0.1.5570551e15368000000300001aa11eac01d070886c98dbe5C:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dlldefc710a-dc7b-11e4-8271-f406691f3258
 

Error: (04/06/2015 06:22:17 PM) (Source: PLCoreService) (EventID: 0) (User: )

Description: PLCoreServicereg session lock = failed w/err 0x00000000
 
 

==================== Memory info =========================== 
 

Processor: Intel(R) Core(TM) i5-5200U CPU @ 2.20GHz

Percentage of memory in use: 38%

Total physical RAM: 3977.11 MB

Available physical RAM: 2465.26 MB

Total Pagefile: 8073.11 MB

Available Pagefile: 6174.96 MB

Total Virtual: 131072 MB

Available Virtual: 131071.85 MB
 

==================== Drives ================================
 

Drive c: (Windows8_OS) (Fixed) (Total:103.08 GB) (Free:71.13 GB) NTFS ==>[System with boot components (obtained from reading drive)]
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (Size: 119.2 GB) (Disk ID: 7CB0AFFE)
 

Partition: GPT Partition Type.
 

==================== End Of Log ============================

Es scheint sich tatsächlich die Problematik gelöst zu haben. Es öffnen sich auf jeden Fall keine kleinen ad-Fenster mehr und auch so läuft das Internet. Danke für die Tolle Hilfe erstmal.

Wären natürlich noch die Sachen alle zu entfernen, dafür gebt ihr doch auch meist ne Anweisung!? Und dann noch eine Frage, was du an Schutz empfielst? Vielleicht gibt es was um Adware und Popups dauerhaft zu blocken? Ist AntiVir erstmal ok als Virenschutz? Der Besitzer hat glaub ein Norton-ABo und würde dann Norton auf dem Laptop installieren.

Danke für die schnelle Hilfe :daumenhoc

Ich empfehle immer Emsisoft, ich arbeite aber auch da :)

http://deeprybka.trojaner-board.de/b...cleanupneu.png
Cleanup:
(Die Reihenfolge ist hier entscheidend)

Falls Defogger verwendet wurde: Erneut starten und auf Re-enable klicken.

Falls Combofix verwendet wurde:
http://deeprybka.trojaner-board.de/b.../combofix2.pngCombofix deinstallieren

Wichtig: Bitte Antivirus-Programm, evtl. vorhandenes Skript-Blocking und Anti-Malware Programme deaktivieren.
Drücke bitte die http://deeprybka.trojaner-board.de/b...ne/revo/w7.png + R Taste und schreibe Combofix /Uninstall in das Ausführen-Fenster.
Klicke auf OK.
Damit wird Combofix komplett entfernt und der Cache der Systemwiederherstellung geleert.
Nun die eben deaktivierten Programme wieder aktivieren.

Alle Logs gepostet? Dann lade Dir bitte http://filepony.de/icon/tiny/delfix.pngDelFix herunter.

Schließe alle offenen Programme.
Starte die delfix.exe mit einem Doppelklick.
Setze vor jede Funktion ein Häkchen.
Klicke auf Start.

Hinweis: DelFix entfernt u.a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
Starte Deinen Rechner abschließend neu. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein, kannst Du diese bedenkenlos löschen.

Wenn Du möchtest, kannst Du hier sagen, ob Du mit mir und meiner Hilfe zufrieden warst...:dankeschoen:und/oder das Forum mit einer kleinen Spende http://www.trojaner-board.de/extra/spende.png unterstützen. :applaus:

http://deeprybka.trojaner-board.de/b...ast/schild.png
Absicherung:
Beim Betriebsystem Windows die automatischen Updates aktivieren. Auch die sicherheitsrelevante Software sollte immer nur in der aktuellsten Version vorliegen:

Browser
Java
Flash-Player
PDF-Reader

Sicherheitslücken in deren alten Versionen werden dazu ausgenutzt, um beim einfachen Besuch einer manipulierten Website per "Drive-by" Malware zu installieren.
Ich empfehle z.B. die Verwendung von Mozilla Firefox statt des Internet Explorers. Zudem lassen sich mit dem Firefox auch PDF-Dokumente öffnen.

Aktiviere eine Firewall. Die in Windows integrierte genügt im Normalfall völlig.

Verwende ein Antivirusprogramm mit Echtzeitscanner und stets aktueller Signaturendatenbank.
Meine Empfehlung:
http://filepony.de/icon/emsisoft_anti_malware.png
Emsisoft

Zusätzlich kannst Du Deinen PC regelmäßig mit Malwarebytes Anti-Malware und ESET scannen.

Optional:
http://filepony.de/icon/noscript.png NoScript verhindert das Ausführen von aktiven Inhalten (Java, JavaScript, Flash,...) für sämtliche Websites. Man kann aber nach dem Prinzip einer Whitelist festlegen, auf welchen Seiten Scripts erlaubt werden sollen.
http://filepony.de/icon/malwarebytes_anti_exploit.pngMalwarebytes Anti Exploit: Schützt die Anwendungen des Computers vor der Ausnutzung bekannter Schwachstellen.

Lade Software von einem sauberen Portal wie http://filepony.de/images/microbanner.gif.
Wähle beim Installieren von Software immer die benutzerdefinierte Option und entferne den Haken bei allen optional angebotenen Toolbars oder sonstigen, fürs Programm, irrelevanten Ergänzungen.
Um Adware wieder los zu werden, empfiehlt sich zunächst die Deinstallation sowie die anschließende Resteentfernung mit Adwcleaner .

Abschließend noch ein paar grundsätzliche Bemerkungen:
Ändere regelmäßig Deine wichtigen Online-Passwörter und erstelle regelmäßig Backups Deiner wichtigen Dateien oder des Systems.
Der Nutzen von Registry-Cleanern, Optimizern usw. zur Performancesteigerung ist umstritten. Ich empfehle deshalb, die Finger von der Registry zu lassen und lieber die windowseigene Datenträgerbereinigung zu verwenden.