Hallo Schrauber, anbei die letzten Logs zur Auswertung. Bin jetzt für den Rest des Tages nicht mehr online, da ich meinem Sohn helfen muss. Danke vorab für deine Hilfe.
FRST Logfile:
FRST Logfile: Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 16-10-2014
Ran by Gerhard (administrator) on GERHARD-PC on 18-10-2014 14:02:46
Running from G:\AdwareCleaner
Loaded Profiles: Gerhard & UpdatusUser (Available profiles: Gerhard & UpdatusUser & Gast)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 10
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(APN LLC.) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Framework\Common\avgsvca.exe
(Microsoft Corp.) C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe
(REINER SCT) C:\Windows\SysWOW64\cjpcsc.exe
() C:\Users\Gerhard\AppData\Local\FirmwareFreewareMacro\FirmwareFreewareMacro.exe
(Gladinet, INC) C:\Program Files (x86)\Nuance\Nuance Cloud Connector\GladFileMonSvc.exe
() E:\ORICO\ORICO Tools\IovstRouteService_win7.exe
() C:\Program Files (x86)\Nuance\Nuance Cloud Connector\WOSVSSSvr.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\VS7DEBUG\mdm.exe
(Micro-Star International) C:\Program Files (x86)\MSI\Live Update\MSI_LiveUpdate_Service.exe
(Nero AG) C:\Program Files (x86)\Nero\Nero BackItUp\NBService.exe
(Nuance Communications, Inc.) E:\Nuance\PaperPort\PDFProFiltSrvPP.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
(AVG Technologies) C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe
(AVG Secure Search) C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.1.9\ToolbarUpdater.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
() C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.1.9\loggingserver.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Trinit-Soft) E:\USB Wächter\USBWService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe
(AVG Technologies) C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesApp64.exe
(NewSoft Technology Corporation) C:\Windows\System32\spool\drivers\x64\3\WrtMon.exe
(Microsoft Corporation) C:\Program Files\Microsoft IntelliType Pro\itype.exe
(VIA Technologies, Inc.) C:\VIA_XHCI\usb3Monitor.exe
(NewSoft Technology Corporation) C:\Windows\System32\spool\drivers\x64\3\WrtProc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Apoint.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe
() C:\Users\Gerhard\AppData\Roaming\InetStat\inetstat.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(T-Com Bereich Endgeräte) E:\TOnline\OnlineControl\ocontrol.exe
() C:\Program Files (x86)\AVG Secure Search\vprot.exe
(Nuance Communications, Inc.) E:\PDF Create 7\PdfCreate7Hook.exe
(Nuance Communications, Inc.) E:\Nuance\PDFViewerPlus\pdfPro5Hook.exe
(Adobe Systems Inc.) E:\Adobe\Acrobat\acrotray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(APN) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Framework\Common\avguix.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApMsgFwd.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\hidfind.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApntEx.exe
(Microsoft Corporation) C:\Program Files\Microsoft IntelliType Pro\dpupdchk.exe
() C:\Users\Gerhard\AppData\Local\FirmwareFreewareMacro\LogNetRoot.exe
() C:\Windows\SysWOW64\CronODBCSprite\CronODBCSprite.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [WrtMon.exe] => C:\Windows\system32\spool\drivers\x64\3\WrtMon.exe [26448 2008-05-24] (NewSoft Technology Corporation)
HKLM\...\Run: [itype] => C:\Program Files\Microsoft IntelliType Pro\itype.exe [1873256 2011-08-10] (Microsoft Corporation)
HKLM\...\Run: [VIAxHCUtl] => C:\VIA_XHCI\usb3Monitor.exe [331776 2012-03-26] (VIA Technologies, Inc.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13656792 2013-10-04] (Realtek Semiconductor)
HKLM\...\Run: [Apoint] => C:\Program Files\Apoint2K\Apoint.exe [380760 2013-07-17] (Alps Electric Co., Ltd.)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [1796056 2014-08-19] (NVIDIA Corporation)
HKLM-x32\...\Run: [GrooveMonitor] => E:\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [NsPrtMon] => C:\Program Files\NewSoft\Presto! PrintCentral\NsPrtMon.exe [42832 2009-09-11] (NewSoft Technology Corporation)
HKLM-x32\...\Run: [PMSpeed] => C:\Program Files (x86)\NewSoft\Presto! PageManager 9.01\PMSpeed.EXE [116632 2010-07-29] (NewSoft Technology Corporation)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)
HKLM-x32\...\Run: [vProt] => C:\Program Files (x86)\AVG Secure Search\vprot.exe [2640408 2014-09-07] ()
HKLM-x32\...\Run: [KiesTrayAgent] => E:\Samsung\Kies\KiesTrayAgent.exe [311616 2014-07-25] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [OmniPage Preload] => E:\ScanSoft18\OmniPage18.exe [2987880 2011-08-15] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PDFCreHook] => E:\PDF Create 7\pdfcreate7hook.exe [605032 2011-06-28] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PDF7 Registry Controller] => E:\PDF Create 7\RegistryController.exe [140136 2011-06-28] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [IndexSearch] => E:\Nuance\PaperPort\IndexSearch.exe [46368 2010-02-11] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PDFHook] => E:\Nuance\PDFViewerPlus\pdfpro5hook.exe [1369376 2010-02-08] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PDF5 Registry Controller] => E:\Nuance\PDFViewerPlus\RegistryController.exe [62752 2010-02-08] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [Acrobat Assistant 8.0] => E:\Adobe\Acrobat\Acrotray.exe [840592 2014-09-04] (Adobe Systems Inc.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [703736 2014-10-07] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [ApnTBMon] => C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1942424 2014-10-09] (APN)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [AvgUi] => C:\Program Files (x86)\AVG\Framework\Common\avguix.exe [1104912 2014-08-20] (AVG Technologies CZ, s.r.o.)
HKU\S-1-5-21-1256300535-3656786790-4203701623-1001\...\Run: [LightScribe Control Panel] => C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2741616 2011-03-04] (Hewlett-Packard Company)
HKU\S-1-5-21-1256300535-3656786790-4203701623-1001\...\Run: [KiesPDLR] => E:\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [845120 2014-07-25] (Samsung)
HKU\S-1-5-21-1256300535-3656786790-4203701623-1001\...\Run: [TomTomHOME.exe] => C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248176 2014-06-05] (TomTom)
HKU\S-1-5-21-1256300535-3656786790-4203701623-1001\...\Run: [KiesPreload] => E:\Samsung\Kies\Kies.exe [1562264 2014-07-25] (Samsung)
HKU\S-1-5-21-1256300535-3656786790-4203701623-1001\...\Run: [InetStat] => C:\Users\Gerhard\AppData\Roaming\InetStat\inetstat.exe [700430 2014-10-12] ()
HKU\S-1-5-21-1256300535-3656786790-4203701623-1005\...\Run: [LightScribe Control Panel] => C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2741616 2011-03-04] (Hewlett-Packard Company)
HKU\S-1-5-21-1256300535-3656786790-4203701623-1005\...\Run: [TomTomHOME.exe] => "E:\TomTom HOME 2\TomTomHOMERunner.exe"
HKU\S-1-5-21-1256300535-3656786790-4203701623-1005\...\Run: [KiesHelper] => E:\Samsung\Kies\KiesHelper.exe /s
HKU\S-1-5-21-1256300535-3656786790-4203701623-1005\...\Run: [KiesPDLR] => E:\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [845120 2014-07-25] (Samsung)
HKU\S-1-5-21-1256300535-3656786790-4203701623-1005\...\Run: [OpAgent] => "OpAgent.exe" /agent
HKU\S-1-5-21-1256300535-3656786790-4203701623-1005\...\Run: [ISUSPM] => C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe [324976 2010-05-21] (Flexera Software, Inc.)
HKU\S-1-5-21-1256300535-3656786790-4203701623-1005\...\Run: [Duden Korrektor SysTray] => E:\Duden-Rechtschreibprüfung\DKTray.exe [347792 2011-12-23] (Expert System S.p.A.)
HKU\S-1-5-21-1256300535-3656786790-4203701623-1005\...\Run: [AVG-Secure-Search-Update_JUNE2013_TB] => C:\Program Files (x86)\AVG Secure Search\AVG-Secure-Search-Update_JUNE2013_TB.exe [1266712 2013-06-11] (AVG Secure Search)
HKU\S-1-5-21-1256300535-3656786790-4203701623-1005\...\MountPoints2: {a4686039-67f6-11df-a1d0-806e6f6e6963} - K:\AUTORUN.EXE
HKU\S-1-5-21-1256300535-3656786790-4203701623-1005\...\MountPoints2: {b0dc9a48-a89c-11e1-9d81-806e6f6e6963} - D:\setup.exe
HKU\S-1-5-18\...\Run: [Duden Korrektor SysTray] => E:\Duden-Rechtschreibprüfung\DKTray.exe [347792 2011-12-23] (Expert System S.p.A.)
IFEO\kies.exe: [Debugger] "C:\Program Files (x86)\AVG\AVG PC TuneUp\TUAutoReactivator64.exe"
IFEO\kiesagent.exe: [Debugger] "C:\Program Files (x86)\AVG\AVG PC TuneUp\TUAutoReactivator64.exe"
IFEO\setup.exe: [Debugger] "C:\Program Files (x86)\AVG\AVG PC TuneUp\TUAutoReactivator64.exe"
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Office-Bibliothek-Direktsuche.lnk
ShortcutTarget: Office-Bibliothek-Direktsuche.lnk -> E:\Fremdwörterlexikon\PCLib.exe ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\OnlineControl.lnk
ShortcutTarget: OnlineControl.lnk -> E:\TOnline\OnlineControl\ocontrol.exe (T-Com Bereich Endgeräte)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Quicken 2012 Zahlungserinnerung.lnk
ShortcutTarget: Quicken 2012 Zahlungserinnerung.lnk -> C:\Windows\Installer\{2FC7CE3A-23E5-41E8-975B-AA0236D649FD}\BillMinder.8C5DA79E_7079_4AB3_81F7_712153351D0D.exe (Macrovision Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\VR-NetWorld Auftragsprüfung.lnk
ShortcutTarget: VR-NetWorld Auftragsprüfung.lnk -> E:\VR-NetWorld\vrtoolcheckorder.exe (VR-NetWorld Software)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WISO Mein Steuer-Sparbuch heute.lnk
ShortcutTarget: WISO Mein Steuer-Sparbuch heute.lnk -> E:\WISO2013\mshaktuell.exe ()
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL-Manager.lnk
ShortcutTarget: DSL-Manager.lnk -> E:\TOnline\DslMgr.exe (T-Systems Enterprise Services GmbH)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL-Manager.lnk
ShortcutTarget: DSL-Manager.lnk -> E:\TOnline\DslMgr.exe (T-Systems Enterprise Services GmbH)
Startup: C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL-Manager.lnk
ShortcutTarget: DSL-Manager.lnk -> E:\TOnline\DslMgr.exe (T-Systems Enterprise Services GmbH)
Startup: C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL-Manager.lnk
ShortcutTarget: DSL-Manager.lnk -> E:\TOnline\DslMgr.exe (T-Systems Enterprise Services GmbH)
ShellIconOverlayIdentifiers: [GladinetIconOverlay] -> {3C3DC57A-7535-48AF-BB9E-C3576A4F34D0} => C:\Program Files (x86)\Nuance\Nuance Cloud Connector\GlOverlayIcon.dll (Gladinet, INC)
ShellIconOverlayIdentifiers: [GladinetUploading] -> {959A18D3-9CC9-41e8-B76F-34ED9A89D4EA} => C:\Program Files (x86)\Nuance\Nuance Cloud Connector\GlOverlayIconU.dll (Gladinet, INC)
ShellIconOverlayIdentifiers-x32: [GladinetIconOverlay] -> {3C3DC57A-7535-48AF-BB9E-C3576A4F34D0} => C:\Program Files (x86)\Nuance\Nuance Cloud Connector\GlOverlayIcon32.dll (Gladinet, INC)
ShellIconOverlayIdentifiers-x32: [GladinetUploading] -> {959A18D3-9CC9-41e8-B76F-34ED9A89D4EA} => C:\Program Files (x86)\Nuance\Nuance Cloud Connector\GlOverlayIconU32.dll (Gladinet, INC)
ShellIconOverlayIdentifiers-x32: [Groove Explorer Icon Overlay 1 (GFS Unread Stub)] -> {99FD978C-D287-4F50-827F-B2C658EDA8E7} => E:\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [Groove Explorer Icon Overlay 2 (GFS Stub)] -> {AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} => E:\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)] -> {920E6DB1-9907-4370-B3A0-BAFC03D81399} => E:\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [Groove Explorer Icon Overlay 3 (GFS Folder)] -> {16F3DD56-1AF5-4347-846D-7C10C4192619} => E:\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [Groove Explorer Icon Overlay 4 (GFS Unread Mark)] -> {2916C86E-86A6-43FE-8112-43ABE6BF8DCC} => E:\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
ProxyEnable: Internet Explorer proxy is enabled.
ProxyServer: http=127.0.0.1:36169
HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = https://isearch.avg.com/?cid={0D4ACC5C-38CE-4F7D-AD5E-54266212ADC2}&mid=a43a809502ad47d18075d154d43bcf47-5dc7dab7a3820688bb38cbc250ac6ec4e6c96f07&lang=de&ds=tt014&pr=sa&d=2011-12-23 13:35:12&v=12.2.5.32&sap=hp
hxxp://www.microsoft.com/windows/ie/searchguide/de-de/default.mspx?dcsref=hxxp://runonce.msn.com/runonce2.aspx#
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/?pc=BDT3&ocid=bdtdhp
URLSearchHook: HKLM-x32 - BrowseToolE0191 Toolbar - {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Program Files (x86)\Winload\prxtbWin0.dll (Conduit Ltd.)
URLSearchHook: HKCU - BrowseToolE0191 Toolbar - {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Program Files (x86)\Winload\prxtbWin0.dll (Conduit Ltd.)
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
SearchScopes: HKLM-x32 - DefaultScope {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2319825
SearchScopes: HKLM-x32 - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2319825
SearchScopes: HKCU - {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=crm&q={searchTerms}&locale=&apn_ptnrs=&apn_dtid=OSJ000&apn_uid=AC0AF970-ABE5-4AE2-989D-14A6F42B02E5&apn_sauid=3107F890-C314-4F1A-B0A5-F9A477BAE173
SearchScopes: HKCU - {65D51F5B-E716-48F8-AA2B-B0851599B02B} URL = hxxp://www.google.de/search?q={searchTerms}
SearchScopes: HKCU - {8C86B2E0-AD99-4008-9A1E-8526E0B00130} URL = hxxp://www.google.de/search?q={searchTerms}
SearchScopes: HKCU - {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxp://isearch.avg.com/search?cid={0D4ACC5C-38CE-4F7D-AD5E-54266212ADC2}&mid=a43a809502ad47d18075d154d43bcf47-5dc7dab7a3820688bb38cbc250ac6ec4e6c96f07&lang=de&ds=tt014&pr=sa&d=2011-12-23 13:35:12&v=15.3.0.11&pid=avg&sg=0&sap=dsp&q={searchTerms}
SearchScopes: HKCU - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2319825
BHO: Avira SearchFree Toolbar -> {41564952-412D-5637-00A7-7A786E7484D7} -> C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll (APN LLC.)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: BrowseToolE0191 Toolbar -> {40c3cc16-7269-4b32-9531-17f2950fb06f} -> C:\Program Files (x86)\Winload\prxtbWin0.dll (Conduit Ltd.)
BHO-x32: Avira SearchFree Toolbar -> {41564952-412D-5637-00A7-7A786E7484D7} -> C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
BHO-x32: PlusIEEventHelper Class -> {551A852F-39A6-44A7-9C13-AFBEC9185A9D} -> E:\Nuance\PDFViewerPlus\Bin\PlusIEContextMenu.dll (Zeon Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> E:\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: AVG Security Toolbar -> {95B7759C-8C7F-4BF1-B163-73684A933233} -> C:\Program Files (x86)\AVG Secure Search\18.1.9.799\AVG Secure Search_toolbar.dll (AVG Secure Search)
BHO-x32: Adobe PDF Conversion Toolbar Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> E:\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: ZeonIEEventHelper Class -> {DA986D7D-CCAF-47B2-84FE-BFA1549BEBF9} -> E:\PDF Create 7\Bin\ZeonIEFavClient.dll (Zeon Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: SmartSelect Class -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll (APN LLC.)
Toolbar: HKLM-x32 - BrowseToolE0191 Toolbar - {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Program Files (x86)\Winload\prxtbWin0.dll (Conduit Ltd.)
Toolbar: HKLM-x32 - Steganos Password Manager Toolbar - {9C65D12D-CF9D-454D-8049-61965D8C6FFF} - E:\SteganosPM12\SPMIEToolbar.dll (Steganos Software GmbH)
Toolbar: HKLM-x32 - AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\18.1.9.799\AVG Secure Search_toolbar.dll (AVG Secure Search)
Toolbar: HKLM-x32 - DocuCom PDF - {E3286BF1-E654-42FF-B4A6-5E111731DF6B} - E:\PDF Create 7\Bin\ZeonIEFavClient.dll (Zeon Corporation)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
Toolbar: HKCU - No Name - {40C3CC16-7269-4B32-9531-17F2950FB06F} - No File
Toolbar: HKCU - No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
Toolbar: HKCU - No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No File
Handler: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\system32\urlmon.dll (Microsoft Corporation)
Handler-x32: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - No File
Handler-x32: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - E:\Office12\GrooveSystemServices.dll (Microsoft Corporation)
Handler-x32: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\18.1.9\ViProtocol.dll (AVG Secure Search)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin: @java.com/DTPlugin,version=10.45.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.45.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin -> C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\18.1.9\\npsitesafety.dll No File
FF Plugin-x32: @canon.com/MycameraPlugin -> C:\Program Files (x86)\Canon\ZoomBrowser EX\Program\NPCIG.dll (CANON INC.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> E:\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> E:\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @Nero.com/KM -> C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Acrobat -> E:\Adobe\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [{00F0643E-B367-4779-B45D-7046EBA37A88}] - E:\SteganosPM12\spmplugin3
FF Extension: Steganos Password Manager - E:\SteganosPM12\spmplugin3 [2010-06-02]
FF HKLM-x32\...\Firefox\Extensions: [avg@toolbar] - C:\ProgramData\AVG Secure Search\FireFoxExt\18.1.9.799
FF Extension: AVG Security Toolbar - C:\ProgramData\AVG Secure Search\FireFoxExt\18.1.9.799 [2014-09-07]
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - E:\Adobe\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - E:\Adobe\Acrobat\Browser\WCFirefoxExtn [2012-04-05]
FF HKLM-x32\...\Thunderbird\Extensions: [{857610fe-b36c-47f2-b4fa-6b7affe0cf5a}] - E:\Mobile Master\ext\1
FF Extension: Mobile Master Add-In - E:\Mobile Master\ext\1 [2014-09-30]
Chrome:
=======
CHR HKLM-x32\...\Chrome\Extension: [ndibdjnfmopecpmkdieinmbadjfpblof] - C:\ProgramData\AVG Secure Search\ChromeExt\17.3.0.49\avg.crx []
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [806704 2014-10-07] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-10-07] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-10-07] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [994096 2014-10-07] (Avira Operations GmbH & Co. KG)
R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [166296 2014-09-20] (APN LLC.)
R2 avgsvc; C:\Program Files (x86)\AVG\Framework\Common\avgsvca.exe [846864 2014-08-20] (AVG Technologies CZ, s.r.o.)
R2 BingDesktopUpdate; C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe [173192 2013-06-20] (Microsoft Corp.)
R2 cjpcsc; C:\Windows\SysWOW64\cjpcsc.exe [514128 2012-03-19] (REINER SCT)
R2 CronODBCSprite; C:\Windows\SysWOW64\CronODBCSprite\CronODBCSprite.exe [60453 2014-10-12] () [File not signed]
R2 FirmwareFreewareMacro.exe; C:\Users\Gerhard\AppData\Local\FirmwareFreewareMacro\FirmwareFreewareMacro.exe [129061 2014-10-12] () [File not signed]
R2 GladFileMonSvc; C:\Program Files (x86)\Nuance\Nuance Cloud Connector\GladFileMonSvc.exe [29552 2011-07-26] (Gladinet, INC)
R2 IovstRouterService; E:\ORICO\ORICO Tools\IovstRouteService_win7.exe [20480 2010-12-16] () [File not signed]
R2 LightScribeService; C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2011-03-04] (Hewlett-Packard Company) [File not signed]
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-10-01] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [968504 2014-10-01] (Malwarebytes Corporation)
R2 MDM; C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe [335872 2006-10-26] (Microsoft Corporation) [File not signed]
S3 Microsoft Office Groove Audit Service; E:\Office12\GrooveAuditService.exe [64856 2009-02-26] (Microsoft Corporation)
R2 MSI_LiveUpdate_Service; C:\Program Files (x86)\MSI\Live Update\MSI_LiveUpdate_Service.exe [1723856 2014-09-18] (Micro-Star International)
R2 NeroBackItUpBackgroundService; C:\Program Files (x86)\Nero\Nero BackItUp\NBService.exe [273248 2014-09-24] (Nero AG)
R2 PDFProFiltSrvPP; E:\Nuance\PaperPort\PDFProFiltSrvPP.exe [144672 2010-02-11] (Nuance Communications, Inc.)
S3 TDslMgrService; E:\TOnline\DslMgrSvc.exe [307200 2008-10-23] (T-Systems Enterprise Services GmbH) [File not signed]
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe [2538808 2014-09-04] (AVG Technologies)
R2 USBWaechter; E:\USB Wächter\USBWService.exe [2403840 2010-07-10] (Trinit-Soft) [File not signed]
R2 vToolbarUpdater18.1.9; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.1.9\ToolbarUpdater.exe [1820184 2014-08-11] (AVG Secure Search)
S2 HPSLPSVC; C:\Users\Gerhard\AppData\Local\Temp\7zS5C53\hpslpsvc64.dll [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-07] (Avira Operations GmbH & Co. KG)
R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [50976 2014-08-11] (AVG Technologies)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-10-07] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-31] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [43064 2014-10-07] (Avira Operations GmbH & Co. KG)
S2 CdaC15BA; C:\Windows\SysWOW64\drivers\CDAC15BA.SYS [8864 2011-06-17] () [File not signed]
S3 cjusb; C:\Windows\System32\DRIVERS\cjusb.sys [34672 2011-03-29] (REINER SCT)
S3 dgderdrv; C:\Windows\System32\drivers\dgderdrv.sys [20552 2010-10-25] (Devguru Co., Ltd)
R1 DslMNLwf; C:\Windows\System32\DRIVERS\dslmnlwf.sys [19008 2007-08-01] (T-Systems Enterprise Services GmbH)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2013-04-15] (DT Soft Ltd)
S3 FsUsbExDisk; C:\Windows\SysWOW64\FsUsbExDisk.SYS [37344 2013-12-30] () [File not signed]
R0 hotcore3; C:\Windows\System32\DRIVERS\hotcore3.sys [37392 2010-05-28] (Paragon Software Group)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-10-01] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2014-10-18] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-10-01] (Malwarebytes Corporation)
R3 NTIOLib_1_0_4; C:\Program Files (x86)\MSI\Live Update\NTIOLib_X64.sys [14136 2010-10-22] (MSI)
S4 sptd; C:\Windows\System32\Drivers\sptd.sys [564824 2013-11-23] (Duplex Secure Ltd.)
S1 StarOpen; C:\Windows\SysWow64\Drivers\StarOpen.sys [5632 2006-07-24] () [File not signed]
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesDriver64.sys [14112 2014-08-28] (TuneUp Software)
S3 xhcdrv; C:\Windows\System32\DRIVERS\xhcdrv.sys [256000 2012-03-26] (VIA Technologies, Inc.)
S3 cpuz132; \??\C:\Users\Gerhard\AppData\Local\Temp\cpuz132\cpuz132_x64.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-10-18 14:02 - 2014-10-18 14:02 - 00000000 ____D () C:\FRST
2014-10-18 13:17 - 2014-10-18 13:17 - 00000020 _____ () C:\Users\Gerhard\defogger_reenable
2014-10-18 11:14 - 2014-09-05 04:11 - 06584320 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-10-18 11:14 - 2014-09-05 03:52 - 05703168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2014-10-18 10:46 - 2014-09-29 02:58 - 03198976 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-10-18 10:46 - 2014-06-19 00:23 - 01943696 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll
2014-10-18 10:46 - 2014-06-19 00:23 - 01131664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dfshim.dll
2014-10-18 10:46 - 2014-06-19 00:23 - 00156824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscorier.dll
2014-10-18 10:46 - 2014-06-19 00:23 - 00156312 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll
2014-10-18 10:46 - 2014-06-19 00:23 - 00081560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscories.dll
2014-10-18 10:46 - 2014-06-19 00:23 - 00073880 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll
2014-10-18 09:40 - 2014-09-18 04:00 - 03241472 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-10-18 09:40 - 2014-09-18 03:32 - 02363904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-10-18 09:38 - 2014-09-13 03:58 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2014-10-18 09:38 - 2014-09-13 03:40 - 00067072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll
2014-10-18 09:38 - 2014-09-04 07:23 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll
2014-10-18 09:38 - 2014-09-04 07:04 - 00372736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastls.dll
2014-10-18 09:10 - 2014-10-18 13:24 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-10-18 09:09 - 2014-10-18 09:09 - 00001112 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-10-18 09:09 - 2014-10-18 09:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-10-18 09:09 - 2014-10-18 09:09 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-10-18 09:09 - 2014-10-18 09:09 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-10-18 09:09 - 2014-10-01 11:11 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-10-18 09:09 - 2014-10-01 11:11 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-10-18 09:09 - 2014-10-01 11:11 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-10-17 19:19 - 2014-10-17 19:19 - 00000000 ____D () C:\Users\Gerhard\AppData\Local\CheckCode
2014-10-12 14:16 - 2014-10-12 14:16 - 00000000 ____D () C:\Users\Gerhard\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\InetStat
2014-10-12 14:16 - 2014-10-12 14:16 - 00000000 ____D () C:\Users\Gerhard\AppData\Roaming\InetStat
2014-10-12 14:00 - 2014-10-12 14:00 - 00301608 _____ (VuuPC Limited) C:\Users\Gerhard\AppData\Local\nsc91A4.tmp
2014-10-12 14:00 - 2014-10-12 14:00 - 00000830 _____ () C:\Users\Gerhard\Desktop\Continue VuuPC Installation.lnk
2014-10-12 13:42 - 2014-10-12 14:14 - 00000000 ____D () C:\Users\Gerhard\AppData\Local\FirmwareFreewareMacro
2014-10-12 13:42 - 2014-10-12 13:42 - 00000000 ____D () C:\Windows\SysWOW64\CronODBCSprite
2014-10-12 13:35 - 2014-10-18 12:29 - 00000000 ____D () C:\Users\Gerhard\AppData\Local\StormWatch
2014-10-11 17:37 - 2014-10-11 17:37 - 00002041 _____ () C:\Users\Public\Desktop\MSI Live Update 6.lnk
2014-10-11 17:37 - 2014-10-11 17:37 - 00000000 ____D () C:\MSILU
2014-10-10 12:03 - 2014-10-10 12:07 - 00000000 ____D () C:\Users\Gerhard\HDR Projects
2014-10-10 12:02 - 2014-10-10 12:02 - 00000726 _____ () C:\Users\Public\Desktop\HDR Projects platin (64-Bit).lnk
2014-10-10 12:02 - 2014-10-10 12:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Franzis
2014-10-09 20:24 - 2014-10-09 20:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2014-10-09 20:16 - 2014-07-02 19:44 - 00609240 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
2014-10-09 20:16 - 2014-07-02 12:14 - 03826628 _____ () C:\Windows\system32\nvcoproc.bin
2014-10-09 18:46 - 2013-10-02 04:22 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbFlt.sys
2014-10-09 18:46 - 2013-10-02 04:11 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe
2014-10-09 18:46 - 2013-10-02 04:08 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll
2014-10-09 18:46 - 2013-10-02 03:48 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\MsRdpWebAccess.dll
2014-10-09 18:46 - 2013-10-02 03:48 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\wksprtPS.dll
2014-10-09 18:46 - 2013-10-02 03:29 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2014-10-09 18:46 - 2013-10-02 03:10 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbGDCoInstaller.dll
2014-10-09 18:46 - 2013-10-02 02:15 - 01057280 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll
2014-10-09 18:46 - 2013-10-02 02:14 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MsRdpWebAccess.dll
2014-10-09 18:46 - 2013-10-02 02:14 - 00017920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wksprtPS.dll
2014-10-09 18:46 - 2013-10-02 02:08 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2014-10-09 18:46 - 2013-10-02 02:01 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe
2014-10-09 18:46 - 2013-10-02 01:58 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2014-10-09 18:46 - 2013-10-02 01:31 - 01147392 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2014-10-09 18:46 - 2013-10-02 01:08 - 00855552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdvidcrl.dll
2014-10-09 18:46 - 2013-10-02 00:34 - 01068544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe
2014-10-09 16:34 - 2014-10-09 16:34 - 00000000 ____D () C:\Users\Public\Documents\NativeFus_Log
2014-10-09 16:34 - 2014-10-09 16:34 - 00000000 ____D () C:\Program Files (x86)\MyFree Codec
2014-10-09 16:28 - 2014-10-09 16:28 - 00000710 _____ () C:\Users\Public\Desktop\Samsung Kies (Lite).lnk
2014-10-09 16:27 - 2013-12-30 03:54 - 00233472 _____ (Teruten) C:\Windows\SysWOW64\FsUsbExService.Exe
2014-10-09 16:27 - 2013-12-30 03:54 - 00037344 _____ () C:\Windows\SysWOW64\FsUsbExDisk.Sys
2014-10-09 16:27 - 2013-12-30 03:54 - 00037344 _____ () C:\Windows\SysWOW64\FsUsbExDisk.Sy_
2014-10-09 16:27 - 2011-11-29 17:40 - 00110592 _____ () C:\Windows\SysWOW64\FsUsbExDevice.Dll
2014-10-09 15:32 - 2014-10-09 19:57 - 00002841 _____ () C:\Users\Public\Desktop\Nero 2015.lnk
2014-10-09 15:30 - 2014-10-09 19:59 - 00002115 _____ () C:\Users\Public\Desktop\Nero MediaHome.lnk
2014-10-09 15:22 - 2014-10-09 15:22 - 00000000 ____D () C:\ProgramData\Package Cache
2014-10-05 17:57 - 2014-10-05 17:57 - 00000000 ____D () C:\Users\Gerhard\AppData\Roaming\3DIS GmbH
2014-10-05 17:57 - 2014-10-05 17:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WebViewer
2014-10-05 17:57 - 2014-10-05 17:57 - 00000000 ____D () C:\ProgramData\3DIS GmbH
2014-10-05 17:57 - 2014-10-05 17:57 - 00000000 ____D () C:\Program Files (x86)\WebViewer
2014-10-05 10:32 - 2014-10-05 10:32 - 00000901 _____ () C:\Users\Public\Desktop\QuickLOAD De-Installation.lnk
2014-10-05 10:32 - 2014-10-05 10:32 - 00000627 _____ () C:\Users\Public\Desktop\QuickLOAD Liste der Messläufe.lnk
2014-10-05 10:32 - 2014-10-05 10:32 - 00000615 _____ () C:\Users\Public\Desktop\QuickTARGET Unlimited Handbuch.lnk
2014-10-05 10:32 - 2014-10-05 10:32 - 00000608 _____ () C:\Users\Public\Desktop\QuickTARGET Benutzerhandbuch.lnk
2014-10-05 10:32 - 2014-10-05 10:32 - 00000604 _____ () C:\Users\Public\Desktop\QuickLOAD Benutzerhandbuch.lnk
2014-10-05 10:32 - 2014-10-05 10:32 - 00000596 _____ () C:\Users\Public\Desktop\QuickLOAD Wichtig!.lnk
2014-10-05 10:32 - 2014-10-05 10:32 - 00000592 _____ () C:\Users\Public\Desktop\QuickTARGETUnlimited.lnk
2014-10-05 10:32 - 2014-10-05 10:32 - 00000577 _____ () C:\Users\Public\Desktop\QuickTARGET.lnk
2014-10-05 10:32 - 2014-10-05 10:32 - 00000573 _____ () C:\Users\Public\Desktop\QuickLOAD.lnk
2014-10-05 10:29 - 2014-10-05 10:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickLOAD
2014-10-05 10:29 - 2012-02-16 15:46 - 00139264 _____ (Axis Controls Ltd) C:\Windows\SysWOW64\SComm32.ocx
2014-10-05 08:46 - 2014-10-05 08:46 - 00002114 _____ () C:\Users\Gerhard\Desktop\AVG 1-Klick-Wartung.lnk
2014-10-01 09:19 - 2014-09-25 04:08 - 00371712 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2014-10-01 09:19 - 2014-09-25 03:40 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2014-09-30 16:31 - 2014-09-30 16:31 - 00000000 ____D () C:\Users\Gerhard\AppData\Local\Mobile Master
2014-09-30 14:07 - 2014-09-30 14:07 - 00000000 ____D () C:\Program Files (x86)\Samsung
2014-09-30 14:01 - 2014-10-02 13:13 - 00000000 ____D () C:\Users\Gerhard\AppData\Roaming\Mobile Master
2014-09-30 14:01 - 2014-09-30 14:01 - 00000000 ____D () C:\ProgramData\Mobile Master
2014-09-30 14:00 - 2014-09-30 14:00 - 00000688 _____ () C:\Users\Public\Desktop\Mobile Master.lnk
2014-09-30 14:00 - 2014-09-30 14:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mobile Master
2014-09-30 13:59 - 2014-09-30 13:59 - 00000000 ____D () C:\Users\Gerhard\AppData\Roaming\Jumping Bytes
2014-09-30 09:59 - 2014-09-30 09:59 - 00002969 _____ () C:\Users\Public\Desktop\Nero BackItUp.lnk
2014-09-25 13:38 - 2014-09-25 13:38 - 00002762 _____ () C:\Windows\System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013
2014-09-24 18:56 - 2014-09-24 18:56 - 00003694 _____ () C:\Windows\System32\Tasks\Adobe Reader and Acrobat Manager
2014-09-24 18:40 - 2014-09-24 18:40 - 00002223 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG PC TuneUp 2015.lnk
2014-09-24 18:40 - 2014-09-24 18:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG PC TuneUp 2015
2014-09-24 18:40 - 2014-09-04 13:23 - 00040248 _____ (AVG Technologies) C:\Windows\system32\TURegOpt.exe
2014-09-24 18:40 - 2014-09-04 13:23 - 00029496 _____ (AVG Technologies) C:\Windows\system32\authuitu.dll
2014-09-24 18:40 - 2014-09-04 13:23 - 00025400 _____ (AVG Technologies) C:\Windows\SysWOW64\authuitu.dll
2014-09-24 18:39 - 2014-09-24 18:39 - 00000000 ____D () C:\Users\Gerhard\AppData\Roaming\AVG
2014-09-24 16:55 - 2014-09-24 16:55 - 00000936 _____ () C:\Users\Public\Desktop\AVG.lnk
2014-09-24 16:55 - 2014-09-24 16:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG Zen
2014-09-24 14:57 - 2014-10-05 09:48 - 00000000 ____D () C:\ProgramData\Avg
2014-09-24 14:57 - 2014-09-24 18:39 - 00000000 ____D () C:\Program Files (x86)\AVG
2014-09-24 14:44 - 2014-09-24 18:39 - 00000000 ____D () C:\Users\Gerhard\AppData\Local\Avg
2014-09-24 14:44 - 2014-09-24 18:36 - 00000000 ____D () C:\Users\Gerhard\AppData\Local\AvgSetupLog
2014-09-24 09:31 - 2014-09-10 00:11 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-09-24 09:31 - 2014-09-09 23:47 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-09-24 08:24 - 2014-09-24 08:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VR-IBAN-Konverter
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-10-18 13:29 - 2009-07-14 06:45 - 00023392 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-18 13:29 - 2009-07-14 06:45 - 00023392 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-18 13:21 - 2010-08-30 18:43 - 00000000 ____D () C:\ProgramData\TEMP
2014-10-18 13:20 - 2010-06-30 10:15 - 00001108 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-10-18 13:18 - 2013-08-05 07:38 - 03758278 _____ () C:\Windows\PFRO.log
2014-10-18 13:18 - 2013-08-05 07:38 - 00020423 _____ () C:\Windows\setupact.log
2014-10-18 13:18 - 2010-05-27 12:05 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-10-18 13:18 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-10-18 13:17 - 2010-05-25 14:24 - 00000000 ____D () C:\Users\Gerhard
2014-10-18 13:17 - 2010-05-25 14:16 - 01845369 _____ () C:\Windows\WindowsUpdate.log
2014-10-18 13:08 - 2012-04-02 18:19 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-10-18 13:06 - 2010-06-30 10:15 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-10-18 12:30 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\Vss
2014-10-18 12:29 - 2010-09-30 20:32 - 00000000 ____D () C:\Program Files (x86)\Winload
2014-10-18 11:55 - 2012-04-22 15:09 - 55886848 _____ () C:\Users\Gerhard\Documents\Outlook.pst
2014-10-18 11:00 - 2013-08-05 07:38 - 00505416 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-10-18 10:20 - 2010-05-25 17:07 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-10-18 10:12 - 2013-08-01 19:26 - 00000000 ____D () C:\Windows\system32\MRT
2014-10-18 10:11 - 2009-07-14 19:58 - 00702942 _____ () C:\Windows\system32\perfh007.dat
2014-10-18 10:11 - 2009-07-14 19:58 - 00150582 _____ () C:\Windows\system32\perfc007.dat
2014-10-18 10:11 - 2009-07-14 07:13 - 01629284 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-10-18 09:53 - 2010-05-25 19:47 - 103265616 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-10-17 19:42 - 2010-05-25 14:24 - 00000000 __SHD () C:\Recovery
2014-10-17 19:42 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\Msdtc
2014-10-11 17:37 - 2013-04-22 15:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSI
2014-10-11 17:37 - 2013-04-22 15:18 - 00000000 ____D () C:\Program Files (x86)\MSI
2014-10-11 17:07 - 2010-05-26 15:28 - 00013030 _____ () C:\Users\Public\PDOXUSRS.NET
2014-10-10 11:42 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-10-09 20:16 - 2011-06-25 15:15 - 00000000 ____D () C:\Temp
2014-10-09 20:16 - 2010-07-18 15:22 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation
2014-10-09 19:59 - 2012-01-14 15:20 - 00002924 _____ () C:\Windows\System32\Tasks\{30E14213-C4CA-4811-9144-5CF8007FFA2E}
2014-10-09 19:59 - 2011-12-23 16:24 - 00002924 _____ () C:\Windows\System32\Tasks\{FC43D33C-9413-48F6-8749-E800708016B1}
2014-10-09 19:59 - 2011-10-28 13:18 - 00002924 _____ () C:\Windows\System32\Tasks\{699649F9-5C0D-4FD7-AD24-617669546763}
2014-10-09 19:59 - 2011-10-28 13:06 - 00002924 _____ () C:\Windows\System32\Tasks\{021D9944-64AF-4BC5-A0FB-1043595DA4C9}
2014-10-09 19:59 - 2010-06-01 12:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nero
2014-10-09 18:46 - 2010-05-27 12:04 - 00000000 ____D () C:\Program Files\NVIDIA Corporation
2014-10-09 18:20 - 2010-06-15 11:44 - 00000000 ____D () C:\Users\Gerhard\AppData\Local\Nero
2014-10-09 16:54 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-10-09 16:37 - 2011-06-25 18:45 - 00000000 ____D () C:\Program Files\SAMSUNG
2014-10-09 15:57 - 2010-06-01 12:33 - 00000000 ____D () C:\Users\Gerhard\AppData\Roaming\Nero
2014-10-09 15:33 - 2010-06-01 12:25 - 00000000 ____D () C:\ProgramData\Nero
2014-10-08 13:33 - 2010-05-25 14:36 - 00000000 ____D () C:\Users\Gerhard\AppData\Roaming\Corel
2014-10-08 13:32 - 2010-06-01 13:53 - 00000000 ____D () C:\VueScan
2014-10-08 13:32 - 2010-05-25 14:36 - 00001838 ___SH () C:\Windows\SysWOW64\KGyGaAvL.sys
2014-10-08 13:32 - 2010-05-25 14:36 - 00000000 ____D () C:\Users\Gerhard\Documents\Meine PSP-Dateien
2014-10-07 20:25 - 2012-09-13 17:09 - 00000000 ____D () C:\Users\Public\Documents\Quickload
2014-10-07 11:21 - 2013-11-25 19:18 - 00131608 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-10-07 11:21 - 2013-11-25 19:18 - 00119272 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-10-07 11:21 - 2013-11-25 19:18 - 00043064 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-10-05 09:52 - 2013-08-04 13:24 - 00146736 _____ () C:\Users\Gerhard\AppData\Local\GDIPFONTCACHEV1.DAT
2014-09-30 19:35 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-09-30 09:59 - 2013-10-20 13:58 - 00003726 _____ () C:\Windows\System32\Tasks\Gerhards Dateisicherung 15 0
2014-09-30 09:59 - 2010-08-25 16:19 - 00000000 ____D () C:\Program Files (x86)\Nero
2014-09-24 08:26 - 2013-12-01 20:26 - 00000041 _____ () C:\Users\Public\IK_PosLen.dat
2014-09-24 08:24 - 2013-05-28 15:59 - 00001569 _____ () C:\Users\Public\Desktop\VR-IBAN-Konverter.lnk
2014-09-24 08:23 - 2013-05-28 15:57 - 00000000 ____D () C:\Users\Gerhard\AppData\Local\VR-IK
2014-09-23 21:10 - 2012-04-02 18:19 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-09-23 21:10 - 2012-04-02 18:19 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-09-23 21:10 - 2011-05-20 13:22 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-09-21 15:29 - 2011-11-23 14:36 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
2014-09-21 13:06 - 2012-04-05 19:54 - 00002507 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat X Standard.lnk
2014-09-21 13:06 - 2012-04-05 19:54 - 00002465 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat Distiller X.lnk
2014-09-21 13:06 - 2012-04-05 19:54 - 00001559 _____ () C:\Users\Public\Desktop\Adobe Acrobat X Standard.lnk
Files to move or delete:
====================
C:\Users\Public\IK_PosLen.dat
C:\Users\Public\VR-IBAN-Konverter.dat
Some content of TEMP:
====================
C:\Users\Gerhard\AppData\Local\Temp\avgnt.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-10-06 16:07
==================== End Of Log ============================
--- --- ---
--- --- ---
Gmer LogGMER Logfile: Code:
GMER 2.1.19357 - GMER - Rootkit Detector and Remover
Rootkit scan 2014-10-18 14:38:05
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-4 WDC_WD7501AALS-00J7B0 rev.05.00K05 698,64GB
Running: GerKK234.exe; Driver: C:\Users\Gerhard\AppData\Local\Temp\uxlirfow.sys
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 E:\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x83 0xAC 0x0F 0xBE ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0xA0 0x02 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x05 0x7F 0xCC 0x7C ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x2C 0x49 0x79 0xC9 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 E:\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x83 0xAC 0x0F 0xBE ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0xA0 0x02 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x05 0x7F 0xCC 0x7C ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x2C 0x49 0x79 0xC9 ...
---- EOF - GMER 2.1 ----
--- --- ---
Mfg
Gerhard
Hallo Schrauber, anbei die letzten Logs zur Auswertung. Bin jetzt für den Rest des Tages nicht mehr online, da ich meinem Sohn helfen muss. Danke vorab für deine Hilfe.
FRST Logfile:
FRST Logfile: Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 16-10-2014
Ran by Gerhard (administrator) on GERHARD-PC on 18-10-2014 14:02:46
Running from G:\AdwareCleaner
Loaded Profiles: Gerhard & UpdatusUser (Available profiles: Gerhard & UpdatusUser & Gast)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 10
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(APN LLC.) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Framework\Common\avgsvca.exe
(Microsoft Corp.) C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe
(REINER SCT) C:\Windows\SysWOW64\cjpcsc.exe
() C:\Users\Gerhard\AppData\Local\FirmwareFreewareMacro\FirmwareFreewareMacro.exe
(Gladinet, INC) C:\Program Files (x86)\Nuance\Nuance Cloud Connector\GladFileMonSvc.exe
() E:\ORICO\ORICO Tools\IovstRouteService_win7.exe
() C:\Program Files (x86)\Nuance\Nuance Cloud Connector\WOSVSSSvr.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\VS7DEBUG\mdm.exe
(Micro-Star International) C:\Program Files (x86)\MSI\Live Update\MSI_LiveUpdate_Service.exe
(Nero AG) C:\Program Files (x86)\Nero\Nero BackItUp\NBService.exe
(Nuance Communications, Inc.) E:\Nuance\PaperPort\PDFProFiltSrvPP.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
(AVG Technologies) C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe
(AVG Secure Search) C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.1.9\ToolbarUpdater.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
() C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.1.9\loggingserver.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Trinit-Soft) E:\USB Wächter\USBWService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe
(AVG Technologies) C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesApp64.exe
(NewSoft Technology Corporation) C:\Windows\System32\spool\drivers\x64\3\WrtMon.exe
(Microsoft Corporation) C:\Program Files\Microsoft IntelliType Pro\itype.exe
(VIA Technologies, Inc.) C:\VIA_XHCI\usb3Monitor.exe
(NewSoft Technology Corporation) C:\Windows\System32\spool\drivers\x64\3\WrtProc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Apoint.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe
() C:\Users\Gerhard\AppData\Roaming\InetStat\inetstat.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(T-Com Bereich Endgeräte) E:\TOnline\OnlineControl\ocontrol.exe
() C:\Program Files (x86)\AVG Secure Search\vprot.exe
(Nuance Communications, Inc.) E:\PDF Create 7\PdfCreate7Hook.exe
(Nuance Communications, Inc.) E:\Nuance\PDFViewerPlus\pdfPro5Hook.exe
(Adobe Systems Inc.) E:\Adobe\Acrobat\acrotray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(APN) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Framework\Common\avguix.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApMsgFwd.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\hidfind.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApntEx.exe
(Microsoft Corporation) C:\Program Files\Microsoft IntelliType Pro\dpupdchk.exe
() C:\Users\Gerhard\AppData\Local\FirmwareFreewareMacro\LogNetRoot.exe
() C:\Windows\SysWOW64\CronODBCSprite\CronODBCSprite.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [WrtMon.exe] => C:\Windows\system32\spool\drivers\x64\3\WrtMon.exe [26448 2008-05-24] (NewSoft Technology Corporation)
HKLM\...\Run: [itype] => C:\Program Files\Microsoft IntelliType Pro\itype.exe [1873256 2011-08-10] (Microsoft Corporation)
HKLM\...\Run: [VIAxHCUtl] => C:\VIA_XHCI\usb3Monitor.exe [331776 2012-03-26] (VIA Technologies, Inc.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13656792 2013-10-04] (Realtek Semiconductor)
HKLM\...\Run: [Apoint] => C:\Program Files\Apoint2K\Apoint.exe [380760 2013-07-17] (Alps Electric Co., Ltd.)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [1796056 2014-08-19] (NVIDIA Corporation)
HKLM-x32\...\Run: [GrooveMonitor] => E:\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [NsPrtMon] => C:\Program Files\NewSoft\Presto! PrintCentral\NsPrtMon.exe [42832 2009-09-11] (NewSoft Technology Corporation)
HKLM-x32\...\Run: [PMSpeed] => C:\Program Files (x86)\NewSoft\Presto! PageManager 9.01\PMSpeed.EXE [116632 2010-07-29] (NewSoft Technology Corporation)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)
HKLM-x32\...\Run: [vProt] => C:\Program Files (x86)\AVG Secure Search\vprot.exe [2640408 2014-09-07] ()
HKLM-x32\...\Run: [KiesTrayAgent] => E:\Samsung\Kies\KiesTrayAgent.exe [311616 2014-07-25] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [OmniPage Preload] => E:\ScanSoft18\OmniPage18.exe [2987880 2011-08-15] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PDFCreHook] => E:\PDF Create 7\pdfcreate7hook.exe [605032 2011-06-28] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PDF7 Registry Controller] => E:\PDF Create 7\RegistryController.exe [140136 2011-06-28] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [IndexSearch] => E:\Nuance\PaperPort\IndexSearch.exe [46368 2010-02-11] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PDFHook] => E:\Nuance\PDFViewerPlus\pdfpro5hook.exe [1369376 2010-02-08] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PDF5 Registry Controller] => E:\Nuance\PDFViewerPlus\RegistryController.exe [62752 2010-02-08] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [Acrobat Assistant 8.0] => E:\Adobe\Acrobat\Acrotray.exe [840592 2014-09-04] (Adobe Systems Inc.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [703736 2014-10-07] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [ApnTBMon] => C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1942424 2014-10-09] (APN)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [AvgUi] => C:\Program Files (x86)\AVG\Framework\Common\avguix.exe [1104912 2014-08-20] (AVG Technologies CZ, s.r.o.)
HKU\S-1-5-21-1256300535-3656786790-4203701623-1001\...\Run: [LightScribe Control Panel] => C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2741616 2011-03-04] (Hewlett-Packard Company)
HKU\S-1-5-21-1256300535-3656786790-4203701623-1001\...\Run: [KiesPDLR] => E:\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [845120 2014-07-25] (Samsung)
HKU\S-1-5-21-1256300535-3656786790-4203701623-1001\...\Run: [TomTomHOME.exe] => C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248176 2014-06-05] (TomTom)
HKU\S-1-5-21-1256300535-3656786790-4203701623-1001\...\Run: [KiesPreload] => E:\Samsung\Kies\Kies.exe [1562264 2014-07-25] (Samsung)
HKU\S-1-5-21-1256300535-3656786790-4203701623-1001\...\Run: [InetStat] => C:\Users\Gerhard\AppData\Roaming\InetStat\inetstat.exe [700430 2014-10-12] ()
HKU\S-1-5-21-1256300535-3656786790-4203701623-1005\...\Run: [LightScribe Control Panel] => C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2741616 2011-03-04] (Hewlett-Packard Company)
HKU\S-1-5-21-1256300535-3656786790-4203701623-1005\...\Run: [TomTomHOME.exe] => "E:\TomTom HOME 2\TomTomHOMERunner.exe"
HKU\S-1-5-21-1256300535-3656786790-4203701623-1005\...\Run: [KiesHelper] => E:\Samsung\Kies\KiesHelper.exe /s
HKU\S-1-5-21-1256300535-3656786790-4203701623-1005\...\Run: [KiesPDLR] => E:\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [845120 2014-07-25] (Samsung)
HKU\S-1-5-21-1256300535-3656786790-4203701623-1005\...\Run: [OpAgent] => "OpAgent.exe" /agent
HKU\S-1-5-21-1256300535-3656786790-4203701623-1005\...\Run: [ISUSPM] => C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe [324976 2010-05-21] (Flexera Software, Inc.)
HKU\S-1-5-21-1256300535-3656786790-4203701623-1005\...\Run: [Duden Korrektor SysTray] => E:\Duden-Rechtschreibprüfung\DKTray.exe [347792 2011-12-23] (Expert System S.p.A.)
HKU\S-1-5-21-1256300535-3656786790-4203701623-1005\...\Run: [AVG-Secure-Search-Update_JUNE2013_TB] => C:\Program Files (x86)\AVG Secure Search\AVG-Secure-Search-Update_JUNE2013_TB.exe [1266712 2013-06-11] (AVG Secure Search)
HKU\S-1-5-21-1256300535-3656786790-4203701623-1005\...\MountPoints2: {a4686039-67f6-11df-a1d0-806e6f6e6963} - K:\AUTORUN.EXE
HKU\S-1-5-21-1256300535-3656786790-4203701623-1005\...\MountPoints2: {b0dc9a48-a89c-11e1-9d81-806e6f6e6963} - D:\setup.exe
HKU\S-1-5-18\...\Run: [Duden Korrektor SysTray] => E:\Duden-Rechtschreibprüfung\DKTray.exe [347792 2011-12-23] (Expert System S.p.A.)
IFEO\kies.exe: [Debugger] "C:\Program Files (x86)\AVG\AVG PC TuneUp\TUAutoReactivator64.exe"
IFEO\kiesagent.exe: [Debugger] "C:\Program Files (x86)\AVG\AVG PC TuneUp\TUAutoReactivator64.exe"
IFEO\setup.exe: [Debugger] "C:\Program Files (x86)\AVG\AVG PC TuneUp\TUAutoReactivator64.exe"
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Office-Bibliothek-Direktsuche.lnk
ShortcutTarget: Office-Bibliothek-Direktsuche.lnk -> E:\Fremdwörterlexikon\PCLib.exe ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\OnlineControl.lnk
ShortcutTarget: OnlineControl.lnk -> E:\TOnline\OnlineControl\ocontrol.exe (T-Com Bereich Endgeräte)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Quicken 2012 Zahlungserinnerung.lnk
ShortcutTarget: Quicken 2012 Zahlungserinnerung.lnk -> C:\Windows\Installer\{2FC7CE3A-23E5-41E8-975B-AA0236D649FD}\BillMinder.8C5DA79E_7079_4AB3_81F7_712153351D0D.exe (Macrovision Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\VR-NetWorld Auftragsprüfung.lnk
ShortcutTarget: VR-NetWorld Auftragsprüfung.lnk -> E:\VR-NetWorld\vrtoolcheckorder.exe (VR-NetWorld Software)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WISO Mein Steuer-Sparbuch heute.lnk
ShortcutTarget: WISO Mein Steuer-Sparbuch heute.lnk -> E:\WISO2013\mshaktuell.exe ()
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL-Manager.lnk
ShortcutTarget: DSL-Manager.lnk -> E:\TOnline\DslMgr.exe (T-Systems Enterprise Services GmbH)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL-Manager.lnk
ShortcutTarget: DSL-Manager.lnk -> E:\TOnline\DslMgr.exe (T-Systems Enterprise Services GmbH)
Startup: C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL-Manager.lnk
ShortcutTarget: DSL-Manager.lnk -> E:\TOnline\DslMgr.exe (T-Systems Enterprise Services GmbH)
Startup: C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL-Manager.lnk
ShortcutTarget: DSL-Manager.lnk -> E:\TOnline\DslMgr.exe (T-Systems Enterprise Services GmbH)
ShellIconOverlayIdentifiers: [GladinetIconOverlay] -> {3C3DC57A-7535-48AF-BB9E-C3576A4F34D0} => C:\Program Files (x86)\Nuance\Nuance Cloud Connector\GlOverlayIcon.dll (Gladinet, INC)
ShellIconOverlayIdentifiers: [GladinetUploading] -> {959A18D3-9CC9-41e8-B76F-34ED9A89D4EA} => C:\Program Files (x86)\Nuance\Nuance Cloud Connector\GlOverlayIconU.dll (Gladinet, INC)
ShellIconOverlayIdentifiers-x32: [GladinetIconOverlay] -> {3C3DC57A-7535-48AF-BB9E-C3576A4F34D0} => C:\Program Files (x86)\Nuance\Nuance Cloud Connector\GlOverlayIcon32.dll (Gladinet, INC)
ShellIconOverlayIdentifiers-x32: [GladinetUploading] -> {959A18D3-9CC9-41e8-B76F-34ED9A89D4EA} => C:\Program Files (x86)\Nuance\Nuance Cloud Connector\GlOverlayIconU32.dll (Gladinet, INC)
ShellIconOverlayIdentifiers-x32: [Groove Explorer Icon Overlay 1 (GFS Unread Stub)] -> {99FD978C-D287-4F50-827F-B2C658EDA8E7} => E:\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [Groove Explorer Icon Overlay 2 (GFS Stub)] -> {AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} => E:\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)] -> {920E6DB1-9907-4370-B3A0-BAFC03D81399} => E:\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [Groove Explorer Icon Overlay 3 (GFS Folder)] -> {16F3DD56-1AF5-4347-846D-7C10C4192619} => E:\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [Groove Explorer Icon Overlay 4 (GFS Unread Mark)] -> {2916C86E-86A6-43FE-8112-43ABE6BF8DCC} => E:\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
ProxyEnable: Internet Explorer proxy is enabled.
ProxyServer: http=127.0.0.1:36169
HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = https://isearch.avg.com/?cid={0D4ACC5C-38CE-4F7D-AD5E-54266212ADC2}&mid=a43a809502ad47d18075d154d43bcf47-5dc7dab7a3820688bb38cbc250ac6ec4e6c96f07&lang=de&ds=tt014&pr=sa&d=2011-12-23 13:35:12&v=12.2.5.32&sap=hp
hxxp://www.microsoft.com/windows/ie/searchguide/de-de/default.mspx?dcsref=hxxp://runonce.msn.com/runonce2.aspx#
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/?pc=BDT3&ocid=bdtdhp
URLSearchHook: HKLM-x32 - BrowseToolE0191 Toolbar - {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Program Files (x86)\Winload\prxtbWin0.dll (Conduit Ltd.)
URLSearchHook: HKCU - BrowseToolE0191 Toolbar - {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Program Files (x86)\Winload\prxtbWin0.dll (Conduit Ltd.)
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
SearchScopes: HKLM-x32 - DefaultScope {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2319825
SearchScopes: HKLM-x32 - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2319825
SearchScopes: HKCU - {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=crm&q={searchTerms}&locale=&apn_ptnrs=&apn_dtid=OSJ000&apn_uid=AC0AF970-ABE5-4AE2-989D-14A6F42B02E5&apn_sauid=3107F890-C314-4F1A-B0A5-F9A477BAE173
SearchScopes: HKCU - {65D51F5B-E716-48F8-AA2B-B0851599B02B} URL = hxxp://www.google.de/search?q={searchTerms}
SearchScopes: HKCU - {8C86B2E0-AD99-4008-9A1E-8526E0B00130} URL = hxxp://www.google.de/search?q={searchTerms}
SearchScopes: HKCU - {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxp://isearch.avg.com/search?cid={0D4ACC5C-38CE-4F7D-AD5E-54266212ADC2}&mid=a43a809502ad47d18075d154d43bcf47-5dc7dab7a3820688bb38cbc250ac6ec4e6c96f07&lang=de&ds=tt014&pr=sa&d=2011-12-23 13:35:12&v=15.3.0.11&pid=avg&sg=0&sap=dsp&q={searchTerms}
SearchScopes: HKCU - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2319825
BHO: Avira SearchFree Toolbar -> {41564952-412D-5637-00A7-7A786E7484D7} -> C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll (APN LLC.)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: BrowseToolE0191 Toolbar -> {40c3cc16-7269-4b32-9531-17f2950fb06f} -> C:\Program Files (x86)\Winload\prxtbWin0.dll (Conduit Ltd.)
BHO-x32: Avira SearchFree Toolbar -> {41564952-412D-5637-00A7-7A786E7484D7} -> C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
BHO-x32: PlusIEEventHelper Class -> {551A852F-39A6-44A7-9C13-AFBEC9185A9D} -> E:\Nuance\PDFViewerPlus\Bin\PlusIEContextMenu.dll (Zeon Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> E:\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: AVG Security Toolbar -> {95B7759C-8C7F-4BF1-B163-73684A933233} -> C:\Program Files (x86)\AVG Secure Search\18.1.9.799\AVG Secure Search_toolbar.dll (AVG Secure Search)
BHO-x32: Adobe PDF Conversion Toolbar Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> E:\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: ZeonIEEventHelper Class -> {DA986D7D-CCAF-47B2-84FE-BFA1549BEBF9} -> E:\PDF Create 7\Bin\ZeonIEFavClient.dll (Zeon Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: SmartSelect Class -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll (APN LLC.)
Toolbar: HKLM-x32 - BrowseToolE0191 Toolbar - {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Program Files (x86)\Winload\prxtbWin0.dll (Conduit Ltd.)
Toolbar: HKLM-x32 - Steganos Password Manager Toolbar - {9C65D12D-CF9D-454D-8049-61965D8C6FFF} - E:\SteganosPM12\SPMIEToolbar.dll (Steganos Software GmbH)
Toolbar: HKLM-x32 - AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\18.1.9.799\AVG Secure Search_toolbar.dll (AVG Secure Search)
Toolbar: HKLM-x32 - DocuCom PDF - {E3286BF1-E654-42FF-B4A6-5E111731DF6B} - E:\PDF Create 7\Bin\ZeonIEFavClient.dll (Zeon Corporation)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
Toolbar: HKCU - No Name - {40C3CC16-7269-4B32-9531-17F2950FB06F} - No File
Toolbar: HKCU - No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
Toolbar: HKCU - No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No File
Handler: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\system32\urlmon.dll (Microsoft Corporation)
Handler-x32: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - No File
Handler-x32: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - E:\Office12\GrooveSystemServices.dll (Microsoft Corporation)
Handler-x32: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\18.1.9\ViProtocol.dll (AVG Secure Search)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin: @java.com/DTPlugin,version=10.45.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.45.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin -> C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\18.1.9\\npsitesafety.dll No File
FF Plugin-x32: @canon.com/MycameraPlugin -> C:\Program Files (x86)\Canon\ZoomBrowser EX\Program\NPCIG.dll (CANON INC.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> E:\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> E:\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @Nero.com/KM -> C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Acrobat -> E:\Adobe\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [{00F0643E-B367-4779-B45D-7046EBA37A88}] - E:\SteganosPM12\spmplugin3
FF Extension: Steganos Password Manager - E:\SteganosPM12\spmplugin3 [2010-06-02]
FF HKLM-x32\...\Firefox\Extensions: [avg@toolbar] - C:\ProgramData\AVG Secure Search\FireFoxExt\18.1.9.799
FF Extension: AVG Security Toolbar - C:\ProgramData\AVG Secure Search\FireFoxExt\18.1.9.799 [2014-09-07]
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - E:\Adobe\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - E:\Adobe\Acrobat\Browser\WCFirefoxExtn [2012-04-05]
FF HKLM-x32\...\Thunderbird\Extensions: [{857610fe-b36c-47f2-b4fa-6b7affe0cf5a}] - E:\Mobile Master\ext\1
FF Extension: Mobile Master Add-In - E:\Mobile Master\ext\1 [2014-09-30]
Chrome:
=======
CHR HKLM-x32\...\Chrome\Extension: [ndibdjnfmopecpmkdieinmbadjfpblof] - C:\ProgramData\AVG Secure Search\ChromeExt\17.3.0.49\avg.crx []
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [806704 2014-10-07] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-10-07] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-10-07] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [994096 2014-10-07] (Avira Operations GmbH & Co. KG)
R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [166296 2014-09-20] (APN LLC.)
R2 avgsvc; C:\Program Files (x86)\AVG\Framework\Common\avgsvca.exe [846864 2014-08-20] (AVG Technologies CZ, s.r.o.)
R2 BingDesktopUpdate; C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe [173192 2013-06-20] (Microsoft Corp.)
R2 cjpcsc; C:\Windows\SysWOW64\cjpcsc.exe [514128 2012-03-19] (REINER SCT)
R2 CronODBCSprite; C:\Windows\SysWOW64\CronODBCSprite\CronODBCSprite.exe [60453 2014-10-12] () [File not signed]
R2 FirmwareFreewareMacro.exe; C:\Users\Gerhard\AppData\Local\FirmwareFreewareMacro\FirmwareFreewareMacro.exe [129061 2014-10-12] () [File not signed]
R2 GladFileMonSvc; C:\Program Files (x86)\Nuance\Nuance Cloud Connector\GladFileMonSvc.exe [29552 2011-07-26] (Gladinet, INC)
R2 IovstRouterService; E:\ORICO\ORICO Tools\IovstRouteService_win7.exe [20480 2010-12-16] () [File not signed]
R2 LightScribeService; C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2011-03-04] (Hewlett-Packard Company) [File not signed]
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-10-01] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [968504 2014-10-01] (Malwarebytes Corporation)
R2 MDM; C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe [335872 2006-10-26] (Microsoft Corporation) [File not signed]
S3 Microsoft Office Groove Audit Service; E:\Office12\GrooveAuditService.exe [64856 2009-02-26] (Microsoft Corporation)
R2 MSI_LiveUpdate_Service; C:\Program Files (x86)\MSI\Live Update\MSI_LiveUpdate_Service.exe [1723856 2014-09-18] (Micro-Star International)
R2 NeroBackItUpBackgroundService; C:\Program Files (x86)\Nero\Nero BackItUp\NBService.exe [273248 2014-09-24] (Nero AG)
R2 PDFProFiltSrvPP; E:\Nuance\PaperPort\PDFProFiltSrvPP.exe [144672 2010-02-11] (Nuance Communications, Inc.)
S3 TDslMgrService; E:\TOnline\DslMgrSvc.exe [307200 2008-10-23] (T-Systems Enterprise Services GmbH) [File not signed]
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe [2538808 2014-09-04] (AVG Technologies)
R2 USBWaechter; E:\USB Wächter\USBWService.exe [2403840 2010-07-10] (Trinit-Soft) [File not signed]
R2 vToolbarUpdater18.1.9; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.1.9\ToolbarUpdater.exe [1820184 2014-08-11] (AVG Secure Search)
S2 HPSLPSVC; C:\Users\Gerhard\AppData\Local\Temp\7zS5C53\hpslpsvc64.dll [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-07] (Avira Operations GmbH & Co. KG)
R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [50976 2014-08-11] (AVG Technologies)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-10-07] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-31] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [43064 2014-10-07] (Avira Operations GmbH & Co. KG)
S2 CdaC15BA; C:\Windows\SysWOW64\drivers\CDAC15BA.SYS [8864 2011-06-17] () [File not signed]
S3 cjusb; C:\Windows\System32\DRIVERS\cjusb.sys [34672 2011-03-29] (REINER SCT)
S3 dgderdrv; C:\Windows\System32\drivers\dgderdrv.sys [20552 2010-10-25] (Devguru Co., Ltd)
R1 DslMNLwf; C:\Windows\System32\DRIVERS\dslmnlwf.sys [19008 2007-08-01] (T-Systems Enterprise Services GmbH)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2013-04-15] (DT Soft Ltd)
S3 FsUsbExDisk; C:\Windows\SysWOW64\FsUsbExDisk.SYS [37344 2013-12-30] () [File not signed]
R0 hotcore3; C:\Windows\System32\DRIVERS\hotcore3.sys [37392 2010-05-28] (Paragon Software Group)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-10-01] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2014-10-18] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-10-01] (Malwarebytes Corporation)
R3 NTIOLib_1_0_4; C:\Program Files (x86)\MSI\Live Update\NTIOLib_X64.sys [14136 2010-10-22] (MSI)
S4 sptd; C:\Windows\System32\Drivers\sptd.sys [564824 2013-11-23] (Duplex Secure Ltd.)
S1 StarOpen; C:\Windows\SysWow64\Drivers\StarOpen.sys [5632 2006-07-24] () [File not signed]
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesDriver64.sys [14112 2014-08-28] (TuneUp Software)
S3 xhcdrv; C:\Windows\System32\DRIVERS\xhcdrv.sys [256000 2012-03-26] (VIA Technologies, Inc.)
S3 cpuz132; \??\C:\Users\Gerhard\AppData\Local\Temp\cpuz132\cpuz132_x64.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-10-18 14:02 - 2014-10-18 14:02 - 00000000 ____D () C:\FRST
2014-10-18 13:17 - 2014-10-18 13:17 - 00000020 _____ () C:\Users\Gerhard\defogger_reenable
2014-10-18 11:14 - 2014-09-05 04:11 - 06584320 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-10-18 11:14 - 2014-09-05 03:52 - 05703168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2014-10-18 10:46 - 2014-09-29 02:58 - 03198976 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-10-18 10:46 - 2014-06-19 00:23 - 01943696 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll
2014-10-18 10:46 - 2014-06-19 00:23 - 01131664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dfshim.dll
2014-10-18 10:46 - 2014-06-19 00:23 - 00156824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscorier.dll
2014-10-18 10:46 - 2014-06-19 00:23 - 00156312 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll
2014-10-18 10:46 - 2014-06-19 00:23 - 00081560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscories.dll
2014-10-18 10:46 - 2014-06-19 00:23 - 00073880 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll
2014-10-18 09:40 - 2014-09-18 04:00 - 03241472 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-10-18 09:40 - 2014-09-18 03:32 - 02363904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-10-18 09:38 - 2014-09-13 03:58 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2014-10-18 09:38 - 2014-09-13 03:40 - 00067072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll
2014-10-18 09:38 - 2014-09-04 07:23 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll
2014-10-18 09:38 - 2014-09-04 07:04 - 00372736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastls.dll
2014-10-18 09:10 - 2014-10-18 13:24 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-10-18 09:09 - 2014-10-18 09:09 - 00001112 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-10-18 09:09 - 2014-10-18 09:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-10-18 09:09 - 2014-10-18 09:09 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-10-18 09:09 - 2014-10-18 09:09 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-10-18 09:09 - 2014-10-01 11:11 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-10-18 09:09 - 2014-10-01 11:11 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-10-18 09:09 - 2014-10-01 11:11 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-10-17 19:19 - 2014-10-17 19:19 - 00000000 ____D () C:\Users\Gerhard\AppData\Local\CheckCode
2014-10-12 14:16 - 2014-10-12 14:16 - 00000000 ____D () C:\Users\Gerhard\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\InetStat
2014-10-12 14:16 - 2014-10-12 14:16 - 00000000 ____D () C:\Users\Gerhard\AppData\Roaming\InetStat
2014-10-12 14:00 - 2014-10-12 14:00 - 00301608 _____ (VuuPC Limited) C:\Users\Gerhard\AppData\Local\nsc91A4.tmp
2014-10-12 14:00 - 2014-10-12 14:00 - 00000830 _____ () C:\Users\Gerhard\Desktop\Continue VuuPC Installation.lnk
2014-10-12 13:42 - 2014-10-12 14:14 - 00000000 ____D () C:\Users\Gerhard\AppData\Local\FirmwareFreewareMacro
2014-10-12 13:42 - 2014-10-12 13:42 - 00000000 ____D () C:\Windows\SysWOW64\CronODBCSprite
2014-10-12 13:35 - 2014-10-18 12:29 - 00000000 ____D () C:\Users\Gerhard\AppData\Local\StormWatch
2014-10-11 17:37 - 2014-10-11 17:37 - 00002041 _____ () C:\Users\Public\Desktop\MSI Live Update 6.lnk
2014-10-11 17:37 - 2014-10-11 17:37 - 00000000 ____D () C:\MSILU
2014-10-10 12:03 - 2014-10-10 12:07 - 00000000 ____D () C:\Users\Gerhard\HDR Projects
2014-10-10 12:02 - 2014-10-10 12:02 - 00000726 _____ () C:\Users\Public\Desktop\HDR Projects platin (64-Bit).lnk
2014-10-10 12:02 - 2014-10-10 12:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Franzis
2014-10-09 20:24 - 2014-10-09 20:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2014-10-09 20:16 - 2014-07-02 19:44 - 00609240 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
2014-10-09 20:16 - 2014-07-02 12:14 - 03826628 _____ () C:\Windows\system32\nvcoproc.bin
2014-10-09 18:46 - 2013-10-02 04:22 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbFlt.sys
2014-10-09 18:46 - 2013-10-02 04:11 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe
2014-10-09 18:46 - 2013-10-02 04:08 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll
2014-10-09 18:46 - 2013-10-02 03:48 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\MsRdpWebAccess.dll
2014-10-09 18:46 - 2013-10-02 03:48 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\wksprtPS.dll
2014-10-09 18:46 - 2013-10-02 03:29 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2014-10-09 18:46 - 2013-10-02 03:10 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbGDCoInstaller.dll
2014-10-09 18:46 - 2013-10-02 02:15 - 01057280 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll
2014-10-09 18:46 - 2013-10-02 02:14 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MsRdpWebAccess.dll
2014-10-09 18:46 - 2013-10-02 02:14 - 00017920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wksprtPS.dll
2014-10-09 18:46 - 2013-10-02 02:08 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2014-10-09 18:46 - 2013-10-02 02:01 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe
2014-10-09 18:46 - 2013-10-02 01:58 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2014-10-09 18:46 - 2013-10-02 01:31 - 01147392 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2014-10-09 18:46 - 2013-10-02 01:08 - 00855552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdvidcrl.dll
2014-10-09 18:46 - 2013-10-02 00:34 - 01068544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe
2014-10-09 16:34 - 2014-10-09 16:34 - 00000000 ____D () C:\Users\Public\Documents\NativeFus_Log
2014-10-09 16:34 - 2014-10-09 16:34 - 00000000 ____D () C:\Program Files (x86)\MyFree Codec
2014-10-09 16:28 - 2014-10-09 16:28 - 00000710 _____ () C:\Users\Public\Desktop\Samsung Kies (Lite).lnk
2014-10-09 16:27 - 2013-12-30 03:54 - 00233472 _____ (Teruten) C:\Windows\SysWOW64\FsUsbExService.Exe
2014-10-09 16:27 - 2013-12-30 03:54 - 00037344 _____ () C:\Windows\SysWOW64\FsUsbExDisk.Sys
2014-10-09 16:27 - 2013-12-30 03:54 - 00037344 _____ () C:\Windows\SysWOW64\FsUsbExDisk.Sy_
2014-10-09 16:27 - 2011-11-29 17:40 - 00110592 _____ () C:\Windows\SysWOW64\FsUsbExDevice.Dll
2014-10-09 15:32 - 2014-10-09 19:57 - 00002841 _____ () C:\Users\Public\Desktop\Nero 2015.lnk
2014-10-09 15:30 - 2014-10-09 19:59 - 00002115 _____ () C:\Users\Public\Desktop\Nero MediaHome.lnk
2014-10-09 15:22 - 2014-10-09 15:22 - 00000000 ____D () C:\ProgramData\Package Cache
2014-10-05 17:57 - 2014-10-05 17:57 - 00000000 ____D () C:\Users\Gerhard\AppData\Roaming\3DIS GmbH
2014-10-05 17:57 - 2014-10-05 17:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WebViewer
2014-10-05 17:57 - 2014-10-05 17:57 - 00000000 ____D () C:\ProgramData\3DIS GmbH
2014-10-05 17:57 - 2014-10-05 17:57 - 00000000 ____D () C:\Program Files (x86)\WebViewer
2014-10-05 10:32 - 2014-10-05 10:32 - 00000901 _____ () C:\Users\Public\Desktop\QuickLOAD De-Installation.lnk
2014-10-05 10:32 - 2014-10-05 10:32 - 00000627 _____ () C:\Users\Public\Desktop\QuickLOAD Liste der Messläufe.lnk
2014-10-05 10:32 - 2014-10-05 10:32 - 00000615 _____ () C:\Users\Public\Desktop\QuickTARGET Unlimited Handbuch.lnk
2014-10-05 10:32 - 2014-10-05 10:32 - 00000608 _____ () C:\Users\Public\Desktop\QuickTARGET Benutzerhandbuch.lnk
2014-10-05 10:32 - 2014-10-05 10:32 - 00000604 _____ () C:\Users\Public\Desktop\QuickLOAD Benutzerhandbuch.lnk
2014-10-05 10:32 - 2014-10-05 10:32 - 00000596 _____ () C:\Users\Public\Desktop\QuickLOAD Wichtig!.lnk
2014-10-05 10:32 - 2014-10-05 10:32 - 00000592 _____ () C:\Users\Public\Desktop\QuickTARGETUnlimited.lnk
2014-10-05 10:32 - 2014-10-05 10:32 - 00000577 _____ () C:\Users\Public\Desktop\QuickTARGET.lnk
2014-10-05 10:32 - 2014-10-05 10:32 - 00000573 _____ () C:\Users\Public\Desktop\QuickLOAD.lnk
2014-10-05 10:29 - 2014-10-05 10:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickLOAD
2014-10-05 10:29 - 2012-02-16 15:46 - 00139264 _____ (Axis Controls Ltd) C:\Windows\SysWOW64\SComm32.ocx
2014-10-05 08:46 - 2014-10-05 08:46 - 00002114 _____ () C:\Users\Gerhard\Desktop\AVG 1-Klick-Wartung.lnk
2014-10-01 09:19 - 2014-09-25 04:08 - 00371712 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2014-10-01 09:19 - 2014-09-25 03:40 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2014-09-30 16:31 - 2014-09-30 16:31 - 00000000 ____D () C:\Users\Gerhard\AppData\Local\Mobile Master
2014-09-30 14:07 - 2014-09-30 14:07 - 00000000 ____D () C:\Program Files (x86)\Samsung
2014-09-30 14:01 - 2014-10-02 13:13 - 00000000 ____D () C:\Users\Gerhard\AppData\Roaming\Mobile Master
2014-09-30 14:01 - 2014-09-30 14:01 - 00000000 ____D () C:\ProgramData\Mobile Master
2014-09-30 14:00 - 2014-09-30 14:00 - 00000688 _____ () C:\Users\Public\Desktop\Mobile Master.lnk
2014-09-30 14:00 - 2014-09-30 14:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mobile Master
2014-09-30 13:59 - 2014-09-30 13:59 - 00000000 ____D () C:\Users\Gerhard\AppData\Roaming\Jumping Bytes
2014-09-30 09:59 - 2014-09-30 09:59 - 00002969 _____ () C:\Users\Public\Desktop\Nero BackItUp.lnk
2014-09-25 13:38 - 2014-09-25 13:38 - 00002762 _____ () C:\Windows\System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013
2014-09-24 18:56 - 2014-09-24 18:56 - 00003694 _____ () C:\Windows\System32\Tasks\Adobe Reader and Acrobat Manager
2014-09-24 18:40 - 2014-09-24 18:40 - 00002223 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG PC TuneUp 2015.lnk
2014-09-24 18:40 - 2014-09-24 18:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG PC TuneUp 2015
2014-09-24 18:40 - 2014-09-04 13:23 - 00040248 _____ (AVG Technologies) C:\Windows\system32\TURegOpt.exe
2014-09-24 18:40 - 2014-09-04 13:23 - 00029496 _____ (AVG Technologies) C:\Windows\system32\authuitu.dll
2014-09-24 18:40 - 2014-09-04 13:23 - 00025400 _____ (AVG Technologies) C:\Windows\SysWOW64\authuitu.dll
2014-09-24 18:39 - 2014-09-24 18:39 - 00000000 ____D () C:\Users\Gerhard\AppData\Roaming\AVG
2014-09-24 16:55 - 2014-09-24 16:55 - 00000936 _____ () C:\Users\Public\Desktop\AVG.lnk
2014-09-24 16:55 - 2014-09-24 16:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG Zen
2014-09-24 14:57 - 2014-10-05 09:48 - 00000000 ____D () C:\ProgramData\Avg
2014-09-24 14:57 - 2014-09-24 18:39 - 00000000 ____D () C:\Program Files (x86)\AVG
2014-09-24 14:44 - 2014-09-24 18:39 - 00000000 ____D () C:\Users\Gerhard\AppData\Local\Avg
2014-09-24 14:44 - 2014-09-24 18:36 - 00000000 ____D () C:\Users\Gerhard\AppData\Local\AvgSetupLog
2014-09-24 09:31 - 2014-09-10 00:11 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-09-24 09:31 - 2014-09-09 23:47 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-09-24 08:24 - 2014-09-24 08:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VR-IBAN-Konverter
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-10-18 13:29 - 2009-07-14 06:45 - 00023392 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-18 13:29 - 2009-07-14 06:45 - 00023392 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-18 13:21 - 2010-08-30 18:43 - 00000000 ____D () C:\ProgramData\TEMP
2014-10-18 13:20 - 2010-06-30 10:15 - 00001108 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-10-18 13:18 - 2013-08-05 07:38 - 03758278 _____ () C:\Windows\PFRO.log
2014-10-18 13:18 - 2013-08-05 07:38 - 00020423 _____ () C:\Windows\setupact.log
2014-10-18 13:18 - 2010-05-27 12:05 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-10-18 13:18 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-10-18 13:17 - 2010-05-25 14:24 - 00000000 ____D () C:\Users\Gerhard
2014-10-18 13:17 - 2010-05-25 14:16 - 01845369 _____ () C:\Windows\WindowsUpdate.log
2014-10-18 13:08 - 2012-04-02 18:19 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-10-18 13:06 - 2010-06-30 10:15 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-10-18 12:30 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\Vss
2014-10-18 12:29 - 2010-09-30 20:32 - 00000000 ____D () C:\Program Files (x86)\Winload
2014-10-18 11:55 - 2012-04-22 15:09 - 55886848 _____ () C:\Users\Gerhard\Documents\Outlook.pst
2014-10-18 11:00 - 2013-08-05 07:38 - 00505416 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-10-18 10:20 - 2010-05-25 17:07 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-10-18 10:12 - 2013-08-01 19:26 - 00000000 ____D () C:\Windows\system32\MRT
2014-10-18 10:11 - 2009-07-14 19:58 - 00702942 _____ () C:\Windows\system32\perfh007.dat
2014-10-18 10:11 - 2009-07-14 19:58 - 00150582 _____ () C:\Windows\system32\perfc007.dat
2014-10-18 10:11 - 2009-07-14 07:13 - 01629284 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-10-18 09:53 - 2010-05-25 19:47 - 103265616 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-10-17 19:42 - 2010-05-25 14:24 - 00000000 __SHD () C:\Recovery
2014-10-17 19:42 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\Msdtc
2014-10-11 17:37 - 2013-04-22 15:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSI
2014-10-11 17:37 - 2013-04-22 15:18 - 00000000 ____D () C:\Program Files (x86)\MSI
2014-10-11 17:07 - 2010-05-26 15:28 - 00013030 _____ () C:\Users\Public\PDOXUSRS.NET
2014-10-10 11:42 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-10-09 20:16 - 2011-06-25 15:15 - 00000000 ____D () C:\Temp
2014-10-09 20:16 - 2010-07-18 15:22 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation
2014-10-09 19:59 - 2012-01-14 15:20 - 00002924 _____ () C:\Windows\System32\Tasks\{30E14213-C4CA-4811-9144-5CF8007FFA2E}
2014-10-09 19:59 - 2011-12-23 16:24 - 00002924 _____ () C:\Windows\System32\Tasks\{FC43D33C-9413-48F6-8749-E800708016B1}
2014-10-09 19:59 - 2011-10-28 13:18 - 00002924 _____ () C:\Windows\System32\Tasks\{699649F9-5C0D-4FD7-AD24-617669546763}
2014-10-09 19:59 - 2011-10-28 13:06 - 00002924 _____ () C:\Windows\System32\Tasks\{021D9944-64AF-4BC5-A0FB-1043595DA4C9}
2014-10-09 19:59 - 2010-06-01 12:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nero
2014-10-09 18:46 - 2010-05-27 12:04 - 00000000 ____D () C:\Program Files\NVIDIA Corporation
2014-10-09 18:20 - 2010-06-15 11:44 - 00000000 ____D () C:\Users\Gerhard\AppData\Local\Nero
2014-10-09 16:54 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-10-09 16:37 - 2011-06-25 18:45 - 00000000 ____D () C:\Program Files\SAMSUNG
2014-10-09 15:57 - 2010-06-01 12:33 - 00000000 ____D () C:\Users\Gerhard\AppData\Roaming\Nero
2014-10-09 15:33 - 2010-06-01 12:25 - 00000000 ____D () C:\ProgramData\Nero
2014-10-08 13:33 - 2010-05-25 14:36 - 00000000 ____D () C:\Users\Gerhard\AppData\Roaming\Corel
2014-10-08 13:32 - 2010-06-01 13:53 - 00000000 ____D () C:\VueScan
2014-10-08 13:32 - 2010-05-25 14:36 - 00001838 ___SH () C:\Windows\SysWOW64\KGyGaAvL.sys
2014-10-08 13:32 - 2010-05-25 14:36 - 00000000 ____D () C:\Users\Gerhard\Documents\Meine PSP-Dateien
2014-10-07 20:25 - 2012-09-13 17:09 - 00000000 ____D () C:\Users\Public\Documents\Quickload
2014-10-07 11:21 - 2013-11-25 19:18 - 00131608 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-10-07 11:21 - 2013-11-25 19:18 - 00119272 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-10-07 11:21 - 2013-11-25 19:18 - 00043064 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-10-05 09:52 - 2013-08-04 13:24 - 00146736 _____ () C:\Users\Gerhard\AppData\Local\GDIPFONTCACHEV1.DAT
2014-09-30 19:35 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-09-30 09:59 - 2013-10-20 13:58 - 00003726 _____ () C:\Windows\System32\Tasks\Gerhards Dateisicherung 15 0
2014-09-30 09:59 - 2010-08-25 16:19 - 00000000 ____D () C:\Program Files (x86)\Nero
2014-09-24 08:26 - 2013-12-01 20:26 - 00000041 _____ () C:\Users\Public\IK_PosLen.dat
2014-09-24 08:24 - 2013-05-28 15:59 - 00001569 _____ () C:\Users\Public\Desktop\VR-IBAN-Konverter.lnk
2014-09-24 08:23 - 2013-05-28 15:57 - 00000000 ____D () C:\Users\Gerhard\AppData\Local\VR-IK
2014-09-23 21:10 - 2012-04-02 18:19 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-09-23 21:10 - 2012-04-02 18:19 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-09-23 21:10 - 2011-05-20 13:22 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-09-21 15:29 - 2011-11-23 14:36 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
2014-09-21 13:06 - 2012-04-05 19:54 - 00002507 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat X Standard.lnk
2014-09-21 13:06 - 2012-04-05 19:54 - 00002465 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat Distiller X.lnk
2014-09-21 13:06 - 2012-04-05 19:54 - 00001559 _____ () C:\Users\Public\Desktop\Adobe Acrobat X Standard.lnk
Files to move or delete:
====================
C:\Users\Public\IK_PosLen.dat
C:\Users\Public\VR-IBAN-Konverter.dat
Some content of TEMP:
====================
C:\Users\Gerhard\AppData\Local\Temp\avgnt.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-10-06 16:07
==================== End Of Log ============================
--- --- ---
--- --- ---
Gmer Log
GMER Logfile: Code:
GMER 2.1.19357 - GMER - Rootkit Detector and Remover
Rootkit scan 2014-10-18 14:38:05
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-4 WDC_WD7501AALS-00J7B0 rev.05.00K05 698,64GB
Running: GerKK234.exe; Driver: C:\Users\Gerhard\AppData\Local\Temp\uxlirfow.sys
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 E:\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x83 0xAC 0x0F 0xBE ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0xA0 0x02 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x05 0x7F 0xCC 0x7C ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x2C 0x49 0x79 0xC9 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 E:\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x83 0xAC 0x0F 0xBE ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0xA0 0x02 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x05 0x7F 0xCC 0x7C ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x2C 0x49 0x79 0xC9 ...
---- EOF - GMER 2.1 ----
--- --- ---
Mfg
Gerhard |
FRST 32-Bit | FRST 64-Bit
So funktioniert es:
Malwarebytes Anti-Malware 
AdwCleaner auf deinen Desktop.
