Trojaner-Board - Spysoftware auf PC?

Hallo,
hier sind die Logfiles:

Code:

GMER 2.1.19357 - hxxp://www.gmer.net

Rootkit scan 2015-02-13 00:08:56

Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST950032 rev.0011 465,76GB

Running: gdfp1i10.exe; Driver: C:\Users\sunias\AppData\Local\Temp\uwdiqpod.sys
 
 

---- User code sections - GMER 2.1 ----
 

.text   C:\windows\system32\Dwm.exe[1376] C:\windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                           000007fefddb8ef0 5 bytes JMP 000007fffdda00b8

.text   C:\windows\system32\Dwm.exe[1376] C:\windows\system32\KERNELBASE.dll!LoadLibraryExA                                                                           000007fefddbbfd0 5 bytes JMP 000007fffdda0038

.text   C:\windows\system32\taskhost.exe[2100] C:\windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                      000007fefddb8ef0 5 bytes JMP 000007fffdd600b8

.text   C:\windows\system32\taskhost.exe[2100] C:\windows\system32\KERNELBASE.dll!LoadLibraryExA                                                                      000007fefddbbfd0 5 bytes JMP 000007fffdd60038

.text   C:\windows\system32\taskhost.exe[2100] C:\windows\system32\ole32.dll!CoCreateInstance                                                                         000007feffc87490 5 bytes JMP 000007fffdd60138

.text   C:\windows\system32\taskhost.exe[2100] C:\windows\system32\WINMM.dll!waveOutReset                                                                             000007fefb70a38c 5 bytes JMP 000007fefdd602b8

.text   C:\windows\system32\taskhost.exe[2100] C:\windows\system32\WINMM.dll!waveOutPause                                                                             000007fefb724b60 5 bytes JMP 000007fefdd60238

.text   C:\windows\system32\taskhost.exe[2100] C:\windows\system32\WINMM.dll!waveOutRestart                                                                           000007fefb724ba0 5 bytes JMP 000007fefdd601b8

.text   C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe[2520] C:\windows\syswow64\ADVAPI32.dll!RegOpenKeyExA                                             0000000077164887 5 bytes JMP 0000000100d22de0

.text   C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[1052] C:\windows\system32\kernel32.dll!LoadLibraryW                                                             0000000077b96440 5 bytes JMP 0000000169ff0038

.text   C:\Program Files (x86)\Lenovo\Energy Management\utility.exe[3372] C:\windows\system32\ole32.dll!CoCreateInstance                                              000007feffc87490 5 bytes JMP 000007fffdda0138

.text   C:\Program Files (x86)\Windows Live\Family Safety\fsui.exe[3936] C:\windows\syswow64\kernel32.dll!LoadLibraryExA                                              00000000778548db 5 bytes JMP 0000000110002710

.text   C:\Program Files (x86)\Windows Live\Family Safety\fsui.exe[3936] C:\windows\syswow64\kernel32.dll!LoadLibraryW                                                00000000778548f3 5 bytes JMP 00000001100027f0

.text   C:\Program Files (x86)\Windows Live\Family Safety\fsui.exe[3936] C:\windows\syswow64\kernel32.dll!LoadLibraryExW                                              0000000077854925 5 bytes JMP 0000000110002780

.text   C:\Program Files (x86)\Windows Live\Family Safety\fsui.exe[3936] C:\windows\syswow64\ole32.dll!CoCreateInstance                                               0000000076bd9d0b 5 bytes JMP 0000000110002850

.text   C:\Program Files (x86)\Salaat Time\SalaatTime.exe[3252] C:\windows\syswow64\kernel32.dll!LoadLibraryExA                                                       00000000778548db 5 bytes JMP 0000000110002710

.text   C:\Program Files (x86)\Salaat Time\SalaatTime.exe[3252] C:\windows\syswow64\kernel32.dll!LoadLibraryW                                                         00000000778548f3 5 bytes JMP 00000001100027f0

.text   C:\Program Files (x86)\Salaat Time\SalaatTime.exe[3252] C:\windows\syswow64\kernel32.dll!LoadLibraryExW                                                       0000000077854925 5 bytes JMP 0000000110002780

.text   C:\Program Files (x86)\Salaat Time\SalaatTime.exe[3252] C:\windows\syswow64\ole32.dll!CoCreateInstance                                                        0000000076bd9d0b 5 bytes JMP 0000000110002850

.text   C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe[3788] C:\windows\system32\kernel32.dll!LoadLibraryW                                                     0000000077b96440 5 bytes JMP 0000000169ff0038

.text   C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE[3244] C:\windows\syswow64\kernel32.dll!LoadLibraryExA                                           00000000778548db 5 bytes JMP 0000000110002710

.text   C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE[3244] C:\windows\syswow64\kernel32.dll!LoadLibraryW                                             00000000778548f3 5 bytes JMP 00000001100027f0

.text   C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE[3244] C:\windows\syswow64\kernel32.dll!LoadLibraryExW                                           0000000077854925 5 bytes JMP 0000000110002780

.text   C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[5008] C:\windows\syswow64\kernel32.dll!LoadLibraryExA                                                  00000000778548db 5 bytes JMP 0000000110002710

.text   C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[5008] C:\windows\syswow64\kernel32.dll!LoadLibraryW                                                    00000000778548f3 5 bytes JMP 00000001100027f0

.text   C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[5008] C:\windows\syswow64\kernel32.dll!LoadLibraryExW                                                  0000000077854925 5 bytes JMP 0000000110002780

.text   C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[5008] C:\windows\syswow64\ole32.dll!CoCreateInstance                                                   0000000076bd9d0b 5 bytes JMP 0000000110002850

.text   C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[5016] C:\windows\syswow64\kernel32.dll!LoadLibraryExA                                              00000000778548db 5 bytes JMP 00000001002a2710

.text   C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[5016] C:\windows\syswow64\kernel32.dll!LoadLibraryW                                                00000000778548f3 5 bytes JMP 00000001002a27f0

.text   C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[5016] C:\windows\syswow64\kernel32.dll!LoadLibraryExW                                              0000000077854925 5 bytes JMP 00000001002a2780

.text   C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[5016] C:\windows\syswow64\ole32.dll!CoCreateInstance                                               0000000076bd9d0b 5 bytes JMP 00000001002a2850

.text   C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[5016] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                      0000000076b81401 2 bytes JMP 7787b21b C:\windows\syswow64\kernel32.dll

.text   C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[5016] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                        0000000076b81419 2 bytes JMP 7787b346 C:\windows\syswow64\kernel32.dll

.text   C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[5016] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                      0000000076b81431 2 bytes JMP 778f8ea9 C:\windows\syswow64\kernel32.dll

.text   C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[5016] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                      0000000076b8144a 2 bytes CALL 778548ad C:\windows\syswow64\kernel32.dll

.text   ...                                                                                                                                                           * 9

.text   C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[5016] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                         0000000076b814dd 2 bytes JMP 778f87a2 C:\windows\syswow64\kernel32.dll

.text   C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[5016] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                  0000000076b814f5 2 bytes JMP 778f8978 C:\windows\syswow64\kernel32.dll

.text   C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[5016] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                         0000000076b8150d 2 bytes JMP 778f8698 C:\windows\syswow64\kernel32.dll

.text   C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[5016] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                  0000000076b81525 2 bytes JMP 778f8a62 C:\windows\syswow64\kernel32.dll

.text   C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[5016] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                        0000000076b8153d 2 bytes JMP 7786fca8 C:\windows\syswow64\kernel32.dll

.text   C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[5016] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                             0000000076b81555 2 bytes JMP 778768ef C:\windows\syswow64\kernel32.dll

.text   C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[5016] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                      0000000076b8156d 2 bytes JMP 778f8f61 C:\windows\syswow64\kernel32.dll

.text   C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[5016] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                        0000000076b81585 2 bytes JMP 778f8ac2 C:\windows\syswow64\kernel32.dll

.text   C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[5016] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                           0000000076b8159d 2 bytes JMP 778f865c C:\windows\syswow64\kernel32.dll

.text   C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[5016] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                        0000000076b815b5 2 bytes JMP 7786fd41 C:\windows\syswow64\kernel32.dll

.text   C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[5016] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                      0000000076b815cd 2 bytes JMP 7787b2dc C:\windows\syswow64\kernel32.dll

.text   C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[5016] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                  0000000076b816b2 2 bytes JMP 778f8e24 C:\windows\syswow64\kernel32.dll

.text   C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[5016] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                  0000000076b816bd 2 bytes JMP 778f85f1 C:\windows\syswow64\kernel32.dll

.text   C:\Program Files (x86)\Brother\Brmfcmon\BrMfcmon.exe[5100] C:\windows\syswow64\kernel32.dll!LoadLibraryExA                                                    00000000778548db 5 bytes JMP 0000000100302710

.text   C:\Program Files (x86)\Brother\Brmfcmon\BrMfcmon.exe[5100] C:\windows\syswow64\kernel32.dll!LoadLibraryW                                                      00000000778548f3 5 bytes JMP 00000001003027f0

.text   C:\Program Files (x86)\Brother\Brmfcmon\BrMfcmon.exe[5100] C:\windows\syswow64\kernel32.dll!LoadLibraryExW                                                    0000000077854925 5 bytes JMP 0000000100302780

.text   C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[6960] C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE!wdGetApplicationObject + 166  000000002f111afc 2 bytes [11, 2F]

.text   C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[6960] C:\windows\syswow64\kernel32.dll!LoadLibraryExA                                            00000000778548db 5 bytes JMP 0000000110002710

.text   C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[6960] C:\windows\syswow64\kernel32.dll!LoadLibraryW                                              00000000778548f3 5 bytes JMP 00000001100027f0

.text   C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[6960] C:\windows\syswow64\kernel32.dll!LoadLibraryExW                                            0000000077854925 5 bytes JMP 0000000110002780

.text   C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[6960] C:\windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter                               0000000077858791 5 bytes JMP 00000001526553fc

.text   C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[6960] C:\windows\syswow64\ole32.dll!OleLoadFromStream                                            0000000076b96143 5 bytes JMP 000000015311f68e

.text   C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[6960] C:\windows\syswow64\ole32.dll!CoCreateInstance                                             0000000076bd9d0b 5 bytes JMP 0000000110002850

.text   C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[6960] C:\windows\syswow64\OLEAUT32.dll!SysFreeString                                             00000000770c3e59 5 bytes JMP 00000001526810b7

.text   C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[6960] C:\windows\syswow64\OLEAUT32.dll!VariantClear                                              00000000770c3eae 5 bytes JMP 000000015268b0be

.text   C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[6960] C:\windows\syswow64\OLEAUT32.dll!SysAllocStringByteLen                                     00000000770c4731 5 bytes JMP 00000001526bb5dc

.text   C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[6960] C:\windows\syswow64\OLEAUT32.dll!VariantChangeType                                         00000000770c5dee 5 bytes JMP 00000001526bc50f

.text   C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[6960] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                    0000000076b81401 2 bytes JMP 7787b21b C:\windows\syswow64\kernel32.dll

.text   C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[6960] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                      0000000076b81419 2 bytes JMP 7787b346 C:\windows\syswow64\kernel32.dll

.text   C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[6960] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                    0000000076b81431 2 bytes JMP 778f8ea9 C:\windows\syswow64\kernel32.dll

.text   C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[6960] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                    0000000076b8144a 2 bytes CALL 778548ad C:\windows\syswow64\kernel32.dll

.text   ...                                                                                                                                                           * 9

.text   C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[6960] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                       0000000076b814dd 2 bytes JMP 778f87a2 C:\windows\syswow64\kernel32.dll

.text   C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[6960] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                0000000076b814f5 2 bytes JMP 778f8978 C:\windows\syswow64\kernel32.dll

.text   C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[6960] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                       0000000076b8150d 2 bytes JMP 778f8698 C:\windows\syswow64\kernel32.dll

.text   C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[6960] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                0000000076b81525 2 bytes JMP 778f8a62 C:\windows\syswow64\kernel32.dll

.text   C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[6960] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                      0000000076b8153d 2 bytes JMP 7786fca8 C:\windows\syswow64\kernel32.dll

.text   C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[6960] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                           0000000076b81555 2 bytes JMP 778768ef C:\windows\syswow64\kernel32.dll

.text   C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[6960] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                    0000000076b8156d 2 bytes JMP 778f8f61 C:\windows\syswow64\kernel32.dll

.text   C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[6960] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                      0000000076b81585 2 bytes JMP 778f8ac2 C:\windows\syswow64\kernel32.dll

.text   C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[6960] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                         0000000076b8159d 2 bytes JMP 778f865c C:\windows\syswow64\kernel32.dll

.text   C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[6960] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                      0000000076b815b5 2 bytes JMP 7786fd41 C:\windows\syswow64\kernel32.dll

.text   C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[6960] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                    0000000076b815cd 2 bytes JMP 7787b2dc C:\windows\syswow64\kernel32.dll

.text   C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[6960] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                0000000076b816b2 2 bytes JMP 778f8e24 C:\windows\syswow64\kernel32.dll

.text   C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[6960] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                0000000076b816bd 2 bytes JMP 778f85f1 C:\windows\syswow64\kernel32.dll
 

---- Threads - GMER 2.1 ----
 

Thread  C:\windows\system32\mmc.exe [6404:5476]                                                                                                                       000007feee7efe98

Thread  C:\windows\system32\mmc.exe [6404:4272]                                                                                                                       000007feee9300bc

Thread  C:\windows\system32\mmc.exe [6404:5500]                                                                                                                       000007fefbd12bf8

Thread  C:\windows\system32\mmc.exe [6404:3316]                                                                                                                       000007feee9300bc

Thread  C:\windows\system32\mmc.exe [6404:6840]                                                                                                                       000007feee939cc0

Thread  C:\windows\system32\mmc.exe [6404:6632]                                                                                                                       000007feee9300bc

Thread  C:\windows\system32\mmc.exe [6404:1108]                                                                                                                       000007feee9300bc

Thread  C:\windows\system32\mmc.exe [6404:5816]                                                                                                                       000007feee81d9ac

Thread  C:\windows\system32\mmc.exe [6404:1564]                                                                                                                       000007feee9300bc

Thread  C:\windows\system32\mmc.exe [6404:1204]                                                                                                                       000007feee9300bc

Thread  C:\windows\system32\mmc.exe [6404:4808]                                                                                                                       000007feee9300bc

Thread  C:\windows\system32\mmc.exe [6404:6064]                                                                                                                       000007feee9300bc
 

---- Registry - GMER 2.1 ----
 

Reg     HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0c6076fc1a13                                                                                   

Reg     HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\64273788b6b5                                                                                   

Reg     HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\64273788b6b5@78f5fd30d664                                                                      0x78 0xA3 0x27 0x44 ...

Reg     HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\64273788b6b5@fcc73433af4b                                                                      0xF1 0xFB 0x97 0xC9 ...

Reg     HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0c6076fc1a13 (not active ControlSet)                                                               

Reg     HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\64273788b6b5 (not active ControlSet)                                                               

Reg     HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\64273788b6b5@78f5fd30d664                                                                          0x78 0xA3 0x27 0x44 ...

Reg     HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\64273788b6b5@fcc73433af4b                                                                          0xF1 0xFB 0x97 0xC9 ...
 

---- EOF - GMER 2.1 ----

Hier ist addition.txt:

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 12-02-2015

Ran by sunias at 2015-02-13 13:27:06

Running from C:\Users\sunias\Downloads

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

(If an entry is included in the fixlist, it will be removed.)
 

AV: Avira Desktop (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}

AV: ZoneAlarm Antivirus (Disabled - Up to date) {DE038A5B-9EDD-18A9-2361-FF7D98D43730}

AS: Avira Desktop (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: Spybot - Search and Destroy (Enabled - Out of date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}

AS: ZoneAlarm Anti-Spyware (Disabled - Up to date) {65626BBF-B8E7-1727-19D1-C40FE3537D8D}

FW: ZoneAlarm Firewall (Disabled) {E6380B7E-D4B2-19F1-083E-56486607704B}
 

==================== Installed Programs ======================
 

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 15.0.0.293 - Adobe Systems Incorporated)

Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.305 - Adobe Systems Incorporated)

Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)

Adobe Reader X (10.1.13) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.13 - Adobe Systems Incorporated)

Amazon Kindle (HKU\S-1-5-21-1621219649-1687009001-4096927769-1001\...\Amazon Kindle) (Version:  - Amazon)

Amazon MP3-Downloader 1.0.18 (HKU\S-1-5-21-1621219649-1687009001-4096927769-1001\...\Amazon MP3-Downloader) (Version: 1.0.18 - Amazon Services LLC)

AntiToolbar (HKLM\...\AntiToolbar) (Version: 1.0.0.5 - Reimage)

Apple Application Support (HKLM-x32\...\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.)

Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)

Avira (HKLM-x32\...\{bd538030-07d4-4999-a525-7fafa2483f56}) (Version: 1.1.30.21727 - Avira Operations & Co. KG)

Avira (x32 Version: 1.1.30.21727 - Avira Operations & Co. KG) Hidden

Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.7.468 - Avira)

Benutzerhandbuch (x32 Version: 1.0.0.6 - Lenovo) Hidden

Biet-O-Matic v2.14.8 (HKLM-x32\...\Biet-O-Matic v2.14.8) (Version: 2.14.8 - BOM Development Team)

Brother MFL-Pro Suite DCP-195C (HKLM-x32\...\{6BF66AED-3EA4-4106-B240-5CE96C9B76B0}) (Version: 1.0.1.0 - Brother Industries, Ltd.)

CdCoverCreator 2.5.3 (HKLM-x32\...\CdCoverCreator) (Version: 2.5.3 - thyanté Software)

Cool Edit Pro 2.1 (HKLM-x32\...\Cool Edit Pro 2.1) (Version:  - )

CyberLink PhotoDirector 2011 (HKLM-x32\...\InstallShield_{4862344A-A39C-4897-ACD4-A1BED5163C5A}) (Version: 2.0.3523 - CyberLink Corp.)

D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden

DVD Shrink 3.2 deutsch (DeCSS-frei) (HKLM-x32\...\DVD Shrink DE_is1) (Version:  - DVD Shrink)

Energy Management (HKLM-x32\...\InstallShield_{D0956C11-0F60-43FE-99AD-524E833471BB}) (Version: 6.0.2.1 - Lenovo)

Energy Management (x32 Version: 6.0.2.1 - Lenovo) Hidden

File Type Advisor 1.4 (HKLM-x32\...\File Type Advisor_is1) (Version:  - filetypeadvisor.com)

Fotogalerie (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden

Free M4a to MP3 Converter 8.1 (HKLM-x32\...\Free M4a to MP3 Converter_is1) (Version:  - ManiacTools.com)

Free PDF to Word Doc Converter v1.1 (HKLM-x32\...\Free PDF to Word Doc Converter_is1) (Version: 1.1 - www.hellopdf.com)

Free Studio version 6.4.0.1122 (HKLM-x32\...\Free Studio_is1) (Version: 6.4.0.1122 - DVDVideoSoft Ltd.)

Free YouTube to MP3 Converter version 3.12.42.716 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.42.716 - DVDVideoSoft Ltd.)

GIMP 2.8.4 (HKLM\...\GIMP-2_is1) (Version: 2.8.4 - The GIMP Team)

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 40.0.2214.111 - Google Inc.)

Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden

Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden

Google+ Auto Backup (HKLM-x32\...\{A50DE037-B5C0-4C8A-8049-B0C576B313D1}) (Version: 1.0.21.81 - Google)

Iminent (x32 Version: 6.42.32.0 - Iminent) Hidden <==== ATTENTION

Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)

Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation)

Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2342 - Intel Corporation)

Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 10.1.5.1001 - Intel Corporation)

Java 7 Update 21 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217017FF}) (Version: 7.0.210 - Oracle)

Junk Mail filter update (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden

Key Maker v2.0.072203 (HKLM-x32\...\Key Maker_is1) (Version: 2.0 - Softnik Technologies)

LEGO® Star Wars™ III: The Clone Wars™ (HKLM-x32\...\{6C0A6B81-0D00-453F-B220-E1F7931B3C2A}) (Version: 1.0.0.0 - LucasArts)

Lenovo Bluetooth with Enhanced Data Rate Software (HKLM\...\{436E0B79-2CFB-4E5F-9380-E17C1B25D0C5}) (Version: 6.3.0.8000 - Broadcom Corporation)

Lenovo EasyCamera (HKLM-x32\...\{ADE16A9D-FBDC-4ECC-B6BD-9C31E51D0333}) (Version: 1.11.0209.1 - Lenovo EasyCamera)

Lenovo EE Boot Optimizer (HKLM\...\Lenovo EE Boot Optimizer) (Version: 0.0.1.5 - Lenovo)

Lenovo Games Console (HKLM-x32\...\Lenovo Games Console) (Version: 1.2.6.436 - Oberon Media Inc.)

Lenovo OneKey Recovery (HKLM-x32\...\InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}) (Version: 7.0.1628 - CyberLink Corp.)

Lenovo OneKey Recovery (Version: 7.0.1628 - CyberLink Corp.) Hidden

Lenovo YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.1.3603 - CyberLink Corp.)

Lenovo YouCam (x32 Version: 3.1.3603 - CyberLink Corp.) Hidden

Lenovo_Wireless_Driver (HKLM-x32\...\{28ABE740-47F3-441B-9437-852F6A64EFF8}) (Version: 1.02.01 - Lenovo)

Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)

Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)

Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)

Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)

Microsoft Office Home and Student 2007 (HKLM-x32\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)

Microsoft Office Klick-und-Los 2010 (HKLM-x32\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)

Microsoft Office Starter 2010 - Deutsch (HKLM-x32\...\{90140011-0066-0407-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)

Microsoft OneDrive (HKU\S-1-5-21-1621219649-1687009001-4096927769-1001\...\OneDriveSetup.exe) (Version: 17.0.4029.0217 - Microsoft Corporation)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)

Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Movie Maker (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden

Mozilla Firefox 35.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 35.0.1 (x86 de)) (Version: 35.0.1 - Mozilla)

Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)

MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)

Nero 7 Premium (HKLM-x32\...\{70AB1576-7883-2313-C650-7A71270B1031}) (Version: 7.01.0735 - Nero AG)

NVIDIA Grafiktreiber 267.54 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 267.54 - NVIDIA Corporation)

Onekey Theater (HKLM-x32\...\InstallShield_{D4B060B9-AD4A-4152-9D99-28B93C615AFE}) (Version: 2.0.2.7 - Lenovo)

Onekey Theater (x32 Version: 2.0.2.7 - Lenovo) Hidden

PamFax (HKLM-x32\...\{6432B21C-CA95-46CA-87D4-178CC2E58F84}_is1) (Version: 3.5.0.14 - Scendix Software GmbH)

PaperPort Image Printer 64-bit (HKLM\...\{ABA4FAF1-6389-45F9-92CE-3914A4E5C471}) (Version: 1.00.0000 - Nuance Communications, Inc.)

PC Inspector File Recovery (HKLM-x32\...\{0DD140D3-9563-481E-AA75-BA457CBDAEF2}) (Version: 4.0 - )

Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9 - Google, Inc.)

Power2Go (HKLM-x32\...\{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 5.6.0.7303 - CyberLink Corp.)

QuickTime 7 (HKLM-x32\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)

Rainlendar2 (remove only) (HKLM-x32\...\Rainlendar2) (Version:  - )

Realtek Ethernet Controller Driver For Windows 7 (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.21.531.2010 - Realtek)

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6505 - Realtek Semiconductor Corp.)

Realtek USB 2.0 Reader Driver (HKLM-x32\...\{62BBB2F0-E220-4821-A564-730807D2C34D}) (Version: 6.1.7600.10008 - Realtek Semiconductor Corp.)

Recuva (HKLM\...\Recuva) (Version: 1.44 - Piriform)

Salaat Time 2.7 (HKLM\...\{F993F285-0F98-4E13-9421-41DB36806EE3}) (Version: 2.7 - Salaat Time - www.salaattime.com)

ScanSoft PaperPort 11 (HKLM-x32\...\{02570AE0-BEE0-4A6C-BE3F-D806E9F2EA17}) (Version: 11.2.0000 - Nuance Communications, Inc.)

Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)

Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)

SRS Control Panel (HKLM\...\{25EE6AF4-8FD6-4E09-AD9B-3ACC0B81D902}) (Version: 1.11.4800 - SRS Labs, Inc.)

Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.2.7.0 - Synaptics Incorporated)

Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)

Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)

Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)

Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)

UserGuide (HKLM-x32\...\InstallShield_{F07C2CF8-4C53-4EC3-8162-A6221E36EB88}) (Version: 1.0.0.6 - Lenovo)

VeriFace (HKLM-x32\...\VeriFace) (Version: 4.0.0.1206 - Lenovo)

VIS (HKLM-x32\...\VIS) (Version:  - ) <==== ATTENTION

Visual Studio 2010 x64 Redistributables (HKLM\...\{21B133D6-5979-47F0-BE1C-F6A6B304693F}) (Version: 13.0.0.1 - AVG Technologies)

VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN)

Winamp (HKLM-x32\...\Winamp) (Version: 5.65  - Nullsoft, Inc)

Winamp Erkennungs-Plug-in (HKU\S-1-5-21-1621219649-1687009001-4096927769-1001\...\Winamp Detect) (Version: 1.0.0.1 - Nullsoft, Inc)

Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3508.0205 - Microsoft Corporation)

Windows-Treiberpaket - Lenovo (ACPIVPC) System  (12/02/2010 6.1.0.1) (HKLM\...\EA12B1FB53CE4E387C31A85236C41EF559B5E392) (Version: 12/02/2010 6.1.0.1 - Lenovo)

WinHex (HKLM-x32\...\WinHex) (Version:  - )

WinRAR 5.00 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.00.0 - win.rar GmbH)

ZoneAlarm Antivirus (x32 Version: 13.0.208.000 - Check Point Software Technologies Ltd.) Hidden

ZoneAlarm Firewall (x32 Version: 13.0.208.000 - Check Point Software Technologies Ltd.) Hidden

ZoneAlarm Free Antivirus + Firewall (HKLM-x32\...\ZoneAlarm Free Antivirus + Firewall) (Version: 13.0.208.000 - Check Point)

ZoneAlarm Security (x32 Version: 13.0.208.000 - Check Point Software Technologies Ltd.) Hidden
 

==================== Custom CLSID (selected items): ==========================
 

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
 

CustomCLSID: HKU\S-1-5-21-1621219649-1687009001-4096927769-1001_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\sunias\AppData\Local\Microsoft\SkyDrive\17.0.4029.0217\amd64\SkyDriveShell64.dll (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-1621219649-1687009001-4096927769-1001_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\sunias\AppData\Local\Microsoft\SkyDrive\17.0.4029.0217\amd64\SkyDriveShell64.dll (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-1621219649-1687009001-4096927769-1001_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32 -> C:\Users\sunias\AppData\Local\Microsoft\SkyDrive\17.0.4029.0217\amd64\SkyDriveShell64.dll (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-1621219649-1687009001-4096927769-1001_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\sunias\AppData\Local\Microsoft\SkyDrive\17.0.4029.0217\amd64\SkyDriveShell64.dll (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-1621219649-1687009001-4096927769-1001_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\sunias\AppData\Local\Microsoft\SkyDrive\17.0.4029.0217\amd64\FileSyncApi64.dll (Microsoft Corporation)
 

==================== Restore Points  =========================
 

27-01-2015 12:01:12 Windows Update

30-01-2015 18:47:25 Windows Update

04-02-2015 07:26:23 Windows Update

10-02-2015 10:51:16 Windows Update

12-02-2015 00:46:35 Windows Update

13-02-2015 02:02:12 Windows Update
 

==================== Hosts content: ==========================
 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts
 

==================== Scheduled Tasks (whitelisted) =============
 

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
 

Task: {1E9C810C-280A-4AE0-8E76-77D1DAF8C5A7} - System32\Tasks\FileAdvisorUpdate => C:\Program Files (x86)\File Type Advisor\fileadvisor.exe [2013-09-04] (File Type Advisor)

Task: {47EF3E5D-D6CE-4B5F-B051-CBCF7919A414} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-05] (Adobe Systems Incorporated)

Task: {49B2E7A3-2EB4-4E7E-BE83-4057D73F2D58} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDImmunize.exe

Task: {702F028F-5711-457D-B821-D5EC059AF3A2} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc

Task: {90556584-549F-4B3E-AF20-D993E795A5F1} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)

Task: {A587CCF5-32A8-4311-967D-A942E88F9188} - System32\Tasks\FileAdvisorCheck => C:\Program Files (x86)\File Type Advisor\file-type-advisor.exe [2013-09-04] (filetypeadvisor.com                                         )

Task: {C9DCF277-2EC2-421F-9884-49CC6F3BCFD4} - System32\Tasks\{482C501C-B190-4BD4-9F07-394AAF0CF979} => pcalua.exe -a "F:\Driver\Windows Driver\Setup.exe" -d "F:\Driver\Windows Driver"

Task: {CC0A1A8E-6A18-4668-AEC6-5037350A7C97} - System32\Tasks\MirageAgent => C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe [2010-12-05] (CyberLink)

Task: {D6B5D4E2-3292-4858-9BCB-37B300C5ED46} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-18] (Google Inc.)

Task: {FA520359-00D7-4B6B-A949-7400FEC70955} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-18] (Google Inc.)

Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
 

==================== Loaded Modules (whitelisted) ==============
 

2010-11-11 11:42 - 2010-11-11 11:42 - 00202144 _____ () C:\Program Files (x86)\Lenovo\Onekey Theater\ActiveDetect64.dll

2010-11-11 11:44 - 2010-11-11 11:44 - 00156576 _____ () C:\Program Files (x86)\Lenovo\Onekey Theater\WindowsApiHookDll64.dll

2012-02-17 13:17 - 2012-02-17 13:17 - 01502720 _____ () C:\windows\system32\IcnOvrly.dll

2011-02-15 13:26 - 2011-02-15 13:26 - 00205088 _____ () C:\Program Files\Lenovo\Bluetooth Software\btkeyind.dll

2011-04-14 04:01 - 2011-03-25 10:28 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll

2008-12-20 04:20 - 2012-02-17 13:32 - 00054088 _____ () C:\Program Files (x86)\Lenovo\Energy Management\HookLib.dll

2008-12-20 04:20 - 2012-02-17 13:32 - 00054088 _____ () C:\Program Files (x86)\Lenovo\Energy Management\kbdhook.dll

2012-07-02 08:11 - 2012-07-02 08:11 - 02498048 _____ () C:\Program Files (x86)\Rainlendar2\Rainlendar2.exe

2012-02-17 13:20 - 2012-02-17 13:20 - 00100256 _____ () C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeySupport.exe

2015-01-31 16:44 - 2014-05-13 12:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl

2015-01-31 16:44 - 2014-05-13 12:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl

2015-01-31 16:44 - 2014-05-13 12:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl

2015-01-31 16:44 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll

2015-01-31 16:44 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll

2010-11-11 11:38 - 2010-11-11 11:38 - 00161696 _____ () C:\Program Files (x86)\Lenovo\Onekey Theater\ActiveDetect32.dll

2010-11-11 11:39 - 2010-11-11 11:39 - 00133024 _____ () C:\Program Files (x86)\Lenovo\Onekey Theater\WindowsApiHookDll32.dll

2012-05-16 20:01 - 2012-05-16 20:01 - 00140800 _____ () C:\Program Files (x86)\Rainlendar2\lua52.dll

2012-07-02 08:11 - 2012-07-02 08:11 - 00198144 _____ () C:\Program Files (x86)\Rainlendar2\plugins\iCalendarPlugin.dll

2012-06-17 14:22 - 2012-06-17 14:22 - 00012800 _____ () C:\Program Files (x86)\Rainlendar2\lfs.dll

2012-02-17 13:17 - 2012-02-17 13:17 - 00013664 _____ () C:\Program Files (x86)\Lenovo\VeriFace\ChooseLang.dll

2012-09-06 16:26 - 2009-02-27 15:38 - 00139264 ____R () C:\Program Files (x86)\Brother\BrUtilities\BrLogAPI.dll

2015-01-27 12:13 - 2015-01-27 12:13 - 03925104 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
 

==================== Alternate Data Streams (whitelisted) =========
 

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
 
 

==================== Safe Mode (whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\vsmon => ""="Service"
 

==================== EXE Association (whitelisted) ===============
 

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
 
 

==================== Other Areas ============================
 

(Currently there is no automatic fix for this section.)
 

HKU\S-1-5-21-1621219649-1687009001-4096927769-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\sunias\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg

HKU\S-1-5-21-1621219649-1687009001-4096927769-1002\Control Panel\Desktop\\Wallpaper -> C:\Users\uni\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg

HKU\S-1-5-21-1621219649-1687009001-4096927769-1003\Control Panel\Desktop\\Wallpaper -> C:\Users\Elias\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg

DNS Servers: 10.10.112.1 - 134.76.63.248
 

==================== MSCONFIG/TASK MANAGER disabled items ==
 

(Currently there is no automatic fix for this section.)
 
 

==================== Accounts: =============================
 

Administrator (S-1-5-21-1621219649-1687009001-4096927769-500 - Administrator - Disabled)

Elias (S-1-5-21-1621219649-1687009001-4096927769-1003 - Limited - Enabled) => C:\Users\Elias

Gast (S-1-5-21-1621219649-1687009001-4096927769-501 - Limited - Disabled)

sunias (S-1-5-21-1621219649-1687009001-4096927769-1001 - Administrator - Enabled) => C:\Users\sunias

uni (S-1-5-21-1621219649-1687009001-4096927769-1002 - Limited - Enabled) => C:\Users\uni

UpdatusUser (S-1-5-21-1621219649-1687009001-4096927769-1000 - Limited - Enabled) => C:\Users\UpdatusUser
 

==================== Faulty Device Manager Devices =============
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (02/13/2015 01:10:16 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: RootkitRevealer.exe, Version: 1.71.0.0, Zeitstempel: 0x44e255aa

Name des fehlerhaften Moduls: RootkitRevealer.exe, Version: 1.71.0.0, Zeitstempel: 0x44e255aa

Ausnahmecode: 0xc0000005

Fehleroffset: 0x000040cd

ID des fehlerhaften Prozesses: 0x17f0

Startzeit der fehlerhaften Anwendung: 0xRootkitRevealer.exe0

Pfad der fehlerhaften Anwendung: RootkitRevealer.exe1

Pfad des fehlerhaften Moduls: RootkitRevealer.exe2

Berichtskennung: RootkitRevealer.exe3
 

Error: (02/13/2015 01:10:05 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: RootkitRevealer.exe, Version: 1.71.0.0, Zeitstempel: 0x44e255aa

Name des fehlerhaften Moduls: RootkitRevealer.exe, Version: 1.71.0.0, Zeitstempel: 0x44e255aa

Ausnahmecode: 0xc0000005

Fehleroffset: 0x000040cd

ID des fehlerhaften Prozesses: 0x16f8

Startzeit der fehlerhaften Anwendung: 0xRootkitRevealer.exe0

Pfad der fehlerhaften Anwendung: RootkitRevealer.exe1

Pfad des fehlerhaften Moduls: RootkitRevealer.exe2

Berichtskennung: RootkitRevealer.exe3
 

Error: (02/13/2015 01:09:44 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: RootkitRevealer.exe, Version: 1.71.0.0, Zeitstempel: 0x44e255aa

Name des fehlerhaften Moduls: RootkitRevealer.exe, Version: 1.71.0.0, Zeitstempel: 0x44e255aa

Ausnahmecode: 0xc0000005

Fehleroffset: 0x000040cd

ID des fehlerhaften Prozesses: 0x192c

Startzeit der fehlerhaften Anwendung: 0xRootkitRevealer.exe0

Pfad der fehlerhaften Anwendung: RootkitRevealer.exe1

Pfad des fehlerhaften Moduls: RootkitRevealer.exe2

Berichtskennung: RootkitRevealer.exe3
 

Error: (02/13/2015 01:06:14 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: RootkitRevealer.exe, Version: 1.71.0.0, Zeitstempel: 0x44e255aa

Name des fehlerhaften Moduls: RootkitRevealer.exe, Version: 1.71.0.0, Zeitstempel: 0x44e255aa

Ausnahmecode: 0xc0000005

Fehleroffset: 0x000040cd

ID des fehlerhaften Prozesses: 0x598

Startzeit der fehlerhaften Anwendung: 0xRootkitRevealer.exe0

Pfad der fehlerhaften Anwendung: RootkitRevealer.exe1

Pfad des fehlerhaften Moduls: RootkitRevealer.exe2

Berichtskennung: RootkitRevealer.exe3
 

Error: (02/13/2015 01:04:34 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: RootkitRevealer.exe, Version: 1.71.0.0, Zeitstempel: 0x44e255aa

Name des fehlerhaften Moduls: RootkitRevealer.exe, Version: 1.71.0.0, Zeitstempel: 0x44e255aa

Ausnahmecode: 0xc0000005

Fehleroffset: 0x000040cd

ID des fehlerhaften Prozesses: 0xb60

Startzeit der fehlerhaften Anwendung: 0xRootkitRevealer.exe0

Pfad der fehlerhaften Anwendung: RootkitRevealer.exe1

Pfad des fehlerhaften Moduls: RootkitRevealer.exe2

Berichtskennung: RootkitRevealer.exe3
 

Error: (02/13/2015 01:03:56 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: RootkitRevealer.exe, Version: 1.71.0.0, Zeitstempel: 0x44e255aa

Name des fehlerhaften Moduls: RootkitRevealer.exe, Version: 1.71.0.0, Zeitstempel: 0x44e255aa

Ausnahmecode: 0xc0000005

Fehleroffset: 0x000040cd

ID des fehlerhaften Prozesses: 0x16e0

Startzeit der fehlerhaften Anwendung: 0xRootkitRevealer.exe0

Pfad der fehlerhaften Anwendung: RootkitRevealer.exe1

Pfad des fehlerhaften Moduls: RootkitRevealer.exe2

Berichtskennung: RootkitRevealer.exe3
 

Error: (02/13/2015 01:02:58 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: RootkitRevealer.exe, Version: 1.71.0.0, Zeitstempel: 0x44e255aa

Name des fehlerhaften Moduls: RootkitRevealer.exe, Version: 1.71.0.0, Zeitstempel: 0x44e255aa

Ausnahmecode: 0xc0000005

Fehleroffset: 0x000040cd

ID des fehlerhaften Prozesses: 0x1be0

Startzeit der fehlerhaften Anwendung: 0xRootkitRevealer.exe0

Pfad der fehlerhaften Anwendung: RootkitRevealer.exe1

Pfad des fehlerhaften Moduls: RootkitRevealer.exe2

Berichtskennung: RootkitRevealer.exe3
 

Error: (02/13/2015 00:51:27 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: daemonu.exe, Version: 1.0.21.0, Zeitstempel: 0x4d736e78

Name des fehlerhaften Moduls: daemonu.exe, Version: 1.0.21.0, Zeitstempel: 0x4d736e78

Ausnahmecode: 0xc000000d

Fehleroffset: 0x0004ddc6

ID des fehlerhaften Prozesses: 0x7dc

Startzeit der fehlerhaften Anwendung: 0xdaemonu.exe0

Pfad der fehlerhaften Anwendung: daemonu.exe1

Pfad des fehlerhaften Moduls: daemonu.exe2

Berichtskennung: daemonu.exe3
 

Error: (02/13/2015 01:57:36 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: RootkitRevealer.exe, Version: 1.71.0.0, Zeitstempel: 0x44e255aa

Name des fehlerhaften Moduls: RootkitRevealer.exe, Version: 1.71.0.0, Zeitstempel: 0x44e255aa

Ausnahmecode: 0xc0000005

Fehleroffset: 0x000040cd

ID des fehlerhaften Prozesses: 0x1080

Startzeit der fehlerhaften Anwendung: 0xRootkitRevealer.exe0

Pfad der fehlerhaften Anwendung: RootkitRevealer.exe1

Pfad des fehlerhaften Moduls: RootkitRevealer.exe2

Berichtskennung: RootkitRevealer.exe3
 

Error: (02/13/2015 01:57:29 AM) (Source: Application Hang) (EventID: 1002) (User: )

Description: Programm mbar.exe, Version 1.8.3.1004 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
 

Prozess-ID: a54
 

Startzeit: 01d04720a18059c2
 

Endzeit: 0
 

Anwendungspfad: C:\Users\sunias\Desktop\mbar\mbar.exe
 

Berichts-ID: 3acb55b9-b31b-11e4-a6e2-64273788b6b5
 
 

System errors:

=============

Error: (02/13/2015 01:23:52 PM) (Source: ipnathlp) (EventID: 31004) (User: )

Description: 0
 

Error: (02/13/2015 01:16:46 PM) (Source: ipnathlp) (EventID: 31004) (User: )

Description: 0
 

Error: (02/13/2015 01:15:09 PM) (Source: ipnathlp) (EventID: 30013) (User: )

Description: 10.10.118.53192.168.137.0255.255.255.0
 

Error: (02/13/2015 01:15:08 PM) (Source: ipnathlp) (EventID: 30013) (User: )

Description: 169.254.85.69192.168.137.0255.255.255.0
 

Error: (02/13/2015 01:15:05 PM) (Source: ipnathlp) (EventID: 31004) (User: )

Description: 0
 

Error: (02/13/2015 01:13:41 PM) (Source: ipnathlp) (EventID: 1233) (User: )

Description: 
 

Error: (02/13/2015 01:04:29 PM) (Source: ipnathlp) (EventID: 31004) (User: )

Description: 0
 

Error: (02/13/2015 01:02:59 PM) (Source: ipnathlp) (EventID: 31004) (User: )

Description: 0
 

Error: (02/13/2015 01:01:31 PM) (Source: ipnathlp) (EventID: 31004) (User: )

Description: 0
 

Error: (02/13/2015 00:58:47 PM) (Source: ipnathlp) (EventID: 31004) (User: )

Description: 0
 
 

Microsoft Office Sessions:

=========================

Error: (01/30/2014 09:09:14 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )

Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6690.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 265164 seconds with 4980 seconds of active time.  This session ended with a crash.
 
 

CodeIntegrity Errors:

===================================

  Date: 2014-09-11 04:53:07.313

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\CheckPoint\ZoneAlarm\avsys\install\instdrivers\kl1\x86\win8\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-09-11 04:53:07.313

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\CheckPoint\ZoneAlarm\avsys\install\instdrivers\kl1\x86\win8\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-09-11 04:53:05.784

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\CheckPoint\ZoneAlarm\avsys\install\instdrivers\kl1\x64\win8\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-09-11 04:53:05.784

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\CheckPoint\ZoneAlarm\avsys\install\instdrivers\kl1\x64\win8\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-09-11 04:51:13.745

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\CheckPoint\ZoneAlarm\avsys\install\instdrivers\kl1\x86\win8\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-09-11 04:51:11.015

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\CheckPoint\ZoneAlarm\avsys\install\instdrivers\kl1\x64\win8\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-08-14 03:57:34.125

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\CheckPoint\ZoneAlarm\avsys\install\instdrivers\kl1\x86\win8\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-08-14 03:57:34.125

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\CheckPoint\ZoneAlarm\avsys\install\instdrivers\kl1\x86\win8\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-08-14 03:57:33.096

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\CheckPoint\ZoneAlarm\avsys\install\instdrivers\kl1\x64\win8\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-08-14 03:57:33.096

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\CheckPoint\ZoneAlarm\avsys\install\instdrivers\kl1\x64\win8\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 
 

==================== Memory info =========================== 
 

Processor: Intel(R) Core(TM) i3-2350M CPU @ 2.30GHz

Percentage of memory in use: 58%

Total physical RAM: 4010.14 MB

Available physical RAM: 1659.57 MB

Total Pagefile: 8018.47 MB

Available Pagefile: 5251.76 MB

Total Virtual: 8192 MB

Available Virtual: 8191.83 MB
 

==================== Drives ================================
 

Drive c: () (Fixed) (Total:421.81 GB) (Free:304.71 GB) NTFS

Drive d: (LENOVO) (Fixed) (Total:29 GB) (Free:25.71 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 959FB4A7)

Partition 1: (Active) - (Size=200 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=421.8 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=29 GB) - (Type=OF Extended)

Partition 4: (Not Active) - (Size=14.8 GB) - (Type=12)
 

==================== End Of Log ============================

FRST.txt:

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-02-2015

Ran by sunias (administrator) on SUNIAS-PC on 13-02-2015 13:25:27

Running from C:\Users\sunias\Downloads

Loaded Profiles: UpdatusUser & sunias & uni & Elias (Available profiles: UpdatusUser & sunias & uni & Elias)

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11 (Default browser: FF)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Microsoft Corporation) C:\Windows\System32\wlanext.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Reimage®) C:\Program Files\AntiToolbar\ReiGuard.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe

(Microsoft Corporation) C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe

(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Check Point Software Technologies, Ltd.) C:\Program Files (x86)\CheckPoint\ZoneAlarm\ZAPrivacyService.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe

(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe

(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE

(Microsoft Corporation) C:\Windows\System32\alg.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Lenovo) C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeyStudio.exe

(Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe

(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\utility.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Microsoft Corporation) C:\Program Files (x86)\Windows Live\Family Safety\fsui.exe

() C:\Program Files (x86)\Rainlendar2\Rainlendar2.exe

() C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeySupport.exe

(Salaat Time - www.salaattime.com) C:\Program Files (x86)\Salaat Time\SalaatTime.exe

(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe

(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE

(Lenovo) C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe

(Nuance Communications, Inc.) C:\Program Files (x86)\ScanSoft\PaperPort\pptd40nt.exe

(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\ControlCenter3\BrccMCtl.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\Brmfcmon\BrMfcMon.exe

(Microsoft Corporation) C:\Windows\splwow64.exe

(Microsoft Corporation) C:\Program Files (x86)\Windows Live\Photo Gallery\WLXPhotoGallery.exe

(Microsoft Corporation) C:\Program Files (x86)\Windows Live\Photo Gallery\WLXPhotoGallery.exe

(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe

(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\BluetoothHeadsetProxy.exe

(Microsoft Corporation) C:\Windows\System32\consent.exe

(Alexander Roshal) C:\Program Files\WinRAR\WinRAR.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWelcome.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDRootAlyzer.exe

(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\BTStackServer.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\BluetoothHeadsetProxy.exe

(Microsoft Corporation) C:\Windows\System32\wsqmcons.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13353064 2011-11-14] (Realtek Semiconductor)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2538280 2010-12-22] (Synaptics Incorporated)

HKLM\...\Run: [Lenovo EE Boot Optimizer] => C:\Program Files (x86)\Lenovo\Boot Optimizer\PopWnd.exe [114688 2012-02-17] (Lenovo)

HKLM\...\Run: [OnekeyStudio] => C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeyStudio.exe [789920 2012-02-17] (Lenovo)

HKLM\...\Run: [UpdatePRCShortCut] => C:\Program Files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe [222504 2009-05-13] (CyberLink Corp.)

HKLM\...\Run: [Energy Management] => C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [9769888 2012-02-17] (Lenovo (Beijing) Limited)

HKLM\...\Run: [EnergyUtility] => C:\Program Files (x86)\Lenovo\Energy Management\Utility.exe [5908928 2012-02-17] (Lenovo(beijing) Limited)

HKLM\...\Run: [fssui] => C:\Program Files (x86)\Windows Live\Family Safety\fsui.exe [892416 2013-02-05] (Microsoft Corporation)

HKLM-x32\...\Run: [YouCam Mirage] => C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe [136488 2010-12-05] (CyberLink)

HKLM-x32\...\Run: [YouCam Tray] => C:\Program Files (x86)\Lenovo\YouCam\YouCam.exe [224352 2010-12-05] (CyberLink Corp.)

HKLM-x32\...\Run: [VeriFaceManager] => C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe [329056 2012-02-17] (Lenovo)

HKLM-x32\...\Run: [UpdateP2GShortCut] => C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2010-07-26] (CyberLink Corp.)

HKLM-x32\...\Run: [UpdatePRCShortCut] => C:\Program Files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe [222504 2009-05-13] (CyberLink Corp.)

HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [SSBkgdUpdate] => C:\Program Files (x86)\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [210472 2006-10-25] (Nuance Communications, Inc.)

HKLM-x32\...\Run: [PaperPort PTD] => C:\Program Files (x86)\ScanSoft\PaperPort\pptd40nt.exe [29984 2008-07-09] (Nuance Communications, Inc.)

HKLM-x32\...\Run: [IndexSearch] => C:\Program Files (x86)\ScanSoft\PaperPort\IndexSearch.exe [46368 2008-07-09] (Nuance Communications, Inc.)

HKLM-x32\...\Run: [PPort11reminder] => C:\Program Files (x86)\ScanSoft\PaperPort\Ereg\Ereg.exe [328992 2007-08-31] (Nuance Communications, Inc.)

HKLM-x32\...\Run: [BrMfcWnd] => C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe [1159168 2009-05-26] (Brother Industries, Ltd.)

HKLM-x32\...\Run: [ControlCenter3] => C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.)

HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [702768 2014-12-20] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)

HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)

HKLM-x32\...\Run: [NeroFilterCheck] => C:\Program Files (x86)\Common Files\Ahead\Lib\NeroCheck.exe [155648 2006-01-12] (Nero AG)

HKLM-x32\...\Run: [ZoneAlarm] => C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe [137352 2014-03-18] (Check Point Software Technologies Ltd.)

HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)

HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)

HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [126712 2015-01-19] (Avira Operations GmbH & Co. KG)

Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)

Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]

HKU\S-1-5-21-1621219649-1687009001-4096927769-1000\...\Run: [FactoryTest] => C:\Windows\Test.bat

HKU\S-1-5-21-1621219649-1687009001-4096927769-1000\...\Run: [Power2GoExpress] => NA

HKU\S-1-5-21-1621219649-1687009001-4096927769-1001\...\Run: [Rainlendar2] => C:\Program Files (x86)\Rainlendar2\Rainlendar2.exe [2498048 2012-07-02] ()

HKU\S-1-5-21-1621219649-1687009001-4096927769-1001\...\Run: [GoogleChromeAutoLaunch_20F96BC222F97C2FF595FCC10AC512E8] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [843592 2015-02-04] (Google Inc.)

HKU\S-1-5-21-1621219649-1687009001-4096927769-1001\...\Run: [SalaatTime] => C:\Program Files (x86)\Salaat Time\SalaatTime.exe [17199104 2013-03-10] (Salaat Time - www.salaattime.com)

HKU\S-1-5-21-1621219649-1687009001-4096927769-1001\...\Policies\system: [LogonHoursAction] 2

HKU\S-1-5-21-1621219649-1687009001-4096927769-1001\...\Policies\system: [DontDisplayLogonHoursWarnings] 1

HKU\S-1-5-21-1621219649-1687009001-4096927769-1002\...\Run: [SalaatTime] => C:\Program Files (x86)\Salaat Time\SalaatTime.exe [17199104 2013-03-10] (Salaat Time - www.salaattime.com)

HKU\S-1-5-21-1621219649-1687009001-4096927769-1002\...\RunOnce: [Application Restart #0] => C:\Program Files (x86)\Windows Live\Family Safety\fsui.exe [892416 2013-02-05] (Microsoft Corporation)

HKU\S-1-5-21-1621219649-1687009001-4096927769-1002\...\RunOnce: [Application Restart #1] => C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE [409768 2015-01-14] (Microsoft Corporation)

HKU\S-1-5-21-1621219649-1687009001-4096927769-1002\...\Policies\system: [LogonHoursAction] 2

HKU\S-1-5-21-1621219649-1687009001-4096927769-1002\...\Policies\system: [DontDisplayLogonHoursWarnings] 1

HKU\S-1-5-21-1621219649-1687009001-4096927769-1002\...\MountPoints2: {bae10d51-595c-11e1-bbda-806e6f6e6963} - F:\Launcher.exe

HKU\S-1-5-21-1621219649-1687009001-4096927769-1003\...\Run: [SalaatTime] => C:\Program Files (x86)\Salaat Time\SalaatTime.exe [17199104 2013-03-10] (Salaat Time - www.salaattime.com)

HKU\S-1-5-21-1621219649-1687009001-4096927769-1003\...\Policies\system: [LogonHoursAction] 2

HKU\S-1-5-21-1621219649-1687009001-4096927769-1003\...\Policies\system: [DontDisplayLogonHoursWarnings] 1

HKU\S-1-5-21-1621219649-1687009001-4096927769-1003\...\MountPoints2: {bae10d51-595c-11e1-bbda-806e6f6e6963} - Skillstraining_2 Installer.exe

AppInit_DLLs: C:\windows\system32\nvinitx.dll => C:\windows\system32\nvinitx.dll [226920 2011-03-06] (NVIDIA Corporation)

AppInit_DLLs-x32: C:\windows\SysWOW64\nvinit.dll => C:\windows\SysWOW64\nvinit.dll [192616 2011-03-06] (NVIDIA Corporation)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk

ShortcutTarget: Bluetooth.lnk -> C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe (Broadcom Corporation.)

Startup: C:\Users\sunias\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk

ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)

ShellIconOverlayIdentifiers: [VeriFace Enc] -> {771C7324-DA80-49D3-8017-753B0AF60951} => C:\windows\system32\IcnOvrly.dll ()

BootExecute: autocheck autochk * sdnclean64.exe

GroupPolicyUsers\S-1-5-21-1621219649-1687009001-4096927769-1003\User: Group Policy restriction detected <======= ATTENTION

GroupPolicyUsers\S-1-5-21-1621219649-1687009001-4096927769-1002\User: Group Policy restriction detected <======= ATTENTION
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKU\S-1-5-21-1621219649-1687009001-4096927769-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.lenovo.com

HKU\S-1-5-21-1621219649-1687009001-4096927769-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.lenovo.com

HKU\S-1-5-21-1621219649-1687009001-4096927769-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=LENN&bmod=LENN

HKU\S-1-5-21-1621219649-1687009001-4096927769-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://google.de/

HKU\S-1-5-21-1621219649-1687009001-4096927769-1002\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=LENN&bmod=LENN

HKU\S-1-5-21-1621219649-1687009001-4096927769-1002\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com

HKU\S-1-5-21-1621219649-1687009001-4096927769-1002\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=LENN&bmod=LENN

HKU\S-1-5-21-1621219649-1687009001-4096927769-1003\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=LENN&bmod=LENN

HKU\S-1-5-21-1621219649-1687009001-4096927769-1003\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com

HKU\S-1-5-21-1621219649-1687009001-4096927769-1003\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=LENN&bmod=LENN

SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=LENDF8&pc=MALN&src=IE-SearchBox

SearchScopes: HKLM-x32 -> DefaultScope value is missing.

SearchScopes: HKU\S-1-5-21-1621219649-1687009001-4096927769-1001 -> DefaultScope {7F595925-1C4E-430B-B712-DEE63B233526} URL = hxxp://search.zonealarm.com/search?src=sp&tbid=HFA5&Lan=de&q={searchTerms}&gu=724592469b2345e2bf7853a962eda41c&tu=10G9z00DW1D03M0&sku=&tstsId=&ver=&&r=355

SearchScopes: HKU\S-1-5-21-1621219649-1687009001-4096927769-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-21-1621219649-1687009001-4096927769-1001 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7LENN_deDE498DE499

SearchScopes: HKU\S-1-5-21-1621219649-1687009001-4096927769-1001 -> {7F595925-1C4E-430B-B712-DEE63B233526} URL = hxxp://search.zonealarm.com/search?src=sp&tbid=HFA5&Lan=de&q={searchTerms}&gu=724592469b2345e2bf7853a962eda41c&tu=10G9z00DW1D03M0&sku=&tstsId=&ver=&&r=355

SearchScopes: HKU\S-1-5-21-1621219649-1687009001-4096927769-1002 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7LENN

SearchScopes: HKU\S-1-5-21-1621219649-1687009001-4096927769-1003 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7LENN

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO: DVDVideoSoft IE Extension -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll (DVDVideoSoft Ltd.)

BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO-x32: DVDVideoSoft IE Extension -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.)

Toolbar: HKU\S-1-5-21-1621219649-1687009001-4096927769-1001 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File

Tcpip\Parameters: [DhcpNameServer] 10.10.112.1 134.76.63.248
 

FireFox:

========

FF ProfilePath: C:\Users\sunias\AppData\Roaming\Mozilla\Firefox\Profiles\0x0rnipr.default

FF SelectedSearchEngine: Search By ZoneAlarm

FF Homepage: hxxp://google.de/

FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll ()

FF Plugin: @microsoft.com/GENUINE -> disabled No File

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll ()

FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)

FF Plugin-x32: @java.com/JavaPlugin,version=10.21.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @nullsoft.com/winampDetector;version=1 -> C:\Program Files (x86)\Winamp Detect\npwachk.dll (Nullsoft, Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKU\S-1-5-21-1621219649-1687009001-4096927769-1001: amazon.com/AmazonMP3DownloaderPlugin -> C:\Users\sunias\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll (Amazon.com, Inc.)

FF user.js: detected! => C:\Users\sunias\AppData\Roaming\Mozilla\Firefox\Profiles\0x0rnipr.default\user.js

FF SearchPlugin: C:\Users\sunias\AppData\Roaming\Mozilla\Firefox\Profiles\0x0rnipr.default\searchplugins\gmx-suche.xml

FF Extension: Avira Browser Safety - C:\Users\sunias\AppData\Roaming\Mozilla\Firefox\Profiles\0x0rnipr.default\Extensions\abs@avira.com [2015-02-02]

FF Extension: WEB.DE MailCheck - C:\Users\sunias\AppData\Roaming\Mozilla\Firefox\Profiles\0x0rnipr.default\Extensions\toolbar@web.de [2014-12-19]

FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Users\sunias\AppData\Roaming\Mozilla\Firefox\Profiles\0x0rnipr.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi [2012-11-21]

FF Extension: Easy YouTube Video Downloader - C:\Users\sunias\AppData\Roaming\Mozilla\Firefox\Profiles\0x0rnipr.default\Extensions\{c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}.xpi [2013-02-10]

FF Extension: Adblock Plus - C:\Users\sunias\AppData\Roaming\Mozilla\Firefox\Profiles\0x0rnipr.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-02-10]

FF HKU\S-1-5-21-1621219649-1687009001-4096927769-1001\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff
 

Chrome: 

=======

CHR HomePage: Profile 1 -> hxxp://feed.plusnetwork.com/?publisher=MessengerPlus&dpid=pb2&sp=hp&searchtype=hp&t=c0120

CHR StartupUrls: Profile 1 -> "hxxp://feed.plusnetwork.com/?publisher=MessengerPlus&dpid=pb2&sp=hp&searchtype=hp&t=c0120"

CHR Profile: C:\Users\sunias\AppData\Local\Google\Chrome\User Data\default

CHR Profile: C:\Users\sunias\AppData\Local\Google\Chrome\User Data\Profile 1

CHR Extension: (Google Docs) - C:\Users\sunias\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aohghmighlieiainnegkcijnfilokake [2014-03-09]

CHR Extension: (Google Drive) - C:\Users\sunias\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-03-09]

CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\sunias\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-26]

CHR Extension: (YouTube) - C:\Users\sunias\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-03-09]

CHR Extension: (Google-Suche) - C:\Users\sunias\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-03-09]

CHR Extension: (Avira Browserschutz) - C:\Users\sunias\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2014-09-26]

CHR Extension: (Google Wallet) - C:\Users\sunias\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-03-09]

CHR Extension: (Google Mail) - C:\Users\sunias\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-03-09]

CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
 

==================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 AntiToolbarProtector; C:\Program Files\AntiToolbar\ReiGuard.exe [5101928 2014-01-23] (Reimage®)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-12-20] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-12-20] (Avira Operations GmbH & Co. KG)

R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [182520 2015-01-19] (Avira Operations GmbH & Co. KG)

R2 btwdins; C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe [956192 2011-02-15] (Broadcom Corporation.)

R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)

R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)

R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)

S2 vsmon; C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe [3558112 2014-03-18] (Check Point Software Technologies Ltd.)

R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

R2 ZAPrivacyService; C:\Program Files (x86)\CheckPoint\ZoneAlarm\ZAPrivacyService.exe [81752 2014-02-23] (Check Point Software Technologies, Ltd.)
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-07] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-10-07] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-27] (Avira Operations GmbH & Co. KG)

R0 KL1; C:\Windows\System32\DRIVERS\kl1.sys [7717984 2013-12-24] (Kaspersky Lab ZAO)

U5 klflt; C:\Windows\System32\Drivers\klflt.sys [90208 2013-12-24] (Kaspersky Lab ZAO)

R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [489568 2013-12-24] (Kaspersky Lab ZAO)

R3 SPUVCbv; C:\Windows\System32\Drivers\usbvideo.sys [185344 2013-07-12] (Microsoft Corporation)

R1 Vsdatant; C:\Windows\System32\DRIVERS\vsdatant.sys [451480 2014-03-18] (Check Point Software Technologies Ltd.)

U2 CLKMSVC10_3A60B698; No ImagePath

U2 CLKMSVC10_C3B3B687; No ImagePath

U2 DriverService; No ImagePath

U2 IAStorDataMgrSvc; No ImagePath

U2 idealife Update Service; No ImagePath

U3 IGRS; No ImagePath

U2 IviRegMgr; No ImagePath

U2 Oasis2Service; No ImagePath

U2 PCCarerServic; No ImagePath

U2 ReadyComm.DirectRouter; No ImagePath

U2 RichVideo; No ImagePath

U2 RtLedService; No ImagePath

U2 SoftwareService; No ImagePath

U2 Stereo Service; No ImagePath

U3 uwdiqpod; \??\C:\Users\sunias\AppData\Local\Temp\uwdiqpod.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2015-02-13 13:25 - 2015-02-13 13:26 - 00026375 _____ () C:\Users\sunias\Downloads\FRST.txt

2015-02-13 13:25 - 2015-02-13 13:25 - 02134016 _____ (Farbar) C:\Users\sunias\Downloads\FRST64.exe

2015-02-13 13:25 - 2015-02-13 13:25 - 00000000 ____D () C:\FRST

2015-02-13 13:19 - 2015-02-13 13:19 - 00380416 _____ () C:\Users\sunias\Downloads\Gmer-19357.exe

2015-02-13 13:07 - 2015-02-13 13:07 - 00000000 ____D () C:\Users\sunias\Downloads\RootkitRevealer(1)

2015-02-13 13:05 - 2015-02-13 13:05 - 00231390 _____ () C:\Users\sunias\Downloads\RootkitRevealer(1).zip

2015-02-13 01:56 - 2015-02-13 01:56 - 00231390 _____ () C:\Users\sunias\Downloads\RootkitRevealer.zip

2015-02-13 01:05 - 2015-02-13 01:56 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)

2015-02-13 01:04 - 2015-02-13 01:56 - 00000000 ____D () C:\Users\sunias\Desktop\mbar

2015-02-13 01:04 - 2015-02-13 01:04 - 16466552 _____ (Malwarebytes Corp.) C:\Users\sunias\Downloads\mbar-1.08.3.1004.exe

2015-02-13 00:09 - 2015-02-13 00:09 - 00000000 ____D () C:\Users\sunias\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth-Geräte

2015-02-13 00:08 - 2015-02-13 00:08 - 00022069 _____ () C:\Users\sunias\Desktop\scan gmer.log

2015-02-12 23:39 - 2015-02-12 23:39 - 00380416 _____ () C:\Users\sunias\Downloads\gdfp1i10.exe

2015-02-12 23:30 - 2015-02-12 23:30 - 01188194 _____ () C:\Users\sunias\Downloads\ProcessExplorer.zip

2015-02-12 23:14 - 2015-02-12 23:14 - 00291606 _____ () C:\Users\sunias\Downloads\TCPView.zip

2015-02-12 20:34 - 2015-01-23 05:42 - 00814080 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll

2015-02-12 20:34 - 2015-01-23 05:41 - 06041600 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll

2015-02-12 20:34 - 2015-01-23 04:43 - 00620032 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll

2015-02-12 20:34 - 2015-01-23 04:17 - 04300800 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll

2015-02-11 05:37 - 2015-02-04 04:16 - 00894976 _____ (Microsoft Corporation) C:\windows\system32\appraiser.dll

2015-02-11 05:37 - 2015-02-04 04:16 - 00762368 _____ (Microsoft Corporation) C:\windows\system32\invagent.dll

2015-02-11 05:37 - 2015-02-04 04:16 - 00609280 _____ (Microsoft Corporation) C:\windows\system32\generaltel.dll

2015-02-11 05:37 - 2015-02-04 04:16 - 00414720 _____ (Microsoft Corporation) C:\windows\system32\devinv.dll

2015-02-11 05:37 - 2015-02-04 04:16 - 00227328 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll

2015-02-11 05:37 - 2015-02-04 04:16 - 00192000 _____ (Microsoft Corporation) C:\windows\system32\aepic.dll

2015-02-11 05:37 - 2015-02-04 04:13 - 01098752 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll

2015-02-11 05:37 - 2015-01-28 00:36 - 01239720 _____ (Microsoft Corporation) C:\windows\system32\aitstatic.exe

2015-02-11 05:37 - 2015-01-10 07:48 - 00341504 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll

2015-02-11 05:37 - 2015-01-10 07:27 - 00550912 _____ (Microsoft Corporation) C:\windows\SysWOW64\kerberos.dll

2015-02-11 05:37 - 2015-01-10 07:27 - 00248832 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll

2015-02-11 05:37 - 2015-01-09 04:14 - 00950272 _____ (Microsoft Corporation) C:\windows\system32\perftrack.dll

2015-02-11 05:37 - 2015-01-09 04:14 - 00091136 _____ (Microsoft Corporation) C:\windows\system32\wdi.dll

2015-02-11 05:37 - 2015-01-09 04:14 - 00029696 _____ (Microsoft Corporation) C:\windows\system32\powertracker.dll

2015-02-11 05:37 - 2015-01-09 03:48 - 00076800 _____ (Microsoft Corporation) C:\windows\SysWOW64\wdi.dll

2015-02-11 05:36 - 2015-01-15 09:14 - 00155072 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys

2015-02-11 05:36 - 2015-01-15 09:14 - 00095680 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecdd.sys

2015-02-11 05:36 - 2015-01-15 09:09 - 01461760 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll

2015-02-11 05:36 - 2015-01-15 09:09 - 00136192 _____ (Microsoft Corporation) C:\windows\system32\sspicli.dll

2015-02-11 05:36 - 2015-01-15 09:09 - 00031232 _____ (Microsoft Corporation) C:\windows\system32\lsass.exe

2015-02-11 05:36 - 2015-01-15 09:09 - 00029184 _____ (Microsoft Corporation) C:\windows\system32\sspisrv.dll

2015-02-11 05:36 - 2015-01-15 09:09 - 00028160 _____ (Microsoft Corporation) C:\windows\system32\secur32.dll

2015-02-11 05:36 - 2015-01-15 09:08 - 00064000 _____ (Microsoft Corporation) C:\windows\system32\auditpol.exe

2015-02-11 05:36 - 2015-01-15 09:06 - 00146432 _____ (Microsoft Corporation) C:\windows\system32\msaudite.dll

2015-02-11 05:36 - 2015-01-15 09:06 - 00060416 _____ (Microsoft Corporation) C:\windows\system32\msobjs.dll

2015-02-11 05:36 - 2015-01-15 09:04 - 00686080 _____ (Microsoft Corporation) C:\windows\system32\adtschema.dll

2015-02-11 05:36 - 2015-01-15 08:42 - 00050176 _____ (Microsoft Corporation) C:\windows\SysWOW64\auditpol.exe

2015-02-11 05:36 - 2015-01-15 08:42 - 00022016 _____ (Microsoft Corporation) C:\windows\SysWOW64\secur32.dll

2015-02-11 05:36 - 2015-01-15 08:41 - 00096768 _____ (Microsoft Corporation) C:\windows\SysWOW64\sspicli.dll

2015-02-11 05:36 - 2015-01-15 08:39 - 00146432 _____ (Microsoft Corporation) C:\windows\SysWOW64\msaudite.dll

2015-02-11 05:36 - 2015-01-15 08:39 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\msobjs.dll

2015-02-11 05:36 - 2015-01-15 08:37 - 00686080 _____ (Microsoft Corporation) C:\windows\SysWOW64\adtschema.dll

2015-02-11 05:36 - 2015-01-15 05:22 - 00458824 _____ (Microsoft Corporation) C:\windows\system32\Drivers\cng.sys

2015-02-11 05:36 - 2015-01-14 06:47 - 00389808 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll

2015-02-11 05:36 - 2015-01-14 06:09 - 00342712 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll

2015-02-11 05:36 - 2015-01-13 04:10 - 01424384 _____ (Microsoft Corporation) C:\windows\system32\WindowsCodecs.dll

2015-02-11 05:36 - 2015-01-13 03:49 - 01230336 _____ (Microsoft Corporation) C:\windows\SysWOW64\WindowsCodecs.dll

2015-02-11 05:36 - 2015-01-12 04:09 - 25056256 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll

2015-02-11 05:36 - 2015-01-12 04:05 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb

2015-02-11 05:36 - 2015-01-12 04:05 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll

2015-02-11 05:36 - 2015-01-12 03:49 - 00066560 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll

2015-02-11 05:36 - 2015-01-12 03:48 - 02885632 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll

2015-02-11 05:36 - 2015-01-12 03:48 - 00584192 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll

2015-02-11 05:36 - 2015-01-12 03:48 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll

2015-02-11 05:36 - 2015-01-12 03:47 - 00088064 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll

2015-02-11 05:36 - 2015-01-12 03:40 - 00054784 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll

2015-02-11 05:36 - 2015-01-12 03:39 - 00034304 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll

2015-02-11 05:36 - 2015-01-12 03:36 - 00633856 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll

2015-02-11 05:36 - 2015-01-12 03:34 - 00144384 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe

2015-02-11 05:36 - 2015-01-12 03:34 - 00114688 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe

2015-02-11 05:36 - 2015-01-12 03:25 - 19740160 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll

2015-02-11 05:36 - 2015-01-12 03:25 - 00968704 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe

2015-02-11 05:36 - 2015-01-12 03:21 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb

2015-02-11 05:36 - 2015-01-12 03:21 - 00490496 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll

2015-02-11 05:36 - 2015-01-12 03:13 - 00077824 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll

2015-02-11 05:36 - 2015-01-12 03:08 - 00503296 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll

2015-02-11 05:36 - 2015-01-12 03:08 - 00199680 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll

2015-02-11 05:36 - 2015-01-12 03:07 - 00092160 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll

2015-02-11 05:36 - 2015-01-12 03:07 - 00062464 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll

2015-02-11 05:36 - 2015-01-12 03:07 - 00047616 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll

2015-02-11 05:36 - 2015-01-12 03:05 - 00064000 _____ (Microsoft Corporation) C:\windows\SysWOW64\MshtmlDac.dll

2015-02-11 05:36 - 2015-01-12 03:04 - 00316928 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll

2015-02-11 05:36 - 2015-01-12 03:02 - 02277888 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll

2015-02-11 05:36 - 2015-01-12 03:00 - 00047104 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll

2015-02-11 05:36 - 2015-01-12 02:59 - 00030720 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll

2015-02-11 05:36 - 2015-01-12 02:57 - 00478208 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll

2015-02-11 05:36 - 2015-01-12 02:55 - 00115712 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe

2015-02-11 05:36 - 2015-01-12 02:48 - 00801280 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll

2015-02-11 05:36 - 2015-01-12 02:48 - 00718848 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe

2015-02-11 05:36 - 2015-01-12 02:46 - 02125824 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl

2015-02-11 05:36 - 2015-01-12 02:46 - 01359360 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll

2015-02-11 05:36 - 2015-01-12 02:45 - 00418304 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll

2015-02-11 05:36 - 2015-01-12 02:43 - 14401024 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll

2015-02-11 05:36 - 2015-01-12 02:40 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll

2015-02-11 05:36 - 2015-01-12 02:36 - 00168960 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll

2015-02-11 05:36 - 2015-01-12 02:35 - 00076288 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll

2015-02-11 05:36 - 2015-01-12 02:33 - 00285696 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll

2015-02-11 05:36 - 2015-01-12 02:27 - 02358272 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll

2015-02-11 05:36 - 2015-01-12 02:23 - 02052608 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl

2015-02-11 05:36 - 2015-01-12 02:23 - 00688640 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll

2015-02-11 05:36 - 2015-01-12 02:22 - 01155072 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll

2015-02-11 05:36 - 2015-01-12 02:14 - 12829184 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll

2015-02-11 05:36 - 2015-01-12 02:14 - 01548288 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll

2015-02-11 05:36 - 2015-01-12 02:02 - 00800768 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll

2015-02-11 05:36 - 2015-01-12 02:00 - 01888256 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll

2015-02-11 05:36 - 2015-01-12 01:56 - 01307136 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll

2015-02-11 05:36 - 2015-01-12 01:55 - 00710144 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll

2015-02-11 05:36 - 2015-01-10 07:48 - 00728064 _____ (Microsoft Corporation) C:\windows\system32\kerberos.dll

2015-02-11 05:36 - 2015-01-10 07:48 - 00314880 _____ (Microsoft Corporation) C:\windows\system32\msv1_0.dll

2015-02-11 05:36 - 2015-01-10 07:48 - 00309760 _____ (Microsoft Corporation) C:\windows\system32\ncrypt.dll

2015-02-11 05:36 - 2015-01-10 07:48 - 00210944 _____ (Microsoft Corporation) C:\windows\system32\wdigest.dll

2015-02-11 05:36 - 2015-01-10 07:48 - 00086528 _____ (Microsoft Corporation) C:\windows\system32\TSpkg.dll

2015-02-11 05:36 - 2015-01-10 07:48 - 00022016 _____ (Microsoft Corporation) C:\windows\system32\credssp.dll

2015-02-11 05:36 - 2015-01-10 07:27 - 00259584 _____ (Microsoft Corporation) C:\windows\SysWOW64\msv1_0.dll

2015-02-11 05:36 - 2015-01-10 07:27 - 00221184 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncrypt.dll

2015-02-11 05:36 - 2015-01-10 07:27 - 00172032 _____ (Microsoft Corporation) C:\windows\SysWOW64\wdigest.dll

2015-02-11 05:36 - 2015-01-10 07:27 - 00065536 _____ (Microsoft Corporation) C:\windows\SysWOW64\TSpkg.dll

2015-02-11 05:36 - 2015-01-10 07:27 - 00017408 _____ (Microsoft Corporation) C:\windows\SysWOW64\credssp.dll

2015-02-11 05:35 - 2015-01-14 07:09 - 05554112 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe

2015-02-11 05:35 - 2015-01-14 06:44 - 03972544 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe

2015-02-11 05:35 - 2015-01-14 06:44 - 03917760 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe

2015-02-11 05:35 - 2014-12-12 06:31 - 01480192 _____ (Microsoft Corporation) C:\windows\system32\crypt32.dll

2015-02-11 05:35 - 2014-12-12 06:07 - 01174528 _____ (Microsoft Corporation) C:\windows\SysWOW64\crypt32.dll

2015-02-11 05:35 - 2014-12-08 04:09 - 00406528 _____ (Microsoft Corporation) C:\windows\system32\scesrv.dll

2015-02-11 05:35 - 2014-12-08 03:46 - 00308224 _____ (Microsoft Corporation) C:\windows\SysWOW64\scesrv.dll

2015-02-11 05:35 - 2014-11-26 04:53 - 00861696 _____ (Microsoft Corporation) C:\windows\system32\oleaut32.dll

2015-02-11 05:35 - 2014-11-26 04:32 - 00571904 _____ (Microsoft Corporation) C:\windows\SysWOW64\oleaut32.dll

2015-02-11 05:35 - 2014-10-04 03:10 - 03722752 _____ (Microsoft Corporation) C:\windows\system32\mstscax.dll

2015-02-11 05:35 - 2014-10-04 02:42 - 03221504 _____ (Microsoft Corporation) C:\windows\SysWOW64\mstscax.dll

2015-02-11 05:35 - 2014-10-04 02:42 - 00131584 _____ (Microsoft Corporation) C:\windows\SysWOW64\aaclient.dll

2015-02-11 05:34 - 2015-01-14 07:05 - 00503808 _____ (Microsoft Corporation) C:\windows\system32\srcore.dll

2015-02-11 05:34 - 2015-01-14 07:05 - 00050176 _____ (Microsoft Corporation) C:\windows\system32\srclient.dll

2015-02-11 05:34 - 2015-01-14 07:04 - 00296960 _____ (Microsoft Corporation) C:\windows\system32\rstrui.exe

2015-02-11 05:34 - 2015-01-14 06:41 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\srclient.dll

2015-02-11 05:34 - 2015-01-09 03:03 - 03201536 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys

2015-02-10 01:34 - 2015-02-10 01:34 - 00000000 _____ () C:\windows\SysWOW64\sho21A1.tmp

2015-02-05 01:26 - 2015-02-05 01:26 - 00000000 _____ () C:\Users\sunias\Documents\~WRD3656.tmp

2015-02-01 22:58 - 2015-02-02 01:10 - 00000000 ____D () C:\Users\sunias\Desktop\Essen

2015-01-31 17:01 - 2015-02-13 01:05 - 00136408 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys

2015-01-31 17:00 - 2015-02-13 01:05 - 00097496 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys

2015-01-31 17:00 - 2015-01-31 17:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2015-01-31 17:00 - 2015-01-31 17:00 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2015-01-31 17:00 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys

2015-01-31 16:44 - 2015-01-31 16:48 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy

2015-01-31 16:44 - 2015-01-31 16:47 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2

2015-01-31 16:44 - 2015-01-31 16:44 - 00001395 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk

2015-01-31 16:44 - 2015-01-31 16:44 - 00001383 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk

2015-01-31 16:44 - 2015-01-31 16:44 - 00000000 ____D () C:\windows\System32\Tasks\Safer-Networking

2015-01-31 16:44 - 2015-01-31 16:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2

2015-01-31 16:44 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\windows\system32\sdnclean64.exe

2015-01-31 16:38 - 2015-01-31 16:38 - 01191200 _____ () C:\Users\sunias\Downloads\SpyBot Search Destroy - CHIP-Installer.exe

2015-01-31 15:29 - 2015-01-31 15:30 - 13946462 _____ () C:\Users\sunias\Downloads\SysinternalsSuite.zip

2015-01-31 15:25 - 2015-01-31 15:27 - 00000000 ____D () C:\Users\sunias\Desktop\Handy-Backup

2015-01-31 15:22 - 2015-01-31 15:22 - 00000000 ____D () C:\Users\sunias\Desktop\WhatsApp

2015-01-29 12:46 - 2015-01-29 12:47 - 00045130 _____ () C:\Users\sunias\Desktop\L'amore più forte è quello che può dimostrare la sua fragilità

2015-01-29 12:41 - 2015-01-29 12:41 - 00039255 _____ () C:\Users\sunias\Desktop\Da lontano giungono canzoni d’addio ma non si sente il rumore degli strappi della separazione

2015-01-29 11:30 - 2015-01-29 11:30 - 00055531 _____ () C:\Users\sunias\Desktop\ La felicità è solo un momento di pausa tra un dolore e l’altro

2015-01-27 12:13 - 2015-01-27 12:13 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2015-01-26 20:00 - 2015-02-02 00:54 - 00000000 ____D () C:\Users\sunias\Desktop\Paare

2015-01-26 19:59 - 2015-01-27 11:57 - 00000000 ____D () C:\Users\sunias\Desktop\Blumen

2015-01-26 19:58 - 2015-02-02 00:54 - 00000000 ____D () C:\Users\sunias\Desktop\Vintage Shabby

2015-01-26 19:58 - 2015-02-01 23:21 - 00000000 ____D () C:\Users\sunias\Desktop\Wohnen

2015-01-26 19:58 - 2015-02-01 23:11 - 00000000 ____D () C:\Users\sunias\Desktop\Strick

2015-01-26 19:55 - 2015-02-01 23:13 - 00000000 ____D () C:\Users\sunias\Desktop\Tiere

2015-01-26 19:55 - 2015-02-01 23:03 - 00000000 ____D () C:\Users\sunias\Desktop\Kinder

2015-01-26 19:55 - 2015-01-30 14:25 - 00000000 ____D () C:\Users\sunias\Desktop\Natur Städte

2015-01-21 12:41 - 2015-01-21 12:41 - 03423974 _____ () C:\Users\sunias\Downloads\Anhänge_2015121.zip

2015-01-20 22:17 - 2015-02-08 22:30 - 00000000 ____D () C:\Users\sunias\Desktop\Bilder

2015-01-20 22:17 - 2015-01-20 22:18 - 00000000 ____D () C:\Users\sunias\Desktop\Dokumente

2015-01-20 22:15 - 2015-01-26 20:23 - 00000000 ____D () C:\Users\sunias\Desktop\sprüche

2015-01-20 22:06 - 2015-01-20 22:06 - 00001305 _____ () C:\Users\sunias\Desktop\Movie Maker.lnk

2015-01-20 20:17 - 2015-01-20 20:17 - 00000000 ___RD () C:\Program Files (x86)\Skype

2015-01-20 20:17 - 2015-01-20 20:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype

2015-01-16 11:10 - 2015-01-16 11:10 - 02928413 _____ () C:\Users\sunias\Downloads\VID_20131206_224235.mp4
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2015-02-13 13:19 - 2012-02-17 20:23 - 00700462 _____ () C:\windows\system32\perfh007.dat

2015-02-13 13:19 - 2012-02-17 20:23 - 00150498 _____ () C:\windows\system32\perfc007.dat

2015-02-13 13:19 - 2012-02-17 13:27 - 00001110 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job

2015-02-13 13:19 - 2009-07-14 06:13 - 01622236 _____ () C:\windows\system32\PerfStringBackup.INI

2015-02-13 13:16 - 2009-07-14 05:45 - 00028704 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2015-02-13 13:16 - 2009-07-14 05:45 - 00028704 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2015-02-13 13:15 - 2014-05-26 20:58 - 00000435 _____ () C:\windows\system32\Drivers\etc\hosts.ics

2015-02-13 13:15 - 2012-02-17 12:31 - 01931515 _____ () C:\windows\WindowsUpdate.log

2015-02-13 13:15 - 2009-07-14 05:51 - 00117907 _____ () C:\windows\setupact.log

2015-02-13 13:10 - 2012-02-17 13:17 - 03905855 _____ () C:\FaceProv.log

2015-02-13 13:05 - 2014-02-12 13:54 - 00000000 ____D () C:\Users\sunias\AppData\Roaming\FileAdvisor

2015-02-13 12:55 - 2012-09-14 12:29 - 00000000 ____D () C:\Users\sunias\.rainlendar2

2015-02-13 12:55 - 2012-08-31 21:50 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job

2015-02-13 12:55 - 2012-02-17 13:18 - 00776769 _____ () C:\windows\system32\fastboot.set

2015-02-13 12:55 - 2012-02-17 13:17 - 00000000 ____D () C:\ProgramData\VeriFace

2015-02-13 12:54 - 2014-08-26 23:44 - 00000680 __RSH () C:\Users\sunias\ntuser.pol

2015-02-13 12:54 - 2012-08-25 16:12 - 00000000 ____D () C:\Users\sunias

2015-02-13 12:54 - 2012-02-17 13:27 - 00001106 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job

2015-02-13 12:47 - 2009-07-14 06:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT

2015-02-12 21:35 - 2014-08-26 23:35 - 00000000 ____D () C:\Users\uni

2015-02-12 18:08 - 2014-02-11 13:05 - 00003518 _____ () C:\windows\System32\Tasks\FileAdvisorCheck

2015-02-12 18:08 - 2014-02-11 13:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\File Type Advisor

2015-02-12 18:08 - 2014-02-11 13:05 - 00000000 ____D () C:\Program Files (x86)\File Type Advisor

2015-02-12 14:38 - 2014-08-26 23:57 - 00001328 __RSH () C:\Users\Elias\ntuser.pol

2015-02-12 14:38 - 2014-08-26 23:57 - 00000000 ____D () C:\Users\Elias

2015-02-12 13:26 - 2009-07-14 05:45 - 00307728 _____ () C:\windows\system32\FNTCACHE.DAT

2015-02-12 13:23 - 2014-12-20 03:22 - 00000000 ____D () C:\windows\system32\appraiser

2015-02-12 13:23 - 2014-05-07 07:33 - 00000000 ___SD () C:\windows\system32\CompatTel

2015-02-12 13:23 - 2009-07-14 04:20 - 00000000 ____D () C:\windows\tracing

2015-02-12 00:51 - 2012-10-02 08:19 - 00000000 ____D () C:\ProgramData\Microsoft Help

2015-02-12 00:18 - 2014-08-16 22:25 - 00000000 ____D () C:\ProgramData\Package Cache

2015-02-12 00:18 - 2012-12-17 06:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira

2015-02-12 00:18 - 2012-12-17 06:18 - 00000000 ____D () C:\Program Files (x86)\Avira

2015-02-10 10:36 - 2010-11-21 04:47 - 00220960 _____ () C:\windows\PFRO.log

2015-02-06 03:47 - 2012-08-25 16:27 - 00000000 ____D () C:\windows\System32\Tasks\Games

2015-02-06 01:14 - 2012-02-17 13:27 - 00004106 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA

2015-02-06 01:14 - 2012-02-17 13:27 - 00003854 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore

2015-02-05 11:55 - 2012-08-31 21:50 - 00701616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe

2015-02-05 11:55 - 2012-08-31 21:50 - 00071344 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl

2015-02-05 11:55 - 2012-08-31 21:50 - 00003822 _____ () C:\windows\System32\Tasks\Adobe Flash Player Updater

2015-02-05 10:05 - 2009-07-14 06:08 - 00032632 _____ () C:\windows\Tasks\SCHEDLGU.TXT

2015-02-05 10:03 - 2012-09-08 00:04 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

2015-02-04 18:25 - 2009-07-14 04:20 - 00000000 ____D () C:\windows\system32\NDF

2015-02-02 19:41 - 2012-09-01 00:10 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk

2015-02-02 10:26 - 2013-05-04 16:37 - 00000000 ____D () C:\Users\sunias\AppData\Roaming\.minecraft

2015-02-01 23:08 - 2014-02-08 00:50 - 00000743 _____ () C:\Users\sunias\Desktop\mp3DirectCut.lnk

2015-02-01 23:07 - 2014-03-16 21:11 - 00000000 ____D () C:\Users\sunias\AppData\Roaming\Skype

2015-01-31 17:00 - 2013-10-30 10:05 - 00000000 ____D () C:\Users\sunias\AppData\Roaming\Malwarebytes

2015-01-31 17:00 - 2013-10-30 10:05 - 00000000 ____D () C:\ProgramData\Malwarebytes

2015-01-31 17:00 - 2013-10-30 10:05 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware

2015-01-31 15:13 - 2014-04-29 09:07 - 00078409 ____H () C:\windows\SysWOW64\BTImages.dat

2015-01-20 20:17 - 2014-03-16 21:11 - 00000000 ____D () C:\ProgramData\Skype

2015-01-20 20:13 - 2012-12-26 23:27 - 00000000 ____D () C:\Temp

2015-01-20 20:10 - 2013-10-27 17:40 - 00001122 _____ () C:\Users\sunias\Desktop\Cyberlink Power2Go.lnk

2015-01-16 11:07 - 2014-06-22 19:50 - 00000000 ____D () C:\Users\sunias\AppData\Roaming\vlc

2015-01-15 03:06 - 2012-09-06 10:59 - 01598034 _____ () C:\windows\SysWOW64\PerfStringBackup.INI
 

==================== Files in the root of some directories =======
 

2013-05-26 19:34 - 2013-05-26 19:34 - 0005909 _____ () C:\Users\sunias\AppData\Local\recently-used.xbel
 

Some content of TEMP:

====================

C:\Users\Elias\AppData\Local\Temp\avgnt.exe

C:\Users\sunias\AppData\Local\Temp\A.exe

C:\Users\sunias\AppData\Local\Temp\avgnt.exe

C:\Users\sunias\AppData\Local\Temp\CUTBA.exe

C:\Users\sunias\AppData\Local\Temp\CXQLD.exe

C:\Users\sunias\AppData\Local\Temp\EYJUY.exe

C:\Users\sunias\AppData\Local\Temp\HUPH.exe

C:\Users\sunias\AppData\Local\Temp\i4jdel0.exe

C:\Users\sunias\AppData\Local\Temp\i4jdel1.exe

C:\Users\sunias\AppData\Local\Temp\i4jdel2.exe

C:\Users\sunias\AppData\Local\Temp\i4jdel3.exe

C:\Users\sunias\AppData\Local\Temp\i4jdel4.exe

C:\Users\sunias\AppData\Local\Temp\PAXH.exe

C:\Users\sunias\AppData\Local\Temp\RIM.exe

C:\Users\sunias\AppData\Local\Temp\tmd_34013428.exe

C:\Users\sunias\AppData\Local\Temp\UQEUEFPDW.exe

C:\Users\sunias\AppData\Local\Temp\vlc-2.1.5-win32.exe

C:\Users\uni\AppData\Local\Temp\avgnt.exe
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2015-02-03 01:48
 

==================== End Of Log ============================

--- --- ---

--- --- ---