Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Werbebomben, ständig öffnende Browser, neue Programme auf Desktop (https://www.trojaner-board.de/165897-werbebomben-staendig-oeffnende-browser-neue-programme-desktop.html)

nine53 07.04.2015 20:57
Werbebomben, ständig öffnende Browser, neue Programme auf Desktop
 
Guten Abend,

heute sind wir zu Besuch bei meinen Grosseltern und die Kinder haben sich Ausmalbilder ausgedruckt.
Seither sind auf dem Desktop mehre Programme erschienen die wir nicht runtergeladen haben, z.b. YT Installer(gelöscht), Sync Folder, Crossbrowse, Anyprotect.
Dazu gehen ständig Browserfenster mit Werbung auf, sowohl IE, Chrome und firefox und Crossbrowse alle mit der Startseite istartsurf.com.
Dazu stürzen jegliche Browser sehr schnell ab, ich kann auch manche Seiten nicht direkkt öffnen sondern muss über google, da diese Seten, z.b. Trojaner Board irgendwie blockiert werden.
Auch defogger konnte ich nicht downloaden, es öffnet ständig andere downloads, aber eben nicht defogger.

Hier aber FRST

Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015
Ran by Tiedt (administrator) on TIEDT-HP on 07-04-2015 20:41:09
Running from C:\Users\Tiedt\Downloads
Loaded Profiles: Tiedt (Available profiles: Tiedt)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(SysTool PasSame LIMITED) C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe
(Abengine) C:\Program Files (x86)\HighlightSearches\abengine.exe
(Webby) C:\Program Files (x86)\iWebar\4947097a-efd7-4265-be23-25706c1bf1f3-6.exe
(AVM Berlin) C:\Program Files (x86)\avmwlanstick\WLanNetService.exe
(Cinema PlusV07.04) C:\Program Files (x86)\Cinema PlusV07.04-ntf\f7c60be6-f43e-478e-86f2-92730f6935fd-10.exe
(Just Develop It) C:\Program Files (x86)\MyPC Backup\BackupStack.exe
(ObjectB) C:\Program Files (x86)\Object Browser\ebbe3f26-9d77-42bb-9f0a-fa747484c8f2-1-6.exe
(Webby) C:\Program Files (x86)\iWebar\4947097a-efd7-4265-be23-25706c1bf1f3-1-6.exe
(ObjectB) C:\Program Files (x86)\Object Browser\ebbe3f26-9d77-42bb-9f0a-fa747484c8f2-6.exe
(Cinema PlusV07.04) C:\Program Files (x86)\Cinema PlusV07.04\f7c60be6-f43e-478e-86f2-92730f6935fd-6.exe
() C:\Program Files (x86)\version85BlockAndSurf\J4BlockAndSurfJ52.exe
(Cinema PlusV07.04) C:\Program Files (x86)\Cinema PlusV07.04\f7c60be6-f43e-478e-86f2-92730f6935fd-1-6.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
() C:\Users\Tiedt\AppData\Roaming\0406D9B4-1428427194-72AF-8C7F-B36FDEF67BEF\jnsb478A.tmp
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
(XTab system) C:\Program Files (x86)\XTab\ProtectService.exe
(SearchProtect) C:\Program Files (x86)\XTab\CmdShell.exe
() C:\Program Files (x86)\HighlightSearches\njs.exe
(Infonaut) C:\Program Files (x86)\Infonaut_1.10.0.13\Service\insvc.exe
() C:\Users\Tiedt\AppData\Roaming\0406D9B4-1428427194-72AF-8C7F-B36FDEF67BEF\nsv1434.tmpfs
() C:\Users\Tiedt\AppData\Local\0406D9B4-1428434594-72AF-8C7F-B36FDEF67BEF\cnsx909.tmp
() C:\ProgramData\LolliScan\LolliScan.exe
(Logitech Inc.) C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
(Logitech Inc.) C:\Program Files (x86)\Common Files\LogiShrd\LVMVFM\LVPrS64H.exe
(PDF Complete Inc) C:\Program Files (x86)\PDF Complete\pdfsvc.exe
(Reimage®) C:\Program Files\Reimage\Reimage Protector\ReiGuard.exe
(ShopperPro) C:\Program Files\Common Files\ShopperPro\spbiu.exe
() C:\Program Files\Reimage\Reimage Protector\ReiSystem.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Auto\HPAuto.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(XTab system) C:\Program Files (x86)\XTab\HPNotify.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
() C:\Program Files (x86)\version85BlockAndSurf\BlockAndSurf.exe
() C:\Users\Tiedt\AppData\Local\mbot_de_587\upmbot_de_587.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Hewlett-Packard ) C:\Program Files\IDT\WDM\Beats64.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3520 series\Bin\ScanToPCActivationApp.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
() C:\Program Files (x86)\ShopperPro\JSDriver\1.38.1.1735\jsdrv.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
(Crossbrowse) C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\crossbrowse.exe
(AVM Berlin) C:\Program Files (x86)\avmwlanstick\WLanGUI.exe
() C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe
(Cyberlink Corp.) C:\Program Files (x86)\Cyberlink\PowerDVD\PDVDServ.exe
(Hewlett-Packard) C:\Program Files (x86)\Hp\HP Software Update\hpwuschd2.exe
() C:\Program Files (x86)\Common Files\LogiShrd\LQCVFX\COCIManager.exe
(MyPCBackup.com) C:\Program Files (x86)\MyPC Backup\MyPC Backup.exe
() C:\Program Files (x86)\mbot_de_587\mbot_de_587.exe
(SoftBrain Technologies Ltd.) C:\Users\Tiedt\AppData\Local\SmartWeb\SmartWebHelper.exe
(Crossbrowse) C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\crossbrowse.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3520 series\Bin\HPNetworkCommunicator.exe
(SoftBrain Technologies Ltd.) C:\Users\Tiedt\AppData\Local\SmartWeb\SmartWebApp.exe
() C:\Users\Tiedt\AppData\Local\0406D9B4-1428434594-72AF-8C7F-B36FDEF67BEF\ansc35D.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Calendar\Service\GCalService.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Calendar\Service\HPTouchSmartSyncCalReminderApp.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
() C:\Users\Tiedt\AppData\Local\Temp\nsw1863.tmp
() C:\Program Files (x86)\gmsd_de_385\gmsd_de_385.exe
() C:\Users\Tiedt\AppData\Local\gmsd_de_385\upgmsd_de_385.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
() C:\Users\Tiedt\AppData\Local\Temp\nsc3E46.tmp
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1425408 2012-03-30] (IDT, Inc.)
HKLM\...\Run: [BeatsOSDApp] => C:\Program Files\IDT\WDM\beats64.exe [37888 2012-03-30] (Hewlett-Packard )
HKLM\...\Run: [HPSYSDRV] => C:\Program Files (x86)\Hewlett-Packard\HP Odometer\HPSYSDRV.EXE [62768 2008-11-20] (Hewlett-Packard)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1332296 2015-01-30] (Microsoft Corporation)
HKLM-x32\...\Run: [Norton Online Backup] => C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [1155928 2010-06-02] (Symantec Corporation)
HKLM-x32\...\Run: [Easybits Recovery] => C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe [61112 2012-02-21] (EasyBits Software AS)
HKLM-x32\...\Run: [PDF Complete] => C:\Program Files (x86)\PDF Complete\pdfsty.exe [684024 2012-04-04] (PDF Complete Inc)
HKLM-x32\...\Run: [AVMWlanClient] => C:\Program Files (x86)\avmwlanstick\wlangui.exe [2105344 2010-10-22] (AVM Berlin)
HKLM-x32\...\Run: [LogitechQuickCamRibbon] => C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe [2793304 2009-10-14] ()
HKLM-x32\...\Run: [RemoteControl] => C:\Program Files (x86)\CyberLink\PowerDVD\PDVDServ.exe [32768 2004-11-02] (Cyberlink Corp.)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [mbot_de_587] => C:\Program Files (x86)\mbot_de_587\mbot_de_587.exe [3984016 2015-04-05] ()
HKLM-x32\...\Run: [SPDriver] => C:\Program Files (x86)\ShopperPro\JSDriver\1.38.1.1735\jsdrv.exe [3224576 2015-04-06] ()
HKLM-x32\...\Run: [YTDownloader] => "C:\Program Files (x86)\YTDownloader\YTDownloader.exe" /boot
HKLM-x32\...\Run: [WinCheck] => C:\Users\Tiedt\AppData\Local\0406D9B4-1428434453-72AF-8C7F-B36FDEF67BEF\bnsbDCCA.exe [329728 2015-04-07] ()
HKLM-x32\...\Run: [gmsd_de_385] => C:\Program Files (x86)\gmsd_de_385\gmsd_de_385.exe [3983504 2015-04-06] ()
HKLM-x32\...\Run: [SmartWeb] => C:\Users\Tiedt\AppData\Local\SmartWeb\SmartWebHelper.exe [270368 2015-02-17] (SoftBrain Technologies Ltd.)
HKLM-x32\...\RunOnce: [upmbot_de_587.exe] => C:\Users\Tiedt\AppData\Local\mbot_de_587\upmbot_de_587.exe [3310736 2015-04-05] ()
HKLM-x32\...\RunOnce: [upgmsd_de_385.exe] => C:\Users\Tiedt\AppData\Local\mbot_de_587\upgmsd_de_385.exe -runonce
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKU\S-1-5-21-2149968534-1042019459-1302014499-1000\...\Run: [HP Deskjet 3520 series (NET)] => C:\Program Files\HP\HP Deskjet 3520 series\Bin\ScanToPCActivationApp.exe [2551656 2012-01-31] (Hewlett-Packard Co.)
HKU\S-1-5-21-2149968534-1042019459-1302014499-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [31087200 2015-01-23] (Skype Technologies S.A.)
HKU\S-1-5-21-2149968534-1042019459-1302014499-1000\...\Run: [SPDriver] => C:\Program Files (x86)\ShopperPro\JSDriver\1.38.1.1735\jsdrv.exe [3224576 2015-04-06] ()
HKU\S-1-5-21-2149968534-1042019459-1302014499-1000\...\Run: [YTDownloader] => "C:\Program Files (x86)\YTDownloader\YTDownloader.exe" /boot
HKU\S-1-5-21-2149968534-1042019459-1302014499-1000\...\Run: [GoogleChromeAutoLaunch_2C142DA54B54EC24056B4AF2F6E94CF1] => C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\crossbrowse.exe [637440 2015-03-04] (Crossbrowse)
HKU\S-1-5-21-2149968534-1042019459-1302014499-1000\...\Policies\system: [DisableLockWorkstation] 0
HKU\S-1-5-21-2149968534-1042019459-1302014499-1000\...\Policies\system: [DisableChangePassword] 0
HKU\S-1-5-21-2149968534-1042019459-1302014499-1000\...\MountPoints2: {21f4f905-0e3e-11e2-bb6f-ac162d091884} - G:\pushinst.exe
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
Startup: C:\Users\Tiedt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\crossbrowse.lnk
ShortcutTarget: crossbrowse.lnk -> C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\crossbrowse.exe (Crossbrowse)
Startup: C:\Users\Tiedt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPC Backup.lnk
ShortcutTarget: MyPC Backup.lnk -> C:\Program Files (x86)\MyPC Backup\MyPC Backup.exe (MyPCBackup.com)
Startup: C:\Users\Tiedt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Priceless_310315.lnk
ShortcutTarget: Priceless_310315.lnk -> C:\ProgramData\{3bef08e0-4997-b04c-3bef-f08e04992381}\Priceless_310315.exe ()
Startup: C:\Users\Tiedt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SmartWeb.lnk
ShortcutTarget: SmartWeb.lnk -> C:\Users\Tiedt\AppData\Local\SmartWeb\SmartWebHelper.exe (SoftBrain Technologies Ltd.)
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.istartsurf.com/?type=hp&ts=1428427809&from=face&uid=HitachiXHDS721010DLE630_MSK5215H20X97G20X97GX
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.istartsurf.com/?type=hp&ts=1428427809&from=face&uid=HitachiXHDS721010DLE630_MSK5215H20X97G20X97GX
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.istartsurf.com/web/?type=ds&ts=1428427809&from=face&uid=HitachiXHDS721010DLE630_MSK5215H20X97G20X97GX&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.istartsurf.com/web/?type=ds&ts=1428427809&from=face&uid=HitachiXHDS721010DLE630_MSK5215H20X97G20X97GX&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.istartsurf.com/?type=hp&ts=1428427809&from=face&uid=HitachiXHDS721010DLE630_MSK5215H20X97G20X97GX
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.istartsurf.com/?type=hp&ts=1428427809&from=face&uid=HitachiXHDS721010DLE630_MSK5215H20X97G20X97GX
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.istartsurf.com/web/?type=ds&ts=1428427809&from=face&uid=HitachiXHDS721010DLE630_MSK5215H20X97G20X97GX&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.istartsurf.com/web/?type=ds&ts=1428427809&from=face&uid=HitachiXHDS721010DLE630_MSK5215H20X97G20X97GX&q={searchTerms}
HKU\S-1-5-21-2149968534-1042019459-1302014499-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.istartsurf.com/?type=hp&ts=1428427809&from=face&uid=HitachiXHDS721010DLE630_MSK5215H20X97G20X97GX
HKU\S-1-5-21-2149968534-1042019459-1302014499-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.istartsurf.com/?type=hp&ts=1428427809&from=face&uid=HitachiXHDS721010DLE630_MSK5215H20X97G20X97GX
SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.istartsurf.com/web/?type=ds&ts=1428427809&from=face&uid=HitachiXHDS721010DLE630_MSK5215H20X97G20X97GX&q={searchTerms}
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox
SearchScopes: HKLM -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPDTDF
SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.istartsurf.com/web/?type=ds&ts=1428427809&from=face&uid=HitachiXHDS721010DLE630_MSK5215H20X97G20X97GX&q={searchTerms}
SearchScopes: HKLM -> {4709F2DE-3A4E-4C6E-BA0B-538370E51EF0} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de1-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPDTDF
SearchScopes: HKLM -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-2/4?mpre=hxxp://www.ebay.de/sch/i.html?_nkw={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.istartsurf.com/web/?type=ds&ts=1428427809&from=face&uid=HitachiXHDS721010DLE630_MSK5215H20X97G20X97GX&q={searchTerms}
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox
SearchScopes: HKLM-x32 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPDTDF
SearchScopes: HKLM-x32 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.istartsurf.com/web/?type=ds&ts=1428427809&from=face&uid=HitachiXHDS721010DLE630_MSK5215H20X97G20X97GX&q={searchTerms}
SearchScopes: HKLM-x32 -> {4709F2DE-3A4E-4C6E-BA0B-538370E51EF0} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de1-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPDTDF
SearchScopes: HKLM-x32 -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-2/4?mpre=hxxp://www.ebay.de/sch/i.html?_nkw={searchTerms}
SearchScopes: HKU\S-1-5-21-2149968534-1042019459-1302014499-1000 -> DefaultScope {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = hxxp://www.istartsurf.com/web/?utm_source=b&utm_medium=face&utm_campaign=install_ie&utm_content=ds&from=face&uid=HitachiXHDS721010DLE630_MSK5215H20X97G20X97GX&ts=1428427864&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2149968534-1042019459-1302014499-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.istartsurf.com/web/?utm_source=b&utm_medium=face&utm_campaign=install_ie&utm_content=ds&from=face&uid=HitachiXHDS721010DLE630_MSK5215H20X97G20X97GX&ts=1428427864&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2149968534-1042019459-1302014499-1000 -> {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = hxxp://www.istartsurf.com/web/?utm_source=b&utm_medium=face&utm_campaign=install_ie&utm_content=ds&from=face&uid=HitachiXHDS721010DLE630_MSK5215H20X97G20X97GX&ts=1428427864&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2149968534-1042019459-1302014499-1000 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://www.istartsurf.com/web/?utm_source=b&utm_medium=face&utm_campaign=install_ie&utm_content=ds&from=face&uid=HitachiXHDS721010DLE630_MSK5215H20X97G20X97GX&ts=1428427864&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2149968534-1042019459-1302014499-1000 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.istartsurf.com/web/?utm_source=b&utm_medium=face&utm_campaign=install_ie&utm_content=ds&from=face&uid=HitachiXHDS721010DLE630_MSK5215H20X97G20X97GX&ts=1428427864&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2149968534-1042019459-1302014499-1000 -> {4709F2DE-3A4E-4C6E-BA0B-538370E51EF0} URL = hxxp://www.istartsurf.com/web/?utm_source=b&utm_medium=face&utm_campaign=install_ie&utm_content=ds&from=face&uid=HitachiXHDS721010DLE630_MSK5215H20X97G20X97GX&ts=1428427864&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2149968534-1042019459-1302014499-1000 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://www.istartsurf.com/web/?utm_source=b&utm_medium=face&utm_campaign=install_ie&utm_content=ds&from=face&uid=HitachiXHDS721010DLE630_MSK5215H20X97G20X97GX&ts=1428427864&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2149968534-1042019459-1302014499-1000 -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://www.istartsurf.com/web/?utm_source=b&utm_medium=face&utm_campaign=install_ie&utm_content=ds&from=face&uid=HitachiXHDS721010DLE630_MSK5215H20X97G20X97GX&ts=1428427864&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2149968534-1042019459-1302014499-1000 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://www.istartsurf.com/web/?utm_source=b&utm_medium=face&utm_campaign=install_ie&utm_content=ds&from=face&uid=HitachiXHDS721010DLE630_MSK5215H20X97G20X97GX&ts=1428427864&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2149968534-1042019459-1302014499-1000 -> {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = hxxp://www.istartsurf.com/web/?utm_source=b&utm_medium=face&utm_campaign=install_ie&utm_content=ds&from=face&uid=HitachiXHDS721010DLE630_MSK5215H20X97G20X97GX&ts=1428427864&type=default&q={searchTerms}
BHO: PoriceLesS -> {4d3bea8a-16de-43d0-974f-2a043c7af36e} -> C:\Program Files (x86)\PoriceLesS\88GrgormqUgNCm.x64.dll [2015-04-07] ()
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-29] (Microsoft Corp.)
BHO: Shopper Pro -> {A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C} -> C:\ProgramData\ShopperPro\ShopperPro64.dll [2015-04-06] (Goobzo Ltd.)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-03-07] (Google Inc.)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2014-07-14] (Microsoft Corporation)
BHO: BlockAndSurf -> {D199A6DE-D224-6983-380B-DA21184BF97A} -> C:\Program Files (x86)\version85BlockAndSurf\191_x64.dll [2015-04-07] ()
BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll [2014-04-09] (McAfee, Inc.)
BHO-x32: IETabPage Class -> {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} -> C:\Program Files (x86)\XTab\SupTab.dll [2015-03-16] (Thinknice Co. Limited)
BHO-x32: PoriceLesS -> {4d3bea8a-16de-43d0-974f-2a043c7af36e} -> C:\Program Files (x86)\PoriceLesS\88GrgormqUgNCm.dll [2015-04-07] ()
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-29] (Microsoft Corp.)
BHO-x32: Shopper Pro -> {A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C} -> C:\ProgramData\ShopperPro\ShopperPro.dll [2015-04-06] (Goobzo Ltd.)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-03-07] (Google Inc.)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2014-07-14] (Microsoft Corporation)
BHO-x32: BlockAndSurf -> {D199A6DE-D224-6983-380B-DA21184BF97A} -> C:\Program Files (x86)\version85BlockAndSurf\191.dll [2015-04-07] ()
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-03-07] (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-03-07] (Google Inc.)
Toolbar: HKU\S-1-5-21-2149968534-1042019459-1302014499-1000 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2014-07-14] (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2014-07-14] (Microsoft Corporation)
ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll [52920 2012-07-06] (EasyBits Software Corp.)
Winsock: Catalog9 01 C:\windows\SysWOW64\abengine.dll [340920] (Abengine)
Winsock: Catalog9 02 C:\windows\SysWOW64\abengine.dll [340920] (Abengine)
Winsock: Catalog9 03 C:\windows\SysWOW64\abengine.dll [340920] (Abengine)
Winsock: Catalog9 04 C:\windows\SysWOW64\abengine.dll [340920] (Abengine)
Winsock: Catalog9 15 C:\windows\SysWOW64\abengine.dll [340920] (Abengine)
Winsock: Catalog9-x64 01 C:\windows\system32\abengine64.dll [408408] (Abengine)
Winsock: Catalog9-x64 02 C:\windows\system32\abengine64.dll [408408] (Abengine)
Winsock: Catalog9-x64 03 C:\windows\system32\abengine64.dll [408408] (Abengine)
Winsock: Catalog9-x64 04 C:\windows\system32\abengine64.dll [408408] (Abengine)
Winsock: Catalog9-x64 15 C:\windows\system32\abengine64.dll [408408] (Abengine)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.luckysearches.com/?type=sc&ts=1428426860&from=amt&uid=HitachiXHDS721010DLE630_MSK5215H20X97G20X97GX

FireFox:
========
FF ProfilePath: C:\Users\Tiedt\AppData\Roaming\Mozilla\Firefox\Profiles\snq3xiqr.default
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2011-05-14] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2011-05-14] (Microsoft Corporation)
FF Plugin-x32: @staging.google.com/globalUpdate Update;version=10 -> C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll [2015-04-07] (globalUpdate)
FF Plugin-x32: @staging.google.com/globalUpdate Update;version=4 -> C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll [2015-04-07] (globalUpdate)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-07] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-07] (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll [2011-09-28] ()
FF HKLM-x32\...\Firefox\Extensions: [quickprint@hp.com] - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\QPExtension
FF Extension: HP Smart Print - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\QPExtension [2012-12-26]
FF HKU\S-1-5-21-2149968534-1042019459-1302014499-1000\...\Firefox\Extensions: [{FE731265-F22A-8201-8F90-E6C9A47F5879}] - C:\Program Files (x86)\version85BlockAndSurf\191.xpi
FF Extension: BlockAndSurf - C:\Program Files (x86)\version85BlockAndSurf\191.xpi [2015-04-07]

Chrome:
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR HomePage: Default -> hxxp://www.luckysearches.com/?type=hp&ts=1428427384&from=fsf&uid=HitachiXHDS721010DLE630_MSK5215H20X97G20X97GX
CHR StartupUrls: Default -> "hxxp://www.luckysearches.com/?type=hp&ts=1428427384&from=fsf&uid=HitachiXHDS721010DLE630_MSK5215H20X97G20X97GX"
CHR DefaultSearchKeyword: Default -> luckysearches
CHR DefaultSuggestURL: Default ->
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.118\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.118\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.118\pdf.dll ()
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File
CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
CHR Plugin: (Windows Live™ Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll No File
CHR Profile: C:\Users\Tiedt\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (YouTube) - C:\Users\Tiedt\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-04-21]
CHR Extension: (Google Search) - C:\Users\Tiedt\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-04-21]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Tiedt\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-13]
CHR Extension: (Skype Click to Call) - C:\Users\Tiedt\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2014-04-17]
CHR Extension: (Google Wallet) - C:\Users\Tiedt\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-11-21]
CHR Extension: (Cinema PlusV07.04) - C:\Users\Tiedt\AppData\Local\Google\Chrome\User Data\Default\Extensions\papbadoldddalgcjcicnikcfenodpghp [2015-04-07]
CHR Extension: (Gmail) - C:\Users\Tiedt\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-04-21]
CHR HKU\S-1-5-21-2149968534-1042019459-1302014499-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [fcfenmboojpjinhpgggodefccipikbpd] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [bopakagnckmlgajfccecajhnimjiiedh] - hxxp://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14]
StartMenuInternet: Google Chrome - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe hxxp://www.istartsurf.com/?type=sc&ts=1428427809&from=face&uid=HitachiXHDS721010DLE630_MSK5215H20X97G20X97GX

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 abengine; C:\Program Files (x86)\HighlightSearches\abengine.exe [1775248 2015-03-30] (Abengine) [File not signed]
R2 AVM WLAN Connection Service; C:\Program Files (x86)\avmwlanstick\WlanNetService.exe [376832 2010-10-22] (AVM Berlin) [File not signed]
R2 BackupStack; C:\Program Files (x86)\MyPC Backup\BackupStack.exe [53832 2014-11-25] (Just Develop It) <==== ATTENTION
R2 be0fb33b; c:\Program Files (x86)\Supporter\Supporter.dll [1626112 2015-04-07] () [File not signed]
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
R2 CalendarSynchService; C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Calendar\Service\GCalService.exe [16384 2011-08-16] (Hewlett-Packard) [File not signed]
R2 ezSharedSvc; C:\windows\SysWOW64\ezSharedSvcHost.exe [514232 2010-04-23] (EasyBits Software AS) [File not signed]
R2 fogezyny; C:\Users\Tiedt\AppData\Roaming\0406D9B4-1428427194-72AF-8C7F-B36FDEF67BEF\jnsb478A.tmp [185856 2015-04-07] () [File not signed]
S2 globalUpdate; C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe [68608 2015-04-07] (globalUpdate) [File not signed]
S3 globalUpdatem; C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe [68608 2015-04-07] (globalUpdate) [File not signed]
R2 HPAuto; C:\Program Files\Hewlett-Packard\HP Auto\HPAuto.exe [682040 2011-02-17] (Hewlett-Packard)
R2 IHProtect Service; C:\Program Files (x86)\XTab\ProtectService.exe [158816 2015-03-16] (XTab system)
R2 InjectorService; C:\Program Files (x86)\HighlightSearches\njs.exe [164352 2015-03-30] () [File not signed]
R2 insvc_1.10.0.13; C:\Program Files (x86)\Infonaut_1.10.0.13\Service\insvc.exe [278600 2015-04-02] (Infonaut)
R2 konureno; C:\Users\Tiedt\AppData\Local\0406D9B4-1428434594-72AF-8C7F-B36FDEF67BEF\cnsx909.tmp [163328 2015-04-07] () [File not signed]
R2 LolliScan; C:\ProgramData\LolliScan\LolliScan.exe [335872 2015-04-02] () [File not signed]
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2015-01-30] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [366512 2015-01-30] (Microsoft Corporation)
R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-02] (Symantec Corporation)
R2 pdfcDispatcher; C:\Program Files (x86)\PDF Complete\pdfsvc.exe [1134584 2012-04-04] (PDF Complete Inc)
R2 ReimageRealTimeProtector; C:\Program Files\Reimage\Reimage Protector\ReiGuard.exe [7410024 2015-01-14] (Reimage®)
R2 SPBIUpd; C:\Program Files\Common Files\ShopperPro\spbiu.exe [2346408 2015-04-06] (ShopperPro)
R2 STacSV; C:\Program Files\IDT\WDM\STacSV64.exe [311296 2012-03-30] (IDT, Inc.) [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
R2 WindowsMangerProtect; C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe [493712 2015-04-07] (SysTool PasSame LIMITED)
R2 jizipyli; C:\Users\Tiedt\AppData\Roaming\0406D9B4-1428427194-72AF-8C7F-B36FDEF67BEF\nsv1434.tmpfs [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 avmeject; C:\Windows\System32\drivers\avmeject.sys [14120 2010-10-25] (AVM Berlin)
R3 fwlanusbn; C:\Windows\System32\DRIVERS\fwlanusbn.sys [714368 2010-10-25] (AVM GmbH)
R1 innfd_1_10_0_13; C:\Windows\System32\drivers\innfd_1_10_0_13.sys [58224 2015-04-02] (Infonaut)
R3 LVPr2M64; C:\Windows\System32\DRIVERS\LVPr2M64.sys [30232 2009-10-07] ()
S3 LVPr2Mon; C:\Windows\System32\DRIVERS\LVPr2M64.sys [30232 2009-10-07] ()
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [274696 2014-11-15] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [124560 2014-11-15] (Microsoft Corporation)
R3 SPBIUpdd; C:\Program Files\Common Files\ShopperPro\spbiw.sys [41624 2015-04-06] ()
R2 SPDRIVER_1.38.1.1735; C:\Program Files (x86)\ShopperPro\JSDriver\1.38.1.1735\jsdrv.sys [52376 2015-04-06] ()
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-14] (Microsoft Corporation)
R2 webTinstMKTN; C:\windows\system32\Drivers\webTinstMKTN.sys [50800 2015-04-07] ()
S3 cpuz134; \??\C:\Users\Tiedt\AppData\Local\Temp\cpuz134\cpuz134_x64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-07 20:43 - 2015-04-07 20:43 - 00000000 ____D () C:\Users\Tiedt\SupTab
2015-04-07 20:41 - 2015-04-07 20:43 - 00035089 _____ () C:\Users\Tiedt\Downloads\FRST.txt
2015-04-07 20:40 - 2015-04-07 20:41 - 00000000 ____D () C:\FRST
2015-04-07 20:39 - 2015-04-07 20:39 - 02095616 _____ (Farbar) C:\Users\Tiedt\Downloads\FRST64.exe
2015-04-07 20:29 - 2015-04-07 20:29 - 00001165 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-04-07 20:29 - 2015-04-07 20:29 - 00001153 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-04-07 20:29 - 2015-04-07 20:29 - 00000000 ____D () C:\Users\Tiedt\AppData\Roaming\Mozilla
2015-04-07 20:29 - 2015-04-07 20:29 - 00000000 ____D () C:\Users\Tiedt\AppData\Local\Mozilla
2015-04-07 20:29 - 2015-04-07 20:29 - 00000000 ____D () C:\ProgramData\Mozilla
2015-04-07 20:29 - 2015-04-07 20:29 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-04-07 20:29 - 2015-04-07 20:29 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-04-07 20:27 - 2015-04-07 20:27 - 00243656 _____ () C:\Users\Tiedt\Downloads\Firefox Setup Stub 37.0.1.exe
2015-04-07 20:04 - 2015-04-07 20:04 - 00000004 _____ () C:\windows\SysWOW64\029B560A371F4E00AB32838EBC01B9E7
2015-04-07 20:00 - 2015-04-07 20:21 - 00000378 _____ () C:\windows\Tasks\APSnotifierPP1.job
2015-04-07 20:00 - 2015-04-07 20:04 - 00000376 _____ () C:\windows\Tasks\APSnotifierPP3.job
2015-04-07 20:00 - 2015-04-07 20:04 - 00000376 _____ () C:\windows\Tasks\APSnotifierPP2.job
2015-04-07 20:00 - 2015-04-07 20:02 - 00002826 _____ () C:\windows\System32\Tasks\APSnotifierPP3
2015-04-07 20:00 - 2015-04-07 20:01 - 00002828 _____ () C:\windows\System32\Tasks\APSnotifierPP1
2015-04-07 20:00 - 2015-04-07 20:01 - 00002826 _____ () C:\windows\System32\Tasks\APSnotifierPP2
2015-04-07 20:00 - 2015-04-07 20:00 - 00001051 _____ () C:\Users\Tiedt\Desktop\AnyProtect.lnk
2015-04-07 20:00 - 2015-04-07 20:00 - 00000000 ____D () C:\Users\Tiedt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AnyProtect PC Backup
2015-04-07 19:58 - 2015-04-07 20:00 - 00000000 ____D () C:\Program Files (x86)\AnyProtectEx
2015-04-07 19:58 - 2015-04-07 19:58 - 00613255 _____ (CMI Limited) C:\Users\Tiedt\AppData\Local\nsh1D35.tmp
2015-04-07 19:58 - 2015-04-07 19:58 - 00000000 __SHD () C:\Users\Tiedt\AppData\Roaming\AnyProtectEx
2015-04-07 19:53 - 2015-04-07 19:53 - 00004274 _____ () C:\windows\System32\Tasks\ReimageUpdater
2015-04-07 19:53 - 2015-04-07 19:53 - 00003434 _____ () C:\windows\System32\Tasks\Reimage Reminder
2015-04-07 19:52 - 2015-04-07 19:54 - 00000000 ____D () C:\rei
2015-04-07 19:52 - 2015-04-07 19:53 - 00000000 ____D () C:\ProgramData\Reimage Protector
2015-04-07 19:52 - 2015-04-07 19:53 - 00000000 ____D () C:\Program Files\Reimage
2015-04-07 19:52 - 2015-04-07 19:52 - 00001903 _____ () C:\Users\Public\Desktop\PC Scan & Repair by Reimage.lnk
2015-04-07 19:52 - 2015-04-07 19:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Reimage Repair
2015-04-07 19:51 - 2015-04-07 19:54 - 00000165 _____ () C:\windows\Reimage.ini
2015-04-07 19:51 - 2015-04-07 19:51 - 00764736 _____ (Reimage®) C:\Users\Tiedt\Downloads\ReimageRepair.exe
2015-04-07 19:32 - 2015-04-07 20:04 - 00000444 _____ () C:\windows\Tasks\BlockAndSurf Update.job
2015-04-07 19:32 - 2015-04-07 19:32 - 00003092 _____ () C:\windows\System32\Tasks\BlockAndSurf Update
2015-04-07 19:32 - 2015-04-07 19:32 - 00002504 _____ () C:\windows\patsearch.bin
2015-04-07 19:32 - 2015-04-07 19:32 - 00000000 ____H () C:\windows\system32\Drivers\Msft_Kernel_webTinstMKTN_01009.Wdf
2015-04-07 19:32 - 2015-04-07 19:32 - 00000000 ____D () C:\Program Files (x86)\version85BlockAndSurf
2015-04-07 19:32 - 2015-04-07 19:31 - 00050800 _____ () C:\windows\system32\Drivers\webTinstMKTN.sys
2015-04-07 19:31 - 2015-04-07 20:31 - 00005854 _____ () C:\windows\Tasks\f7c60be6-f43e-478e-86f2-92730f6935fd-6.job
2015-04-07 19:31 - 2015-04-07 20:31 - 00003130 _____ () C:\windows\Tasks\f7c60be6-f43e-478e-86f2-92730f6935fd-1-6.job
2015-04-07 19:31 - 2015-04-07 20:04 - 00005510 _____ () C:\windows\Tasks\f7c60be6-f43e-478e-86f2-92730f6935fd-7.job
2015-04-07 19:31 - 2015-04-07 20:04 - 00003466 _____ () C:\windows\Tasks\f7c60be6-f43e-478e-86f2-92730f6935fd-1-7.job
2015-04-07 19:31 - 2015-04-07 20:04 - 00002438 _____ () C:\windows\Tasks\f7c60be6-f43e-478e-86f2-92730f6935fd-5_user.job
2015-04-07 19:31 - 2015-04-07 20:04 - 00002438 _____ () C:\windows\Tasks\f7c60be6-f43e-478e-86f2-92730f6935fd-5.job
2015-04-07 19:31 - 2015-04-07 20:04 - 00001334 _____ () C:\windows\Tasks\SXZQ.job
2015-04-07 19:31 - 2015-04-07 19:31 - 01760256 _____ (Cinema PlusV07.04) C:\Users\Tiedt\AppData\Roaming\SXZQ.exe
2015-04-07 19:31 - 2015-04-07 19:31 - 00008882 _____ () C:\windows\System32\Tasks\f7c60be6-f43e-478e-86f2-92730f6935fd-6
2015-04-07 19:31 - 2015-04-07 19:31 - 00008540 _____ () C:\windows\System32\Tasks\f7c60be6-f43e-478e-86f2-92730f6935fd-7
2015-04-07 19:31 - 2015-04-07 19:31 - 00006496 _____ () C:\windows\System32\Tasks\f7c60be6-f43e-478e-86f2-92730f6935fd-1-7
2015-04-07 19:31 - 2015-04-07 19:31 - 00006158 _____ () C:\windows\System32\Tasks\f7c60be6-f43e-478e-86f2-92730f6935fd-1-6
2015-04-07 19:31 - 2015-04-07 19:31 - 00005468 _____ () C:\windows\System32\Tasks\f7c60be6-f43e-478e-86f2-92730f6935fd-5
2015-04-07 19:31 - 2015-04-07 19:31 - 00004360 _____ () C:\windows\System32\Tasks\SXZQ
2015-04-07 19:31 - 2015-04-07 19:31 - 00000000 ____D () C:\Program Files (x86)\9cb3e9f1-8ae7-4112-a04b-7199a616d34b
2015-04-07 19:30 - 2015-04-07 20:04 - 00001056 _____ () C:\windows\Tasks\Crossbrowse.job
2015-04-07 19:30 - 2015-04-07 19:30 - 00004082 _____ () C:\windows\System32\Tasks\Crossbrowse
2015-04-07 19:30 - 2015-04-07 19:30 - 00000000 ____D () C:\Users\Tiedt\AppData\Roaming\istartsurf
2015-04-07 19:30 - 2015-04-07 19:30 - 00000000 ____D () C:\Users\Tiedt\AppData\Local\Crossbrowse
2015-04-07 19:30 - 2015-04-07 19:30 - 00000000 ____D () C:\Users\Tiedt\AppData\Local\0406D9B4-1428435003-72AF-8C7F-B36FDEF67BEF
2015-04-07 19:30 - 2015-04-07 19:30 - 00000000 ____D () C:\Program Files (x86)\IGS
2015-04-07 19:29 - 2015-04-07 20:29 - 00002112 _____ () C:\windows\Tasks\f7c60be6-f43e-478e-86f2-92730f6935fd-10_user.job
2015-04-07 19:29 - 2015-04-07 20:04 - 00004486 _____ () C:\windows\Tasks\f7c60be6-f43e-478e-86f2-92730f6935fd-3.job
2015-04-07 19:29 - 2015-04-07 19:31 - 00000000 ____D () C:\Program Files (x86)\Cinema PlusV07.04
2015-04-07 19:29 - 2015-04-07 19:30 - 00007516 _____ () C:\windows\System32\Tasks\f7c60be6-f43e-478e-86f2-92730f6935fd-3
2015-04-07 19:29 - 2015-04-07 19:29 - 00002392 _____ () C:\Users\Public\Desktop\Crossbrowse.lnk
2015-04-07 19:29 - 2015-04-07 19:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Crossbrowse
2015-04-07 19:29 - 2015-04-07 19:29 - 00000000 ____D () C:\Program Files (x86)\Crossbrowse
2015-04-07 19:29 - 2015-04-07 19:29 - 00000000 ____D () C:\Program Files (x86)\Cinema PlusV07.04-ntf
2015-04-07 19:28 - 2015-04-07 19:28 - 00000000 ____D () C:\Users\Tiedt\AppData\Local\SmartWeb
2015-04-07 19:27 - 2015-04-07 20:36 - 00000000 ____D () C:\Users\Tiedt\AppData\Local\gmsd_de_385
2015-04-07 19:27 - 2015-04-07 20:36 - 00000000 ____D () C:\Program Files (x86)\gmsd_de_385
2015-04-07 19:27 - 2015-04-07 19:27 - 00000000 ____D () C:\Program Files (x86)\Infonaut_1.10.0.13
2015-04-07 19:23 - 2015-04-07 19:23 - 00000000 ____D () C:\Users\Tiedt\AppData\Local\0406D9B4-1428434594-72AF-8C7F-B36FDEF67BEF
2015-04-07 19:22 - 2015-04-07 19:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\imalicmf
2015-04-07 19:22 - 2015-04-07 19:22 - 00000000 ____D () C:\Program Files (x86)\turbodiagnosis
2015-04-07 19:22 - 2015-04-07 19:22 - 00000000 ____D () C:\Program Files (x86)\imalicmf
2015-04-07 19:21 - 2015-04-07 19:21 - 00000000 ____D () C:\ProgramData\5666253508951638902
2015-04-07 19:21 - 2015-04-07 19:21 - 00000000 ____D () C:\Program Files (x86)\Supporter
2015-04-07 19:21 - 2015-04-07 19:21 - 00000000 ____D () C:\Program Files (x86)\PoriceLesS
2015-04-07 19:20 - 2015-04-07 19:25 - 00000000 ____D () C:\ProgramData\{3bef08e0-4997-b04c-3bef-f08e04992381}
2015-04-07 19:20 - 2015-04-07 19:24 - 00000000 ____D () C:\Program Files (x86)\MyPC Backup
2015-04-07 19:20 - 2015-04-07 19:21 - 00000000 ____D () C:\ProgramData\njacolbmlcidaijbbblocplginaodmak
2015-04-07 19:20 - 2015-04-07 19:20 - 00004014 _____ () C:\windows\System32\Tasks\LaunchSignup
2015-04-07 19:20 - 2015-04-07 19:20 - 00001975 _____ () C:\Users\Tiedt\Desktop\Sync Folder.lnk
2015-04-07 19:20 - 2015-04-07 19:20 - 00001075 _____ () C:\Users\Tiedt\Desktop\MyPC Backup.lnk
2015-04-07 19:20 - 2015-04-07 19:20 - 00000000 ____D () C:\Users\Tiedt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MyPC Backup
2015-04-07 19:20 - 2015-04-07 19:20 - 00000000 ____D () C:\Users\Tiedt\AppData\Local\0406D9B4-1428434453-72AF-8C7F-B36FDEF67BEF
2015-04-07 19:20 - 2015-04-07 19:20 - 00000000 ____D () C:\Program Files (x86)\system app
2015-04-07 19:20 - 2015-04-07 19:20 - 00000000 ____D () C:\Program Files (x86)\Priceless
2015-04-07 19:20 - 2015-04-07 19:20 - 00000000 ____D () C:\Program Files (x86)\MyPcBackup
2015-04-07 19:19 - 2015-04-07 19:20 - 00000000 ____D () C:\Users\Tiedt\AppData\Roaming\0406D9B4-1428427194-72AF-8C7F-B36FDEF67BEF
2015-04-07 19:19 - 2015-04-07 19:19 - 00000000 ____D () C:\Users\Tiedt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ASPackage
2015-04-07 19:19 - 2015-04-07 19:19 - 00000000 ____D () C:\Users\Tiedt\AppData\Roaming\ASPackage
2015-04-07 19:18 - 2015-04-07 20:04 - 00002760 _____ () C:\windows\Tasks\4947097a-efd7-4265-be23-25706c1bf1f3-5_user.job
2015-04-07 19:18 - 2015-04-07 20:04 - 00002760 _____ () C:\windows\Tasks\4947097a-efd7-4265-be23-25706c1bf1f3-5.job
2015-04-07 19:18 - 2015-04-07 20:04 - 00002432 _____ () C:\windows\Tasks\ebbe3f26-9d77-42bb-9f0a-fa747484c8f2-5_user.job
2015-04-07 19:18 - 2015-04-07 20:04 - 00002432 _____ () C:\windows\Tasks\ebbe3f26-9d77-42bb-9f0a-fa747484c8f2-5.job
2015-04-07 19:18 - 2015-04-07 19:18 - 00005790 _____ () C:\windows\System32\Tasks\4947097a-efd7-4265-be23-25706c1bf1f3-5
2015-04-07 19:18 - 2015-04-07 19:18 - 00005462 _____ () C:\windows\System32\Tasks\ebbe3f26-9d77-42bb-9f0a-fa747484c8f2-5
2015-04-07 19:17 - 2015-04-07 20:17 - 00005504 _____ () C:\windows\Tasks\ebbe3f26-9d77-42bb-9f0a-fa747484c8f2-6.job
2015-04-07 19:17 - 2015-04-07 20:17 - 00003444 _____ () C:\windows\Tasks\4947097a-efd7-4265-be23-25706c1bf1f3-1-6.job
2015-04-07 19:17 - 2015-04-07 20:17 - 00003124 _____ () C:\windows\Tasks\ebbe3f26-9d77-42bb-9f0a-fa747484c8f2-1-6.job
2015-04-07 19:17 - 2015-04-07 20:04 - 00003788 _____ () C:\windows\Tasks\4947097a-efd7-4265-be23-25706c1bf1f3-1-7.job
2015-04-07 19:17 - 2015-04-07 20:04 - 00003460 _____ () C:\windows\Tasks\ebbe3f26-9d77-42bb-9f0a-fa747484c8f2-1-7.job
2015-04-07 19:17 - 2015-04-07 19:30 - 00003972 _____ () C:\windows\System32\Tasks\globalUpdateUpdateTaskMachineUA
2015-04-07 19:17 - 2015-04-07 19:18 - 00006152 _____ () C:\windows\System32\Tasks\ebbe3f26-9d77-42bb-9f0a-fa747484c8f2-1-6
2015-04-07 19:17 - 2015-04-07 19:17 - 00008534 _____ () C:\windows\System32\Tasks\ebbe3f26-9d77-42bb-9f0a-fa747484c8f2-7
2015-04-07 19:17 - 2015-04-07 19:17 - 00008532 _____ () C:\windows\System32\Tasks\ebbe3f26-9d77-42bb-9f0a-fa747484c8f2-6
2015-04-07 19:17 - 2015-04-07 19:17 - 00006818 _____ () C:\windows\System32\Tasks\4947097a-efd7-4265-be23-25706c1bf1f3-1-7
2015-04-07 19:17 - 2015-04-07 19:17 - 00006490 _____ () C:\windows\System32\Tasks\ebbe3f26-9d77-42bb-9f0a-fa747484c8f2-1-7
2015-04-07 19:17 - 2015-04-07 19:17 - 00006472 _____ () C:\windows\System32\Tasks\4947097a-efd7-4265-be23-25706c1bf1f3-1-6
2015-04-07 19:16 - 2015-04-07 20:16 - 00005832 _____ () C:\windows\Tasks\4947097a-efd7-4265-be23-25706c1bf1f3-6.job
2015-04-07 19:16 - 2015-04-07 20:04 - 00005832 _____ () C:\windows\Tasks\4947097a-efd7-4265-be23-25706c1bf1f3-7.job
2015-04-07 19:16 - 2015-04-07 20:04 - 00005504 _____ () C:\windows\Tasks\ebbe3f26-9d77-42bb-9f0a-fa747484c8f2-7.job
2015-04-07 19:16 - 2015-04-07 20:04 - 00001336 _____ () C:\windows\Tasks\XDKWM.job
2015-04-07 19:16 - 2015-04-07 20:04 - 00000970 _____ () C:\windows\Tasks\globalUpdateUpdateTaskMachineCore.job
2015-04-07 19:16 - 2015-04-07 19:35 - 00000974 _____ () C:\windows\Tasks\globalUpdateUpdateTaskMachineUA.job
2015-04-07 19:16 - 2015-04-07 19:31 - 00000000 ____D () C:\Program Files (x86)\691f0be1-5255-412a-8083-cbfcdb6532b4
2015-04-07 19:16 - 2015-04-07 19:30 - 00003718 _____ () C:\windows\System32\Tasks\globalUpdateUpdateTaskMachineCore
2015-04-07 19:16 - 2015-04-07 19:20 - 00000000 ____D () C:\Users\Tiedt\AppData\Local\BrowserHelper
2015-04-07 19:16 - 2015-04-07 19:18 - 00000000 ____D () C:\Program Files (x86)\Object Browser
2015-04-07 19:16 - 2015-04-07 19:18 - 00000000 ____D () C:\Program Files (x86)\iWebar
2015-04-07 19:16 - 2015-04-07 19:17 - 00008860 _____ () C:\windows\System32\Tasks\4947097a-efd7-4265-be23-25706c1bf1f3-6
2015-04-07 19:16 - 2015-04-07 19:17 - 00004362 _____ () C:\windows\System32\Tasks\XDKWM
2015-04-07 19:16 - 2015-04-07 19:17 - 00000000 ____D () C:\Program Files (x86)\5eb99ca5-046a-49ee-9304-c67a0fd45030
2015-04-07 19:16 - 2015-04-07 19:16 - 01760256 _____ (ObjectB) C:\Users\Tiedt\AppData\Roaming\XDKWM.exe
2015-04-07 19:16 - 2015-04-07 19:16 - 00008862 _____ () C:\windows\System32\Tasks\4947097a-efd7-4265-be23-25706c1bf1f3-7
2015-04-07 19:16 - 2015-04-07 19:16 - 00004234 _____ () C:\windows\System32\Tasks\SPBIW_UpdateTask_Time_323539353732313531312d5b5b4a346c4123452a5a556c
2015-04-07 19:16 - 2015-04-07 19:16 - 00003722 _____ () C:\windows\System32\Tasks\SMupdate1
2015-04-07 19:16 - 2015-04-07 19:16 - 00000000 ____D () C:\Users\Tiedt\AppData\Local\globalUpdate
2015-04-07 19:16 - 2015-04-07 19:16 - 00000000 ____D () C:\Program Files (x86)\globalUpdate
2015-04-07 19:15 - 2015-04-07 19:16 - 00000000 ____D () C:\ProgramData\ShopperPro
2015-04-07 19:15 - 2015-04-07 19:16 - 00000000 ____D () C:\Program Files\Common Files\ShopperPro
2015-04-07 19:15 - 2015-04-07 19:15 - 00004514 _____ () C:\windows\System32\Tasks\ShopperPro
2015-04-07 19:15 - 2015-04-07 19:15 - 00003568 _____ () C:\windows\System32\Tasks\ShopperProJSUpd
2015-04-07 19:15 - 2015-04-07 19:15 - 00003494 _____ () C:\windows\System32\Tasks\SPDriver
2015-04-07 19:15 - 2015-04-07 19:15 - 00000000 ____D () C:\Users\Public\Documents\ShopperPro
2015-04-07 19:15 - 2015-04-07 19:15 - 00000000 ____D () C:\Program Files (x86)\ShopperPro
2015-04-07 19:14 - 2015-04-07 19:31 - 00000000 ____D () C:\Program Files (x86)\XTab
2015-04-07 19:14 - 2015-04-07 19:14 - 00003558 _____ () C:\windows\System32\Tasks\TKKMJ
2015-04-07 19:14 - 2015-04-07 19:14 - 00003398 _____ () C:\windows\System32\Tasks\Inst_Rep
2015-04-07 19:14 - 2015-04-07 19:14 - 00000000 ____D () C:\Users\Tiedt\AppData\Local\CrashRpt
2015-04-07 19:14 - 2015-04-07 19:14 - 00000000 ____D () C:\ProgramData\WindowsMangerProtect
2015-04-07 19:14 - 2015-04-07 19:14 - 00000000 ____D () C:\ProgramData\IHProtectUpDate
2015-04-07 19:14 - 2015-04-07 19:14 - 00000000 ____D () C:\ProgramData\3a8c9699124a4506a71d46fb652dc7b1
2015-04-07 19:13 - 2015-04-07 20:36 - 00000000 ____D () C:\Users\Tiedt\AppData\Local\mbot_de_587
2015-04-07 19:13 - 2015-04-07 20:05 - 00008616 _____ () C:\windows\SysWOW64\abengineOff.ini
2015-04-07 19:13 - 2015-04-07 20:05 - 00008616 _____ () C:\windows\system32\abengineOff.ini
2015-04-07 19:13 - 2015-04-07 19:18 - 00000000 _____ () C:\END
2015-04-07 19:13 - 2015-04-07 19:14 - 00000000 ____D () C:\ProgramData\LolliScan
2015-04-07 19:13 - 2015-04-07 19:13 - 00003090 _____ () C:\windows\System32\Tasks\fres3005
2015-04-07 19:13 - 2015-04-07 19:13 - 00000000 ____D () C:\Users\Tiedt\AppData\Roaming\moters
2015-04-07 19:13 - 2015-04-07 19:13 - 00000000 ____D () C:\Users\Tiedt\AppData\Roaming\lection
2015-04-07 19:13 - 2015-04-07 19:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MYBESTOFFERSTODAY
2015-04-07 19:13 - 2015-04-07 19:13 - 00000000 ____D () C:\ProgramData\36ebbb131f884f3aa5b926d4db990ab9
2015-04-07 19:13 - 2015-04-07 19:13 - 00000000 ____D () C:\Program Files (x86)\mbot_de_587
2015-04-07 19:13 - 2015-03-30 16:13 - 00408408 _____ (Abengine) C:\windows\system32\abengine64.dll
2015-04-07 19:13 - 2015-03-30 16:13 - 00340920 _____ (Abengine) C:\windows\SysWOW64\abengine.dll
2015-04-07 19:09 - 2015-04-07 19:09 - 00001233 _____ () C:\Users\Tiedt\Desktop\Continue installation .lnk
2015-04-07 19:08 - 2015-04-07 19:08 - 01560080 _____ (Dummy, Ltd.) C:\Users\Tiedt\Downloads\micky maus wunderhaus kostenlos_10924_i50396469_il345.exe
2015-04-04 15:10 - 2015-04-04 15:10 - 00000000 ___SD () C:\windows\SysWOW64\GWX
2015-04-04 15:10 - 2015-04-04 15:10 - 00000000 ___SD () C:\windows\system32\GWX
2015-04-02 21:57 - 2015-04-02 21:57 - 00058224 _____ (Infonaut) C:\windows\system32\Drivers\innfd_1_10_0_13.sys
2015-03-26 21:14 - 2015-03-26 21:14 - 00005542 _____ () C:\Users\Tiedt\AppData\Roaming\XDKWM
2015-03-26 21:14 - 2015-03-26 21:14 - 00005542 _____ () C:\Users\Tiedt\AppData\Roaming\SXZQ
2015-03-24 21:28 - 2015-03-11 06:06 - 00943616 _____ (Microsoft Corporation) C:\windows\system32\appraiser.dll
2015-03-24 21:28 - 2015-03-11 06:06 - 00760832 _____ (Microsoft Corporation) C:\windows\system32\invagent.dll
2015-03-24 21:28 - 2015-03-11 06:06 - 00677888 _____ (Microsoft Corporation) C:\windows\system32\generaltel.dll
2015-03-24 21:28 - 2015-03-11 06:06 - 00414720 _____ (Microsoft Corporation) C:\windows\system32\devinv.dll
2015-03-24 21:28 - 2015-03-11 06:05 - 00227328 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2015-03-24 21:28 - 2015-03-11 06:05 - 00192000 _____ (Microsoft Corporation) C:\windows\system32\aepic.dll
2015-03-24 21:28 - 2015-03-11 06:05 - 00030720 _____ (Microsoft Corporation) C:\windows\system32\acmigration.dll
2015-03-24 21:28 - 2015-03-11 06:02 - 01107456 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2015-03-10 19:48 - 2015-02-20 06:41 - 00041984 _____ (Microsoft Corporation) C:\windows\system32\lpk.dll
2015-03-10 19:48 - 2015-02-20 06:40 - 00100864 _____ (Microsoft Corporation) C:\windows\system32\fontsub.dll
2015-03-10 19:48 - 2015-02-20 06:40 - 00046080 _____ (Adobe Systems) C:\windows\system32\atmlib.dll
2015-03-10 19:48 - 2015-02-20 06:40 - 00014336 _____ (Microsoft Corporation) C:\windows\system32\dciman32.dll
2015-03-10 19:48 - 2015-02-20 06:13 - 00070656 _____ (Microsoft Corporation) C:\windows\SysWOW64\fontsub.dll
2015-03-10 19:48 - 2015-02-20 06:13 - 00034304 _____ (Adobe Systems) C:\windows\SysWOW64\atmlib.dll
2015-03-10 19:48 - 2015-02-20 06:13 - 00010240 _____ (Microsoft Corporation) C:\windows\SysWOW64\dciman32.dll
2015-03-10 19:48 - 2015-02-20 06:12 - 00025600 _____ (Microsoft Corporation) C:\windows\SysWOW64\lpk.dll
2015-03-10 19:48 - 2015-02-20 05:29 - 00372224 _____ (Adobe Systems Incorporated) C:\windows\system32\atmfd.dll
2015-03-10 19:48 - 2015-02-20 05:09 - 00299008 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\atmfd.dll
2015-03-10 19:48 - 2015-02-03 05:34 - 05554104 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2015-03-10 19:48 - 2015-02-03 05:34 - 00693176 _____ (Microsoft Corporation) C:\windows\system32\winload.efi
2015-03-10 19:48 - 2015-02-03 05:34 - 00094656 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mountmgr.sys
2015-03-10 19:48 - 2015-02-03 05:33 - 00616360 _____ (Microsoft Corporation) C:\windows\system32\winresume.efi
2015-03-10 19:48 - 2015-02-03 05:31 - 14632960 _____ (Microsoft Corporation) C:\windows\system32\wmp.dll
2015-03-10 19:48 - 2015-02-03 05:31 - 04121600 _____ (Microsoft Corporation) C:\windows\system32\mf.dll
2015-03-10 19:48 - 2015-02-03 05:31 - 01574400 _____ (Microsoft Corporation) C:\windows\system32\quartz.dll
2015-03-10 19:48 - 2015-02-03 05:31 - 00782848 _____ (Microsoft Corporation) C:\windows\system32\wmdrmsdk.dll
2015-03-10 19:48 - 2015-02-03 05:31 - 00641024 _____ (Microsoft Corporation) C:\windows\system32\msscp.dll
2015-03-10 19:48 - 2015-02-03 05:31 - 00503808 _____ (Microsoft Corporation) C:\windows\system32\srcore.dll
2015-03-10 19:48 - 2015-02-03 05:31 - 00500224 _____ (Microsoft Corporation) C:\windows\system32\AUDIOKSE.dll
2015-03-10 19:48 - 2015-02-03 05:31 - 00432128 _____ (Microsoft Corporation) C:\windows\system32\mfplat.dll
2015-03-10 19:48 - 2015-02-03 05:31 - 00371712 _____ (Microsoft Corporation) C:\windows\system32\qdvd.dll
2015-03-10 19:48 - 2015-02-03 05:31 - 00325632 _____ (Microsoft Corporation) C:\windows\system32\msnetobj.dll
2015-03-10 19:48 - 2015-02-03 05:31 - 00229376 _____ (Microsoft Corporation) C:\windows\system32\wintrust.dll
2015-03-10 19:48 - 2015-02-03 05:31 - 00206848 _____ (Microsoft Corporation) C:\windows\system32\mfps.dll
2015-03-10 19:48 - 2015-02-03 05:31 - 00188416 _____ (Microsoft Corporation) C:\windows\system32\pcasvc.dll
2015-03-10 19:48 - 2015-02-03 05:31 - 00063488 _____ (Microsoft Corporation) C:\windows\system32\setbcdlocale.dll
2015-03-10 19:48 - 2015-02-03 05:31 - 00050176 _____ (Microsoft Corporation) C:\windows\system32\srclient.dll
2015-03-10 19:48 - 2015-02-03 05:31 - 00037376 _____ (Microsoft Corporation) C:\windows\system32\pcadm.dll
2015-03-10 19:48 - 2015-02-03 05:31 - 00011264 _____ (Microsoft Corporation) C:\windows\system32\msmmsp.dll
2015-03-10 19:48 - 2015-02-03 05:31 - 00009728 _____ (Microsoft Corporation) C:\windows\system32\spwmp.dll
2015-03-10 19:48 - 2015-02-03 05:31 - 00005120 _____ (Microsoft Corporation) C:\windows\system32\msdxm.ocx
2015-03-10 19:48 - 2015-02-03 05:31 - 00005120 _____ (Microsoft Corporation) C:\windows\system32\dxmasf.dll
2015-03-10 19:48 - 2015-02-03 05:30 - 12625920 _____ (Microsoft Corporation) C:\windows\system32\wmploc.DLL
2015-03-10 19:48 - 2015-02-03 05:30 - 01480192 _____ (Microsoft Corporation) C:\windows\system32\crypt32.dll
2015-03-10 19:48 - 2015-02-03 05:30 - 01202176 _____ (Microsoft Corporation) C:\windows\system32\drmv2clt.dll
2015-03-10 19:48 - 2015-02-03 05:30 - 01069056 _____ (Microsoft Corporation) C:\windows\system32\cryptui.dll
2015-03-10 19:48 - 2015-02-03 05:30 - 00842240 _____ (Microsoft Corporation) C:\windows\system32\blackbox.dll
2015-03-10 19:48 - 2015-02-03 05:30 - 00680960 _____ (Microsoft Corporation) C:\windows\system32\audiosrv.dll
2015-03-10 19:48 - 2015-02-03 05:30 - 00631808 _____ (Microsoft Corporation) C:\windows\system32\evr.dll
2015-03-10 19:48 - 2015-02-03 05:30 - 00497664 _____ (Microsoft Corporation) C:\windows\system32\drmmgrtn.dll
2015-03-10 19:48 - 2015-02-03 05:30 - 00440832 _____ (Microsoft Corporation) C:\windows\system32\AudioEng.dll
2015-03-10 19:48 - 2015-02-03 05:30 - 00296960 _____ (Microsoft Corporation) C:\windows\system32\rstrui.exe
2015-03-10 19:48 - 2015-02-03 05:30 - 00296448 _____ (Microsoft Corporation) C:\windows\system32\AudioSes.dll
2015-03-10 19:48 - 2015-02-03 05:30 - 00284672 _____ (Microsoft Corporation) C:\windows\system32\EncDump.dll
2015-03-10 19:48 - 2015-02-03 05:30 - 00187904 _____ (Microsoft Corporation) C:\windows\system32\cryptsvc.dll
2015-03-10 19:48 - 2015-02-03 05:30 - 00146944 _____ (Microsoft Corporation) C:\windows\system32\appidpolicyconverter.exe
2015-03-10 19:48 - 2015-02-03 05:30 - 00140288 _____ (Microsoft Corporation) C:\windows\system32\cryptnet.dll
2015-03-10 19:48 - 2015-02-03 05:30 - 00126464 _____ (Microsoft Corporation) C:\windows\system32\audiodg.exe
2015-03-10 19:48 - 2015-02-03 05:30 - 00112640 _____ (Microsoft Corporation) C:\windows\system32\smss.exe
2015-03-10 19:48 - 2015-02-03 05:30 - 00082432 _____ (Microsoft Corporation) C:\windows\system32\cryptsp.dll
2015-03-10 19:48 - 2015-02-03 05:30 - 00058880 _____ (Microsoft Corporation) C:\windows\system32\appidapi.dll
2015-03-10 19:48 - 2015-02-03 05:30 - 00055808 _____ (Microsoft Corporation) C:\windows\system32\rrinstaller.exe
2015-03-10 19:48 - 2015-02-03 05:30 - 00043520 _____ (Microsoft Corporation) C:\windows\system32\csrsrv.dll
2015-03-10 19:48 - 2015-02-03 05:30 - 00032256 _____ (Microsoft Corporation) C:\windows\system32\appidsvc.dll
2015-03-10 19:48 - 2015-02-03 05:30 - 00024576 _____ (Microsoft Corporation) C:\windows\system32\mfpmp.exe
2015-03-10 19:48 - 2015-02-03 05:30 - 00017920 _____ (Microsoft Corporation) C:\windows\system32\appidcertstorecheck.exe
2015-03-10 19:48 - 2015-02-03 05:30 - 00011264 _____ (Microsoft Corporation) C:\windows\system32\pcawrk.exe
2015-03-10 19:48 - 2015-02-03 05:30 - 00009728 _____ (Microsoft Corporation) C:\windows\system32\pcalua.exe
2015-03-10 19:48 - 2015-02-03 05:29 - 00008704 _____ (Microsoft Corporation) C:\windows\system32\pcaevts.dll
2015-03-10 19:48 - 2015-02-03 05:28 - 00006656 _____ (Microsoft Corporation) C:\windows\system32\apisetschema.dll
2015-03-10 19:48 - 2015-02-03 05:28 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\mferror.dll
2015-03-10 19:48 - 2015-02-03 05:19 - 00663552 _____ (Microsoft Corporation) C:\windows\system32\Drivers\PEAuth.sys
2015-03-10 19:48 - 2015-02-03 05:16 - 03973048 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe
2015-03-10 19:48 - 2015-02-03 05:16 - 03917760 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe
2015-03-10 19:48 - 2015-02-03 05:12 - 11411968 _____ (Microsoft Corporation) C:\windows\SysWOW64\wmp.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 03209728 _____ (Microsoft Corporation) C:\windows\SysWOW64\mf.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 01329664 _____ (Microsoft Corporation) C:\windows\SysWOW64\quartz.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 01174528 _____ (Microsoft Corporation) C:\windows\SysWOW64\crypt32.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 01005056 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptui.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 00988160 _____ (Microsoft Corporation) C:\windows\SysWOW64\drmv2clt.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 00744960 _____ (Microsoft Corporation) C:\windows\SysWOW64\blackbox.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 00617984 _____ (Microsoft Corporation) C:\windows\SysWOW64\wmdrmsdk.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 00519680 _____ (Microsoft Corporation) C:\windows\SysWOW64\qdvd.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 00504320 _____ (Microsoft Corporation) C:\windows\SysWOW64\msscp.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 00489984 _____ (Microsoft Corporation) C:\windows\SysWOW64\evr.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 00442880 _____ (Microsoft Corporation) C:\windows\SysWOW64\AUDIOKSE.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 00406016 _____ (Microsoft Corporation) C:\windows\SysWOW64\drmmgrtn.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 00374784 _____ (Microsoft Corporation) C:\windows\SysWOW64\AudioEng.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 00354816 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfplat.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 00265216 _____ (Microsoft Corporation) C:\windows\SysWOW64\msnetobj.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 00195584 _____ (Microsoft Corporation) C:\windows\SysWOW64\AudioSes.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 00179200 _____ (Microsoft Corporation) C:\windows\SysWOW64\wintrust.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 00143872 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptsvc.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 00103936 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptnet.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 00103424 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfps.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 00081408 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptsp.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 00050688 _____ (Microsoft Corporation) C:\windows\SysWOW64\appidapi.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\srclient.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 00008192 _____ (Microsoft Corporation) C:\windows\SysWOW64\spwmp.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 00004096 _____ (Microsoft Corporation) C:\windows\SysWOW64\msdxm.ocx
2015-03-10 19:48 - 2015-02-03 05:12 - 00004096 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxmasf.dll
2015-03-10 19:48 - 2015-02-03 05:11 - 12625408 _____ (Microsoft Corporation) C:\windows\SysWOW64\wmploc.DLL
2015-03-10 19:48 - 2015-02-03 05:11 - 00050176 _____ (Microsoft Corporation) C:\windows\SysWOW64\rrinstaller.exe
2015-03-10 19:48 - 2015-02-03 05:11 - 00023040 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfpmp.exe
2015-03-10 19:48 - 2015-02-03 05:09 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\mferror.dll
2015-03-10 19:48 - 2015-02-03 05:08 - 00006656 _____ (Microsoft Corporation) C:\windows\SysWOW64\apisetschema.dll
2015-03-10 19:48 - 2015-02-03 04:32 - 00061440 _____ (Microsoft Corporation) C:\windows\system32\Drivers\appid.sys
2015-03-10 19:48 - 2014-11-01 00:24 - 00619056 _____ (Microsoft Corporation) C:\windows\system32\winload.exe
2015-03-10 19:48 - 2014-06-28 02:21 - 00532176 _____ (Microsoft Corporation) C:\windows\system32\winresume.exe
2015-03-10 19:48 - 2014-06-28 02:21 - 00457400 _____ (Microsoft Corporation) C:\windows\system32\ci.dll
2015-03-10 19:47 - 2015-03-06 07:56 - 00155576 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys
2015-03-10 19:47 - 2015-03-06 07:56 - 00095680 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecdd.sys
2015-03-10 19:47 - 2015-03-06 07:42 - 01461760 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll
2015-03-10 19:47 - 2015-03-06 07:42 - 00728064 _____ (Microsoft Corporation) C:\windows\system32\kerberos.dll
2015-03-10 19:47 - 2015-03-06 07:42 - 00341504 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll
2015-03-10 19:47 - 2015-03-06 07:42 - 00314880 _____ (Microsoft Corporation) C:\windows\system32\msv1_0.dll
2015-03-10 19:47 - 2015-03-06 07:42 - 00309760 _____ (Microsoft Corporation) C:\windows\system32\ncrypt.dll
2015-03-10 19:47 - 2015-03-06 07:42 - 00210944 _____ (Microsoft Corporation) C:\windows\system32\wdigest.dll
2015-03-10 19:47 - 2015-03-06 07:42 - 00136192 _____ (Microsoft Corporation) C:\windows\system32\sspicli.dll
2015-03-10 19:47 - 2015-03-06 07:42 - 00086528 _____ (Microsoft Corporation) C:\windows\system32\TSpkg.dll
2015-03-10 19:47 - 2015-03-06 07:42 - 00029184 _____ (Microsoft Corporation) C:\windows\system32\sspisrv.dll
2015-03-10 19:47 - 2015-03-06 07:42 - 00028160 _____ (Microsoft Corporation) C:\windows\system32\secur32.dll
2015-03-10 19:47 - 2015-03-06 07:42 - 00022016 _____ (Microsoft Corporation) C:\windows\system32\credssp.dll
2015-03-10 19:47 - 2015-03-06 07:41 - 00064000 _____ (Microsoft Corporation) C:\windows\system32\auditpol.exe
2015-03-10 19:47 - 2015-03-06 07:41 - 00031232 _____ (Microsoft Corporation) C:\windows\system32\lsass.exe
2015-03-10 19:47 - 2015-03-06 07:39 - 00060416 _____ (Microsoft Corporation) C:\windows\system32\msobjs.dll
2015-03-10 19:47 - 2015-03-06 07:38 - 00146432 _____ (Microsoft Corporation) C:\windows\system32\msaudite.dll
2015-03-10 19:47 - 2015-03-06 07:36 - 00686080 _____ (Microsoft Corporation) C:\windows\system32\adtschema.dll
2015-03-10 19:47 - 2015-03-06 07:10 - 00550912 _____ (Microsoft Corporation) C:\windows\SysWOW64\kerberos.dll
2015-03-10 19:47 - 2015-03-06 07:10 - 00259584 _____ (Microsoft Corporation) C:\windows\SysWOW64\msv1_0.dll
2015-03-10 19:47 - 2015-03-06 07:10 - 00248832 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll
2015-03-10 19:47 - 2015-03-06 07:10 - 00221184 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncrypt.dll
2015-03-10 19:47 - 2015-03-06 07:10 - 00172032 _____ (Microsoft Corporation) C:\windows\SysWOW64\wdigest.dll
2015-03-10 19:47 - 2015-03-06 07:10 - 00065536 _____ (Microsoft Corporation) C:\windows\SysWOW64\TSpkg.dll
2015-03-10 19:47 - 2015-03-06 07:10 - 00022016 _____ (Microsoft Corporation) C:\windows\SysWOW64\secur32.dll
2015-03-10 19:47 - 2015-03-06 07:10 - 00017408 _____ (Microsoft Corporation) C:\windows\SysWOW64\credssp.dll
2015-03-10 19:47 - 2015-03-06 07:09 - 00096768 _____ (Microsoft Corporation) C:\windows\SysWOW64\sspicli.dll
2015-03-10 19:47 - 2015-03-06 07:09 - 00050176 _____ (Microsoft Corporation) C:\windows\SysWOW64\auditpol.exe
2015-03-10 19:47 - 2015-03-06 07:07 - 00146432 _____ (Microsoft Corporation) C:\windows\SysWOW64\msaudite.dll
2015-03-10 19:47 - 2015-03-06 07:07 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\msobjs.dll
2015-03-10 19:47 - 2015-03-06 07:06 - 00686080 _____ (Microsoft Corporation) C:\windows\SysWOW64\adtschema.dll
2015-03-10 19:47 - 2015-02-26 05:25 - 03204096 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2015-03-10 19:47 - 2015-02-24 05:15 - 00389800 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
2015-03-10 19:47 - 2015-02-24 04:32 - 00342696 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll
2015-03-10 19:47 - 2015-02-21 03:16 - 25021440 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2015-03-10 19:47 - 2015-02-21 02:41 - 12827648 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2015-03-10 19:47 - 2015-02-21 02:27 - 00418304 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
2015-03-10 19:47 - 2015-02-21 02:27 - 00285696 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
2015-03-10 19:47 - 2015-02-21 02:25 - 19720192 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2015-03-10 19:47 - 2015-02-21 01:58 - 00092160 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2015-03-10 19:47 - 2015-02-21 01:32 - 00076288 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2015-03-10 19:47 - 2015-02-20 05:06 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2015-03-10 19:47 - 2015-02-20 05:05 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
2015-03-10 19:47 - 2015-02-20 04:50 - 00066560 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2015-03-10 19:47 - 2015-02-20 04:49 - 00584192 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2015-03-10 19:47 - 2015-02-20 04:49 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
2015-03-10 19:47 - 2015-02-20 04:48 - 02886144 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2015-03-10 19:47 - 2015-02-20 04:47 - 00088064 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll
2015-03-10 19:47 - 2015-02-20 04:41 - 00054784 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2015-03-10 19:47 - 2015-02-20 04:40 - 00034304 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2015-03-10 19:47 - 2015-02-20 04:36 - 00633856 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2015-03-10 19:47 - 2015-02-20 04:35 - 00144384 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2015-03-10 19:47 - 2015-02-20 04:35 - 00114688 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
2015-03-10 19:47 - 2015-02-20 04:34 - 00814080 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
2015-03-10 19:47 - 2015-02-20 04:32 - 06035456 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2015-03-10 19:47 - 2015-02-20 04:26 - 00968704 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2015-03-10 19:47 - 2015-02-20 04:22 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2015-03-10 19:47 - 2015-02-20 04:22 - 00490496 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2015-03-10 19:47 - 2015-02-20 04:13 - 00077824 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll
2015-03-10 19:47 - 2015-02-20 04:09 - 00503296 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2015-03-10 19:47 - 2015-02-20 04:08 - 00199680 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2015-03-10 19:47 - 2015-02-20 04:08 - 00062464 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2015-03-10 19:47 - 2015-02-20 04:08 - 00047616 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll
2015-03-10 19:47 - 2015-02-20 04:06 - 00064000 _____ (Microsoft Corporation) C:\windows\SysWOW64\MshtmlDac.dll
2015-03-10 19:47 - 2015-02-20 04:05 - 00316928 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2015-03-10 19:47 - 2015-02-20 04:03 - 02278400 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2015-03-10 19:47 - 2015-02-20 04:01 - 00047104 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2015-03-10 19:47 - 2015-02-20 04:00 - 00030720 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2015-03-10 19:47 - 2015-02-20 03:58 - 00478208 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2015-03-10 19:47 - 2015-02-20 03:56 - 00620032 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll
2015-03-10 19:47 - 2015-02-20 03:56 - 00115712 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe
2015-03-10 19:47 - 2015-02-20 03:49 - 00801280 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2015-03-10 19:47 - 2015-02-20 03:49 - 00718848 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2015-03-10 19:47 - 2015-02-20 03:47 - 01359360 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll
2015-03-10 19:47 - 2015-02-20 03:46 - 02125824 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2015-03-10 19:47 - 2015-02-20 03:43 - 14398976 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2015-03-10 19:47 - 2015-02-20 03:41 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-03-10 19:47 - 2015-02-20 03:37 - 00168960 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
2015-03-10 19:47 - 2015-02-20 03:30 - 04300288 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2015-03-10 19:47 - 2015-02-20 03:28 - 02358784 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2015-03-10 19:47 - 2015-02-20 03:24 - 02052608 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2015-03-10 19:47 - 2015-02-20 03:24 - 00689152 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2015-03-10 19:47 - 2015-02-20 03:23 - 01155072 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll
2015-03-10 19:47 - 2015-02-20 03:16 - 01548288 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2015-03-10 19:47 - 2015-02-20 03:03 - 00800768 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2015-03-10 19:47 - 2015-02-20 03:01 - 01888256 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2015-03-10 19:47 - 2015-02-20 02:57 - 01311232 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2015-03-10 19:47 - 2015-02-20 02:55 - 00710144 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
2015-03-10 19:47 - 2015-02-13 07:26 - 12875264 _____ (Microsoft Corporation) C:\windows\SysWOW64\shell32.dll
2015-03-10 19:47 - 2015-02-13 07:22 - 14177280 _____ (Microsoft Corporation) C:\windows\system32\shell32.dll
2015-03-10 19:47 - 2015-02-03 05:31 - 01424896 _____ (Microsoft Corporation) C:\windows\system32\WindowsCodecs.dll
2015-03-10 19:47 - 2015-02-03 05:31 - 00215552 _____ (Microsoft Corporation) C:\windows\system32\ubpm.dll
2015-03-10 19:47 - 2015-02-03 05:12 - 01230848 _____ (Microsoft Corporation) C:\windows\SysWOW64\WindowsCodecs.dll
2015-03-10 19:47 - 2015-02-03 05:12 - 00171520 _____ (Microsoft Corporation) C:\windows\SysWOW64\ubpm.dll
2015-03-10 19:47 - 2015-01-31 01:56 - 00459336 _____ (Microsoft Corporation) C:\windows\system32\Drivers\cng.sys
2015-03-10 19:47 - 2015-01-17 04:48 - 01067520 _____ (Microsoft Corporation) C:\windows\system32\msctf.dll
2015-03-10 19:47 - 2015-01-17 04:30 - 00828928 _____ (Microsoft Corporation) C:\windows\SysWOW64\msctf.dll
2015-03-10 19:46 - 2015-02-04 05:16 - 00465920 _____ (Microsoft Corporation) C:\windows\system32\WMPhoto.dll
2015-03-10 19:46 - 2015-02-04 04:54 - 00417792 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMPhoto.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-07 20:43 - 2012-10-04 11:22 - 00000000 ____D () C:\Users\Tiedt
2015-04-07 20:36 - 2012-10-04 20:36 - 00000000 ____D () C:\Users\Tiedt\AppData\Local\CrashDumps
2015-04-07 20:34 - 2012-10-04 20:26 - 00000000 ____D () C:\Users\Tiedt\AppData\Roaming\Skype
2015-04-07 20:12 - 2009-07-14 06:45 - 00024400 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-04-07 20:12 - 2009-07-14 06:45 - 00024400 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-04-07 20:11 - 2012-07-06 09:19 - 00699416 _____ () C:\windows\system32\perfh007.dat
2015-04-07 20:11 - 2012-07-06 09:19 - 00149556 _____ () C:\windows\system32\perfc007.dat
2015-04-07 20:11 - 2009-07-14 07:13 - 01620612 _____ () C:\windows\system32\PerfStringBackup.INI
2015-04-07 20:09 - 2012-10-04 11:20 - 01679340 _____ () C:\windows\WindowsUpdate.log
2015-04-07 20:05 - 2012-07-06 09:53 - 00000000 ____D () C:\ProgramData\PDFC
2015-04-07 20:04 - 2013-04-21 21:14 - 00001106 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-04-07 20:04 - 2010-11-21 05:47 - 01435174 _____ () C:\windows\PFRO.log
2015-04-07 20:04 - 2009-07-14 07:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2015-04-07 20:04 - 2009-07-14 06:51 - 00142571 _____ () C:\windows\setupact.log
2015-04-07 20:03 - 2013-04-21 21:14 - 00001110 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-04-07 19:54 - 2012-07-06 09:48 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2015-04-07 19:30 - 2013-04-21 21:14 - 00002395 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-04-07 19:30 - 2012-12-26 22:58 - 00001633 _____ () C:\Users\Tiedt\Desktop\Internet Explorer.lnk
2015-04-07 19:30 - 2012-10-04 11:29 - 00001645 _____ () C:\Users\Tiedt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-04-07 19:17 - 2012-10-04 18:17 - 00000000 ____D () C:\Program Files (x86)\avmwlanstick
2015-04-07 19:16 - 2009-07-14 05:20 - 00000000 ____D () C:\Program Files\Common Files\System
2015-04-07 17:39 - 2012-10-04 22:53 - 00000000 ____D () C:\Users\Tiedt\Desktop\Bilder
2015-04-07 13:54 - 2012-10-04 11:29 - 00003930 _____ () C:\windows\System32\Tasks\User_Feed_Synchronization-{7D6F304C-B00A-4C98-8F21-73A9DAAE244A}
2015-04-04 15:09 - 2013-09-08 20:18 - 00003186 _____ () C:\windows\System32\Tasks\HPCeeScheduleForTiedt
2015-04-04 15:09 - 2013-09-08 20:18 - 00000332 _____ () C:\windows\Tasks\HPCeeScheduleForTiedt.job
2015-04-04 15:09 - 2012-10-06 10:39 - 00000000 ____D () C:\Users\Tiedt\AppData\Roaming\HpUpdate
2015-04-04 15:09 - 2012-10-06 10:39 - 00000000 ____D () C:\Users\Tiedt\AppData\Roaming\HP Support Assistant
2015-04-01 19:55 - 2012-10-04 22:51 - 00000000 ____D () C:\Users\Tiedt\Desktop\Christine
2015-03-31 19:10 - 2014-01-13 19:53 - 00040448 _____ () C:\Users\Tiedt\Desktop\Betriebskosten ab 2014.xls
2015-03-31 08:56 - 2012-10-06 10:41 - 00003218 _____ () C:\windows\System32\Tasks\HPCeeScheduleForTIEDT-HP$
2015-03-31 08:56 - 2012-10-06 10:41 - 00000342 _____ () C:\windows\Tasks\HPCeeScheduleForTIEDT-HP$.job
2015-03-25 20:48 - 2014-12-11 20:08 - 00000000 ____D () C:\windows\system32\appraiser
2015-03-25 20:48 - 2014-05-08 16:45 - 00000000 ___SD () C:\windows\system32\CompatTel
2015-03-14 10:18 - 2009-07-14 07:09 - 00000000 ____D () C:\windows\System32\Tasks\WPD
2015-03-13 17:25 - 2009-07-14 07:08 - 00032632 _____ () C:\windows\Tasks\SCHEDLGU.TXT
2015-03-12 21:03 - 2009-07-14 05:20 - 00000000 ____D () C:\windows\rescache
2015-03-11 17:21 - 2009-07-14 06:45 - 00356936 _____ () C:\windows\system32\FNTCACHE.DAT
2015-03-11 17:19 - 2009-07-14 05:20 - 00000000 ____D () C:\windows\SysWOW64\Dism
2015-03-11 17:19 - 2009-07-14 05:20 - 00000000 ____D () C:\windows\system32\Dism
2015-03-10 20:25 - 2013-08-14 20:25 - 00000000 ____D () C:\windows\system32\MRT
2015-03-10 20:22 - 2012-10-05 12:14 - 122905848 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2015-03-08 13:36 - 2012-07-06 09:53 - 00000000 ____D () C:\ProgramData\Skype

==================== Files in the root of some directories =======

2015-03-26 21:14 - 2015-03-26 21:14 - 0005542 _____ () C:\Users\Tiedt\AppData\Roaming\SXZQ
2015-04-07 19:31 - 2015-04-07 19:31 - 1760256 _____ (Cinema PlusV07.04) C:\Users\Tiedt\AppData\Roaming\SXZQ.exe
2015-03-26 21:14 - 2015-03-26 21:14 - 0005542 _____ () C:\Users\Tiedt\AppData\Roaming\XDKWM
2015-04-07 19:16 - 2015-04-07 19:16 - 1760256 _____ (ObjectB) C:\Users\Tiedt\AppData\Roaming\XDKWM.exe
2015-04-07 19:58 - 2015-04-07 19:58 - 0613255 _____ (CMI Limited) C:\Users\Tiedt\AppData\Local\nsh1D35.tmp
2012-12-26 11:10 - 2012-12-26 11:10 - 0000057 _____ () C:\ProgramData\Ament.ini

Some content of TEMP:
====================
C:\Users\Tiedt\AppData\Local\Temp\2680.exe
C:\Users\Tiedt\AppData\Local\Temp\744.exe
C:\Users\Tiedt\AppData\Local\Temp\9275.exe
C:\Users\Tiedt\AppData\Local\Temp\9D528DB1-7C1F-4381-24DF-9476FD4AD6D4.dll
C:\Users\Tiedt\AppData\Local\Temp\9D528DB1-7C1F-4381-24DF-9476FD4AD6D4.exe
C:\Users\Tiedt\AppData\Local\Temp\B190.exe
C:\Users\Tiedt\AppData\Local\Temp\BDD4B49F-668E-64D8-0A34-C05064A06B11.exe
C:\Users\Tiedt\AppData\Local\Temp\bitool.dll
C:\Users\Tiedt\AppData\Local\Temp\CloudBackup8054.exe
C:\Users\Tiedt\AppData\Local\Temp\EFC0.exe
C:\Users\Tiedt\AppData\Local\Temp\jPT63A2.exe
C:\Users\Tiedt\AppData\Local\Temp\lvid_lvid.exe
C:\Users\Tiedt\AppData\Local\Temp\micky maus wunderhaus kostenlos__10924_i1493454126_il538367.exe
C:\Users\Tiedt\AppData\Local\Temp\ReimagePackage.exe
C:\Users\Tiedt\AppData\Local\Temp\ReiSysUpdate.exe
C:\Users\Tiedt\AppData\Local\Temp\setup.exe
C:\Users\Tiedt\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Tiedt\AppData\Local\Temp\tu17p84.exe
C:\Users\Tiedt\AppData\Local\Temp\Uninstall.exe
C:\Users\Tiedt\AppData\Local\Temp\_is2904.exe
C:\Users\Tiedt\AppData\Local\Temp\_is363D.exe
C:\Users\Tiedt\AppData\Local\Temp\_is892D.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-03-28 19:41

==================== End Of Log ============================


GMER konnte ich durchführen, passt aber nicht hier hinein.

Ich hoffe ihr könnt helfen.

Gruss nine53

nine53 07.04.2015 21:01
hier Addition

Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-03-2015
Ran by Tiedt at 2015-04-07 20:45:01
Running from C:\Users\Tiedt\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Enabled - Up to date) {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}
AS: Microsoft Security Essentials (Enabled - Up to date) {0C8D1929-27B2-688D-E114-9117BD2BB1B7}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

ABBYY FineReader 6.0 Sprint (HKLM-x32\...\{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}) (Version: 6.00.1395.4512 - ABBYY Software House)
Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.305 - Adobe Systems Incorporated)
AnyProtect (HKLM-x32\...\AnyProtect) (Version: 1.0.0.4 - CMI Limited) <==== ATTENTION
AnySend (HKLM-x32\...\ASPackage) (Version: 1.0.0.0 - CMI Limited) <==== ATTENTION!
AVM FRITZ!WLAN (HKLM-x32\...\AVMWLANCLI) (Version:  - AVM Berlin)
Bejeweled 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Belkin F5D8053 N Wireless USB Adapter (HKLM-x32\...\InstallShield_{E6607F5B-50E7-4B54-81B7-F0600E3C8CF4}) (Version: 2.0.0.10 - Belkin)
Belkin F5D8053 N Wireless USB Adapter (x32 Version: 2.0.0.10 - Belkin) Hidden
BlockAndSurf (HKLM-x32\...\00DC837A-6B19-1B3C-1324-4578182B0256) (Version:  - BlockAndSurf-software) <==== ATTENTION
Cable Compact (HKLM-x32\...\IGS) (Version:  - )
Cake Mania (x32 Version: 2.2.0.98 - WildTangent) Hidden
Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Cinema PlusV07.04 (HKLM-x32\...\Cinema PlusV07.04) (Version: 1.36.01.22 - Cinema PlusV07.04)
Compatibility Pack für 2007 Office System (HKLM-x32\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Cradle of Rome 2 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Crossbrowse (HKLM-x32\...\Crossbrowse) (Version: 39.4.2171.95 - The Crossbrowse Authors)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DirectX for Managed Code Update (Summer 2004) (x32 Version: 9.02.2904 - Microsoft) Hidden
Facebook (HKLM-x32\...\{8AE50893-3A87-4439-9A57-942ED43F7189}) (Version: 1.1.0004 - Hewlett-Packard)
Farm Frenzy (x32 Version: 2.2.0.98 - WildTangent) Hidden
Farmscapes (x32 Version: 2.2.0.97 - WildTangent) Hidden
FATE (x32 Version: 2.2.0.97 - WildTangent) Hidden
Final Drive Fury (x32 Version: 2.2.0.95 - WildTangent) Hidden
Fishdom (TM) 2 (x32 Version: 2.2.0.98 - WildTangent) Hidden
GamesDesktop 014.385 (HKLM-x32\...\gmsd_de_385_is1) (Version:  - GAMESDESKTOP) <==== ATTENTION
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 41.0.2272.118 - Google Inc.)
Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.6227.252 - Google Inc.)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
Hewlett-Packard ACLM.NET v1.1.2.0 (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden
HighlightSearches (HKLM-x32\...\HighlightSearches) (Version: 3.0.0.5 - HighlightSearches)
HP Calendar (HKLM-x32\...\{2B38E0FA-D8A5-4EBF-A018-E3C1C8E7A2E2}) (Version: 5.1.4245.23508 - Hewlett-Packard)
HP Clock (HKLM-x32\...\{750E9D0F-B188-4A7E-ADD2-84B7ED7D32F6}) (Version: 5.1.4281.27332 - Hewlett-Packard)
HP Deskjet 3520 series - Grundlegende Software für das Gerät (HKLM\...\{A9C5381E-F415-4EDC-95A2-9164218FEA8A}) (Version: 27.0.847.0 - Hewlett-Packard Co.)
HP Deskjet 3520 series Hilfe (HKLM-x32\...\{6B953497-169C-4929-9AA9-A9F510347468}) (Version: 27.0.0 - Hewlett Packard)
HP Deskjet 3520 series Setup Guide (HKLM-x32\...\{AEEDCEB7-00B8-4BE1-B492-AB04803D5F1E}) (Version: 27.0.0 - Hewlett Packard)
HP Games (HKLM-x32\...\WildTangent hp Master Uninstall) (Version: 1.0.2.5 - WildTangent)
HP Magic Canvas (HKLM-x32\...\{DDFDC9D6-4220-41F8-BF9A-8E7512C4EF52}) (Version: 5.1.15.0 - Hewlett-Packard)
HP Magic Canvas Tutorials (HKLM-x32\...\{858FCB65-7C6D-4BA4-AD80-A3CB3744CE09}_is1) (Version: 6.0.0.0 - Hewlett-Packard)
HP Notes (HKLM-x32\...\{86BAB08A-5E66-4C53-82E3-C1E91673C7CA}) (Version: 5.1.4274.30382 - Hewlett-Packard)
HP Odometer (HKLM-x32\...\{B8AC1A89-FFD1-4F97-8051-E505A160F562}) (Version: 2.10.0000 - Hewlett-Packard)
HP Photo Creations (HKLM-x32\...\HP Photo Creations) (Version: 1.0.0.3341 - HP Photo Creations Powered by RocketLife)
HP RSS (HKLM-x32\...\{452479C5-0118-48E9-AA69-0A7339F95FC8}) (Version: 5.1.4289.23799 - Hewlett-Packard)
HP Setup (HKLM-x32\...\{438363A8-F486-4C37-834C-4955773CB3D3}) (Version: 9.1.15430.4033 - Hewlett-Packard Company)
HP Support Assistant (HKLM-x32\...\{6F44AF95-3CDE-4513-AD3F-6D45F17BF324}) (Version: 6.1.12.1 - Hewlett-Packard Company)
HP Support Information (HKLM-x32\...\{B2B7B1C8-7C8B-476C-BE2C-049731C55992}) (Version: 11.00.0001 - Hewlett-Packard)
HP TouchSmart Background - Beats (HKLM-x32\...\{6A6F8D36-04BA-41E9-9004-1789BD545874}) (Version: 1.0.1.0 - Hewlett-Packard)
HP TouchSmart RecipeBox (HKLM-x32\...\{20714B53-FC73-4F9C-9687-49EB237D6FD7}) (Version: 3.0.3830.27730 - Hewlett-Packard)
HP Update (HKLM-x32\...\{6F1C00D2-25C2-4CBA-8126-AE9A6E2E9CD5}) (Version: 5.003.003.001 - Hewlett-Packard)
Infonaut 1.10.0.13 (HKLM-x32\...\Infonaut_1.10.0.13) (Version: 1.10.0.13 - Infonaut)
Insaniquarium Deluxe (x32 Version: 2.2.0.97 - WildTangent) Hidden
Install Preview (HKLM-x32\...\igsc) (Version: 1.0.0.0 - Install Preview)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.0.0.1351 - Intel Corporation)
istartsurf uninstall (HKLM-x32\...\istartsurf uninstall) (Version:  - istartsurf) <==== ATTENTION
iWebar (HKLM-x32\...\iWebar) (Version: 1.36.01.22 - Webby) <==== ATTENTION
Jewel Match 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Jewel Quest II (x32 Version: 2.2.0.97 - WildTangent) Hidden
Jewel Quest Solitaire 2 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
LabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.4507 - CyberLink Corp.)
LabelPrint (x32 Version: 2.5.4507 - CyberLink Corp.) Hidden
lection (HKLM-x32\...\{55d4b236-fe79-4782-cc2d-55acaf147087}) (Version: 1.0.0 - subpar)
Logitech Vid HD (HKLM-x32\...\Logitech Vid) (Version: 7.2 (7259) - Logitech Inc..)
Logitech Webcam Software (HKLM\...\{987FE247-4E69-4A2E-A961-D14F901FDBF6}) (Version: 12.10.1113 - Logitech Inc.)
Logitech Webcam Software-Treiberpaket (HKLM\...\lvdrivers_12.10) (Version: 12.10.1110 - Logitech Inc.)
LolliScan (HKLM-x32\...\LolliScan) (Version:  - )
luckysearches uninstall (HKLM-x32\...\luckysearches uninstall) (Version:  - luckysearches)
Magic Desktop (HKLM-x32\...\EasyBits Magic Desktop) (Version: 3.0 - EasyBits Software AS)
Mahjongg Artifacts (x32 Version: 2.2.0.95 - WildTangent) Hidden
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.150.1 - McAfee, Inc.)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Mathematics (HKLM-x32\...\{4D090F70-6F08-4B60-9357-A1DFD4458F09}) (Version: 4.0 - Microsoft Corporation)
Microsoft Office 2003 Web Components (HKLM-x32\...\{90A40407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Professional Edition 2003 (HKLM-x32\...\{90110407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.7.205.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
moters (HKLM-x32\...\{c8730ca5-3f82-41cc-65e2-01b87600cd89}) (Version: 1.0.0 - ningsup) <==== ATTENTION!
Mozilla Firefox 37.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 37.0.1 (x86 de)) (Version: 37.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 37.0.1 - Mozilla)
MyBestOffersToday 014.587 (HKLM-x32\...\mbot_de_587_is1) (Version:  - MYBESTOFFERSTODAY) <==== ATTENTION
MyPC Backup  (HKLM\...\MyPC Backup) (Version:  - JDi Backup Ltd) <==== ATTENTION
MyPcBackup version 2.04 (HKLM-x32\...\{59680D1A-6A49-4E85-BB42-6886773DF589}_is1) (Version: 2.04 - )
Mystery of Mortlake Mansion (x32 Version: 2.2.0.98 - WildTangent) Hidden
Norton Online Backup (HKLM-x32\...\{40A66DF6-22D3-44B5-A7D3-83B118A2C0DC}) (Version: 2.1.17869 - Symantec Corporation)
NVIDIA Graphics Driver 296.28 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 296.28 - NVIDIA Corporation)
NVIDIA HD Audio Driver 1.3.14.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.14.1 - NVIDIA Corporation)
NVIDIA PhysX System Software 9.12.0213 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.12.0213 - NVIDIA Corporation)
Object Browser (HKLM-x32\...\Object Browser) (Version: 1.36.01.22 - ObjectB) <==== ATTENTION!
opensource (x32 Version: 1.0.14960.3876 - Your Company Name) Hidden
PDF Complete Corporate Edition (HKLM-x32\...\PDF Complete) (Version: 4.0.95 - PDF Complete, Inc)
Pixel Wireless (HKLM-x32\...\wincheck) (Version: 1.0.0.0 - Pixel Wireless)
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.98 - WildTangent) Hidden
PlayReady PC Runtime amd64 (HKLM\...\{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}) (Version: 1.3.0 - Microsoft Corporation)
Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden
PoriceLesS (HKLM-x32\...\{75F9BF4A-AF67-A478-A37B-31D73186D3F3}) (Version:  - )
Power Pre-formatted (HKLM-x32\...\ConvertAd) (Version: 1.0.0.0 - Power Pre-formatted) <==== ATTENTION
Power2Go (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.1.6207 - CyberLink Corp.)
Power2Go (x32 Version: 6.1.6207 - CyberLink Corp.) Hidden
PowerDVD (HKLM-x32\...\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}) (Version:  - )
Ranch Rush 2 - Premium Edition (x32 Version: 2.2.0.98 - WildTangent) Hidden
Recovery Manager (x32 Version: 5.5.0.5119 - CyberLink Corp.) Hidden
Reimage Repair (HKLM\...\Reimage Repair) (Version: 1.8.1.4 - Reimage) <==== ATTENTION
Shopper-Pro (HKLM-x32\...\ShopperPro) (Version:  - ) <==== ATTENTION
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)
Skype™ 7.1 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.1.105 - Skype Technologies S.A.)
SmartWeb (HKLM-x32\...\SmartWeb) (Version: 8.0.9 - SoftBrain Technologies Ltd.) <==== ATTENTION
Studie zur Verbesserung von HP Deskjet 3520 series Produkten (HKLM\...\{E75A77D7-A854-44D6-A46B-82332AD79E9E}) (Version: 27.0.847.0 - Hewlett-Packard Co.)
Support PL 1.1 (HKLM-x32\...\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{be0fb33b}) (Version:  - riceLes) <==== ATTENTION
TI USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{355FBD67-5A4F-44DA-86A1-56EEC4C20EC0}) (Version: 1.12.18.0 - Texas Instruments Inc.)
TI USB3 Host Driver (x32 Version: 1.12.18.0 - Texas Instruments Inc.) Hidden
Torchlight (x32 Version: 2.2.0.98 - WildTangent) Hidden
TSHostedAppLauncher (x32 Version: 5.1.15.0 - Hewlett-Packard) Hidden
turbodiagnosis version 1.02 (HKLM-x32\...\{365C5DC2-679A-4A5D-B40B-5096A49087A8}_is1) (Version: 1.02 - )
Update Installer for WildTangent Games App (x32 Version:  - WildTangent) Hidden
Virtual Families (x32 Version: 2.2.0.98 - WildTangent) Hidden
Virtual Villagers 4 - The Tree of Life (x32 Version: 2.2.0.98 - WildTangent) Hidden
Wedding Dash (x32 Version: 2.2.0.95 - WildTangent) Hidden
WildTangent Games App (HP Games) (x32 Version: 4.0.5.36 - WildTangent) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3538.0513 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
WinZip 16.0 (HKLM\...\{CD95F661-A5C4-44F5-A6AA-ECDD91C240CD}) (Version: 16.0.9715 - WinZip Computing, S.L. )
Zuma's Revenge (x32 Version: 2.2.0.98 - WildTangent) Hidden

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-2149968534-1042019459-1302014499-1000_Classes\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}\InprocServer32 -> C:\Users\Tiedt\AppData\Roaming\moters\supna.dll () <==== ATTENTION

==================== Restore Points  =========================

25-02-2015 16:34:49 Windows Update
25-02-2015 21:10:30 Windows Update
01-03-2015 10:48:32 Windows Update
05-03-2015 10:31:35 Windows Update
08-03-2015 21:09:08 Windows Update
10-03-2015 20:20:52 Windows Update
15-03-2015 17:23:57 Windows Update
18-03-2015 20:38:40 Windows Update
21-03-2015 21:05:39 Windows Update
24-03-2015 21:31:27 Windows Update
28-03-2015 19:22:30 Windows Update
01-04-2015 11:37:52 Windows Update
04-04-2015 15:09:31 Windows Update
07-04-2015 16:17:17 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____N C:\windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {05C1BC02-1120-4C5E-985F-35878B05CA4C} - System32\Tasks\{72DBAEEB-80FA-4B86-9A03-BF2B50B21D4D} => pcalua.exe -a "C:\Users\Tiedt\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\60AVZVWL\f5d8053 v3011 v2.0.0.8.exe" -d C:\Users\Tiedt\Desktop
Task: {0622B4D4-E6E1-4AB6-B67A-CAF3915B3EE2} - System32\Tasks\{95E36204-5040-48CE-94C1-4930759A5044} => pcalua.exe -a "C:\Users\Tiedt\Downloads\f5d8053 v3011 v2.0.0.8 (1).exe" -d C:\Users\Tiedt\Downloads
Task: {11B43CF2-3A8E-47F8-9C01-9389FF517BE3} - System32\Tasks\f7c60be6-f43e-478e-86f2-92730f6935fd-1-7 => C:\Program Files (x86)\Cinema PlusV07.04\f7c60be6-f43e-478e-86f2-92730f6935fd-1-7.exe [2015-04-07] (Cinema PlusV07.04) <==== ATTENTION
Task: {127549AF-0C7C-4570-B163-24C84F111C9C} - System32\Tasks\APSnotifierPP3 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe [2015-04-07] (AnyProtect.com) <==== ATTENTION
Task: {176D5C2E-04BF-4FBC-98F4-F46C10ED93F8} - System32\Tasks\HPCustParticipation HP Deskjet 3520 series => C:\Program Files\HP\HP Deskjet 3520 series\Bin\HPCustPartic.exe [2012-01-31] (Hewlett-Packard Co.)
Task: {18543076-B6EA-4506-95AD-5A6C14521B23} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater\HPSFUpdater.exe [2011-06-14] (Hewlett-Packard)
Task: {192E2559-F3C4-4F1B-BE24-03021D16213E} - System32\Tasks\f7c60be6-f43e-478e-86f2-92730f6935fd-5_user => C:\Program Files (x86)\Cinema PlusV07.04\f7c60be6-f43e-478e-86f2-92730f6935fd-5.exe [2015-04-07] (Cinema PlusV07.04) <==== ATTENTION
Task: {1C811F10-9AC3-4F3F-AF1E-5051BF4577FE} - System32\Tasks\ebbe3f26-9d77-42bb-9f0a-fa747484c8f2-1-7 => C:\Program Files (x86)\Object Browser\ebbe3f26-9d77-42bb-9f0a-fa747484c8f2-1-7.exe [2015-04-07] (ObjectB) <==== ATTENTION
Task: {1D002410-9FEF-4D70-B8D1-7E29E284BBB2} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-05] (Adobe Systems Incorporated)
Task: {1F41BABB-5253-4695-9440-908F93729C2A} - System32\Tasks\f7c60be6-f43e-478e-86f2-92730f6935fd-5 => C:\Program Files (x86)\Cinema PlusV07.04\f7c60be6-f43e-478e-86f2-92730f6935fd-5.exe [2015-04-07] (Cinema PlusV07.04) <==== ATTENTION
Task: {2848D944-E495-470D-8EDF-FBEB7B61F196} - System32\Tasks\ebbe3f26-9d77-42bb-9f0a-fa747484c8f2-7 => C:\Program Files (x86)\Object Browser\ebbe3f26-9d77-42bb-9f0a-fa747484c8f2-7.exe [2015-04-07] (ObjectB) <==== ATTENTION
Task: {3084A692-5950-455F-8846-714C1AE2778E} - System32\Tasks\4947097a-efd7-4265-be23-25706c1bf1f3-5 => C:\Program Files (x86)\iWebar\4947097a-efd7-4265-be23-25706c1bf1f3-5.exe [2015-04-07] (Webby) <==== ATTENTION
Task: {317DC2EB-04A0-49B7-9CAE-8B6F963309A3} - System32\Tasks\ebbe3f26-9d77-42bb-9f0a-fa747484c8f2-5_user => C:\Program Files (x86)\Object Browser\ebbe3f26-9d77-42bb-9f0a-fa747484c8f2-5.exe [2015-04-07] (ObjectB) <==== ATTENTION
Task: {331CE427-9E40-41CE-B452-6B2383DCDBA6} - System32\Tasks\f7c60be6-f43e-478e-86f2-92730f6935fd-1-6 => C:\Program Files (x86)\Cinema PlusV07.04\f7c60be6-f43e-478e-86f2-92730f6935fd-1-6.exe [2015-04-07] (Cinema PlusV07.04) <==== ATTENTION
Task: {41AF4603-7CC3-4A08-8B2A-51099108D67B} - System32\Tasks\fres3005 => C:\Program Files (x86)\HighlightSearches\fres3005.exe [2015-03-23] ()
Task: {48D4D143-C7A8-4ADB-82E2-E5D604EDE9CA} - System32\Tasks\ShopperPro => C:\Program Files (x86)\ShopperPro\ShopperPro.exe [2015-04-06] (Goobzo LTD) <==== ATTENTION
Task: {4C643BE2-2058-43CF-94D1-A1EB9908E6A4} - System32\Tasks\APSnotifierPP2 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe [2015-04-07] (AnyProtect.com) <==== ATTENTION
Task: {4CE3B0F3-D021-4CFC-85CF-BD4556246AB2} - System32\Tasks\Microsoft\Windows\Setup\gwx\runappraiser => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-25] (Microsoft Corporation)
Task: {5556CC0A-773F-45E4-B5D2-C0FD5B9A1442} - System32\Tasks\globalUpdateUpdateTaskMachineUA => C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe [2015-04-07] (globalUpdate) <==== ATTENTION
Task: {569746C1-AFA0-4B1A-BB7E-6537418BB12F} - System32\Tasks\f7c60be6-f43e-478e-86f2-92730f6935fd-3 => C:\Program Files (x86)\Cinema PlusV07.04\f7c60be6-f43e-478e-86f2-92730f6935fd-3.exe [2015-04-07] (Cinema PlusV07.04) <==== ATTENTION
Task: {58822C57-7B15-467E-984D-F3A95652E66B} - System32\Tasks\ReimageUpdater => C:\Program Files\Reimage\Reimage Protector\ReiGuard.exe [2015-01-14] (Reimage®) <==== ATTENTION
Task: {5DDAB2C5-E5A1-4AF7-8A6B-210560D285EC} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2011-09-10] (Hewlett-Packard Company)
Task: {608E4AD9-614B-4BFE-917C-3A520E645B17} - System32\Tasks\ebbe3f26-9d77-42bb-9f0a-fa747484c8f2-6 => C:\Program Files (x86)\Object Browser\ebbe3f26-9d77-42bb-9f0a-fa747484c8f2-6.exe [2015-04-07] (ObjectB) <==== ATTENTION
Task: {6920DCAD-344C-42CC-AB78-0299D57F4802} - System32\Tasks\BlockAndSurf Update => C:\Program Files (x86)\version85BlockAndSurf\J4BlockAndSurfJ52.exe [2015-04-07] () <==== ATTENTION
Task: {6A6F5FCB-F70A-4CEB-A24E-6BAF1DF3E0EA} - System32\Tasks\APSnotifierPP1 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe [2015-04-07] (AnyProtect.com) <==== ATTENTION
Task: {6D2D0264-EBC0-4509-BE9B-FDE620B5451E} - System32\Tasks\ShopperProJSUpd => C:\Program Files (x86)\ShopperPro\updater.exe [2015-04-06] (Goobzo) <==== ATTENTION
Task: {7067FACB-8C8C-41AE-9706-FA4C470F126C} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPSFMessenger\HPSFMsgr.exe [2011-09-10] (Hewlett-Packard Company)
Task: {718DEB69-8D36-4175-9DCE-8943DF61FCF8} - System32\Tasks\globalUpdateUpdateTaskMachineCore => C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe [2015-04-07] (globalUpdate) <==== ATTENTION
Task: {73FBD61A-1A2D-4B23-804F-E331166EFDB3} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-03-25] (Microsoft Corporation)
Task: {76874D2D-35DF-4832-9EA0-F66A8D903A81} - System32\Tasks\SPBIW_UpdateTask_Time_323539353732313531312d5b5b4a346c4123452a5a556c => Wscript.exe //B "C:\ProgramData\ShopperPro\spbihe.js" spbiu.exe /invoke /f:check_services /l:0 <==== ATTENTION
Task: {76A600C1-613F-4D89-B863-400A46A439D9} - System32\Tasks\4947097a-efd7-4265-be23-25706c1bf1f3-1-6 => C:\Program Files (x86)\iWebar\4947097a-efd7-4265-be23-25706c1bf1f3-1-6.exe [2015-04-07] (Webby) <==== ATTENTION
Task: {84663929-A5E6-4FF4-A93D-85B8528C2A56} - System32\Tasks\Crossbrowse => C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\utility.exe [2015-04-07] ()
Task: {8DE97AD7-D461-4F32-83E3-0563FDA32153} - System32\Tasks\SMupdate1 => Rundll32.exe C:\PROGRA~1\COMMON~1\System\SysMenu.dll ,Command701 update1 <==== ATTENTION
Task: {8E3188E2-25B1-4ECA-8C4C-3681A1105068} - System32\Tasks\f7c60be6-f43e-478e-86f2-92730f6935fd-6 => C:\Program Files (x86)\Cinema PlusV07.04\f7c60be6-f43e-478e-86f2-92730f6935fd-6.exe [2015-04-07] (Cinema PlusV07.04) <==== ATTENTION
Task: {8F03C14B-A158-42F5-BB79-4D248D1D43F9} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxcontent => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-25] (Microsoft Corporation)
Task: {93DD7170-FBE2-4625-A459-F4DBD16FAB9B} - System32\Tasks\SPDriver => C:\Program Files (x86)\ShopperPro\JSDriver\1.38.1.1735\jsdrv.exe [2015-04-06] () <==== ATTENTION
Task: {9FF8CE88-68CA-4497-BDCD-E0162962516C} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-25] (Microsoft Corporation)
Task: {A1E500BA-1360-4AD2-BD94-65A9F744A1BD} - System32\Tasks\TKKMJ => C:\ProgramData\3a8c9699124a4506a71d46fb652dc7b1\3a8c9699124a4506a71d46fb652dc7b1.exe [2015-04-02] ()
Task: {AF25C51C-4359-4040-8224-B078C7E9E0C7} - System32\Tasks\XDKWM => C:\Users\Tiedt\AppData\Roaming\XDKWM.exe [2015-04-07] (ObjectB) <==== ATTENTION
Task: {B0988F87-41C6-44D9-A3FA-ECC9A6AD49CF} - System32\Tasks\4947097a-efd7-4265-be23-25706c1bf1f3-5_user => C:\Program Files (x86)\iWebar\4947097a-efd7-4265-be23-25706c1bf1f3-5.exe [2015-04-07] (Webby) <==== ATTENTION
Task: {B1DF402C-3FD6-49FA-9319-8BF0D7BC8BA3} - System32\Tasks\ebbe3f26-9d77-42bb-9f0a-fa747484c8f2-1-6 => C:\Program Files (x86)\Object Browser\ebbe3f26-9d77-42bb-9f0a-fa747484c8f2-1-6.exe [2015-04-07] (ObjectB) <==== ATTENTION
Task: {B4EEDE97-A226-4246-A9AD-0C65CA3E86A6} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Total Care Tune-Up => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPTuneUp.exe [2011-03-23] (Hewlett-Packard Company)
Task: {B7804514-7C87-4E0C-BD7A-C92932553D63} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-25] (Google Inc.)
Task: {B890224F-C601-465D-8611-27C429FB41F6} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2015-03-10] (Hewlett-Packard)
Task: {C06D7E4F-9B9E-4837-ABDE-7A7012773CE8} - System32\Tasks\SXZQ => C:\Users\Tiedt\AppData\Roaming\SXZQ.exe [2015-04-07] (Cinema PlusV07.04) <==== ATTENTION
Task: {C6FED5E7-525C-4DC4-B30C-AC8B1894D20F} - System32\Tasks\HPCeeScheduleForTiedt => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2011-07-15] (Hewlett-Packard)
Task: {C9019F23-CC90-4B9E-976B-9B5B32237264} - System32\Tasks\HPCeeScheduleForTIEDT-HP$ => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2011-07-15] (Hewlett-Packard)
Task: {D0499454-4CFC-46F7-A8F8-FD708A5B7226} - System32\Tasks\Inst_Rep => C:\Users\Tiedt\AppData\Local\Installer\Install_10974\DCytdieamodc_amodc_setup.exe [2015-04-07] ()
Task: {D7EFB4ED-17FB-45EC-9F6C-77DA5D752168} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Tuneup => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2011-09-10] (Hewlett-Packard Company)
Task: {D96138CE-6DED-4DD5-ABE4-7B3B1DF81CFE} - System32\Tasks\ebbe3f26-9d77-42bb-9f0a-fa747484c8f2-5 => C:\Program Files (x86)\Object Browser\ebbe3f26-9d77-42bb-9f0a-fa747484c8f2-5.exe [2015-04-07] (ObjectB) <==== ATTENTION
Task: {DBE54C8B-DBD3-475D-943F-1A65D95616A7} - System32\Tasks\Microsoft\Windows\Maintenance\SMupdate2 => Rundll32.exe C:\PROGRA~1\COMMON~1\System\SysMenu.dll ,Command701 update2 <==== ATTENTION
Task: {DBEE29D3-CD54-4E3D-BD37-60E5D35F04CF} - System32\Tasks\LaunchSignup => C:\Program Files (x86)\MyPC Backup\Signup Wizard.exe [2014-11-25] (MyPC Backup) <==== ATTENTION
Task: {DC99B4BE-A7E1-49CD-8301-A47730F3C92A} - System32\Tasks\Microsoft\Windows\Multimedia\SMupdate3 => Rundll32.exe C:\PROGRA~1\COMMON~1\System\SysMenu.dll ,Command701 update3 <==== ATTENTION
Task: {EE650F2B-3F9F-4C36-8963-0309ADE79C27} - System32\Tasks\f7c60be6-f43e-478e-86f2-92730f6935fd-10_user => C:\Program Files (x86)\Cinema PlusV07.04-ntf\f7c60be6-f43e-478e-86f2-92730f6935fd-10.exe [2015-04-07] (Cinema PlusV07.04) <==== ATTENTION
Task: {F04545E3-C5D9-44EB-86B0-48904C28BA5F} - System32\Tasks\Reimage Reminder => C:\Program Files\Reimage\Reimage Repair\ReimageReminder.exe [2015-03-16] (Reimage ltd.) <==== ATTENTION
Task: {F0994B80-C0EC-4672-AC3F-076475E49C40} - System32\Tasks\f7c60be6-f43e-478e-86f2-92730f6935fd-7 => C:\Program Files (x86)\Cinema PlusV07.04\f7c60be6-f43e-478e-86f2-92730f6935fd-7.exe [2015-04-07] (Cinema PlusV07.04) <==== ATTENTION
Task: {F185290B-89B2-4EC2-8E42-4810D6726BE4} - System32\Tasks\4947097a-efd7-4265-be23-25706c1bf1f3-6 => C:\Program Files (x86)\iWebar\4947097a-efd7-4265-be23-25706c1bf1f3-6.exe [2015-04-07] (Webby) <==== ATTENTION
Task: {F46AB327-5A24-4C03-85DD-C231BF3220FA} - System32\Tasks\4947097a-efd7-4265-be23-25706c1bf1f3-7 => C:\Program Files (x86)\iWebar\4947097a-efd7-4265-be23-25706c1bf1f3-7.exe [2015-04-07] (Webby) <==== ATTENTION
Task: {F9A03563-C8B2-4CBD-BCAC-0DDC2368B96A} - System32\Tasks\4947097a-efd7-4265-be23-25706c1bf1f3-1-7 => C:\Program Files (x86)\iWebar\4947097a-efd7-4265-be23-25706c1bf1f3-1-7.exe [2015-04-07] (Webby) <==== ATTENTION
Task: {F9F849AC-F881-4E48-BF3C-9BDF2C4F3FFA} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-25] (Google Inc.)
Task: C:\windows\Tasks\4947097a-efd7-4265-be23-25706c1bf1f3-1-6.job => C:\Program Files (x86)\iWebar\4947097a-efd7-4265-be23-25706c1bf1f3-1-6.exe <==== ATTENTION
Task: C:\windows\Tasks\4947097a-efd7-4265-be23-25706c1bf1f3-1-7.job => C:\Program Files (x86)\iWebar\4947097a-efd7-4265-be23-25706c1bf1f3-1-7.exe <==== ATTENTION
Task: C:\windows\Tasks\4947097a-efd7-4265-be23-25706c1bf1f3-5.job => C:\Program Files (x86)\iWebar\4947097a-efd7-4265-be23-25706c1bf1f3-5.exe <==== ATTENTION
Task: C:\windows\Tasks\4947097a-efd7-4265-be23-25706c1bf1f3-5_user.job => C:\Program Files (x86)\iWebar\4947097a-efd7-4265-be23-25706c1bf1f3-5.exe <==== ATTENTION
Task: C:\windows\Tasks\4947097a-efd7-4265-be23-25706c1bf1f3-6.job => C:\Program Files (x86)\iWebar\4947097a-efd7-4265-be23-25706c1bf1f3-6.exe <==== ATTENTION
Task: C:\windows\Tasks\4947097a-efd7-4265-be23-25706c1bf1f3-7.job => C:\Program Files (x86)\iWebar\4947097a-efd7-4265-be23-25706c1bf1f3-7.exe <==== ATTENTION
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\APSnotifierPP1.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\windows\Tasks\APSnotifierPP2.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\windows\Tasks\APSnotifierPP3.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\windows\Tasks\BlockAndSurf Update.job => C:\Program Files (x86)\version85BlockAndSurf\J4BlockAndSurfJ52.exe <==== ATTENTION
Task: C:\windows\Tasks\Crossbrowse.job => C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\utility.exe
Task: C:\windows\Tasks\ebbe3f26-9d77-42bb-9f0a-fa747484c8f2-1-6.job => C:\Program Files (x86)\Object Browser\ebbe3f26-9d77-42bb-9f0a-fa747484c8f2-1-6.exe <==== ATTENTION
Task: C:\windows\Tasks\ebbe3f26-9d77-42bb-9f0a-fa747484c8f2-1-7.job => C:\Program Files (x86)\Object Browser\ebbe3f26-9d77-42bb-9f0a-fa747484c8f2-1-7.exe <==== ATTENTION
Task: C:\windows\Tasks\ebbe3f26-9d77-42bb-9f0a-fa747484c8f2-5.job => C:\Program Files (x86)\Object Browser\ebbe3f26-9d77-42bb-9f0a-fa747484c8f2-5.exe <==== ATTENTION
Task: C:\windows\Tasks\ebbe3f26-9d77-42bb-9f0a-fa747484c8f2-5_user.job => C:\Program Files (x86)\Object Browser\ebbe3f26-9d77-42bb-9f0a-fa747484c8f2-5.exe <==== ATTENTION
Task: C:\windows\Tasks\ebbe3f26-9d77-42bb-9f0a-fa747484c8f2-6.job => C:\Program Files (x86)\Object Browser\ebbe3f26-9d77-42bb-9f0a-fa747484c8f2-6.exe <==== ATTENTION
Task: C:\windows\Tasks\ebbe3f26-9d77-42bb-9f0a-fa747484c8f2-7.job => C:\Program Files (x86)\Object Browser\ebbe3f26-9d77-42bb-9f0a-fa747484c8f2-7.exe <==== ATTENTION
Task: C:\windows\Tasks\f7c60be6-f43e-478e-86f2-92730f6935fd-1-6.job => C:\Program Files (x86)\Cinema PlusV07.04\f7c60be6-f43e-478e-86f2-92730f6935fd-1-6.exe <==== ATTENTION
Task: C:\windows\Tasks\f7c60be6-f43e-478e-86f2-92730f6935fd-1-7.job => C:\Program Files (x86)\Cinema PlusV07.04\f7c60be6-f43e-478e-86f2-92730f6935fd-1-7.exe <==== ATTENTION
Task: C:\windows\Tasks\f7c60be6-f43e-478e-86f2-92730f6935fd-10_user.job => C:\Program Files (x86)\Cinema PlusV07.04-ntf\f7c60be6-f43e-478e-86f2-92730f6935fd-10.exe <==== ATTENTION
Task: C:\windows\Tasks\f7c60be6-f43e-478e-86f2-92730f6935fd-3.job => C:\Program Files (x86)\Cinema PlusV07.04\f7c60be6-f43e-478e-86f2-92730f6935fd-3.exe <==== ATTENTION
Task: C:\windows\Tasks\f7c60be6-f43e-478e-86f2-92730f6935fd-5.job => C:\Program Files (x86)\Cinema PlusV07.04\f7c60be6-f43e-478e-86f2-92730f6935fd-5.exe <==== ATTENTION
Task: C:\windows\Tasks\f7c60be6-f43e-478e-86f2-92730f6935fd-5_user.job => C:\Program Files (x86)\Cinema PlusV07.04\f7c60be6-f43e-478e-86f2-92730f6935fd-5.exe <==== ATTENTION
Task: C:\windows\Tasks\f7c60be6-f43e-478e-86f2-92730f6935fd-6.job => C:\Program Files (x86)\Cinema PlusV07.04\f7c60be6-f43e-478e-86f2-92730f6935fd-6.exe <==== ATTENTION
Task: C:\windows\Tasks\f7c60be6-f43e-478e-86f2-92730f6935fd-7.job => C:\Program Files (x86)\Cinema PlusV07.04\f7c60be6-f43e-478e-86f2-92730f6935fd-7.exe <==== ATTENTION
Task: C:\windows\Tasks\globalUpdateUpdateTaskMachineCore.job => C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe <==== ATTENTION
Task: C:\windows\Tasks\globalUpdateUpdateTaskMachineUA.job => C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe <==== ATTENTION
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\HPCeeScheduleForTIEDT-HP$.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
Task: C:\windows\Tasks\HPCeeScheduleForTiedt.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
Task: C:\windows\Tasks\SXZQ.job => C:\Users\Tiedt\AppData\Roaming\SXZQ.exe <==== ATTENTION
Task: C:\windows\Tasks\XDKWM.job => C:\Users\Tiedt\AppData\Roaming\XDKWM.exe <==== ATTENTION

==================== Loaded Modules (whitelisted) ==============

2015-04-07 19:20 - 2014-11-25 21:29 - 00299008 _____ () C:\Program Files (x86)\MyPC Backup\AlphaFS.dll
2015-04-07 19:31 - 2015-04-07 19:31 - 00512000 _____ () C:\Program Files (x86)\version85BlockAndSurf\J4BlockAndSurfJ52.exe
2015-04-07 19:20 - 2015-04-07 19:20 - 00185856 _____ () C:\Users\Tiedt\AppData\Roaming\0406D9B4-1428427194-72AF-8C7F-B36FDEF67BEF\jnsb478A.tmp
2015-03-30 21:00 - 2015-03-30 21:00 - 00164352 _____ () C:\Program Files (x86)\HighlightSearches\njs.exe
2015-04-07 19:20 - 2015-04-07 19:20 - 00285696 _____ () C:\Users\Tiedt\AppData\Roaming\0406D9B4-1428427194-72AF-8C7F-B36FDEF67BEF\nsv1434.tmpfs
2015-04-07 19:23 - 2015-04-07 19:23 - 00163328 _____ () C:\Users\Tiedt\AppData\Local\0406D9B4-1428434594-72AF-8C7F-B36FDEF67BEF\cnsx909.tmp
2015-04-07 19:14 - 2015-04-02 15:53 - 00335872 _____ () C:\ProgramData\LolliScan\LolliScan.exe
2015-01-14 12:07 - 2015-01-14 12:07 - 06757728 _____ () C:\Program Files\Reimage\Reimage Protector\ReiSystem.exe
2015-04-07 19:31 - 2015-04-07 19:31 - 00196608 _____ () C:\Program Files (x86)\version85BlockAndSurf\BlockAndSurf.exe
2015-04-07 19:13 - 2015-04-05 13:40 - 03310736 _____ () C:\Users\Tiedt\AppData\Local\mbot_de_587\upmbot_de_587.exe
2015-04-07 19:15 - 2015-04-06 19:11 - 03224576 _____ () C:\Program Files (x86)\ShopperPro\JSDriver\1.38.1.1735\jsdrv.exe
2009-10-14 13:36 - 2009-10-14 13:36 - 02793304 _____ () C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe
2009-10-14 13:34 - 2009-10-14 13:34 - 00560472 _____ () C:\Program Files (x86)\Common Files\Logishrd\LQCVFX\COCIManager.exe
2015-04-07 19:20 - 2014-11-25 21:37 - 00012800 _____ () C:\Program Files (x86)\MyPC Backup\GetText.dll
2015-04-07 19:13 - 2015-04-05 13:39 - 03984016 _____ () C:\Program Files (x86)\mbot_de_587\mbot_de_587.exe
2015-04-06 13:24 - 2015-04-06 13:24 - 02800128 _____ () C:\Users\Tiedt\AppData\Local\0406D9B4-1428434594-72AF-8C7F-B36FDEF67BEF\ansc35D.exe
2015-04-06 19:09 - 2015-04-06 19:09 - 01656832 _____ () C:\Program Files\Common Files\ShopperPro\spbici64.dll
2015-04-07 20:35 - 2015-04-07 20:36 - 00282377 _____ () C:\Users\Tiedt\AppData\Local\Temp\nsw1863.tmp
2015-04-07 19:27 - 2015-04-06 11:31 - 03983504 _____ () C:\Program Files (x86)\gmsd_de_385\gmsd_de_385.exe
2015-04-07 19:27 - 2015-04-06 11:31 - 03308688 _____ () C:\Users\Tiedt\AppData\Local\gmsd_de_385\upgmsd_de_385.exe
2015-04-07 20:38 - 2015-04-07 20:38 - 00256777 _____ () C:\Users\Tiedt\AppData\Local\Temp\nsc3E46.tmp
2015-04-07 19:21 - 2015-04-07 19:21 - 01626112 _____ () c:\Program Files (x86)\Supporter\Supporter.dll
2014-10-07 21:27 - 2014-10-07 21:27 - 00117760 _____ () C:\Users\Tiedt\AppData\Roaming\moters\mentste.dll
2015-04-07 19:29 - 2015-03-04 18:31 - 01070592 _____ () C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.4.2171.95\libglesv2.dll
2015-04-07 19:29 - 2015-03-04 18:31 - 00204800 _____ () C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.4.2171.95\libegl.dll
2015-04-06 19:08 - 2015-04-06 19:08 - 01311232 _____ () C:\Program Files\Common Files\ShopperPro\spbici32.dll
2015-04-07 19:17 - 2015-04-07 19:17 - 00186368 _____ () C:\Program Files (x86)\Object Browser\84fbb313-ac12-4011-83b2-604424784096.dll
2015-04-07 19:31 - 2015-04-07 19:31 - 00186368 _____ () C:\Program Files (x86)\Cinema PlusV07.04\019b7c5c-5928-4f7e-947d-a1eb4b7a7f2e.dll
2015-04-07 19:17 - 2015-04-07 19:17 - 00186368 _____ () C:\Program Files (x86)\iWebar\8c03bd5d-6391-4d30-941c-bf9bd1df506f.dll
2015-04-04 15:05 - 2015-03-30 23:07 - 01174856 _____ () C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.118\libglesv2.dll
2015-04-04 15:05 - 2015-03-30 23:07 - 00080200 _____ () C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.118\libegl.dll
2015-04-04 15:05 - 2015-03-30 23:07 - 09279304 _____ () C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.118\pdf.dll
2015-04-04 15:05 - 2015-03-30 23:07 - 14974280 _____ () C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.118\PepperFlash\pepflashplayer.dll
2015-04-07 20:36 - 2015-04-07 20:36 - 00011264 _____ () C:\Users\Tiedt\AppData\Local\Temp\nsb7263.tmp\System.dll
2015-04-07 20:38 - 2015-04-07 20:38 - 00011264 _____ () C:\Users\Tiedt\AppData\Local\Temp\nss6191.tmp\System.dll
2015-04-07 20:38 - 2015-04-07 20:38 - 00009728 _____ () C:\Users\Tiedt\AppData\Local\Temp\nss6191.tmp\nsDialogs.dll
2015-04-07 20:38 - 2015-04-07 20:38 - 00025088 _____ () C:\Users\Tiedt\AppData\Local\Temp\nss6191.tmp\registry.dll
2015-04-07 20:38 - 2015-04-07 20:38 - 00067584 _____ () C:\Users\Tiedt\AppData\Local\Temp\nss6191.tmp\Math.dll
2015-04-07 20:38 - 2015-04-07 20:38 - 00069120 _____ () C:\Users\Tiedt\AppData\Local\Temp\nss6191.tmp\nsWeb_DispOffr.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\abengine => ""="service"

==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2149968534-1042019459-1302014499-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Tiedt\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.2.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== Accounts: =============================

Administrator (S-1-5-21-2149968534-1042019459-1302014499-500 - Administrator - Disabled)
Gast (S-1-5-21-2149968534-1042019459-1302014499-501 - Limited - Disabled)
Tiedt (S-1-5-21-2149968534-1042019459-1302014499-1000 - Administrator - Enabled) => C:\Users\Tiedt

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (04/07/2015 08:36:54 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: IEXPLORE.EXE, Version: 11.0.9600.17689, Zeitstempel: 0x54e68526
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0813fe70
ID des fehlerhaften Prozesses: 0x124c
Startzeit der fehlerhaften Anwendung: 0xIEXPLORE.EXE0
Pfad der fehlerhaften Anwendung: IEXPLORE.EXE1
Pfad des fehlerhaften Moduls: IEXPLORE.EXE2
Berichtskennung: IEXPLORE.EXE3

Error: (04/07/2015 08:02:23 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: IEXPLORE.EXE, Version: 11.0.9600.17689, Zeitstempel: 0x54e68526
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000
ID des fehlerhaften Prozesses: 0x2150
Startzeit der fehlerhaften Anwendung: 0xIEXPLORE.EXE0
Pfad der fehlerhaften Anwendung: IEXPLORE.EXE1
Pfad des fehlerhaften Moduls: IEXPLORE.EXE2
Berichtskennung: IEXPLORE.EXE3

Error: (04/07/2015 08:01:48 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: IEXPLORE.EXE, Version: 11.0.9600.17689, Zeitstempel: 0x54e68526
Name des fehlerhaften Moduls: urlmon.dll, Version: 11.0.9600.17689, Zeitstempel: 0x54e68687
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00048799
ID des fehlerhaften Prozesses: 0x3b8
Startzeit der fehlerhaften Anwendung: 0xIEXPLORE.EXE0
Pfad der fehlerhaften Anwendung: IEXPLORE.EXE1
Pfad des fehlerhaften Moduls: IEXPLORE.EXE2
Berichtskennung: IEXPLORE.EXE3

Error: (04/07/2015 07:51:55 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm IEXPLORE.EXE, Version 11.0.9600.17689 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 984

Startzeit: 01d071597e91afb1

Endzeit: 60000

Anwendungspfad: C:\Program Files\Internet Explorer\IEXPLORE.EXE

Berichts-ID: 99e52966-dd4e-11e4-8310-bc05430e1a38

Error: (04/07/2015 07:30:36 PM) (Source: MsiInstaller) (EventID: 11309) (User: Tiedt-HP)
Description: Product: Google Update Helper -- Error 1309. Error reading from file: C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\Google\Update\RequiredFile.txt.  System error 3.  Verify that the file exists and that you can access it.

Error: (04/07/2015 07:28:01 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm IEXPLORE.EXE, Version 11.0.9600.17689 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 2018

Startzeit: 01d071582971b82b

Endzeit: 0

Anwendungspfad: C:\Program Files\Internet Explorer\IEXPLORE.EXE

Berichts-ID: 6e42f054-dd4b-11e4-8310-bc05430e1a38

Error: (04/07/2015 07:22:23 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: TyHelpTFUO.xyz, Version: 0.0.0.0, Zeitstempel: 0x54c6ec8f
Name des fehlerhaften Moduls: TyHelpTFUO.xyz, Version: 0.0.0.0, Zeitstempel: 0x54c6ec8f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000328a1
ID des fehlerhaften Prozesses: 0x1324
Startzeit der fehlerhaften Anwendung: 0xTyHelpTFUO.xyz0
Pfad der fehlerhaften Anwendung: TyHelpTFUO.xyz1
Pfad des fehlerhaften Moduls: TyHelpTFUO.xyz2
Berichtskennung: TyHelpTFUO.xyz3

Error: (04/07/2015 07:19:08 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm gentlemjmp_ieu.tmp, Version 51.52.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 17b0

Startzeit: 01d07156bbc089e2

Endzeit: 10

Anwendungspfad: C:\Users\Tiedt\AppData\Local\Temp\is-T30MN.tmp\gentlemjmp_ieu.tmp

Berichts-ID:

Error: (04/07/2015 07:17:17 PM) (Source: MsiInstaller) (EventID: 11309) (User: Tiedt-HP)
Description: Product: Google Update Helper -- Error 1309. Error reading from file: C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\Google\Update\RequiredFile.txt.  System error 3.  Verify that the file exists and that you can access it.

Error: (01/07/2015 05:30:19 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Skype.exe, Version: 7.0.60.100, Zeitstempel: 0x547efc55
Name des fehlerhaften Moduls: Skype.exe, Version: 7.0.60.100, Zeitstempel: 0x547efc55
Ausnahmecode: 0xc0000005
Fehleroffset: 0x01938ad9
ID des fehlerhaften Prozesses: 0xae0
Startzeit der fehlerhaften Anwendung: 0xSkype.exe0
Pfad der fehlerhaften Anwendung: Skype.exe1
Pfad des fehlerhaften Moduls: Skype.exe2
Berichtskennung: Skype.exe3


System errors:
=============
Error: (04/07/2015 07:24:48 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "IHProtect Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error: (04/04/2015 03:11:02 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Beim Aktualisieren der Signaturen wurde von %NT-AUTORITÄT60 ein Fehler festgestellt.

        Neue Signaturversion:

        Vorherige Signaturversion: 1.195.1632.0

        Aktualisierungsquelle: %NT-AUTORITÄT59

        Aktualisierungsphase: 4.7.0205.00

        Quellpfad: 4.7.0205.01

        Signaturtyp: %NT-AUTORITÄT602

        Aktualisierungstyp: %NT-AUTORITÄT604

        Benutzer: NT-AUTORITÄT\SYSTEM

        Aktuelle Modulversion: %NT-AUTORITÄT605

        Vorherige Modulversion: %NT-AUTORITÄT606

        Fehlercode: %NT-AUTORITÄT607

        Fehlerbeschreibung: %NT-AUTORITÄT608

Error: (04/04/2015 03:11:02 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Beim Aktualisieren der Signaturen wurde von %NT-AUTORITÄT60 ein Fehler festgestellt.

        Neue Signaturversion:

        Vorherige Signaturversion: 1.195.1632.0

        Aktualisierungsquelle: %NT-AUTORITÄT59

        Aktualisierungsphase: 4.7.0205.00

        Quellpfad: 4.7.0205.01

        Signaturtyp: %NT-AUTORITÄT602

        Aktualisierungstyp: %NT-AUTORITÄT604

        Benutzer: NT-AUTORITÄT\SYSTEM

        Aktuelle Modulversion: %NT-AUTORITÄT605

        Vorherige Modulversion: %NT-AUTORITÄT606

        Fehlercode: %NT-AUTORITÄT607

        Fehlerbeschreibung: %NT-AUTORITÄT608

Error: (03/28/2015 11:29:38 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Windows Update" wurde mit folgendem Fehler beendet:
%%-2147467243

Error: (03/28/2015 11:29:30 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Sicherheitscenter" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1069

Error: (03/28/2015 11:29:30 AM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Der Dienst "wscsvc" konnte sich nicht als "NT AUTHORITY\LocalService" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:
%%1352

Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).

Error: (03/24/2015 09:32:17 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Beim Aktualisieren der Signaturen wurde von %NT-AUTORITÄT60 ein Fehler festgestellt.

        Neue Signaturversion:

        Vorherige Signaturversion: 1.195.3.0

        Aktualisierungsquelle: %NT-AUTORITÄT59

        Aktualisierungsphase: 4.7.0205.00

        Quellpfad: 4.7.0205.01

        Signaturtyp: %NT-AUTORITÄT602

        Aktualisierungstyp: %NT-AUTORITÄT604

        Benutzer: NT-AUTORITÄT\SYSTEM

        Aktuelle Modulversion: %NT-AUTORITÄT605

        Vorherige Modulversion: %NT-AUTORITÄT606

        Fehlercode: %NT-AUTORITÄT607

        Fehlerbeschreibung: %NT-AUTORITÄT608

Error: (03/24/2015 09:32:17 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Beim Aktualisieren der Signaturen wurde von %NT-AUTORITÄT60 ein Fehler festgestellt.

        Neue Signaturversion:

        Vorherige Signaturversion: 1.195.3.0

        Aktualisierungsquelle: %NT-AUTORITÄT59

        Aktualisierungsphase: 4.7.0205.00

        Quellpfad: 4.7.0205.01

        Signaturtyp: %NT-AUTORITÄT602

        Aktualisierungstyp: %NT-AUTORITÄT604

        Benutzer: NT-AUTORITÄT\SYSTEM

        Aktuelle Modulversion: %NT-AUTORITÄT605

        Vorherige Modulversion: %NT-AUTORITÄT606

        Fehlercode: %NT-AUTORITÄT607

        Fehlerbeschreibung: %NT-AUTORITÄT608

Error: (03/24/2015 09:31:41 PM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "FailureCommand" aufgrund folgenden Fehlers fehlgeschlagen:
%%5

Error: (03/24/2015 09:31:29 PM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "Start" aufgrund folgenden Fehlers fehlgeschlagen:
%%5


Microsoft Office Sessions:
=========================
Error: (04/07/2015 08:36:54 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: IEXPLORE.EXE11.0.9600.1768954e68526unknown0.0.0.000000000c00000050813fe70124c01d07161b7ce93afC:\Program Files (x86)\Internet Explorer\IEXPLORE.EXEunknown0fb2336a-dd55-11e4-833e-bc05430e1a38

Error: (04/07/2015 08:02:23 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: IEXPLORE.EXE11.0.9600.1768954e68526unknown0.0.0.000000000c000000500000000215001d0715cfd7d046bC:\Program Files (x86)\Internet Explorer\IEXPLORE.EXEunknown3da3909c-dd50-11e4-8310-bc05430e1a38

Error: (04/07/2015 08:01:48 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: IEXPLORE.EXE11.0.9600.1768954e68526urlmon.dll11.0.9600.1768954e68687c0000005000487993b801d0715ce57cc6ccC:\Program Files (x86)\Internet Explorer\IEXPLORE.EXEC:\windows\syswow64\urlmon.dll28bcb1af-dd50-11e4-8310-bc05430e1a38

Error: (04/07/2015 07:51:55 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: IEXPLORE.EXE11.0.9600.1768998401d071597e91afb160000C:\Program Files\Internet Explorer\IEXPLORE.EXE99e52966-dd4e-11e4-8310-bc05430e1a38

Error: (04/07/2015 07:30:36 PM) (Source: MsiInstaller) (EventID: 11309) (User: Tiedt-HP)
Description: Product: Google Update Helper -- Error 1309. Error reading from file: C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\Google\Update\RequiredFile.txt.  System error 3.  Verify that the file exists and that you can access it.(NULL)(NULL)(NULL)(NULL)(NULL)

Error: (04/07/2015 07:28:01 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: IEXPLORE.EXE11.0.9600.17689201801d071582971b82b0C:\Program Files\Internet Explorer\IEXPLORE.EXE6e42f054-dd4b-11e4-8310-bc05430e1a38

Error: (04/07/2015 07:22:23 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: TyHelpTFUO.xyz0.0.0.054c6ec8fTyHelpTFUO.xyz0.0.0.054c6ec8fc0000005000328a1132401d071574c5ed815C:\Users\Tiedt\AppData\Local\Temp\FDA0\temp\TyHelpTFUO.xyzC:\Users\Tiedt\AppData\Local\Temp\FDA0\temp\TyHelpTFUO.xyza6caa6c9-dd4a-11e4-9ea8-bc05430e1a38

Error: (04/07/2015 07:19:08 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: gentlemjmp_ieu.tmp51.52.0.017b001d07156bbc089e210C:\Users\Tiedt\AppData\Local\Temp\is-T30MN.tmp\gentlemjmp_ieu.tmp

Error: (04/07/2015 07:17:17 PM) (Source: MsiInstaller) (EventID: 11309) (User: Tiedt-HP)
Description: Product: Google Update Helper -- Error 1309. Error reading from file: C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\Google\Update\RequiredFile.txt.  System error 3.  Verify that the file exists and that you can access it.(NULL)(NULL)(NULL)(NULL)(NULL)

Error: (01/07/2015 05:30:19 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Skype.exe7.0.60.100547efc55Skype.exe7.0.60.100547efc55c000000501938ad9ae001d02a8ed3ecc4faC:\Program Files (x86)\Skype\Phone\Skype.exeC:\Program Files (x86)\Skype\Phone\Skype.exe15ff698f-9682-11e4-9e19-bc05430e1a38


==================== Memory info ===========================

Processor: Intel(R) Core(TM) i5-3450 CPU @ 3.10GHz
Percentage of memory in use: 61%
Total physical RAM: 6100.01 MB
Available physical RAM: 2375.75 MB
Total Pagefile: 12198.21 MB
Available Pagefile: 7791.9 MB
Total Virtual: 8192 MB
Available Virtual: 8191.8 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:914.41 GB) (Free:805.92 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (HP_RECOVERY) (Fixed) (Total:16.88 GB) (Free:2.1 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: AC56E740)

Partition: GPT Partition Type.

==================== End Of Log ============================

M-K-D-B 07.04.2015 21:05
:hallo:


Mein Name ist Matthias und ich werde dir bei der Bereinigung deines Computers helfen.


Bitte beachte folgende Hinweise:
  • Falls wir Hinweise auf illegal erworbene Software finden, werden wir den Support unterbrechen bis jegliche Art von illegaler Software vom Rechner entfernt wurde.
  • Lies dir die Anleitungen sorgfältig durch. Solltest du Probleme haben, stoppe mit deiner Bearbeitung und beschreibe mir dein Problem so gut es geht.
  • Solltest du mir nicht innerhalb von 3 Tagen antworten, gehe ich davon aus, dass du keine Hilfe mehr benötigst. Dann lösche ich dein Thema aus meinem Abo. Solltest du einmal länger abwesend sein, so gib mir bitte Bescheid!
  • Während der Bereinigung bitte nichts installieren oder deinstallieren, außer ich bitte dich darum!
  • Bitte beachten: Download bei filepony.de: So ladet Ihr unsere Tools richtig!
  • Alle zu verwendenen Programme sind auf dem Desktop abzuspeichern und von dort zu starten!


Bitte arbeite alle Schritte in der vorgegebenen Reihefolge nacheinander ab und poste alle Logdateien in CODE-Tags:
So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert deinem Helfer massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu groß für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke aauf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
http://www.trojaner-board.de/picture...&pictureid=307

Danke für deine Mitarbeit!





Schritt 1
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument


Code:
start
CloseProcesses:
R2 konureno; C:\Users\Tiedt\AppData\Local\0406D9B4-1428434594-72AF-8C7F-B36FDEF67BEF\cnsx909.tmp [163328 2015-04-07] () [File not signed]
R2 jizipyli; C:\Users\Tiedt\AppData\Roaming\0406D9B4-1428427194-72AF-8C7F-B36FDEF67BEF\nsv1434.tmpfs [X]
R2 fogezyny; C:\Users\Tiedt\AppData\Roaming\0406D9B4-1428427194-72AF-8C7F-B36FDEF67BEF\jnsb478A.tmp [185856 2015-04-07] () [File not signed]
C:\Users\Tiedt\AppData\Roaming\0406D9B4-1428427194-72AF-8C7F-B36FDEF67BEF
EmptyTemp:
end

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.







Schritt 2
Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).





Schritt 3
Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.







Schritt 4

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.







Schritt 5
  • Starte die FRST.exe erneut. Setze einen Haken vor Addition.txt und drücke auf Scan.
  • FRST erstellt wieder zwei Logdateien (FRST.txt und Addition.txt).
  • Poste mir beide Logdateien mit deiner nächsten Antwort.






Bitte poste mit deiner nächsten Antwort
  • die Logdatei von AdwCleaner,
  • die Logdatei von MBAM,
  • die Logdatei von JRT,
  • die beiden neuen Logdateien von FRST.

nine53 07.04.2015 22:30
Hallo Matthias danke schonmal im vorraus,

hier ADWCleaner

Code:
# AdwCleaner v4.200 - Bericht erstellt 07/04/2015 um 22:30:33
# Aktualisiert 29/03/2015 von Xplode
# Datenbank : 2015-04-06.3 [Server]
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (x64)
# Benutzername : Tiedt - TIEDT-HP
# Gestarted von : C:\Users\Tiedt\Downloads\AdwCleaner_4.200.exe
# Option : Löschen

***** [ Dienste ] *****

Dienst Gelöscht : abengine
[#] Dienst Gelöscht : BackupStack
[#] Dienst Gelöscht : globalUpdate
[#] Dienst Gelöscht : globalUpdatem
[#] Dienst Gelöscht : IHProtect Service
[#] Dienst Gelöscht : InjectorService
[#] Dienst Gelöscht : LolliScan
[#] Dienst Gelöscht : ReimageRealTimeProtector
[#] Dienst Gelöscht : SPBIUpd
Dienst Gelöscht : SPBIUpdd
Dienst Gelöscht : webTinstMKTN
[#] Dienst Gelöscht : WindowsMangerProtect
[#] Dienst Gelöscht : be0fb33b
[#] Dienst Gelöscht : innfd_1_10_0_13
Dienst Gelöscht : SPDRIVER_1.38.1.1735

***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\rei
Ordner Gelöscht : C:\ProgramData\ShopperPro
Ordner Gelöscht : C:\ProgramData\WindowsMangerProtect
Ordner Gelöscht : C:\ProgramData\Reimage Protector
Ordner Gelöscht : C:\ProgramData\IHProtectUpDate
Ordner Gelöscht : C:\ProgramData\LolliScan
Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MyBestOffersToday
Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GAMESDESKTOP
Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Crossbrowse
Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\reimage repair
Ordner Gelöscht : C:\Program Files (x86)\AnyProtectEx
Ordner Gelöscht : C:\Program Files (x86)\globalUpdate
Ordner Gelöscht : C:\Program Files (x86)\iWebar
Ordner Gelöscht : C:\Program Files (x86)\MyPC Backup
Ordner Gelöscht : C:\Program Files (x86)\Object Browser
Ordner Gelöscht : C:\Program Files (x86)\ShopperPro
Ordner Gelöscht : C:\Program Files (x86)\supporter
Ordner Gelöscht : C:\Program Files (x86)\XTab
Ordner Gelöscht : C:\Program Files (x86)\igs
Ordner Gelöscht : C:\Program Files (x86)\turbodiagnosis
Ordner Gelöscht : C:\Program Files (x86)\Crossbrowse
Ordner Gelöscht : C:\Program Files (x86)\system app
Ordner Gelöscht : C:\Program Files (x86)\PoriceLesS
Ordner Gelöscht : C:\Program Files (x86)\Priceless
Ordner Gelöscht : C:\Program Files (x86)\version85BlockAndSurf
Ordner Gelöscht : C:\Program Files (x86)\Cinema PlusV07.04
Ordner Gelöscht : C:\Program Files (x86)\gmsd_de_385
Ordner Gelöscht : C:\Program Files (x86)\mbot_de_587
Ordner Gelöscht : C:\Program Files\Reimage
Ordner Gelöscht : C:\Users\Tiedt\SupTab
Ordner Gelöscht : C:\Users\Tiedt\AppData\Local\globalUpdate
Ordner Gelöscht : C:\Users\Tiedt\AppData\Local\SmartWeb
Ordner Gelöscht : C:\Users\Tiedt\AppData\Local\BrowserHelper
Ordner Gelöscht : C:\Users\Tiedt\AppData\Local\Crossbrowse
Ordner Gelöscht : C:\Users\Tiedt\AppData\Local\gmsd_de_385
Ordner Gelöscht : C:\Users\Tiedt\AppData\Local\mbot_de_587
Ordner Gelöscht : C:\Users\Tiedt\AppData\LocalLow\SmartWeb
Ordner Gelöscht : C:\Users\Tiedt\AppData\Roaming\AnyProtectEx
Ordner Gelöscht : C:\Users\Tiedt\AppData\Roaming\istartsurf
Ordner Gelöscht : C:\Users\Tiedt\AppData\Roaming\ASPackage
Ordner Gelöscht : C:\Users\Tiedt\AppData\Roaming\moters
Ordner Gelöscht : C:\Users\Tiedt\AppData\Roaming\luckysearches
Ordner Gelöscht : C:\Users\Tiedt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AnyProtect PC Backup
Ordner Gelöscht : C:\Users\Tiedt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MyPC Backup
Ordner Gelöscht : C:\Users\Tiedt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ASPackage
Ordner Gelöscht : C:\Users\Tiedt\AppData\Roaming\Mozilla\Firefox\Profiles\snq3xiqr.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}
Ordner Gelöscht : C:\Users\Tiedt\AppData\Local\Google\Chrome\User Data\Default\Extensions\papbadoldddalgcjcicnikcfenodpghp
Datei Gelöscht : C:\Users\Tiedt\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_papbadoldddalgcjcicnikcfenodpghp_0.localstorage
Datei Gelöscht : C:\Users\Tiedt\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_papbadoldddalgcjcicnikcfenodpghp_0.localstorage-journal
Datei Gelöscht : C:\Users\Tiedt\AppData\Local\Google\Chrome\User Data\Default\databases\chrome-extension_papbadoldddalgcjcicnikcfenodpghp_0
Datei Gelöscht : C:\Users\Tiedt\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\papbadoldddalgcjcicnikcfenodpghp
Datei Gelöscht : C:\END
Datei Gelöscht : C:\Users\Public\Desktop\crossbrowse.lnk
Datei Gelöscht : C:\Users\Public\Desktop\PC Scan & Repair by Reimage.lnk
Datei Gelöscht : C:\windows\patsearch.bin
Datei Gelöscht : C:\windows\Reimage.ini
Datei Gelöscht : C:\windows\SysWOW64\abengine.dll
Datei Gelöscht : C:\windows\SysWOW64\abengineOff.ini
Datei Gelöscht : C:\Users\Tiedt\AppData\Local\Temp\Uninstall.exe
Datei Gelöscht : C:\windows\System32\abengine64.dll
Datei Gelöscht : C:\windows\System32\abengineOff.ini
Datei Gelöscht : C:\windows\System32\drivers\webTinstMKTN.sys
Datei Gelöscht : C:\windows\System32\drivers\innfd_1_10_0_13.sys
Datei Gelöscht : C:\Users\Tiedt\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\crossbrowse.lnk
Datei Gelöscht : C:\Users\Tiedt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\crossbrowse.lnk
Datei Gelöscht : C:\Users\Tiedt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPC Backup.lnk
Datei Gelöscht : C:\Users\Tiedt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SmartWeb.lnk
Datei Gelöscht : C:\Users\Tiedt\Desktop\AnyProtect.lnk
Datei Gelöscht : C:\Users\Tiedt\Desktop\MyPC Backup.lnk
Datei Gelöscht : C:\Users\Tiedt\Desktop\Sync Folder.lnk
Datei Gelöscht : C:\Users\Tiedt\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_allin1convert.dl.tb.ask.com_0.localstorage
Datei Gelöscht : C:\Users\Tiedt\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_allin1convert.dl.tb.ask.com_0.localstorage-journal
Datei Gelöscht : C:\Users\Tiedt\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.istartsurf.com_0.localstorage
Datei Gelöscht : C:\Users\Tiedt\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.istartsurf.com_0.localstorage-journal
Datei Gelöscht : C:\Users\Tiedt\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.luckysearches.com_0.localstorage
Datei Gelöscht : C:\Users\Tiedt\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.luckysearches.com_0.localstorage-journal

***** [ Geplante Tasks ] *****

Task Gelöscht : APSnotifierPP1
Task Gelöscht : APSnotifierPP2
Task Gelöscht : APSnotifierPP3
Task Gelöscht : Crossbrowse
Task Gelöscht : globalUpdateUpdateTaskMachineCore
Task Gelöscht : globalUpdateUpdateTaskMachineUA
Task Gelöscht : Inst_Rep
Task Gelöscht : LaunchSignup
Task Gelöscht : Reimage Reminder
Task Gelöscht : ReimageUpdater
Task Gelöscht : ShopperPro
Task Gelöscht : ShopperProJSUpd
Task Gelöscht : SMupdate1
Task Gelöscht : SPDriver
Task Gelöscht : 4947097a-efd7-4265-be23-25706c1bf1f3-1-6
Task Gelöscht : 4947097a-efd7-4265-be23-25706c1bf1f3-1-7
Task Gelöscht : 4947097a-efd7-4265-be23-25706c1bf1f3-5
Task Gelöscht : 4947097a-efd7-4265-be23-25706c1bf1f3-5_user
Task Gelöscht : 4947097a-efd7-4265-be23-25706c1bf1f3-6
Task Gelöscht : 4947097a-efd7-4265-be23-25706c1bf1f3-7
Task Gelöscht : ebbe3f26-9d77-42bb-9f0a-fa747484c8f2-1-6
Task Gelöscht : ebbe3f26-9d77-42bb-9f0a-fa747484c8f2-1-7
Task Gelöscht : ebbe3f26-9d77-42bb-9f0a-fa747484c8f2-5
Task Gelöscht : ebbe3f26-9d77-42bb-9f0a-fa747484c8f2-5_user
Task Gelöscht : ebbe3f26-9d77-42bb-9f0a-fa747484c8f2-6
Task Gelöscht : ebbe3f26-9d77-42bb-9f0a-fa747484c8f2-7
Task Gelöscht : f7c60be6-f43e-478e-86f2-92730f6935fd-1-6
Task Gelöscht : f7c60be6-f43e-478e-86f2-92730f6935fd-1-7
Task Gelöscht : f7c60be6-f43e-478e-86f2-92730f6935fd-10_user
Task Gelöscht : f7c60be6-f43e-478e-86f2-92730f6935fd-3
Task Gelöscht : f7c60be6-f43e-478e-86f2-92730f6935fd-5
Task Gelöscht : f7c60be6-f43e-478e-86f2-92730f6935fd-5_user
Task Gelöscht : f7c60be6-f43e-478e-86f2-92730f6935fd-6
Task Gelöscht : f7c60be6-f43e-478e-86f2-92730f6935fd-7

***** [ Verknüpfungen ] *****

Verknüpfung Desinfiziert : C:\Users\Public\Desktop\Google Chrome.lnk
Verknüpfung Desinfiziert : C:\Users\Tiedt\Desktop\Internet Explorer.lnk
Verknüpfung Desinfiziert : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk
Verknüpfung Desinfiziert : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\It Girl!.lnk
Verknüpfung Desinfiziert : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Marvel Super Hero Squad Online.lnk
Verknüpfung Desinfiziert : C:\Users\Tiedt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
Verknüpfung Desinfiziert : C:\Users\Tiedt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk
Verknüpfung Desinfiziert : C:\Users\Tiedt\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
Verknüpfung Desinfiziert : C:\Users\Tiedt\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
Verknüpfung Desinfiziert : C:\Users\Tiedt\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk
Verknüpfung Desinfiziert : C:\Users\Tiedt\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk

***** [ Registrierungsdatenbank ] *****

Wert Gelöscht : HKCU\Software\Mozilla\Firefox\Extensions [{FE731265-F22A-8201-8F90-E6C9A47F5879}]
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\bopakagnckmlgajfccecajhnimjiiedh
Schlüssel Gelöscht : HKCU\Software\Google\Chrome\Extensions\fcfenmboojpjinhpgggodefccipikbpd
Schlüssel Gelöscht : HKCU\Software\MICROSOFT\INTERNET EXPLORER\DOMSTORAGE\superfish.com
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\DOMStorage\www.superfish.com
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\superfish.com
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\www.superfish.com
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\ShopperPro.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdate.OneClickCtrl.10
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdate.OneClickProcessLauncherMachine
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdate.OneClickProcessLauncherMachine.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdate.Update3WebControl.4
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoCreateAsync
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoCreateAsync.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreClass
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreClass.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreMachineClass
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreMachineClass.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CredentialDialogMachine
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CredentialDialogMachine.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachine
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachine.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachineFallback
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachineFallback.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassSvc
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassSvc.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.ProcessLauncher
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.ProcessLauncher.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3COMClassService
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3COMClassService.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachine
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachine.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachineFallback
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachineFallback.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebSvc
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebSvc.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protector_dll.protectorbho
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protector_dll.protectorbho.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ShopperPro.ShopperProBHO
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ShopperPro.ShopperProBHO.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\mypc backup
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [SPDriver]
Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@staging.google.com/globalUpdate Update;version=10
Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@staging.google.com/globalUpdate Update;version=4
Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WindowsMangerProtect
Wert Gelöscht : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [YTDownloader]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [YTDownloader]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [WinCheck]
Wert Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [SPDriver]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [SmartWeb]
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\ShopperPro.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\abengineLib.DataContainer
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\abengineLib.DataContainer.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\abengineLib.DataController
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\abengineLib.DataController.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\abengineLib.DataTable
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\abengineLib.DataTable.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\abengineLib.DataTableFields
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\abengineLib.DataTableFields.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\abengineLib.DataTableHolder
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\abengineLib.DataTableHolder.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\abengineLib.LSPLogic
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\abengineLib.LSPLogic.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\abengineLib.ReadOnlyManager
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\abengineLib.ReadOnlyManager.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\SysMenuExt
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\SysMenu.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\REI_AxControl.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\REI_AxControl.ReiEngine.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\REI_AxControl.ReiEngine
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Reimage.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\P4d3bea8a_16de_43d0_974f_2a043c7af36e_.P4d3bea8a_16de_43d0_974f_2a043c7af36e_
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\P4d3bea8a_16de_43d0_974f_2a043c7af36e_.P4d3bea8a_16de_43d0_974f_2a043c7af36e_.9
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [gmsd_de_385]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [mbot_de_587]
Schlüssel Gelöscht : HKLM\SOFTWARE\019b7c5c-5928-4f7e-947d-a1eb4b7a7f2e
Schlüssel Gelöscht : HKLM\SOFTWARE\84fbb313-ac12-4011-83b2-604424784096
Schlüssel Gelöscht : HKLM\SOFTWARE\8c03bd5d-6391-4d30-941c-bf9bd1df506f
Schlüssel Gelöscht : HKLM\SOFTWARE\c98006c5-6531-c7cf-0f8f-9f28e4dc001f
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{be0fb33b}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{3278F5CF-48F3-4253-A6BB-004CE84AF492}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{577975B8-C40E-43E6-B0DE-4C6B44088B52}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{D813D5BB-EBC7-45F9-B8A4-36A305168069}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{28FF42B8-A0DA-4BE5-9B81-E26DD59B350A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{02A96331-0CA6-40E2-A87D-C224601985EB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3278F5CF-48F3-4253-A6BB-004CE84AF492}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3B5702BA-7F4C-4D1A-B026-1E9A01D43978}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{5645E0E7-FC12-43BF-A6E4-F9751942B298}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{577975B8-C40E-43E6-B0DE-4C6B44088B52}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{5E89ACE9-E16B-499A-87B4-0DBF742404C1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{69F256DF-BA98-45E9-86EA-FC3CFECF9D30}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{6E87FC94-9866-49B9-8E93-5736D6DE3DD7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{7E49F793-B3CD-4BF7-8419-B34B8BD30E61}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{834469E3-CA2B-4F21-A5CA-4F6F4DBCDE87}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{8529FAA3-5BFD-43C1-AB35-B53C4B96C6E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{ADBC39BE-3D20-4333-8D99-E91EB1B62474}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CFC47BB5-5FB5-4AD0-8427-6AA04334A3FC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E06CA7F5-BA34-4FF6-8D24-B1BDC594D91F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E0ADB535-D7B5-4D8B-B15D-578BDD20D76A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F6421EE5-A5BE-4D31-81D5-C16B7BF48E4C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FD8E81D0-F5FE-4CB1-9AEA-1E163D2BAB78}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{4d3bea8a-16de-43d0-974f-2a043c7af36e}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{D199A6DE-D224-6983-380B-DA21184BF97A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9BB31AD8-5DB2-459E-A901-DEA536F23BA4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{BD51A48E-EB5F-4454-8774-EF962DF64546}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{FA6468D2-FAA4-4951-A53B-2A5CF9CC0A36}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{C3510196-382C-41D1-8E63-6E84DB3709C9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4d3bea8a-16de-43d0-974f-2a043c7af36e}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D199A6DE-D224-6983-380B-DA21184BF97A}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{4d3bea8a-16de-43d0-974f-2a043c7af36e}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D199A6DE-D224-6983-380B-DA21184BF97A}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{10ECCE17-29B5-4880-A8F5-EAD298611484}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{4d3bea8a-16de-43d0-974f-2a043c7af36e}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D199A6DE-D224-6983-380B-DA21184BF97A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{5645E0E7-FC12-43BF-A6E4-F9751942B298}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{4d3bea8a-16de-43d0-974f-2a043c7af36e}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5645E0E7-FC12-43BF-A6E4-F9751942B298}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5E89ACE9-E16B-499A-87B4-0DBF742404C1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{020B1D4B-5738-4C77-9E19-4F173DD9B486}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{10ECCE17-29B5-4880-A8F5-EAD298611484}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{801B440B-1EE3-49B0-B05D-2AB076D4E8CB}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{4d3bea8a-16de-43d0-974f-2a043c7af36e}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{D199A6DE-D224-6983-380B-DA21184BF97A}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{9BB31AD8-5DB2-459E-A901-DEA536F23BA4}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{BD51A48E-EB5F-4454-8774-EF962DF64546}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4d3bea8a-16de-43d0-974f-2a043c7af36e}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D199A6DE-D224-6983-380B-DA21184BF97A}
Schlüssel Gelöscht : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Schlüssel Gelöscht : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
Schlüssel Gelöscht : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3}
Schlüssel Gelöscht : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3}
Daten Wiederhergestellt : HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command
Daten Wiederhergestellt : HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Google Chrome\shell\open\command
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{4709F2DE-3A4E-4C6E-BA0B-538370E51EF0}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{D944BB61-2E34-4DBF-A683-47E505C587DC}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Schlüssel Gelöscht : HKCU\Software\AnyProtect
Schlüssel Gelöscht : HKCU\Software\APN PIP
Schlüssel Gelöscht : HKCU\Software\GlobalUpdate
Schlüssel Gelöscht : HKCU\Software\HomeTab
Schlüssel Gelöscht : HKCU\Software\InstalledBrowserExtensions
Schlüssel Gelöscht : HKCU\Software\iWebar-nv
Schlüssel Gelöscht : HKCU\Software\simplytech
Schlüssel Gelöscht : HKCU\Software\Tutorials
Schlüssel Gelöscht : HKCU\Software\TutoTag
Schlüssel Gelöscht : HKCU\Software\Reimage
Schlüssel Gelöscht : HKCU\Software\TNT2
Schlüssel Gelöscht : HKCU\Software\WajIntEnhance
Schlüssel Gelöscht : HKCU\Software\CrossBrowser
Schlüssel Gelöscht : HKCU\Software\SearchProtectWS
Schlüssel Gelöscht : HKCU\Software\Crossbrowse
Schlüssel Gelöscht : HKCU\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\BlockAndSurf
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Crossrider
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\SmartWeb
Schlüssel Gelöscht : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Schlüssel Gelöscht : HKLM\SOFTWARE\AskPartnerNetwork
Schlüssel Gelöscht : HKLM\SOFTWARE\Conduit
Schlüssel Gelöscht : HKLM\SOFTWARE\GlobalUpdate
Schlüssel Gelöscht : HKLM\SOFTWARE\Iminent
Schlüssel Gelöscht : HKLM\SOFTWARE\InstalledBrowserExtensions
Schlüssel Gelöscht : HKLM\SOFTWARE\istartsurfSoftware
Schlüssel Gelöscht : HKLM\SOFTWARE\iWebar
Schlüssel Gelöscht : HKLM\SOFTWARE\iWebar-nv
Schlüssel Gelöscht : HKLM\SOFTWARE\MyBestOffersToday
Schlüssel Gelöscht : HKLM\SOFTWARE\Object Browser
Schlüssel Gelöscht : HKLM\SOFTWARE\SearchProtect
Schlüssel Gelöscht : HKLM\SOFTWARE\ShopperPro
Schlüssel Gelöscht : HKLM\SOFTWARE\SupDp
Schlüssel Gelöscht : HKLM\SOFTWARE\SupTab
Schlüssel Gelöscht : HKLM\SOFTWARE\Tutorials
Schlüssel Gelöscht : HKLM\SOFTWARE\GAMESDESKTOP
Schlüssel Gelöscht : HKLM\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}
Schlüssel Gelöscht : HKLM\SOFTWARE\IHProtect
Schlüssel Gelöscht : HKLM\SOFTWARE\{12A61307-94CD-4F8E-94BC-918E511FAA81}
Schlüssel Gelöscht : HKLM\SOFTWARE\IGS
Schlüssel Gelöscht : HKLM\SOFTWARE\WajIntEnhance
Schlüssel Gelöscht : HKLM\SOFTWARE\TabNav
Schlüssel Gelöscht : HKLM\SOFTWARE\Crossbrowse
Schlüssel Gelöscht : HKLM\SOFTWARE\SpeedBit
Schlüssel Gelöscht : HKLM\SOFTWARE\luckysearchesSoftware
Schlüssel Gelöscht : HKLM\SOFTWARE\Cinema PlusV07.04
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\IMBoosterARP
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\IminentToolbar
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\WajIntEnhance
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Vosteran.com
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AnyProtect
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IMBoosterARP
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IminentToolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\istartsurf uninstall
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\iWebar
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Object Browser
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ShopperPro
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VOPackage
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ConvertAd
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SmartWeb
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{c8730ca5-3f82-41cc-65e2-01b87600cd89}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\wincheck
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\igsc
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IGS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WajIntEnhance
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ASPackage
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Vosteran.com
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{59680D1A-6A49-4E85-BB42-6886773DF589}_is1
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Crossbrowse
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\luckysearches uninstall
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\00DC837A-6B19-1B3C-1324-4578182B0256
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{75F9BF4A-AF67-A478-A37B-31D73186D3F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Cinema PlusV07.04
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\gmsd_de_385_is1
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mbot_de_587_is1
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\InstalledBrowserExtensions
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\ShopperPro
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Reimage
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\YTDownloader
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyPC Backup
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Reimage Repair
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\ask.com
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\de.reimageplus.com
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\istartsurf.com
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\reimageplus.com
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\softonic.de
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\www.istartsurf.com
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\www.softonic.de

***** [ Internetbrowser ] *****

-\\ Internet Explorer v11.0.9600.17689

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Default_Page_URL]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL]
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]

-\\ Mozilla Firefox v37.0.1 (x86 de)


-\\ Google Chrome v41.0.2272.118

[C:\Users\Tiedt\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://www.luckysearches.com/web/?type=ds&ts=1428426860&from=amt&uid=HitachiXHDS721010DLE630_MSK5215H20X97G20X97GX&q={searchTerms}
[C:\Users\Tiedt\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://www.luckysearches.com/web/?type=ds&ts=1428427384&from=fsf&uid=HitachiXHDS721010DLE630_MSK5215H20X97G20X97GX&q={searchTerms}
[C:\Users\Tiedt\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] - Gelöscht [Extension] : bopakagnckmlgajfccecajhnimjiiedh
[C:\Users\Tiedt\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] - Gelöscht [Extension] : fcfenmboojpjinhpgggodefccipikbpd
[C:\Users\Tiedt\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] - Gelöscht [Extension] : papbadoldddalgcjcicnikcfenodpghp
[C:\Users\Tiedt\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] - Gelöscht [Homepage] : hxxp://www.luckysearches.com/?type=hp&ts=1428427384&from=fsf&uid=HitachiXHDS721010DLE630_MSK5215H20X97G20X97GX
[C:\Users\Tiedt\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] - Gelöscht [Startup_URLs] : hxxp://www.luckysearches.com/?type=hp&ts=1428427384&from=fsf&uid=HitachiXHDS721010DLE630_MSK5215H20X97G20X97GX
[C:\Users\Tiedt\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] - Gelöscht [Default_Search_Provider_Data] : hxxp://www.luckysearches.com/web/?type=ds&ts=1428427384&from=fsf&uid=HitachiXHDS721010DLE630_MSK5215H20X97G20X97GX&q={searchTerms}

*************************

AdwCleaner[R0].txt - [39710 Bytes] - [07/04/2015 22:29:16]
AdwCleaner[S0].txt - [34385 Bytes] - [07/04/2015 22:30:33]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [34445  Bytes] ##########
und MBAM

Code:
Malwarebytes Anti-Malware
www.malwarebytes.org

Suchlauf Datum: 07.04.2015
Suchlauf-Zeit: 22:37:59
Logdatei: mbam.txt
Administrator: Ja

Version: 2.01.4.1018
Malware Datenbank: v2015.04.07.06
Rootkit Datenbank: v2015.03.31.01
Lizenz: Testversion
Malware Schutz: Aktiviert
Bösartiger Webseiten Schutz: Aktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: Tiedt

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 350431
Verstrichene Zeit: 16 Min, 55 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 5
PUP.Optional.Infonaut.A, C:\Program Files (x86)\Infonaut_1.10.0.13\Service\insvc.exe, 2116, Löschen bei Neustart, [6d553b2e800a86b057e784b143c37c84]
PUP.Optional.Multiplug, C:\Users\Tiedt\AppData\Local\Temp\18DC.exe, 1972, Löschen bei Neustart, [11b1d198d6b4181e15de033c45bd0af6]
PUP.Optional.MultiPlug.A, C:\Users\Tiedt\AppData\Local\0406D9B4-1428434594-72AF-8C7F-B36FDEF67BEF\cnsx909.tmp, 2336, Löschen bei Neustart, [11b14a1f98f2d95da622d4e3db28ff01]
PUP.Optional.MultiPlug.A, C:\Users\Tiedt\AppData\Roaming\0406D9B4-1428427194-72AF-8C7F-B36FDEF67BEF\nsv1434.tmpfs, 2292, Löschen bei Neustart, [279b15546d1d56e0c409b70022e1b34d]
PUP.Optional.MultiPlug.A, C:\Users\Tiedt\AppData\Roaming\0406D9B4-1428427194-72AF-8C7F-B36FDEF67BEF\jnsb478A.tmp, 1180, Löschen bei Neustart, [279b15546d1d56e0c409b70022e1b34d]

Module: 0
(Keine schädliche Elemente gefunden)

Registrierungsschlüssel: 83
PUP.Optional.Infonaut.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\insvc_1.10.0.13, In Quarantäne, [6d553b2e800a86b057e784b143c37c84],
PUP.Optional.Multiplug, HKU\S-1-5-21-2149968534-1042019459-1302014499-1000_Classes\TYPELIB\{157B1AA6-3E5C-404A-9118-C1D91F537040}, In Quarantäne, [5270c2a7296192a45c768ca87d868878],
PUP.Optional.Multiplug, HKU\S-1-5-21-2149968534-1042019459-1302014499-1000_Classes\INTERFACE\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}, In Quarantäne, [5270c2a7296192a45c768ca87d868878],
PUP.Optional.Infonaut.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\Infonaut_1.10.0.13, In Quarantäne, [4082f079e9a13cfa0d3172c323e3f907],
PUP.Optional.MultiPlug.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\konureno, In Quarantäne, [11b14a1f98f2d95da622d4e3db28ff01],
PUP.Optional.MultiPlug.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\jizipyli, In Quarantäne, [279b15546d1d56e0c409b70022e1b34d],
PUP.Optional.MultiPlug.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\fogezyny, In Quarantäne, [279b15546d1d56e0c409b70022e1b34d],
PUP.Optional.HighlightSearches.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{1BCB34DC-BA6D-4B44-B786-4E259598A7C8}, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{025EEF9C-90F5-417E-9196-09FA4AAB4C92}, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{03F13205-38FF-4361-BECE-EE939A002FA2}, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{1FAAF6AB-B931-4D05-BA12-B0ECCCCE2D0F}, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{4AEC2270-2E5F-40C8-BE5A-E5A5264714C0}, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{52E8E39B-2773-448F-BC20-547CD8DA4685}, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{62163814-0C94-4DC3-BA99-5E9E2420C914}, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{68AEA825-D48B-4A56-87F0-6FCE988A2C48}, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{6A0F07D3-F28E-4F45-8D4C-BBF8000F5BB8}, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{7AF435BC-80A9-466E-938B-32E4482EBD65}, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{85CEBABD-A775-41E2-8B67-FE06104F06ED}, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{AE92A5AB-E575-4487-BCC0-96D333E5346C}, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{C622315B-3049-43D4-9B41-D4B2DC2CD706}, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{CDB85458-AE08-4106-B699-B946FF4A61CD}, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{025EEF9C-90F5-417E-9196-09FA4AAB4C92}, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{03F13205-38FF-4361-BECE-EE939A002FA2}, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{1FAAF6AB-B931-4D05-BA12-B0ECCCCE2D0F}, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{4AEC2270-2E5F-40C8-BE5A-E5A5264714C0}, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{52E8E39B-2773-448F-BC20-547CD8DA4685}, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{62163814-0C94-4DC3-BA99-5E9E2420C914}, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{68AEA825-D48B-4A56-87F0-6FCE988A2C48}, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{6A0F07D3-F28E-4F45-8D4C-BBF8000F5BB8}, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{7AF435BC-80A9-466E-938B-32E4482EBD65}, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{85CEBABD-A775-41E2-8B67-FE06104F06ED}, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{AE92A5AB-E575-4487-BCC0-96D333E5346C}, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{C622315B-3049-43D4-9B41-D4B2DC2CD706}, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{CDB85458-AE08-4106-B699-B946FF4A61CD}, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{025EEF9C-90F5-417E-9196-09FA4AAB4C92}, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{03F13205-38FF-4361-BECE-EE939A002FA2}, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{1FAAF6AB-B931-4D05-BA12-B0ECCCCE2D0F}, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{4AEC2270-2E5F-40C8-BE5A-E5A5264714C0}, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{52E8E39B-2773-448F-BC20-547CD8DA4685}, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{62163814-0C94-4DC3-BA99-5E9E2420C914}, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{68AEA825-D48B-4A56-87F0-6FCE988A2C48}, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{6A0F07D3-F28E-4F45-8D4C-BBF8000F5BB8}, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{7AF435BC-80A9-466E-938B-32E4482EBD65}, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{85CEBABD-A775-41E2-8B67-FE06104F06ED}, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{AE92A5AB-E575-4487-BCC0-96D333E5346C}, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{C622315B-3049-43D4-9B41-D4B2DC2CD706}, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{CDB85458-AE08-4106-B699-B946FF4A61CD}, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{1BCB34DC-BA6D-4B44-B786-4E259598A7C8}, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, HKLM\SOFTWARE\CLASSES\WOW6432NODE\TYPELIB\{1BCB34DC-BA6D-4B44-B786-4E259598A7C8}, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\HighlightSearches, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.LolliScan.A, HKLM\SOFTWARE\LolliScan, In Quarantäne, [dfe30069eaa043f32eb5c101758eae52],
PUP.Optional.Crossbrowse.C, HKLM\SOFTWARE\CLASSES\CRSBRWSHTML, In Quarantäne, [d4ee5118addd1422f9da11a79a697b85],
PUP.Optional.Crossbrowse.A, HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\Crossbrowse, In Quarantäne, [6161f17899f1092d16eea1183cc71ee2],
PUP.Optional.Crossbrowse.C, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\crossbrowse.exe, In Quarantäne, [2b9771f86d1d9b9be3f1d3e5768df50b],
PUP.Optional.CinemaPlus.A, HKLM\SOFTWARE\WOW6432NODE\Cinema PlusV07.04-nv, In Quarantäne, [4b77d69335550c2aae80e866c83dab55],
PUP.Optional.CinemaPlus.A, HKLM\SOFTWARE\WOW6432NODE\Cinema PlusV07.04-nv-ie, In Quarantäne, [b60c73f63a5068ce9d91c28c50b520e0],
PUP.Optional.Infonaut.A, HKLM\SOFTWARE\WOW6432NODE\Infonaut_1.10.0.13, In Quarantäne, [437f73f6a7e3ba7c3e5707b0996ad32d],
PUP.Optional.iWebar.A, HKLM\SOFTWARE\WOW6432NODE\iWebar-nv-ie, In Quarantäne, [b50dde8b2a6062d481da2e975fa45ba5],
PUP.Optional.LolliScan.A, HKLM\SOFTWARE\WOW6432NODE\LolliScan, In Quarantäne, [3b8766036e1c63d34a99d6ec5fa427d9],
PUP.Optional.ObjectBrowser.A, HKLM\SOFTWARE\WOW6432NODE\Object Browser-nv, In Quarantäne, [dce69ecbfd8d2d09eb00f0cf38cb916f],
PUP.Optional.ObjectBrowser.A, HKLM\SOFTWARE\WOW6432NODE\Object Browser-nv-ie, In Quarantäne, [3e84fa6fd0ba2e087e6db40b26dd758b],
PUP.Optional.Crossbrowse.C, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CRSBRWSHTML, In Quarantäne, [893982e71a70aa8ceee5ae0a2bd8b848],
PUP.Optional.Crossbrowse.A, HKLM\SOFTWARE\WOW6432NODE\CLIENTS\STARTMENUINTERNET\Crossbrowse, In Quarantäne, [467c99d0dfab0d295ba9b306d52e936d],
PUP.Optional.Crossbrowse.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\MEDIAPLAYER\SHIMINCLUSIONLIST\crossbrowse.exe, In Quarantäne, [e5dd7eeb93f716202ed4dadfa75c24dc],
PUP.Optional.Crossbrowse.C, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\crossbrowse.exe, In Quarantäne, [29991950810950e6f4e0e1d722e16a96],
PUP.Optional.TabNav.A, HKLM\SOFTWARE\WOW6432NODE\TABNAV, In Quarantäne, [6d552445d9b12a0ce6fcfeb9c1422fd1],
PUP.Optional.Infonaut.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\innfd_1_10_0_13, In Quarantäne, [6161c2a72f5bd75faae9a4138c779967],
PUP.Optional.CinemaPlus.A, HKU\S-1-5-18\SOFTWARE\Cinema PlusV07.04-nv, In Quarantäne, [3191a0c9a8e2999d9994d47a0afb8779],
PUP.Optional.CinemaPlus.A, HKU\S-1-5-18\SOFTWARE\Cinema PlusV07.04-nv-ie, In Quarantäne, [03bf4b1e76142a0c72bbaf9f7a8b18e8],
PUP.Optional.iWebar.A, HKU\S-1-5-18\SOFTWARE\iWebar-nv, In Quarantäne, [7a480861fe8ce65095c7368fbb489769],
PUP.Optional.iWebar.A, HKU\S-1-5-18\SOFTWARE\iWebar-nv-ie, In Quarantäne, [378b4029afdb48eed785626342c17e82],
PUP.Optional.ObjectBrowser.A, HKU\S-1-5-18\SOFTWARE\Object Browser-nv, In Quarantäne, [8e34abbe9feb7fb7f7f5d1ee45be768a],
PUP.Optional.ObjectBrowser.A, HKU\S-1-5-18\SOFTWARE\Object Browser-nv-ie, In Quarantäne, [41815217008afd395c900ab5e91a11ef],
PUP.Optional.CinemaPlus.A, HKU\S-1-5-21-2149968534-1042019459-1302014499-1000\SOFTWARE\Cinema PlusV07.04-ntf, In Quarantäne, [dee43b2e1377ba7ca08d2a248e7714ec],
PUP.Optional.CinemaPlus.A, HKU\S-1-5-21-2149968534-1042019459-1302014499-1000\SOFTWARE\Cinema PlusV07.04-nv, In Quarantäne, [7d45afba5e2c5cda101dfb53a164b848],
PUP.Optional.CinemaPlus.A, HKU\S-1-5-21-2149968534-1042019459-1302014499-1000\SOFTWARE\Cinema PlusV07.04-nv-ie, In Quarantäne, [0cb65910ddadb284dc51123c1ee7af51],
PUP.Optional.iWebar.A, HKU\S-1-5-21-2149968534-1042019459-1302014499-1000\SOFTWARE\iWebar-nv-ie, In Quarantäne, [18aa1a4f642604329cc08540e12258a8],
PUP.Optional.Moters.A, HKU\S-1-5-21-2149968534-1042019459-1302014499-1000\SOFTWARE\ningsup, In Quarantäne, [932f6efb4e3c989ef3ee358212f1b34d],
PUP.Optional.ObjectBrowser.A, HKU\S-1-5-21-2149968534-1042019459-1302014499-1000\SOFTWARE\Object Browser-nv, In Quarantäne, [c8fa62072e5cb77f08e44b747a8902fe],
PUP.Optional.ObjectBrowser.A, HKU\S-1-5-21-2149968534-1042019459-1302014499-1000\SOFTWARE\Object Browser-nv-ie, In Quarantäne, [6d5586e31e6c181e9755308f679c59a7],
PUP.Optional.Linkey.A, HKU\S-1-5-21-2149968534-1042019459-1302014499-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\Linkey, In Quarantäne, [e8daf8717a101422de1da21b60a322de],
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\GOOGLEUPDATE.EXE, In Quarantäne, [03bf46235139d264a9cfff9a23e028d8],
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\GOOGLEUPDATE.EXE, In Quarantäne, [03bf46235139d264a9cfff9a23e028d8],

Registrierungswerte: 5
PUP.Optional.TabNav.A, HKLM\SOFTWARE\WOW6432NODE\TABNAV|affid, 1123, In Quarantäne, [6d552445d9b12a0ce6fcfeb9c1422fd1]
PUP.Optional.MultiPlug.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\fogezyny|ImagePath, C:\Users\Tiedt\AppData\Roaming\0406D9B4-1428427194-72AF-8C7F-B36FDEF67BEF\jnsb478A.tmp, In Quarantäne, [a220a8c14c3e2c0ad436f25c24e14fb1]
PUP.Optional.MultiPlug.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\jizipyli|ImagePath, C:\Users\Tiedt\AppData\Roaming\0406D9B4-1428427194-72AF-8C7F-B36FDEF67BEF\nsv1434.tmpfs, In Quarantäne, [556d5811fe8cd75fb356e36b9471e818]
PUP.Optional.MultiPlug.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\konureno|ImagePath, C:\Users\Tiedt\AppData\Local\0406D9B4-1428434594-72AF-8C7F-B36FDEF67BEF\cnsx909.tmp, In Quarantäne, [7b47323723678aac86834a04b84de61a]
PUP.Optional.Infonaut.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\insvc_1.10.0.13|ImagePath, "C:\Program Files (x86)\Infonaut_1.10.0.13\Service\insvc.exe", In Quarantäne, [c3fffb6ed8b2ae88692b5265a0638878]

Registrierungsdaten: 0
(Keine schädliche Elemente gefunden)

Ordner: 16
PUP.Optional.MultiPlug.A, C:\Users\Tiedt\AppData\Local\0406D9B4-1428434594-72AF-8C7F-B36FDEF67BEF, Löschen bei Neustart, [11b14a1f98f2d95da622d4e3db28ff01],
PUP.Optional.MultiPlug.A, C:\Users\Tiedt\AppData\Local\0406D9B4-1428435003-72AF-8C7F-B36FDEF67BEF, In Quarantäne, [e8da0d5c7515b87eab1e6d4aec1758a8],
PUP.Optional.MultiPlug.A, C:\Users\Tiedt\AppData\Roaming\0406D9B4-1428427194-72AF-8C7F-B36FDEF67BEF, Löschen bei Neustart, [279b15546d1d56e0c409b70022e1b34d],
PUP.Optional.HighlightSearches.A, C:\Program Files (x86)\HighlightSearches, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.MyPCBackUp.A, C:\Program Files (x86)\MyPcBackup, In Quarantäne, [a41e3c2d3a5083b3ab37d77528ddb749],
PUP.Optional.MultiPlug.A, C:\ProgramData\njacolbmlcidaijbbblocplginaodmak, In Quarantäne, [c8fa37327c0efb3b48ba3f0f2cd92cd4],
PUP.Optional.GlobalUpdate.A, C:\Users\Tiedt\AppData\Local\Temp\comh.325031, In Quarantäne, [03bf46235139d264a9cfff9a23e028d8],
PUP.Optional.GlobalUpdate.A, C:\Users\Tiedt\AppData\Local\Temp\comh.439983, In Quarantäne, [457d4029b9d1a98d2355c9d058ab758b],
PUP.Optional.GlobalUpdate.A, C:\Users\Tiedt\AppData\Local\Temp\comh.477157, In Quarantäne, [af130a5f721841f593e57326c63d21df],
PUP.Optional.ShopperPro, C:\Program Files\Common Files\ShopperPro, In Quarantäne, [5c66f079fb8ff0460b98d3cb6c97d42c],
PUP.Optional.ShopperPro.A, C:\Users\Public\Documents\ShopperPro, In Quarantäne, [41810a5f7b0fd36382fb8e288d768e72],
PUP.Optional.ShopperPro.A, C:\Users\Public\Documents\ShopperPro\JsDriver, In Quarantäne, [41810a5f7b0fd36382fb8e288d768e72],
PUP.Optional.CinemaPlus.A, C:\Program Files (x86)\Cinema PlusV07.04-ntf, In Quarantäne, [20a2e5841d6db581cf0732841ae9817f],
PUP.Optional.Infonaut.A, C:\Program Files (x86)\Infonaut_1.10.0.13, Löschen bei Neustart, [01c15217880295a1c85fd4e324dfb54b],
PUP.Optional.Infonaut.A, C:\Program Files (x86)\Infonaut_1.10.0.13\3rd Party Licenses, In Quarantäne, [01c15217880295a1c85fd4e324dfb54b],
PUP.Optional.Infonaut.A, C:\Program Files (x86)\Infonaut_1.10.0.13\Service, Löschen bei Neustart, [01c15217880295a1c85fd4e324dfb54b],

Dateien: 156
PUP.Optional.Infonaut.A, C:\Program Files (x86)\Infonaut_1.10.0.13\Service\insvc.exe, Löschen bei Neustart, [6d553b2e800a86b057e784b143c37c84],
PUP.Optional.Multiplug, C:\Users\Tiedt\AppData\Local\Temp\18DC.exe, Löschen bei Neustart, [11b1d198d6b4181e15de033c45bd0af6],
PUP.Optional.Multiplug, C:\Users\Tiedt\AppData\Local\Temp\FDA0\temp\Priceless_310315.exe, In Quarantäne, [5270c2a7296192a45c768ca87d868878],
PUP.Optional.JellySplit.Gen, C:\ProgramData\3a8c9699124a4506a71d46fb652dc7b1\3a8c9699124a4506a71d46fb652dc7b1.exe, In Quarantäne, [f4cecc9df1992e084ad90e2ee81aed13],
PUP.Optional.Multiplug, C:\ProgramData\{3bef08e0-4997-b04c-3bef-f08e04992381}\Priceless_310315.exe, In Quarantäne, [853d56130882013530c3f24d07fb4ab6],
PUP.Optional.CrossRider.A, C:\Users\Tiedt\AppData\Roaming\SXZQ.exe, In Quarantäne, [d6ec1c4d31594fe71d69b578c83ea35d],
PUP.Optional.ObjectBrowser.A, C:\Users\Tiedt\AppData\Roaming\XDKWM.exe, In Quarantäne, [d4ee96d3acde5dd9f7aef42742c0fa06],
PUP.Optional.Nova.A, C:\Program Files (x86)\5eb99ca5-046a-49ee-9304-c67a0fd45030\cde5e197-b664-4994-abdb-1d6e695117ac.dll, In Quarantäne, [d3ef81e85139b97db6fcb758c43e40c0],
PUP.Optional.Nova.A, C:\Program Files (x86)\691f0be1-5255-412a-8083-cbfcdb6532b4\234441e9-a8d0-457d-88c1-0a31cafc83ed.dll, In Quarantäne, [04becb9e880256e02f835ab59171d22e],
PUP.Optional.Nova.A, C:\Program Files (x86)\691f0be1-5255-412a-8083-cbfcdb6532b4\47e85500-1dc2-4fbf-82e2-7e9347b7a1c8.dll, In Quarantäne, [952dda8fa9e1b086347ea36c7f83a15f],
PUP.Optional.Nova.A, C:\Program Files (x86)\691f0be1-5255-412a-8083-cbfcdb6532b4\f6fc9422-d8c5-4c8b-90f5-f7c85334fc3d.dll, In Quarantäne, [536ff970543696a0ffb353bc91715ca4],
PUP.Optional.Nova.A, C:\Program Files (x86)\9cb3e9f1-8ae7-4112-a04b-7199a616d34b\865b7c23-f089-43a3-be55-2024b91eedd1.dll, In Quarantäne, [8f332148454581b5b00212fd758dc838],
PUP.Optional.Nova.A, C:\Program Files (x86)\avmwlanstick\fc3c5766-9eaa-40ac-a9c8-9febb2c4c798.dll, In Quarantäne, [e4de3633e6a452e4139f070825dd2cd4],
PUP.Optional.CrossRider, C:\Program Files (x86)\Cinema PlusV07.04-ntf\f7c60be6-f43e-478e-86f2-92730f6935fd-10.exe, In Quarantäne, [efd36603bdcd80b65d80142e8c76f60a],
PUP.Optional.Imali.SID.A, C:\Program Files (x86)\imalicmf\ImaliBundle.exe, In Quarantäne, [9230a7c2a8e2f1459cb263d2937336ca],
PUP.Optional.Infonaut.A, C:\Program Files (x86)\Infonaut_1.10.0.13\Uninstall.exe, In Quarantäne, [4082f079e9a13cfa0d3172c323e3f907],
PUP.Optional.Amonetize, C:\$RECYCLE.BIN\S-1-5-21-2149968534-1042019459-1302014499-1000\$R16MY5Z.exe, In Quarantäne, [279b48217416cb6be4b70234ed15748c],
PUP.Optional.CrossRider, C:\Users\Tiedt\AppData\Local\Temp\2680.exe, In Quarantäne, [f5cdf475761447efe245b1323fc22ed2],
PUP.Optional.Multiplug, C:\Users\Tiedt\AppData\Local\Temp\3CE0.exe, In Quarantäne, [d8ea81e87614cb6beb0866d9f40edc24],
Trojan.Downloader, C:\Users\Tiedt\AppData\Local\Temp\nsaD80C.tmp, In Quarantäne, [586a10590882bb7bb63443e9f01346ba],
PUP.Optional.Bundle, C:\Users\Tiedt\AppData\Local\Temp\nsaD80D.tmp, In Quarantäne, [764c53167614de5849b035b659ac2dd3],
PUP.Optional.IStartSurf.A, C:\Users\Tiedt\AppData\Local\Temp\nsc81D0.tmp, In Quarantäne, [cef4e485f892c96dcc0a78bc17ef33cd],
PUP.Optional.Somoto, C:\Users\Tiedt\AppData\Local\Temp\bitool.dll, In Quarantäne, [289a79f0dab0a69046366101649e7789],
PUP.Optional.Outbrowse.Gen, C:\Users\Tiedt\AppData\Local\Temp\setup.exe, In Quarantäne, [833f1455bdcda492fdc3e15ece34ff01],
PUP.Optional.Multiplug, C:\Users\Tiedt\AppData\Local\Temp\EFC0.exe, In Quarantäne, [39892742a5e5f640757e40ffd42e9967],
PUP.Optional.Multiplug, C:\Users\Tiedt\AppData\Local\Temp\B190.exe, In Quarantäne, [1ca68cdd9befb38333c0a69914ee619f],
PUP.Optional.CrossRider, C:\Users\Tiedt\AppData\Local\Temp\9275.exe, In Quarantäne, [3a886504d9b11e18091e9a49669bbb45],
PUP.Optional.OfferInstaller.C, C:\Users\Tiedt\AppData\Local\Temp\jPT63A2.exe, In Quarantäne, [6f53d594cdbd55e10a9c3a00fa082cd4],
PUP.Optional.Conduit.A, C:\Users\Tiedt\AppData\Local\Temp\ct3334333\ism.exe, In Quarantäne, [358d5118deac9d990cca59dc3bc7837d],
PUP.Optional.CrossRider, C:\Users\Tiedt\AppData\Local\Temp\Install_358\ins_cr.exe, In Quarantäne, [2c9669007812fc3a3dea568d47bade22],
PUP.Optional.CrossRider, C:\Users\Tiedt\AppData\Local\Temp\Install_358\ins_iwebar.exe, In Quarantäne, [9929d9900387e84eb572647f9968ba46],
PUP.Optional.Tuto4PC.A, C:\Users\Tiedt\AppData\Local\Temp\is-1GAFR.tmp\package_MyStartSearch_installer_multilang.exe, In Quarantäne, [863c5316e2a845f16e8f52ad7c853ec2],
PUP.Optional.Tuto4PC.A, C:\Users\Tiedt\AppData\Local\Temp\is-1GAFR.tmp\150.exe, In Quarantäne, [c5fd2346800a88aefa0334cb13ee916f],
PUP.Optional.Conduit.A, C:\Users\Tiedt\AppData\Local\Temp\is-1GAFR.tmp\ism.exe, In Quarantäne, [ffc31158018981b5a432e154fa088f71],
PUP.Optional.Tuto4PC.A, C:\Users\Tiedt\AppData\Local\Temp\is-1GAFR.tmp\package_browsergood_installer_multilang.exe, In Quarantäne, [00c278f1deac290d3ebf07f8ef12867a],
PUP.Optional.Tuto4PC.A, C:\Users\Tiedt\AppData\Local\Temp\is-1GAFR.tmp\package_istartsurfp_installer_multilang.exe, In Quarantäne, [2e949fca6a20f4429e5fe51a12ef1ce4],
PUP.Optional.Tuto4PC.A, C:\Users\Tiedt\AppData\Local\Temp\is-1GAFR.tmp\package_mountainbike_installer_multilang.exe, In Quarantäne, [f6cc37326426a1957f7e20df9869de22],
PUP.Optional.Tuto4PC.A, C:\Users\Tiedt\AppData\Local\Temp\is-1GAFR.tmp\package_optimizerpro_installer_multilang.exe, In Quarantäne, [fec4f178d0baf73fed106798ae53669a],
PUP.Optional.Tuto4PC.A, C:\Users\Tiedt\AppData\Local\Temp\is-1GAFR.tmp\package_plushd_installer_multilang.exe, In Quarantäne, [a9195b0ed2b89c9a7a831ce3b0511be5],
PUP.Optional.Tuto4PC.A, C:\Users\Tiedt\AppData\Local\Temp\is-1GAFR.tmp\package_quickref_installer_multilang.exe, In Quarantäne, [c0025b0ee8a2979f609dc03f827f6f91],
PUP.Optional.Tuto4PC.A, C:\Users\Tiedt\AppData\Local\Temp\is-1GAFR.tmp\package_SByoutube_installer_multilang.exe, In Quarantäne, [e1e1ea7f5e2c83b356a703fc22dfc33d],
PUP.Optional.Tuto4PC.A, C:\Users\Tiedt\AppData\Local\Temp\is-1GAFR.tmp\package_secprotwhite_installer_multilang.exe, In Quarantäne, [952d37328406f73fa35a35ca89788f71],
PUP.Optional.Tuto4PC.A, C:\Users\Tiedt\AppData\Local\Temp\is-1GAFR.tmp\package_secureprotect_installer_multilang.exe, In Quarantäne, [b0121257abdf81b52dd0936cb44da858],
PUP.Optional.Tuto4PC.A, C:\Users\Tiedt\AppData\Local\Temp\is-1GAFR.tmp\package_speeditup_installer_multilang.exe, In Quarantäne, [428021484941a98d5aa3b34cef129f61],
PUP.Optional.Tuto4PC.A, C:\Users\Tiedt\AppData\Local\Temp\is-1GAFR.tmp\package_superpc_installer_multilang.exe, In Quarantäne, [1ba7d7925d2d65d15ba236c97a878d73],
PUP.Optional.Tuto4PC.A, C:\Users\Tiedt\AppData\Local\Temp\is-1GAFR.tmp\package_wajam_installer_multilang.exe, In Quarantäne, [21a1adbcfa9061d5feff8778e120c937],
PUP.Optional.Tuto4PC.A, C:\Users\Tiedt\AppData\Local\Temp\is-1GAFR.tmp\package_zombie_installer_multilang.exe, In Quarantäne, [a61c2a3f6f1b181e906da55aca370ef2],
PUP.Optional.VeriBrowse.A, C:\Users\Tiedt\AppData\Local\Temp\f9626892-7a78-3199-abd2-97bbce96297b\adv_61.exe, In Quarantäne, [01c1bbae701a3402672ccf68b74b7789],
PUP.Optional.Giga, C:\Users\Tiedt\Downloads\Samsung-Galaxy-S3-Mini-GT-I8190-Handbuch-lnstall.exe, In Quarantäne, [ab170b5e97f32a0cc411f7e525e0af51],
PUP.Optional.MultiPlug.A, C:\Users\Tiedt\AppData\Local\0406D9B4-1428434594-72AF-8C7F-B36FDEF67BEF\cnsx909.tmp, Löschen bei Neustart, [11b14a1f98f2d95da622d4e3db28ff01],
PUP.Optional.MultiPlug.A, C:\Users\Tiedt\AppData\Local\0406D9B4-1428434594-72AF-8C7F-B36FDEF67BEF\ansc35D.exe, In Quarantäne, [11b14a1f98f2d95da622d4e3db28ff01],
PUP.Optional.MultiPlug.A, C:\Users\Tiedt\AppData\Local\0406D9B4-1428434594-72AF-8C7F-B36FDEF67BEF\rnsx90A.exe, In Quarantäne, [11b14a1f98f2d95da622d4e3db28ff01],
PUP.Optional.MultiPlug.A, C:\Users\Tiedt\AppData\Local\0406D9B4-1428434594-72AF-8C7F-B36FDEF67BEF\Uninstall.exe, In Quarantäne, [11b14a1f98f2d95da622d4e3db28ff01],
PUP.Optional.MultiPlug.A, C:\Users\Tiedt\AppData\Local\0406D9B4-1428435003-72AF-8C7F-B36FDEF67BEF\inshC40C.tmp, In Quarantäne, [e8da0d5c7515b87eab1e6d4aec1758a8],
PUP.Optional.MultiPlug.A, C:\Users\Tiedt\AppData\Local\0406D9B4-1428435003-72AF-8C7F-B36FDEF67BEF\jnshBF7A.exe, In Quarantäne, [e8da0d5c7515b87eab1e6d4aec1758a8],
PUP.Optional.MultiPlug.A, C:\Users\Tiedt\AppData\Local\0406D9B4-1428435003-72AF-8C7F-B36FDEF67BEF\rnshC40D.exe, In Quarantäne, [e8da0d5c7515b87eab1e6d4aec1758a8],
PUP.Optional.MultiPlug.A, C:\Users\Tiedt\AppData\Local\0406D9B4-1428435003-72AF-8C7F-B36FDEF67BEF\Uninstall.exe, In Quarantäne, [e8da0d5c7515b87eab1e6d4aec1758a8],
PUP.Optional.MultiPlug.A, C:\Users\Tiedt\AppData\Roaming\0406D9B4-1428427194-72AF-8C7F-B36FDEF67BEF\nsv1434.tmpfs, Löschen bei Neustart, [279b15546d1d56e0c409b70022e1b34d],
PUP.Optional.MultiPlug.A, C:\Users\Tiedt\AppData\Roaming\0406D9B4-1428427194-72AF-8C7F-B36FDEF67BEF\jnsb478A.tmp, Löschen bei Neustart, [279b15546d1d56e0c409b70022e1b34d],
PUP.Optional.MultiPlug.A, C:\Users\Tiedt\AppData\Roaming\0406D9B4-1428427194-72AF-8C7F-B36FDEF67BEF\rnsw41EB.exe, In Quarantäne, [279b15546d1d56e0c409b70022e1b34d],
PUP.Optional.MultiPlug.A, C:\Users\Tiedt\AppData\Roaming\0406D9B4-1428427194-72AF-8C7F-B36FDEF67BEF\Uninstall.exe, In Quarantäne, [279b15546d1d56e0c409b70022e1b34d],
PUP.Optional.HighlightSearches.A, C:\Program Files (x86)\HighlightSearches\abengine.tlb, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, C:\Program Files (x86)\HighlightSearches\lengine64.exe, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, C:\Program Files (x86)\HighlightSearches\abengine.dll, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, C:\Program Files (x86)\HighlightSearches\abengine.exe, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, C:\Program Files (x86)\HighlightSearches\abengine64.dll, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, C:\Program Files (x86)\HighlightSearches\abenginecert.dll, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, C:\Program Files (x86)\HighlightSearches\abenginep.exe, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, C:\Program Files (x86)\HighlightSearches\abenginew.exe, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, C:\Program Files (x86)\HighlightSearches\abenginewd.dll, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, C:\Program Files (x86)\HighlightSearches\freebl3.dll, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, C:\Program Files (x86)\HighlightSearches\fres3005.exe, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, C:\Program Files (x86)\HighlightSearches\lengine.exe, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, C:\Program Files (x86)\HighlightSearches\lengine.ini, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, C:\Program Files (x86)\HighlightSearches\libnspr4.dll, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, C:\Program Files (x86)\HighlightSearches\libplc4.dll, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, C:\Program Files (x86)\HighlightSearches\libplds4.dll, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, C:\Program Files (x86)\HighlightSearches\list.txt, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, C:\Program Files (x86)\HighlightSearches\njs.exe, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, C:\Program Files (x86)\HighlightSearches\nss3.dll, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, C:\Program Files (x86)\HighlightSearches\nssckbi.dll, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, C:\Program Files (x86)\HighlightSearches\nssdbm3.dll, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, C:\Program Files (x86)\HighlightSearches\nssutil3.dll, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, C:\Program Files (x86)\HighlightSearches\slite.exe, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, C:\Program Files (x86)\HighlightSearches\smime3.dll, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, C:\Program Files (x86)\HighlightSearches\softokn3.dll, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, C:\Program Files (x86)\HighlightSearches\sqlite3.dll, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, C:\Program Files (x86)\HighlightSearches\ssl3.dll, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, C:\Program Files (x86)\HighlightSearches\term.txt, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.HighlightSearches.A, C:\Program Files (x86)\HighlightSearches\uninstall.exe, In Quarantäne, [a31f1f4a91f980b6a638b20556ad02fe],
PUP.Optional.VCL.A, C:\Users\Tiedt\AppData\Local\Temp\VCLr.log, In Quarantäne, [a31f30391872fc3a4b6fe5d411f2be42],
PUP.Optional.WebTInst.A, C:\Windows\System32\drivers\Msft_Kernel_webTinstMKTN_01009.Wdf, In Quarantäne, [9f2375f4b5d5f73fa1c5fac67c87956b],
PUP.Optional.ShopperPro.A, C:\Windows\System32\Tasks\SPBIW_UpdateTask_Time_323539353732313531312d5b5b4a346c4123452a5a556c, In Quarantäne, [269cb0b9dab044f2a1f18a3a996a22de],
PUP.Optional.ABEngine.A, C:\Users\Tiedt\AppData\Local\Temp\abengine.log, In Quarantäne, [b30fd19899f1ae883f1baf165da6b34d],
PUP.Optional.ABEngine.A, C:\Windows\Temp\abengine.log, In Quarantäne, [dde54e1b2d5db97d94c69e27e320ae52],
PUP.Optional.BoostSaves.A, C:\Users\Tiedt\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_static.boostsaves.com_0.localstorage, In Quarantäne, [952deb7ebfcb3600e481eddf08fb7789],
PUP.Optional.BoostSaves.A, C:\Users\Tiedt\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_static.boostsaves.com_0.localstorage-journal, In Quarantäne, [11b1db8ed0ba132382e37656ac5707f9],
PUP.Optional.BlockAndSurf.A, C:\Windows\System32\Tasks\BlockAndSurf Update, In Quarantäne, [685aa7c296f4d85eec60a446fe0514ec],
PUP.Optional.ShoppingGate.A, C:\Users\Tiedt\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_inst.shoppingate.info_0.localstorage, In Quarantäne, [d2f091d89af02c0a24fdee055ba8f907],
PUP.Optional.ShoppingGate.A, C:\Users\Tiedt\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_inst.shoppingate.info_0.localstorage-journal, In Quarantäne, [744e432698f24aec51d0d71caa595da3],
PUP.Optional.BlockAndSurf.A, C:\Windows\Tasks\BlockAndSurf Update.job, In Quarantäne, [ab176900acde5ed8615203f9c2418779],
PUP.Optional.Vitruvian.A, C:\Users\Tiedt\AppData\Local\Temp\vitruvian-installer-hardwareprofile-v0001, In Quarantäne, [d2f01554f2987eb827e477d128dd0bf5],
PUP.Optional.Vitruvian.A, C:\Users\Tiedt\AppData\Local\Temp\vitruvian-installer-install-v0003, In Quarantäne, [853dda8f395125117398f55385803dc3],
PUP.Optional.Vitruvian.A, C:\Users\Tiedt\AppData\Local\Temp\vitruvian-installer-processes-v0002, In Quarantäne, [7a485b0e0189181e6aa18bbd40c5768a],
PUP.Optional.Vitruvian.A, C:\Users\Tiedt\AppData\Local\Temp\vitruvian-installer-scheduledtasks-v0001, In Quarantäne, [d1f14326365457dfde2dc3856c99fc04],
PUP.Optional.Vitruvian.A, C:\Users\Tiedt\AppData\Local\Temp\vitruvian-installer-softwareregkeys-v0002, In Quarantäne, [e3dfdd8cf2989e9843c887c18d78f50b],
PUP.Optional.MyPCBackUp.A, C:\Program Files (x86)\MyPcBackup\unins000.dat, In Quarantäne, [a41e3c2d3a5083b3ab37d77528ddb749],
PUP.Optional.MyPCBackUp.A, C:\Program Files (x86)\MyPcBackup\unins000.exe, In Quarantäne, [a41e3c2d3a5083b3ab37d77528ddb749],
PUP.Optional.MultiPlug.A, C:\ProgramData\njacolbmlcidaijbbblocplginaodmak\lsdb.js, In Quarantäne, [c8fa37327c0efb3b48ba3f0f2cd92cd4],
PUP.Optional.MultiPlug.A, C:\ProgramData\njacolbmlcidaijbbblocplginaodmak\background.html, In Quarantäne, [c8fa37327c0efb3b48ba3f0f2cd92cd4],
PUP.Optional.MultiPlug.A, C:\ProgramData\njacolbmlcidaijbbblocplginaodmak\content.js, In Quarantäne, [c8fa37327c0efb3b48ba3f0f2cd92cd4],
PUP.Optional.MultiPlug.A, C:\ProgramData\njacolbmlcidaijbbblocplginaodmak\manifest.json, In Quarantäne, [c8fa37327c0efb3b48ba3f0f2cd92cd4],
PUP.Optional.MultiPlug.A, C:\ProgramData\njacolbmlcidaijbbblocplginaodmak\wOmeIe7VJa.js, In Quarantäne, [c8fa37327c0efb3b48ba3f0f2cd92cd4],
PUP.Optional.ReMarkable.A, C:\Users\Tiedt\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_static.re-markable00.re-markable.net_0.localstorage, In Quarantäne, [457d0465701aff376740c985dc2917e9],
PUP.Optional.ReMarkable.A, C:\Users\Tiedt\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_static.re-markable00.re-markable.net_0.localstorage-journal, In Quarantäne, [eed41653791180b68324e5691ee76d93],
PUP.Optional.GlobalUpdate.A, C:\Users\Tiedt\AppData\Local\Temp\comh.325031\GoogleCrashHandler.exe, In Quarantäne, [03bf46235139d264a9cfff9a23e028d8],
PUP.Optional.GlobalUpdate.A, C:\Users\Tiedt\AppData\Local\Temp\comh.325031\GoogleUpdate.exe, In Quarantäne, [03bf46235139d264a9cfff9a23e028d8],
PUP.Optional.GlobalUpdate.A, C:\Users\Tiedt\AppData\Local\Temp\comh.325031\GoogleUpdateBroker.exe, In Quarantäne, [03bf46235139d264a9cfff9a23e028d8],
PUP.Optional.GlobalUpdate.A, C:\Users\Tiedt\AppData\Local\Temp\comh.325031\GoogleUpdateHelper.msi, In Quarantäne, [03bf46235139d264a9cfff9a23e028d8],
PUP.Optional.GlobalUpdate.A, C:\Users\Tiedt\AppData\Local\Temp\comh.325031\GoogleUpdateOnDemand.exe, In Quarantäne, [03bf46235139d264a9cfff9a23e028d8],
PUP.Optional.GlobalUpdate.A, C:\Users\Tiedt\AppData\Local\Temp\comh.325031\goopdate.dll, In Quarantäne, [03bf46235139d264a9cfff9a23e028d8],
PUP.Optional.GlobalUpdate.A, C:\Users\Tiedt\AppData\Local\Temp\comh.325031\goopdateres_en.dll, In Quarantäne, [03bf46235139d264a9cfff9a23e028d8],
PUP.Optional.GlobalUpdate.A, C:\Users\Tiedt\AppData\Local\Temp\comh.325031\npGoogleUpdate4.dll, In Quarantäne, [03bf46235139d264a9cfff9a23e028d8],
PUP.Optional.GlobalUpdate.A, C:\Users\Tiedt\AppData\Local\Temp\comh.325031\psmachine.dll, In Quarantäne, [03bf46235139d264a9cfff9a23e028d8],
PUP.Optional.GlobalUpdate.A, C:\Users\Tiedt\AppData\Local\Temp\comh.325031\psuser.dll, In Quarantäne, [03bf46235139d264a9cfff9a23e028d8],
PUP.Optional.GlobalUpdate.A, C:\Users\Tiedt\AppData\Local\Temp\comh.439983\GoogleCrashHandler.exe, In Quarantäne, [457d4029b9d1a98d2355c9d058ab758b],
PUP.Optional.GlobalUpdate.A, C:\Users\Tiedt\AppData\Local\Temp\comh.439983\GoogleUpdate.exe, In Quarantäne, [457d4029b9d1a98d2355c9d058ab758b],
PUP.Optional.GlobalUpdate.A, C:\Users\Tiedt\AppData\Local\Temp\comh.439983\GoogleUpdateBroker.exe, In Quarantäne, [457d4029b9d1a98d2355c9d058ab758b],
PUP.Optional.GlobalUpdate.A, C:\Users\Tiedt\AppData\Local\Temp\comh.439983\GoogleUpdateHelper.msi, In Quarantäne, [457d4029b9d1a98d2355c9d058ab758b],
PUP.Optional.GlobalUpdate.A, C:\Users\Tiedt\AppData\Local\Temp\comh.439983\GoogleUpdateOnDemand.exe, In Quarantäne, [457d4029b9d1a98d2355c9d058ab758b],
PUP.Optional.GlobalUpdate.A, C:\Users\Tiedt\AppData\Local\Temp\comh.439983\goopdate.dll, In Quarantäne, [457d4029b9d1a98d2355c9d058ab758b],
PUP.Optional.GlobalUpdate.A, C:\Users\Tiedt\AppData\Local\Temp\comh.439983\goopdateres_en.dll, In Quarantäne, [457d4029b9d1a98d2355c9d058ab758b],
PUP.Optional.GlobalUpdate.A, C:\Users\Tiedt\AppData\Local\Temp\comh.439983\npGoogleUpdate4.dll, In Quarantäne, [457d4029b9d1a98d2355c9d058ab758b],
PUP.Optional.GlobalUpdate.A, C:\Users\Tiedt\AppData\Local\Temp\comh.439983\psmachine.dll, In Quarantäne, [457d4029b9d1a98d2355c9d058ab758b],
PUP.Optional.GlobalUpdate.A, C:\Users\Tiedt\AppData\Local\Temp\comh.439983\psuser.dll, In Quarantäne, [457d4029b9d1a98d2355c9d058ab758b],
PUP.Optional.GlobalUpdate.A, C:\Users\Tiedt\AppData\Local\Temp\comh.477157\GoogleCrashHandler.exe, In Quarantäne, [af130a5f721841f593e57326c63d21df],
PUP.Optional.GlobalUpdate.A, C:\Users\Tiedt\AppData\Local\Temp\comh.477157\GoogleUpdate.exe, In Quarantäne, [af130a5f721841f593e57326c63d21df],
PUP.Optional.GlobalUpdate.A, C:\Users\Tiedt\AppData\Local\Temp\comh.477157\GoogleUpdateBroker.exe, In Quarantäne, [af130a5f721841f593e57326c63d21df],
PUP.Optional.GlobalUpdate.A, C:\Users\Tiedt\AppData\Local\Temp\comh.477157\GoogleUpdateHelper.msi, In Quarantäne, [af130a5f721841f593e57326c63d21df],
PUP.Optional.GlobalUpdate.A, C:\Users\Tiedt\AppData\Local\Temp\comh.477157\GoogleUpdateOnDemand.exe, In Quarantäne, [af130a5f721841f593e57326c63d21df],
PUP.Optional.GlobalUpdate.A, C:\Users\Tiedt\AppData\Local\Temp\comh.477157\goopdate.dll, In Quarantäne, [af130a5f721841f593e57326c63d21df],
PUP.Optional.GlobalUpdate.A, C:\Users\Tiedt\AppData\Local\Temp\comh.477157\goopdateres_en.dll, In Quarantäne, [af130a5f721841f593e57326c63d21df],
PUP.Optional.GlobalUpdate.A, C:\Users\Tiedt\AppData\Local\Temp\comh.477157\npGoogleUpdate4.dll, In Quarantäne, [af130a5f721841f593e57326c63d21df],
PUP.Optional.GlobalUpdate.A, C:\Users\Tiedt\AppData\Local\Temp\comh.477157\psmachine.dll, In Quarantäne, [af130a5f721841f593e57326c63d21df],
PUP.Optional.GlobalUpdate.A, C:\Users\Tiedt\AppData\Local\Temp\comh.477157\psuser.dll, In Quarantäne, [af130a5f721841f593e57326c63d21df],
PUP.Optional.ShopperPro, C:\Program Files\Common Files\ShopperPro\spbia.exe, In Quarantäne, [5c66f079fb8ff0460b98d3cb6c97d42c],
PUP.Optional.ShopperPro, C:\Program Files\Common Files\ShopperPro\spbiw.sys, In Quarantäne, [5c66f079fb8ff0460b98d3cb6c97d42c],
PUP.Optional.ShopperPro.A, C:\Users\Public\Documents\ShopperPro\JsDriver\Config.xml, In Quarantäne, [41810a5f7b0fd36382fb8e288d768e72],
PUP.Optional.Infonaut.A, C:\Program Files (x86)\Infonaut_1.10.0.13\terms-of-service.rtf, In Quarantäne, [01c15217880295a1c85fd4e324dfb54b],
PUP.Optional.Infonaut.A, C:\Program Files (x86)\Infonaut_1.10.0.13\3rd Party Licenses\buildcrx-license.txt, In Quarantäne, [01c15217880295a1c85fd4e324dfb54b],
PUP.Optional.Infonaut.A, C:\Program Files (x86)\Infonaut_1.10.0.13\3rd Party Licenses\Info-ZIP-license.txt, In Quarantäne, [01c15217880295a1c85fd4e324dfb54b],
PUP.Optional.Infonaut.A, C:\Program Files (x86)\Infonaut_1.10.0.13\3rd Party Licenses\JSON-simple-license.txt, In Quarantäne, [01c15217880295a1c85fd4e324dfb54b],
PUP.Optional.Infonaut.A, C:\Program Files (x86)\Infonaut_1.10.0.13\3rd Party Licenses\nsJSON-license.txt, In Quarantäne, [01c15217880295a1c85fd4e324dfb54b],
PUP.Optional.Infonaut.A, C:\Program Files (x86)\Infonaut_1.10.0.13\3rd Party Licenses\Nustache-license.txt, In Quarantäne, [01c15217880295a1c85fd4e324dfb54b],
PUP.Optional.Infonaut.A, C:\Program Files (x86)\Infonaut_1.10.0.13\3rd Party Licenses\TaskScheduler-license.txt, In Quarantäne, [01c15217880295a1c85fd4e324dfb54b],
PUP.Optional.Infonaut.A, C:\Program Files (x86)\Infonaut_1.10.0.13\3rd Party Licenses\UAC-license.txt, In Quarantäne, [01c15217880295a1c85fd4e324dfb54b],

Physische Sektoren: 0
(Keine schädliche Elemente gefunden)


(end)
und JRT

Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.5.3 (04.07.2015:1)
OS: Windows 7 Home Premium x64
Ran by Tiedt on 07.04.2015 at 23:08:13,64
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}



~~~ Files

Successfully deleted: [File] "C:\Users\Tiedt\appdata\local\google\chrome\user data\default\local storage\http_www.superfish.com_0.localstorage"
Successfully deleted: [File] "C:\Users\Tiedt\appdata\local\google\chrome\user data\default\local storage\http_www.superfish.com_0.localstorage-journal"



~~~ Folders

Successfully deleted: [Empty Folder] C:\Users\Tiedt\appdata\local\{96A101A1-5E9D-4BD2-85C8-24DCD95DAC82}
Successfully deleted: [Empty Folder] C:\Users\Tiedt\appdata\local\{A2076A2E-3A75-4DC6-A1C5-6F2EF8A8F0C9}
Successfully deleted: [Empty Folder] C:\Users\Tiedt\appdata\local\{EF4C680A-3005-4C61-9AD5-45DEBF44AC39}



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 07.04.2015 at 23:10:44,32
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


ich glaube wir haben hier gar kein richtiges Virenprogramm habe nur McAfee Security Scan Pro gefunden und glaube das ist zu wenig, haben sie eine günstige Allternative ?

nine53 07.04.2015 22:31
dann FRST

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015
Ran by Tiedt (administrator) on TIEDT-HP on 07-04-2015 23:12:44
Running from C:\Users\Tiedt\Downloads
Loaded Profiles: Tiedt (Available profiles: Tiedt)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Calendar\Service\HPTouchSmartSyncCalReminderApp.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1425408 2012-03-30] (IDT, Inc.)
HKLM\...\Run: [BeatsOSDApp] => C:\Program Files\IDT\WDM\beats64.exe [37888 2012-03-30] (Hewlett-Packard )
HKLM\...\Run: [HPSYSDRV] => C:\Program Files (x86)\Hewlett-Packard\HP Odometer\HPSYSDRV.EXE [62768 2008-11-20] (Hewlett-Packard)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1332296 2015-01-30] (Microsoft Corporation)
HKLM-x32\...\Run: [Norton Online Backup] => C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [1155928 2010-06-02] (Symantec Corporation)
HKLM-x32\...\Run: [Easybits Recovery] => C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe [61112 2012-02-21] (EasyBits Software AS)
HKLM-x32\...\Run: [PDF Complete] => C:\Program Files (x86)\PDF Complete\pdfsty.exe [684024 2012-04-04] (PDF Complete Inc)
HKLM-x32\...\Run: [AVMWlanClient] => C:\Program Files (x86)\avmwlanstick\wlangui.exe [2105344 2010-10-22] (AVM Berlin)
HKLM-x32\...\Run: [LogitechQuickCamRibbon] => C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe [2793304 2009-10-14] ()
HKLM-x32\...\Run: [RemoteControl] => C:\Program Files (x86)\CyberLink\PowerDVD\PDVDServ.exe [32768 2004-11-02] (Cyberlink Corp.)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKU\S-1-5-21-2149968534-1042019459-1302014499-1000\...\Run: [HP Deskjet 3520 series (NET)] => C:\Program Files\HP\HP Deskjet 3520 series\Bin\ScanToPCActivationApp.exe [2551656 2012-01-31] (Hewlett-Packard Co.)
HKU\S-1-5-21-2149968534-1042019459-1302014499-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [31087200 2015-01-23] (Skype Technologies S.A.)
HKU\S-1-5-21-2149968534-1042019459-1302014499-1000\...\Run: [GoogleChromeAutoLaunch_2C142DA54B54EC24056B4AF2F6E94CF1] => "C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\crossbrowse.exe" --no-startup-window
HKU\S-1-5-21-2149968534-1042019459-1302014499-1000\...\Policies\system: [DisableLockWorkstation] 0
HKU\S-1-5-21-2149968534-1042019459-1302014499-1000\...\Policies\system: [DisableChangePassword] 0
HKU\S-1-5-21-2149968534-1042019459-1302014499-1000\...\MountPoints2: {21f4f905-0e3e-11e2-bb6f-ac162d091884} - G:\pushinst.exe
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
Startup: C:\Users\Tiedt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Priceless_310315.lnk
ShortcutTarget: Priceless_310315.lnk -> C:\ProgramData\{3bef08e0-4997-b04c-3bef-f08e04992381}\Priceless_310315.exe (No File)
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
SearchScopes: HKLM -> {4709F2DE-3A4E-4C6E-BA0B-538370E51EF0} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de1-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-2/4?mpre=hxxp://www.ebay.de/sch/i.html?_nkw={searchTerms}
SearchScopes: HKLM-x32 -> {4709F2DE-3A4E-4C6E-BA0B-538370E51EF0} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de1-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-2/4?mpre=hxxp://www.ebay.de/sch/i.html?_nkw={searchTerms}
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-29] (Microsoft Corp.)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-03-07] (Google Inc.)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2014-07-14] (Microsoft Corporation)
BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll [2014-04-09] (McAfee, Inc.)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-29] (Microsoft Corp.)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-03-07] (Google Inc.)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2014-07-14] (Microsoft Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-03-07] (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-03-07] (Google Inc.)
Toolbar: HKU\S-1-5-21-2149968534-1042019459-1302014499-1000 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2014-07-14] (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2014-07-14] (Microsoft Corporation)
ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll [52920 2012-07-06] (EasyBits Software Corp.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Tiedt\AppData\Roaming\Mozilla\Firefox\Profiles\snq3xiqr.default
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2011-05-14] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2011-05-14] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-07] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-07] (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll [2011-09-28] ()
FF HKLM-x32\...\Firefox\Extensions: [quickprint@hp.com] - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\QPExtension
FF Extension: HP Smart Print - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\QPExtension [2012-12-26]
FF HKU\S-1-5-21-2149968534-1042019459-1302014499-1000\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: McAfee Security Scan Plus - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]
FF Extension: No Name - C:\Users\Tiedt\AppData\Roaming\Mozilla\Firefox\Profiles\snq3xiqr.default\extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF} [Not Found]

Chrome:
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR HomePage: Default ->
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.118\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.118\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.118\pdf.dll ()
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File
CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
CHR Plugin: (Windows Live™ Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll No File
CHR Profile: C:\Users\Tiedt\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (YouTube) - C:\Users\Tiedt\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-04-21]
CHR Extension: (Google Search) - C:\Users\Tiedt\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-04-21]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Tiedt\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-13]
CHR Extension: (Skype Click to Call) - C:\Users\Tiedt\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2014-04-17]
CHR Extension: (Google Wallet) - C:\Users\Tiedt\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-11-21]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 AVM WLAN Connection Service; C:\Program Files (x86)\avmwlanstick\WlanNetService.exe [376832 2010-10-22] (AVM Berlin) [File not signed]
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
S2 CalendarSynchService; C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Calendar\Service\GCalService.exe [16384 2011-08-16] (Hewlett-Packard) [File not signed]
R2 ezSharedSvc; C:\windows\SysWOW64\ezSharedSvcHost.exe [514232 2010-04-23] (EasyBits Software AS) [File not signed]
S2 HPAuto; C:\Program Files\Hewlett-Packard\HP Auto\HPAuto.exe [682040 2011-02-17] (Hewlett-Packard)
S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2015-03-17] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1080120 2015-03-17] (Malwarebytes Corporation)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2015-01-30] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [366512 2015-01-30] (Microsoft Corporation)
S2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-02] (Symantec Corporation)
S2 pdfcDispatcher; C:\Program Files (x86)\PDF Complete\pdfsvc.exe [1134584 2012-04-04] (PDF Complete Inc)
S2 STacSV; C:\Program Files\IDT\WDM\STacSV64.exe [311296 2012-03-30] (IDT, Inc.) [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 avmeject; C:\Windows\System32\drivers\avmeject.sys [14120 2010-10-25] (AVM Berlin)
R3 fwlanusbn; C:\Windows\System32\DRIVERS\fwlanusbn.sys [714368 2010-10-25] (AVM GmbH)
R3 LVPr2M64; C:\Windows\System32\DRIVERS\LVPr2M64.sys [30232 2009-10-07] ()
S3 LVPr2Mon; C:\Windows\System32\DRIVERS\LVPr2M64.sys [30232 2009-10-07] ()
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25816 2015-03-17] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\windows\system32\drivers\MBAMSwissArmy.sys [136408 2015-04-07] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\windows\system32\drivers\mwac.sys [63704 2015-03-17] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [274696 2014-11-15] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [124560 2014-11-15] (Microsoft Corporation)
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-14] (Microsoft Corporation)
S3 cpuz134; \??\C:\Users\Tiedt\AppData\Local\Temp\cpuz134\cpuz134_x64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-07 23:10 - 2015-04-07 23:10 - 00001393 _____ () C:\Users\Tiedt\Desktop\JRT.txt
2015-04-07 23:08 - 2015-04-07 23:08 - 00000207 _____ () C:\windows\tweaking.com-regbackup-TIEDT-HP-Windows-7-Home-Premium-(64-bit).dat
2015-04-07 23:08 - 2015-04-07 23:08 - 00000000 ____D () C:\RegBackup
2015-04-07 23:07 - 2015-04-07 23:07 - 02686959 _____ (Thisisu) C:\Users\Tiedt\Downloads\JRT.exe
2015-04-07 22:37 - 2015-04-07 23:03 - 00136408 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2015-04-07 22:37 - 2015-04-07 22:37 - 00001108 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-04-07 22:37 - 2015-04-07 22:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-04-07 22:36 - 2015-04-07 22:37 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-04-07 22:36 - 2015-04-07 22:36 - 21540440 _____ (Malwarebytes Corporation ) C:\Users\Tiedt\Downloads\mbam-setup-2.1.4.1018.exe
2015-04-07 22:36 - 2015-04-07 22:36 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-04-07 22:36 - 2015-03-17 06:15 - 00107736 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2015-04-07 22:36 - 2015-03-17 06:15 - 00063704 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2015-04-07 22:36 - 2015-03-17 06:15 - 00025816 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2015-04-07 22:34 - 2015-04-07 22:34 - 00034650 _____ () C:\Users\Tiedt\Desktop\AdwCleaner[S0].txt
2015-04-07 22:29 - 2015-04-07 22:31 - 00000000 ____D () C:\AdwCleaner
2015-04-07 22:28 - 2015-04-07 22:28 - 02208768 _____ () C:\Users\Tiedt\Downloads\AdwCleaner_4.200.exe
2015-04-07 22:23 - 2015-04-07 22:23 - 00000501 _____ () C:\Users\Tiedt\Downloads\editor.txt
2015-04-07 21:09 - 2015-04-07 21:09 - 00171794 _____ () C:\Users\Tiedt\Desktop\gmer.log
2015-04-07 20:56 - 2015-04-07 22:26 - 00083675 _____ () C:\Users\Tiedt\Desktop\FRST.txt
2015-04-07 20:55 - 2015-04-07 20:55 - 00053044 _____ () C:\Users\Tiedt\Desktop\Addition.txt
2015-04-07 20:53 - 2015-04-07 20:53 - 00380416 _____ () C:\Users\Tiedt\Downloads\Gmer-19357.exe
2015-04-07 20:45 - 2015-04-07 20:46 - 00053044 _____ () C:\Users\Tiedt\Downloads\Addition.txt
2015-04-07 20:41 - 2015-04-07 23:13 - 00017350 _____ () C:\Users\Tiedt\Downloads\FRST.txt
2015-04-07 20:40 - 2015-04-07 23:12 - 00000000 ____D () C:\FRST
2015-04-07 20:39 - 2015-04-07 20:39 - 02095616 _____ (Farbar) C:\Users\Tiedt\Downloads\FRST64.exe
2015-04-07 20:29 - 2015-04-07 20:29 - 00001165 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-04-07 20:29 - 2015-04-07 20:29 - 00001153 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-04-07 20:29 - 2015-04-07 20:29 - 00000000 ____D () C:\Users\Tiedt\AppData\Roaming\Mozilla
2015-04-07 20:29 - 2015-04-07 20:29 - 00000000 ____D () C:\Users\Tiedt\AppData\Local\Mozilla
2015-04-07 20:29 - 2015-04-07 20:29 - 00000000 ____D () C:\ProgramData\Mozilla
2015-04-07 20:29 - 2015-04-07 20:29 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-04-07 20:29 - 2015-04-07 20:29 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-04-07 20:27 - 2015-04-07 20:27 - 00243656 _____ () C:\Users\Tiedt\Downloads\Firefox Setup Stub 37.0.1.exe
2015-04-07 20:04 - 2015-04-07 21:16 - 00000004 _____ () C:\windows\SysWOW64\029B560A371F4E00AB32838EBC01B9E7
2015-04-07 19:58 - 2015-04-07 19:58 - 00613255 _____ (CMI Limited) C:\Users\Tiedt\AppData\Local\nsh1D35.tmp
2015-04-07 19:51 - 2015-04-07 19:51 - 00764736 _____ (Reimage®) C:\Users\Tiedt\Downloads\ReimageRepair.exe
2015-04-07 19:31 - 2015-04-07 23:03 - 00001334 _____ () C:\windows\Tasks\SXZQ.job
2015-04-07 19:31 - 2015-04-07 22:58 - 00000000 ____D () C:\Program Files (x86)\9cb3e9f1-8ae7-4112-a04b-7199a616d34b
2015-04-07 19:31 - 2015-04-07 19:31 - 00004360 _____ () C:\windows\System32\Tasks\SXZQ
2015-04-07 19:22 - 2015-04-07 22:58 - 00000000 ____D () C:\Program Files (x86)\imalicmf
2015-04-07 19:22 - 2015-04-07 19:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\imalicmf
2015-04-07 19:21 - 2015-04-07 19:21 - 00000000 ____D () C:\ProgramData\5666253508951638902
2015-04-07 19:20 - 2015-04-07 22:58 - 00000000 ____D () C:\ProgramData\{3bef08e0-4997-b04c-3bef-f08e04992381}
2015-04-07 19:20 - 2015-04-07 19:20 - 00000000 ____D () C:\Users\Tiedt\AppData\Local\0406D9B4-1428434453-72AF-8C7F-B36FDEF67BEF
2015-04-07 19:16 - 2015-04-07 23:03 - 00001336 _____ () C:\windows\Tasks\XDKWM.job
2015-04-07 19:16 - 2015-04-07 22:58 - 00000000 ____D () C:\Program Files (x86)\691f0be1-5255-412a-8083-cbfcdb6532b4
2015-04-07 19:16 - 2015-04-07 22:58 - 00000000 ____D () C:\Program Files (x86)\5eb99ca5-046a-49ee-9304-c67a0fd45030
2015-04-07 19:16 - 2015-04-07 19:17 - 00004362 _____ () C:\windows\System32\Tasks\XDKWM
2015-04-07 19:14 - 2015-04-07 22:58 - 00000000 ____D () C:\ProgramData\3a8c9699124a4506a71d46fb652dc7b1
2015-04-07 19:14 - 2015-04-07 19:14 - 00003558 _____ () C:\windows\System32\Tasks\TKKMJ
2015-04-07 19:14 - 2015-04-07 19:14 - 00000000 ____D () C:\Users\Tiedt\AppData\Local\CrashRpt
2015-04-07 19:13 - 2015-04-07 19:13 - 00003090 _____ () C:\windows\System32\Tasks\fres3005
2015-04-07 19:13 - 2015-04-07 19:13 - 00000000 ____D () C:\Users\Tiedt\AppData\Roaming\lection
2015-04-07 19:13 - 2015-04-07 19:13 - 00000000 ____D () C:\ProgramData\36ebbb131f884f3aa5b926d4db990ab9
2015-04-07 19:09 - 2015-04-07 19:09 - 00001233 _____ () C:\Users\Tiedt\Desktop\Continue installation .lnk
2015-04-04 15:10 - 2015-04-04 15:10 - 00000000 ___SD () C:\windows\SysWOW64\GWX
2015-04-04 15:10 - 2015-04-04 15:10 - 00000000 ___SD () C:\windows\system32\GWX
2015-03-26 21:14 - 2015-03-26 21:14 - 00005542 _____ () C:\Users\Tiedt\AppData\Roaming\XDKWM
2015-03-26 21:14 - 2015-03-26 21:14 - 00005542 _____ () C:\Users\Tiedt\AppData\Roaming\SXZQ
2015-03-24 21:28 - 2015-03-11 06:06 - 00943616 _____ (Microsoft Corporation) C:\windows\system32\appraiser.dll
2015-03-24 21:28 - 2015-03-11 06:06 - 00760832 _____ (Microsoft Corporation) C:\windows\system32\invagent.dll
2015-03-24 21:28 - 2015-03-11 06:06 - 00677888 _____ (Microsoft Corporation) C:\windows\system32\generaltel.dll
2015-03-24 21:28 - 2015-03-11 06:06 - 00414720 _____ (Microsoft Corporation) C:\windows\system32\devinv.dll
2015-03-24 21:28 - 2015-03-11 06:05 - 00227328 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2015-03-24 21:28 - 2015-03-11 06:05 - 00192000 _____ (Microsoft Corporation) C:\windows\system32\aepic.dll
2015-03-24 21:28 - 2015-03-11 06:05 - 00030720 _____ (Microsoft Corporation) C:\windows\system32\acmigration.dll
2015-03-24 21:28 - 2015-03-11 06:02 - 01107456 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2015-03-10 19:48 - 2015-02-20 06:41 - 00041984 _____ (Microsoft Corporation) C:\windows\system32\lpk.dll
2015-03-10 19:48 - 2015-02-20 06:40 - 00100864 _____ (Microsoft Corporation) C:\windows\system32\fontsub.dll
2015-03-10 19:48 - 2015-02-20 06:40 - 00046080 _____ (Adobe Systems) C:\windows\system32\atmlib.dll
2015-03-10 19:48 - 2015-02-20 06:40 - 00014336 _____ (Microsoft Corporation) C:\windows\system32\dciman32.dll
2015-03-10 19:48 - 2015-02-20 06:13 - 00070656 _____ (Microsoft Corporation) C:\windows\SysWOW64\fontsub.dll
2015-03-10 19:48 - 2015-02-20 06:13 - 00034304 _____ (Adobe Systems) C:\windows\SysWOW64\atmlib.dll
2015-03-10 19:48 - 2015-02-20 06:13 - 00010240 _____ (Microsoft Corporation) C:\windows\SysWOW64\dciman32.dll
2015-03-10 19:48 - 2015-02-20 06:12 - 00025600 _____ (Microsoft Corporation) C:\windows\SysWOW64\lpk.dll
2015-03-10 19:48 - 2015-02-20 05:29 - 00372224 _____ (Adobe Systems Incorporated) C:\windows\system32\atmfd.dll
2015-03-10 19:48 - 2015-02-20 05:09 - 00299008 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\atmfd.dll
2015-03-10 19:48 - 2015-02-03 05:34 - 05554104 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2015-03-10 19:48 - 2015-02-03 05:34 - 00693176 _____ (Microsoft Corporation) C:\windows\system32\winload.efi
2015-03-10 19:48 - 2015-02-03 05:34 - 00094656 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mountmgr.sys
2015-03-10 19:48 - 2015-02-03 05:33 - 00616360 _____ (Microsoft Corporation) C:\windows\system32\winresume.efi
2015-03-10 19:48 - 2015-02-03 05:31 - 14632960 _____ (Microsoft Corporation) C:\windows\system32\wmp.dll
2015-03-10 19:48 - 2015-02-03 05:31 - 04121600 _____ (Microsoft Corporation) C:\windows\system32\mf.dll
2015-03-10 19:48 - 2015-02-03 05:31 - 01574400 _____ (Microsoft Corporation) C:\windows\system32\quartz.dll
2015-03-10 19:48 - 2015-02-03 05:31 - 00782848 _____ (Microsoft Corporation) C:\windows\system32\wmdrmsdk.dll
2015-03-10 19:48 - 2015-02-03 05:31 - 00641024 _____ (Microsoft Corporation) C:\windows\system32\msscp.dll
2015-03-10 19:48 - 2015-02-03 05:31 - 00503808 _____ (Microsoft Corporation) C:\windows\system32\srcore.dll
2015-03-10 19:48 - 2015-02-03 05:31 - 00500224 _____ (Microsoft Corporation) C:\windows\system32\AUDIOKSE.dll
2015-03-10 19:48 - 2015-02-03 05:31 - 00432128 _____ (Microsoft Corporation) C:\windows\system32\mfplat.dll
2015-03-10 19:48 - 2015-02-03 05:31 - 00371712 _____ (Microsoft Corporation) C:\windows\system32\qdvd.dll
2015-03-10 19:48 - 2015-02-03 05:31 - 00325632 _____ (Microsoft Corporation) C:\windows\system32\msnetobj.dll
2015-03-10 19:48 - 2015-02-03 05:31 - 00229376 _____ (Microsoft Corporation) C:\windows\system32\wintrust.dll
2015-03-10 19:48 - 2015-02-03 05:31 - 00206848 _____ (Microsoft Corporation) C:\windows\system32\mfps.dll
2015-03-10 19:48 - 2015-02-03 05:31 - 00188416 _____ (Microsoft Corporation) C:\windows\system32\pcasvc.dll
2015-03-10 19:48 - 2015-02-03 05:31 - 00063488 _____ (Microsoft Corporation) C:\windows\system32\setbcdlocale.dll
2015-03-10 19:48 - 2015-02-03 05:31 - 00050176 _____ (Microsoft Corporation) C:\windows\system32\srclient.dll
2015-03-10 19:48 - 2015-02-03 05:31 - 00037376 _____ (Microsoft Corporation) C:\windows\system32\pcadm.dll
2015-03-10 19:48 - 2015-02-03 05:31 - 00011264 _____ (Microsoft Corporation) C:\windows\system32\msmmsp.dll
2015-03-10 19:48 - 2015-02-03 05:31 - 00009728 _____ (Microsoft Corporation) C:\windows\system32\spwmp.dll
2015-03-10 19:48 - 2015-02-03 05:31 - 00005120 _____ (Microsoft Corporation) C:\windows\system32\msdxm.ocx
2015-03-10 19:48 - 2015-02-03 05:31 - 00005120 _____ (Microsoft Corporation) C:\windows\system32\dxmasf.dll
2015-03-10 19:48 - 2015-02-03 05:30 - 12625920 _____ (Microsoft Corporation) C:\windows\system32\wmploc.DLL
2015-03-10 19:48 - 2015-02-03 05:30 - 01480192 _____ (Microsoft Corporation) C:\windows\system32\crypt32.dll
2015-03-10 19:48 - 2015-02-03 05:30 - 01202176 _____ (Microsoft Corporation) C:\windows\system32\drmv2clt.dll
2015-03-10 19:48 - 2015-02-03 05:30 - 01069056 _____ (Microsoft Corporation) C:\windows\system32\cryptui.dll
2015-03-10 19:48 - 2015-02-03 05:30 - 00842240 _____ (Microsoft Corporation) C:\windows\system32\blackbox.dll
2015-03-10 19:48 - 2015-02-03 05:30 - 00680960 _____ (Microsoft Corporation) C:\windows\system32\audiosrv.dll
2015-03-10 19:48 - 2015-02-03 05:30 - 00631808 _____ (Microsoft Corporation) C:\windows\system32\evr.dll
2015-03-10 19:48 - 2015-02-03 05:30 - 00497664 _____ (Microsoft Corporation) C:\windows\system32\drmmgrtn.dll
2015-03-10 19:48 - 2015-02-03 05:30 - 00440832 _____ (Microsoft Corporation) C:\windows\system32\AudioEng.dll
2015-03-10 19:48 - 2015-02-03 05:30 - 00296960 _____ (Microsoft Corporation) C:\windows\system32\rstrui.exe
2015-03-10 19:48 - 2015-02-03 05:30 - 00296448 _____ (Microsoft Corporation) C:\windows\system32\AudioSes.dll
2015-03-10 19:48 - 2015-02-03 05:30 - 00284672 _____ (Microsoft Corporation) C:\windows\system32\EncDump.dll
2015-03-10 19:48 - 2015-02-03 05:30 - 00187904 _____ (Microsoft Corporation) C:\windows\system32\cryptsvc.dll
2015-03-10 19:48 - 2015-02-03 05:30 - 00146944 _____ (Microsoft Corporation) C:\windows\system32\appidpolicyconverter.exe
2015-03-10 19:48 - 2015-02-03 05:30 - 00140288 _____ (Microsoft Corporation) C:\windows\system32\cryptnet.dll
2015-03-10 19:48 - 2015-02-03 05:30 - 00126464 _____ (Microsoft Corporation) C:\windows\system32\audiodg.exe
2015-03-10 19:48 - 2015-02-03 05:30 - 00112640 _____ (Microsoft Corporation) C:\windows\system32\smss.exe
2015-03-10 19:48 - 2015-02-03 05:30 - 00082432 _____ (Microsoft Corporation) C:\windows\system32\cryptsp.dll
2015-03-10 19:48 - 2015-02-03 05:30 - 00058880 _____ (Microsoft Corporation) C:\windows\system32\appidapi.dll
2015-03-10 19:48 - 2015-02-03 05:30 - 00055808 _____ (Microsoft Corporation) C:\windows\system32\rrinstaller.exe
2015-03-10 19:48 - 2015-02-03 05:30 - 00043520 _____ (Microsoft Corporation) C:\windows\system32\csrsrv.dll
2015-03-10 19:48 - 2015-02-03 05:30 - 00032256 _____ (Microsoft Corporation) C:\windows\system32\appidsvc.dll
2015-03-10 19:48 - 2015-02-03 05:30 - 00024576 _____ (Microsoft Corporation) C:\windows\system32\mfpmp.exe
2015-03-10 19:48 - 2015-02-03 05:30 - 00017920 _____ (Microsoft Corporation) C:\windows\system32\appidcertstorecheck.exe
2015-03-10 19:48 - 2015-02-03 05:30 - 00011264 _____ (Microsoft Corporation) C:\windows\system32\pcawrk.exe
2015-03-10 19:48 - 2015-02-03 05:30 - 00009728 _____ (Microsoft Corporation) C:\windows\system32\pcalua.exe
2015-03-10 19:48 - 2015-02-03 05:29 - 00008704 _____ (Microsoft Corporation) C:\windows\system32\pcaevts.dll
2015-03-10 19:48 - 2015-02-03 05:28 - 00006656 _____ (Microsoft Corporation) C:\windows\system32\apisetschema.dll
2015-03-10 19:48 - 2015-02-03 05:28 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\mferror.dll
2015-03-10 19:48 - 2015-02-03 05:19 - 00663552 _____ (Microsoft Corporation) C:\windows\system32\Drivers\PEAuth.sys
2015-03-10 19:48 - 2015-02-03 05:16 - 03973048 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe
2015-03-10 19:48 - 2015-02-03 05:16 - 03917760 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe
2015-03-10 19:48 - 2015-02-03 05:12 - 11411968 _____ (Microsoft Corporation) C:\windows\SysWOW64\wmp.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 03209728 _____ (Microsoft Corporation) C:\windows\SysWOW64\mf.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 01329664 _____ (Microsoft Corporation) C:\windows\SysWOW64\quartz.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 01174528 _____ (Microsoft Corporation) C:\windows\SysWOW64\crypt32.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 01005056 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptui.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 00988160 _____ (Microsoft Corporation) C:\windows\SysWOW64\drmv2clt.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 00744960 _____ (Microsoft Corporation) C:\windows\SysWOW64\blackbox.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 00617984 _____ (Microsoft Corporation) C:\windows\SysWOW64\wmdrmsdk.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 00519680 _____ (Microsoft Corporation) C:\windows\SysWOW64\qdvd.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 00504320 _____ (Microsoft Corporation) C:\windows\SysWOW64\msscp.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 00489984 _____ (Microsoft Corporation) C:\windows\SysWOW64\evr.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 00442880 _____ (Microsoft Corporation) C:\windows\SysWOW64\AUDIOKSE.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 00406016 _____ (Microsoft Corporation) C:\windows\SysWOW64\drmmgrtn.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 00374784 _____ (Microsoft Corporation) C:\windows\SysWOW64\AudioEng.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 00354816 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfplat.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 00265216 _____ (Microsoft Corporation) C:\windows\SysWOW64\msnetobj.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 00195584 _____ (Microsoft Corporation) C:\windows\SysWOW64\AudioSes.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 00179200 _____ (Microsoft Corporation) C:\windows\SysWOW64\wintrust.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 00143872 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptsvc.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 00103936 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptnet.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 00103424 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfps.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 00081408 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptsp.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 00050688 _____ (Microsoft Corporation) C:\windows\SysWOW64\appidapi.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\srclient.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 00008192 _____ (Microsoft Corporation) C:\windows\SysWOW64\spwmp.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 00004096 _____ (Microsoft Corporation) C:\windows\SysWOW64\msdxm.ocx
2015-03-10 19:48 - 2015-02-03 05:12 - 00004096 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxmasf.dll
2015-03-10 19:48 - 2015-02-03 05:11 - 12625408 _____ (Microsoft Corporation) C:\windows\SysWOW64\wmploc.DLL
2015-03-10 19:48 - 2015-02-03 05:11 - 00050176 _____ (Microsoft Corporation) C:\windows\SysWOW64\rrinstaller.exe
2015-03-10 19:48 - 2015-02-03 05:11 - 00023040 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfpmp.exe
2015-03-10 19:48 - 2015-02-03 05:09 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\mferror.dll
2015-03-10 19:48 - 2015-02-03 05:08 - 00006656 _____ (Microsoft Corporation) C:\windows\SysWOW64\apisetschema.dll
2015-03-10 19:48 - 2015-02-03 04:32 - 00061440 _____ (Microsoft Corporation) C:\windows\system32\Drivers\appid.sys
2015-03-10 19:48 - 2014-11-01 00:24 - 00619056 _____ (Microsoft Corporation) C:\windows\system32\winload.exe
2015-03-10 19:48 - 2014-06-28 02:21 - 00532176 _____ (Microsoft Corporation) C:\windows\system32\winresume.exe
2015-03-10 19:48 - 2014-06-28 02:21 - 00457400 _____ (Microsoft Corporation) C:\windows\system32\ci.dll
2015-03-10 19:47 - 2015-03-06 07:56 - 00155576 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys
2015-03-10 19:47 - 2015-03-06 07:56 - 00095680 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecdd.sys
2015-03-10 19:47 - 2015-03-06 07:42 - 01461760 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll
2015-03-10 19:47 - 2015-03-06 07:42 - 00728064 _____ (Microsoft Corporation) C:\windows\system32\kerberos.dll
2015-03-10 19:47 - 2015-03-06 07:42 - 00341504 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll
2015-03-10 19:47 - 2015-03-06 07:42 - 00314880 _____ (Microsoft Corporation) C:\windows\system32\msv1_0.dll
2015-03-10 19:47 - 2015-03-06 07:42 - 00309760 _____ (Microsoft Corporation) C:\windows\system32\ncrypt.dll
2015-03-10 19:47 - 2015-03-06 07:42 - 00210944 _____ (Microsoft Corporation) C:\windows\system32\wdigest.dll
2015-03-10 19:47 - 2015-03-06 07:42 - 00136192 _____ (Microsoft Corporation) C:\windows\system32\sspicli.dll
2015-03-10 19:47 - 2015-03-06 07:42 - 00086528 _____ (Microsoft Corporation) C:\windows\system32\TSpkg.dll
2015-03-10 19:47 - 2015-03-06 07:42 - 00029184 _____ (Microsoft Corporation) C:\windows\system32\sspisrv.dll
2015-03-10 19:47 - 2015-03-06 07:42 - 00028160 _____ (Microsoft Corporation) C:\windows\system32\secur32.dll
2015-03-10 19:47 - 2015-03-06 07:42 - 00022016 _____ (Microsoft Corporation) C:\windows\system32\credssp.dll
2015-03-10 19:47 - 2015-03-06 07:41 - 00064000 _____ (Microsoft Corporation) C:\windows\system32\auditpol.exe
2015-03-10 19:47 - 2015-03-06 07:41 - 00031232 _____ (Microsoft Corporation) C:\windows\system32\lsass.exe
2015-03-10 19:47 - 2015-03-06 07:39 - 00060416 _____ (Microsoft Corporation) C:\windows\system32\msobjs.dll
2015-03-10 19:47 - 2015-03-06 07:38 - 00146432 _____ (Microsoft Corporation) C:\windows\system32\msaudite.dll
2015-03-10 19:47 - 2015-03-06 07:36 - 00686080 _____ (Microsoft Corporation) C:\windows\system32\adtschema.dll
2015-03-10 19:47 - 2015-03-06 07:10 - 00550912 _____ (Microsoft Corporation) C:\windows\SysWOW64\kerberos.dll
2015-03-10 19:47 - 2015-03-06 07:10 - 00259584 _____ (Microsoft Corporation) C:\windows\SysWOW64\msv1_0.dll
2015-03-10 19:47 - 2015-03-06 07:10 - 00248832 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll
2015-03-10 19:47 - 2015-03-06 07:10 - 00221184 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncrypt.dll
2015-03-10 19:47 - 2015-03-06 07:10 - 00172032 _____ (Microsoft Corporation) C:\windows\SysWOW64\wdigest.dll
2015-03-10 19:47 - 2015-03-06 07:10 - 00065536 _____ (Microsoft Corporation) C:\windows\SysWOW64\TSpkg.dll
2015-03-10 19:47 - 2015-03-06 07:10 - 00022016 _____ (Microsoft Corporation) C:\windows\SysWOW64\secur32.dll
2015-03-10 19:47 - 2015-03-06 07:10 - 00017408 _____ (Microsoft Corporation) C:\windows\SysWOW64\credssp.dll
2015-03-10 19:47 - 2015-03-06 07:09 - 00096768 _____ (Microsoft Corporation) C:\windows\SysWOW64\sspicli.dll
2015-03-10 19:47 - 2015-03-06 07:09 - 00050176 _____ (Microsoft Corporation) C:\windows\SysWOW64\auditpol.exe
2015-03-10 19:47 - 2015-03-06 07:07 - 00146432 _____ (Microsoft Corporation) C:\windows\SysWOW64\msaudite.dll
2015-03-10 19:47 - 2015-03-06 07:07 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\msobjs.dll
2015-03-10 19:47 - 2015-03-06 07:06 - 00686080 _____ (Microsoft Corporation) C:\windows\SysWOW64\adtschema.dll
2015-03-10 19:47 - 2015-02-26 05:25 - 03204096 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2015-03-10 19:47 - 2015-02-24 05:15 - 00389800 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
2015-03-10 19:47 - 2015-02-24 04:32 - 00342696 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll
2015-03-10 19:47 - 2015-02-21 03:16 - 25021440 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2015-03-10 19:47 - 2015-02-21 02:41 - 12827648 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2015-03-10 19:47 - 2015-02-21 02:27 - 00418304 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
2015-03-10 19:47 - 2015-02-21 02:27 - 00285696 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
2015-03-10 19:47 - 2015-02-21 02:25 - 19720192 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2015-03-10 19:47 - 2015-02-21 01:58 - 00092160 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2015-03-10 19:47 - 2015-02-21 01:32 - 00076288 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2015-03-10 19:47 - 2015-02-20 05:06 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2015-03-10 19:47 - 2015-02-20 05:05 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
2015-03-10 19:47 - 2015-02-20 04:50 - 00066560 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2015-03-10 19:47 - 2015-02-20 04:49 - 00584192 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2015-03-10 19:47 - 2015-02-20 04:49 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
2015-03-10 19:47 - 2015-02-20 04:48 - 02886144 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2015-03-10 19:47 - 2015-02-20 04:47 - 00088064 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll
2015-03-10 19:47 - 2015-02-20 04:41 - 00054784 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2015-03-10 19:47 - 2015-02-20 04:40 - 00034304 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2015-03-10 19:47 - 2015-02-20 04:36 - 00633856 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2015-03-10 19:47 - 2015-02-20 04:35 - 00144384 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2015-03-10 19:47 - 2015-02-20 04:35 - 00114688 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
2015-03-10 19:47 - 2015-02-20 04:34 - 00814080 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
2015-03-10 19:47 - 2015-02-20 04:32 - 06035456 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2015-03-10 19:47 - 2015-02-20 04:26 - 00968704 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2015-03-10 19:47 - 2015-02-20 04:22 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2015-03-10 19:47 - 2015-02-20 04:22 - 00490496 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2015-03-10 19:47 - 2015-02-20 04:13 - 00077824 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll
2015-03-10 19:47 - 2015-02-20 04:09 - 00503296 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2015-03-10 19:47 - 2015-02-20 04:08 - 00199680 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2015-03-10 19:47 - 2015-02-20 04:08 - 00062464 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2015-03-10 19:47 - 2015-02-20 04:08 - 00047616 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll
2015-03-10 19:47 - 2015-02-20 04:06 - 00064000 _____ (Microsoft Corporation) C:\windows\SysWOW64\MshtmlDac.dll
2015-03-10 19:47 - 2015-02-20 04:05 - 00316928 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2015-03-10 19:47 - 2015-02-20 04:03 - 02278400 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2015-03-10 19:47 - 2015-02-20 04:01 - 00047104 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2015-03-10 19:47 - 2015-02-20 04:00 - 00030720 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2015-03-10 19:47 - 2015-02-20 03:58 - 00478208 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2015-03-10 19:47 - 2015-02-20 03:56 - 00620032 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll
2015-03-10 19:47 - 2015-02-20 03:56 - 00115712 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe
2015-03-10 19:47 - 2015-02-20 03:49 - 00801280 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2015-03-10 19:47 - 2015-02-20 03:49 - 00718848 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2015-03-10 19:47 - 2015-02-20 03:47 - 01359360 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll
2015-03-10 19:47 - 2015-02-20 03:46 - 02125824 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2015-03-10 19:47 - 2015-02-20 03:43 - 14398976 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2015-03-10 19:47 - 2015-02-20 03:41 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-03-10 19:47 - 2015-02-20 03:37 - 00168960 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
2015-03-10 19:47 - 2015-02-20 03:30 - 04300288 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2015-03-10 19:47 - 2015-02-20 03:28 - 02358784 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2015-03-10 19:47 - 2015-02-20 03:24 - 02052608 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2015-03-10 19:47 - 2015-02-20 03:24 - 00689152 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2015-03-10 19:47 - 2015-02-20 03:23 - 01155072 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll
2015-03-10 19:47 - 2015-02-20 03:16 - 01548288 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2015-03-10 19:47 - 2015-02-20 03:03 - 00800768 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2015-03-10 19:47 - 2015-02-20 03:01 - 01888256 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2015-03-10 19:47 - 2015-02-20 02:57 - 01311232 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2015-03-10 19:47 - 2015-02-20 02:55 - 00710144 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
2015-03-10 19:47 - 2015-02-13 07:26 - 12875264 _____ (Microsoft Corporation) C:\windows\SysWOW64\shell32.dll
2015-03-10 19:47 - 2015-02-13 07:22 - 14177280 _____ (Microsoft Corporation) C:\windows\system32\shell32.dll
2015-03-10 19:47 - 2015-02-03 05:31 - 01424896 _____ (Microsoft Corporation) C:\windows\system32\WindowsCodecs.dll
2015-03-10 19:47 - 2015-02-03 05:31 - 00215552 _____ (Microsoft Corporation) C:\windows\system32\ubpm.dll
2015-03-10 19:47 - 2015-02-03 05:12 - 01230848 _____ (Microsoft Corporation) C:\windows\SysWOW64\WindowsCodecs.dll
2015-03-10 19:47 - 2015-02-03 05:12 - 00171520 _____ (Microsoft Corporation) C:\windows\SysWOW64\ubpm.dll
2015-03-10 19:47 - 2015-01-31 01:56 - 00459336 _____ (Microsoft Corporation) C:\windows\system32\Drivers\cng.sys
2015-03-10 19:47 - 2015-01-17 04:48 - 01067520 _____ (Microsoft Corporation) C:\windows\system32\msctf.dll
2015-03-10 19:47 - 2015-01-17 04:30 - 00828928 _____ (Microsoft Corporation) C:\windows\SysWOW64\msctf.dll
2015-03-10 19:46 - 2015-02-04 05:16 - 00465920 _____ (Microsoft Corporation) C:\windows\system32\WMPhoto.dll
2015-03-10 19:46 - 2015-02-04 04:54 - 00417792 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMPhoto.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-07 23:08 - 2009-07-14 06:45 - 00024400 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-04-07 23:08 - 2009-07-14 06:45 - 00024400 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-04-07 23:07 - 2012-10-04 11:20 - 01714146 _____ () C:\windows\WindowsUpdate.log
2015-04-07 23:05 - 2012-10-04 20:26 - 00000000 ____D () C:\Users\Tiedt\AppData\Roaming\Skype
2015-04-07 23:03 - 2013-04-21 21:14 - 00001106 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-04-07 23:03 - 2012-07-06 09:53 - 00000000 ____D () C:\ProgramData\PDFC
2015-04-07 23:03 - 2009-07-14 07:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2015-04-07 23:03 - 2009-07-14 06:51 - 00142739 _____ () C:\windows\setupact.log
2015-04-07 23:02 - 2010-11-21 05:47 - 01483166 _____ () C:\windows\PFRO.log
2015-04-07 22:58 - 2012-10-04 18:17 - 00000000 ____D () C:\Program Files (x86)\avmwlanstick
2015-04-07 22:54 - 2012-07-06 09:48 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2015-04-07 22:39 - 2012-07-06 09:19 - 00699416 _____ () C:\windows\system32\perfh007.dat
2015-04-07 22:39 - 2012-07-06 09:19 - 00149556 _____ () C:\windows\system32\perfc007.dat
2015-04-07 22:39 - 2009-07-14 07:13 - 01620612 _____ () C:\windows\system32\PerfStringBackup.INI
2015-04-07 22:31 - 2013-04-21 21:14 - 00001284 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-04-07 22:31 - 2013-04-21 21:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-04-07 22:31 - 2012-12-26 22:58 - 00001154 _____ () C:\Users\Tiedt\Desktop\Internet Explorer.lnk
2015-04-07 22:31 - 2012-10-04 11:29 - 00000997 _____ () C:\Users\Tiedt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-04-07 22:31 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2015-04-07 22:30 - 2012-10-04 11:22 - 00000000 ____D () C:\Users\Tiedt
2015-04-07 22:03 - 2013-04-21 21:14 - 00001110 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-04-07 21:53 - 2012-10-04 20:36 - 00000000 ____D () C:\Users\Tiedt\AppData\Local\CrashDumps
2015-04-07 19:16 - 2009-07-14 05:20 - 00000000 ____D () C:\Program Files\Common Files\System
2015-04-07 17:39 - 2012-10-04 22:53 - 00000000 ____D () C:\Users\Tiedt\Desktop\Bilder
2015-04-07 13:54 - 2012-10-04 11:29 - 00003930 _____ () C:\windows\System32\Tasks\User_Feed_Synchronization-{7D6F304C-B00A-4C98-8F21-73A9DAAE244A}
2015-04-04 15:09 - 2013-09-08 20:18 - 00003186 _____ () C:\windows\System32\Tasks\HPCeeScheduleForTiedt
2015-04-04 15:09 - 2013-09-08 20:18 - 00000332 _____ () C:\windows\Tasks\HPCeeScheduleForTiedt.job
2015-04-04 15:09 - 2012-10-06 10:39 - 00000000 ____D () C:\Users\Tiedt\AppData\Roaming\HpUpdate
2015-04-04 15:09 - 2012-10-06 10:39 - 00000000 ____D () C:\Users\Tiedt\AppData\Roaming\HP Support Assistant
2015-04-01 19:55 - 2012-10-04 22:51 - 00000000 ____D () C:\Users\Tiedt\Desktop\Christine
2015-03-31 19:10 - 2014-01-13 19:53 - 00040448 _____ () C:\Users\Tiedt\Desktop\Betriebskosten ab 2014.xls
2015-03-31 08:56 - 2012-10-06 10:41 - 00003218 _____ () C:\windows\System32\Tasks\HPCeeScheduleForTIEDT-HP$
2015-03-31 08:56 - 2012-10-06 10:41 - 00000342 _____ () C:\windows\Tasks\HPCeeScheduleForTIEDT-HP$.job
2015-03-25 20:48 - 2014-12-11 20:08 - 00000000 ____D () C:\windows\system32\appraiser
2015-03-25 20:48 - 2014-05-08 16:45 - 00000000 ___SD () C:\windows\system32\CompatTel
2015-03-14 10:18 - 2009-07-14 07:09 - 00000000 ____D () C:\windows\System32\Tasks\WPD
2015-03-13 17:25 - 2009-07-14 07:08 - 00032632 _____ () C:\windows\Tasks\SCHEDLGU.TXT
2015-03-12 21:03 - 2009-07-14 05:20 - 00000000 ____D () C:\windows\rescache
2015-03-11 17:21 - 2009-07-14 06:45 - 00356936 _____ () C:\windows\system32\FNTCACHE.DAT
2015-03-11 17:19 - 2009-07-14 05:20 - 00000000 ____D () C:\windows\SysWOW64\Dism
2015-03-11 17:19 - 2009-07-14 05:20 - 00000000 ____D () C:\windows\system32\Dism
2015-03-10 20:25 - 2013-08-14 20:25 - 00000000 ____D () C:\windows\system32\MRT
2015-03-10 20:22 - 2012-10-05 12:14 - 122905848 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2015-03-08 13:36 - 2012-07-06 09:53 - 00000000 ____D () C:\ProgramData\Skype

==================== Files in the root of some directories =======

2015-03-26 21:14 - 2015-03-26 21:14 - 0005542 _____ () C:\Users\Tiedt\AppData\Roaming\SXZQ
2015-03-26 21:14 - 2015-03-26 21:14 - 0005542 _____ () C:\Users\Tiedt\AppData\Roaming\XDKWM
2015-04-07 19:58 - 2015-04-07 19:58 - 0613255 _____ (CMI Limited) C:\Users\Tiedt\AppData\Local\nsh1D35.tmp
2012-12-26 11:10 - 2012-12-26 11:10 - 0000057 _____ () C:\ProgramData\Ament.ini

Some content of TEMP:
====================
C:\Users\Tiedt\AppData\Local\Temp\744.exe
C:\Users\Tiedt\AppData\Local\Temp\9D528DB1-7C1F-4381-24DF-9476FD4AD6D4.dll
C:\Users\Tiedt\AppData\Local\Temp\9D528DB1-7C1F-4381-24DF-9476FD4AD6D4.exe
C:\Users\Tiedt\AppData\Local\Temp\BDD4B49F-668E-64D8-0A34-C05064A06B11.exe
C:\Users\Tiedt\AppData\Local\Temp\CloudBackup8054.exe
C:\Users\Tiedt\AppData\Local\Temp\lvid_lvid.exe
C:\Users\Tiedt\AppData\Local\Temp\micky maus wunderhaus kostenlos__10924_i1493454126_il538367.exe
C:\Users\Tiedt\AppData\Local\Temp\Quarantine.exe
C:\Users\Tiedt\AppData\Local\Temp\ReimagePackage.exe
C:\Users\Tiedt\AppData\Local\Temp\ReiSysUpdate.exe
C:\Users\Tiedt\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Tiedt\AppData\Local\Temp\sqlite3.dll
C:\Users\Tiedt\AppData\Local\Temp\tu17p84.exe
C:\Users\Tiedt\AppData\Local\Temp\_is2904.exe
C:\Users\Tiedt\AppData\Local\Temp\_is363D.exe
C:\Users\Tiedt\AppData\Local\Temp\_is892D.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-03-28 19:41

==================== End Of Log ============================
--- --- ---


und Addition

Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-03-2015
Ran by Tiedt at 2015-04-07 23:14:20
Running from C:\Users\Tiedt\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Enabled - Up to date) {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}
AS: Microsoft Security Essentials (Enabled - Up to date) {0C8D1929-27B2-688D-E114-9117BD2BB1B7}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

ABBYY FineReader 6.0 Sprint (HKLM-x32\...\{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}) (Version: 6.00.1395.4512 - ABBYY Software House)
Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.305 - Adobe Systems Incorporated)
AVM FRITZ!WLAN (HKLM-x32\...\AVMWLANCLI) (Version:  - AVM Berlin)
Bejeweled 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Belkin F5D8053 N Wireless USB Adapter (HKLM-x32\...\InstallShield_{E6607F5B-50E7-4B54-81B7-F0600E3C8CF4}) (Version: 2.0.0.10 - Belkin)
Belkin F5D8053 N Wireless USB Adapter (x32 Version: 2.0.0.10 - Belkin) Hidden
Cake Mania (x32 Version: 2.2.0.98 - WildTangent) Hidden
Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Compatibility Pack für 2007 Office System (HKLM-x32\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Cradle of Rome 2 (x32 Version: 2.2.0.98 - WildTangent) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DirectX for Managed Code Update (Summer 2004) (x32 Version: 9.02.2904 - Microsoft) Hidden
Facebook (HKLM-x32\...\{8AE50893-3A87-4439-9A57-942ED43F7189}) (Version: 1.1.0004 - Hewlett-Packard)
Farm Frenzy (x32 Version: 2.2.0.98 - WildTangent) Hidden
Farmscapes (x32 Version: 2.2.0.97 - WildTangent) Hidden
FATE (x32 Version: 2.2.0.97 - WildTangent) Hidden
Final Drive Fury (x32 Version: 2.2.0.95 - WildTangent) Hidden
Fishdom (TM) 2 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 41.0.2272.118 - Google Inc.)
Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.6227.252 - Google Inc.)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
Hewlett-Packard ACLM.NET v1.1.2.0 (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden
HP Calendar (HKLM-x32\...\{2B38E0FA-D8A5-4EBF-A018-E3C1C8E7A2E2}) (Version: 5.1.4245.23508 - Hewlett-Packard)
HP Clock (HKLM-x32\...\{750E9D0F-B188-4A7E-ADD2-84B7ED7D32F6}) (Version: 5.1.4281.27332 - Hewlett-Packard)
HP Deskjet 3520 series - Grundlegende Software für das Gerät (HKLM\...\{A9C5381E-F415-4EDC-95A2-9164218FEA8A}) (Version: 27.0.847.0 - Hewlett-Packard Co.)
HP Deskjet 3520 series Hilfe (HKLM-x32\...\{6B953497-169C-4929-9AA9-A9F510347468}) (Version: 27.0.0 - Hewlett Packard)
HP Deskjet 3520 series Setup Guide (HKLM-x32\...\{AEEDCEB7-00B8-4BE1-B492-AB04803D5F1E}) (Version: 27.0.0 - Hewlett Packard)
HP Games (HKLM-x32\...\WildTangent hp Master Uninstall) (Version: 1.0.2.5 - WildTangent)
HP Magic Canvas (HKLM-x32\...\{DDFDC9D6-4220-41F8-BF9A-8E7512C4EF52}) (Version: 5.1.15.0 - Hewlett-Packard)
HP Magic Canvas Tutorials (HKLM-x32\...\{858FCB65-7C6D-4BA4-AD80-A3CB3744CE09}_is1) (Version: 6.0.0.0 - Hewlett-Packard)
HP Notes (HKLM-x32\...\{86BAB08A-5E66-4C53-82E3-C1E91673C7CA}) (Version: 5.1.4274.30382 - Hewlett-Packard)
HP Odometer (HKLM-x32\...\{B8AC1A89-FFD1-4F97-8051-E505A160F562}) (Version: 2.10.0000 - Hewlett-Packard)
HP Photo Creations (HKLM-x32\...\HP Photo Creations) (Version: 1.0.0.3341 - HP Photo Creations Powered by RocketLife)
HP RSS (HKLM-x32\...\{452479C5-0118-48E9-AA69-0A7339F95FC8}) (Version: 5.1.4289.23799 - Hewlett-Packard)
HP Setup (HKLM-x32\...\{438363A8-F486-4C37-834C-4955773CB3D3}) (Version: 9.1.15430.4033 - Hewlett-Packard Company)
HP Support Assistant (HKLM-x32\...\{6F44AF95-3CDE-4513-AD3F-6D45F17BF324}) (Version: 6.1.12.1 - Hewlett-Packard Company)
HP Support Information (HKLM-x32\...\{B2B7B1C8-7C8B-476C-BE2C-049731C55992}) (Version: 11.00.0001 - Hewlett-Packard)
HP TouchSmart Background - Beats (HKLM-x32\...\{6A6F8D36-04BA-41E9-9004-1789BD545874}) (Version: 1.0.1.0 - Hewlett-Packard)
HP TouchSmart RecipeBox (HKLM-x32\...\{20714B53-FC73-4F9C-9687-49EB237D6FD7}) (Version: 3.0.3830.27730 - Hewlett-Packard)
HP Update (HKLM-x32\...\{6F1C00D2-25C2-4CBA-8126-AE9A6E2E9CD5}) (Version: 5.003.003.001 - Hewlett-Packard)
Insaniquarium Deluxe (x32 Version: 2.2.0.97 - WildTangent) Hidden
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.0.0.1351 - Intel Corporation)
Jewel Match 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Jewel Quest II (x32 Version: 2.2.0.97 - WildTangent) Hidden
Jewel Quest Solitaire 2 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
LabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.4507 - CyberLink Corp.)
LabelPrint (x32 Version: 2.5.4507 - CyberLink Corp.) Hidden
lection (HKLM-x32\...\{55d4b236-fe79-4782-cc2d-55acaf147087}) (Version: 1.0.0 - subpar)
Logitech Vid HD (HKLM-x32\...\Logitech Vid) (Version: 7.2 (7259) - Logitech Inc..)
Logitech Webcam Software (HKLM\...\{987FE247-4E69-4A2E-A961-D14F901FDBF6}) (Version: 12.10.1113 - Logitech Inc.)
Logitech Webcam Software-Treiberpaket (HKLM\...\lvdrivers_12.10) (Version: 12.10.1110 - Logitech Inc.)
LolliScan (HKLM-x32\...\LolliScan) (Version:  - )
Magic Desktop (HKLM-x32\...\EasyBits Magic Desktop) (Version: 3.0 - EasyBits Software AS)
Mahjongg Artifacts (x32 Version: 2.2.0.95 - WildTangent) Hidden
Malwarebytes Anti-Malware Version 2.1.4.1018 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.4.1018 - Malwarebytes Corporation)
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.150.1 - McAfee, Inc.)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Mathematics (HKLM-x32\...\{4D090F70-6F08-4B60-9357-A1DFD4458F09}) (Version: 4.0 - Microsoft Corporation)
Microsoft Office 2003 Web Components (HKLM-x32\...\{90A40407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Professional Edition 2003 (HKLM-x32\...\{90110407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.7.205.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 37.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 37.0.1 (x86 de)) (Version: 37.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 37.0.1 - Mozilla)
Mystery of Mortlake Mansion (x32 Version: 2.2.0.98 - WildTangent) Hidden
Norton Online Backup (HKLM-x32\...\{40A66DF6-22D3-44B5-A7D3-83B118A2C0DC}) (Version: 2.1.17869 - Symantec Corporation)
NVIDIA Graphics Driver 296.28 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 296.28 - NVIDIA Corporation)
NVIDIA HD Audio Driver 1.3.14.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.14.1 - NVIDIA Corporation)
NVIDIA PhysX System Software 9.12.0213 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.12.0213 - NVIDIA Corporation)
opensource (x32 Version: 1.0.14960.3876 - Your Company Name) Hidden
PDF Complete Corporate Edition (HKLM-x32\...\PDF Complete) (Version: 4.0.95 - PDF Complete, Inc)
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.98 - WildTangent) Hidden
PlayReady PC Runtime amd64 (HKLM\...\{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}) (Version: 1.3.0 - Microsoft Corporation)
Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden
Power2Go (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.1.6207 - CyberLink Corp.)
Power2Go (x32 Version: 6.1.6207 - CyberLink Corp.) Hidden
PowerDVD (HKLM-x32\...\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}) (Version:  - )
Ranch Rush 2 - Premium Edition (x32 Version: 2.2.0.98 - WildTangent) Hidden
Recovery Manager (x32 Version: 5.5.0.5119 - CyberLink Corp.) Hidden
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)
Skype™ 7.1 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.1.105 - Skype Technologies S.A.)
Studie zur Verbesserung von HP Deskjet 3520 series Produkten (HKLM\...\{E75A77D7-A854-44D6-A46B-82332AD79E9E}) (Version: 27.0.847.0 - Hewlett-Packard Co.)
TI USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{355FBD67-5A4F-44DA-86A1-56EEC4C20EC0}) (Version: 1.12.18.0 - Texas Instruments Inc.)
TI USB3 Host Driver (x32 Version: 1.12.18.0 - Texas Instruments Inc.) Hidden
Torchlight (x32 Version: 2.2.0.98 - WildTangent) Hidden
TSHostedAppLauncher (x32 Version: 5.1.15.0 - Hewlett-Packard) Hidden
turbodiagnosis version 1.02 (HKLM-x32\...\{365C5DC2-679A-4A5D-B40B-5096A49087A8}_is1) (Version: 1.02 - )
Update Installer for WildTangent Games App (x32 Version:  - WildTangent) Hidden
Virtual Families (x32 Version: 2.2.0.98 - WildTangent) Hidden
Virtual Villagers 4 - The Tree of Life (x32 Version: 2.2.0.98 - WildTangent) Hidden
Wedding Dash (x32 Version: 2.2.0.95 - WildTangent) Hidden
WildTangent Games App (HP Games) (x32 Version: 4.0.5.36 - WildTangent) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3538.0513 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
WinZip 16.0 (HKLM\...\{CD95F661-A5C4-44F5-A6AA-ECDD91C240CD}) (Version: 16.0.9715 - WinZip Computing, S.L. )
Zuma's Revenge (x32 Version: 2.2.0.98 - WildTangent) Hidden

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-2149968534-1042019459-1302014499-1000_Classes\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}\InprocServer32 -> C:\Users\Tiedt\AppData\Roaming\moters\supna.dll No File <==== ATTENTION

==================== Restore Points  =========================

25-02-2015 16:34:49 Windows Update
25-02-2015 21:10:30 Windows Update
01-03-2015 10:48:32 Windows Update
05-03-2015 10:31:35 Windows Update
08-03-2015 21:09:08 Windows Update
10-03-2015 20:20:52 Windows Update
15-03-2015 17:23:57 Windows Update
18-03-2015 20:38:40 Windows Update
21-03-2015 21:05:39 Windows Update
24-03-2015 21:31:27 Windows Update
28-03-2015 19:22:30 Windows Update
01-04-2015 11:37:52 Windows Update
04-04-2015 15:09:31 Windows Update
07-04-2015 16:17:17 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____N C:\windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {05C1BC02-1120-4C5E-985F-35878B05CA4C} - System32\Tasks\{72DBAEEB-80FA-4B86-9A03-BF2B50B21D4D} => pcalua.exe -a "C:\Users\Tiedt\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\60AVZVWL\f5d8053 v3011 v2.0.0.8.exe" -d C:\Users\Tiedt\Desktop
Task: {0622B4D4-E6E1-4AB6-B67A-CAF3915B3EE2} - System32\Tasks\{95E36204-5040-48CE-94C1-4930759A5044} => pcalua.exe -a "C:\Users\Tiedt\Downloads\f5d8053 v3011 v2.0.0.8 (1).exe" -d C:\Users\Tiedt\Downloads
Task: {176D5C2E-04BF-4FBC-98F4-F46C10ED93F8} - System32\Tasks\HPCustParticipation HP Deskjet 3520 series => C:\Program Files\HP\HP Deskjet 3520 series\Bin\HPCustPartic.exe [2012-01-31] (Hewlett-Packard Co.)
Task: {18543076-B6EA-4506-95AD-5A6C14521B23} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater\HPSFUpdater.exe [2011-06-14] (Hewlett-Packard)
Task: {1D002410-9FEF-4D70-B8D1-7E29E284BBB2} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-05] (Adobe Systems Incorporated)
Task: {41AF4603-7CC3-4A08-8B2A-51099108D67B} - System32\Tasks\fres3005 => C:\PROGRA~2\HIGHLI~1\fres3005.exe
Task: {4CE3B0F3-D021-4CFC-85CF-BD4556246AB2} - System32\Tasks\Microsoft\Windows\Setup\gwx\runappraiser => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-25] (Microsoft Corporation)
Task: {5DDAB2C5-E5A1-4AF7-8A6B-210560D285EC} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2011-09-10] (Hewlett-Packard Company)
Task: {7067FACB-8C8C-41AE-9706-FA4C470F126C} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPSFMessenger\HPSFMsgr.exe [2011-09-10] (Hewlett-Packard Company)
Task: {73FBD61A-1A2D-4B23-804F-E331166EFDB3} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-03-25] (Microsoft Corporation)
Task: {76874D2D-35DF-4832-9EA0-F66A8D903A81} - \SPBIW_UpdateTask_Time_323539353732313531312d5b5b4a346c4123452a5a556c No Task File <==== ATTENTION
Task: {8F03C14B-A158-42F5-BB79-4D248D1D43F9} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxcontent => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-25] (Microsoft Corporation)
Task: {9FF8CE88-68CA-4497-BDCD-E0162962516C} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-25] (Microsoft Corporation)
Task: {A1E500BA-1360-4AD2-BD94-65A9F744A1BD} - System32\Tasks\TKKMJ => C:\ProgramData\3a8c9699124a4506a71d46fb652dc7b1\3a8c9699124a4506a71d46fb652dc7b1.exe
Task: {AF25C51C-4359-4040-8224-B078C7E9E0C7} - System32\Tasks\XDKWM => C:\Users\Tiedt\AppData\Roaming\XDKWM.exe <==== ATTENTION
Task: {B4EEDE97-A226-4246-A9AD-0C65CA3E86A6} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Total Care Tune-Up => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPTuneUp.exe [2011-03-23] (Hewlett-Packard Company)
Task: {B7804514-7C87-4E0C-BD7A-C92932553D63} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-25] (Google Inc.)
Task: {B890224F-C601-465D-8611-27C429FB41F6} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2015-03-10] (Hewlett-Packard)
Task: {C06D7E4F-9B9E-4837-ABDE-7A7012773CE8} - System32\Tasks\SXZQ => C:\Users\Tiedt\AppData\Roaming\SXZQ.exe <==== ATTENTION
Task: {C6FED5E7-525C-4DC4-B30C-AC8B1894D20F} - System32\Tasks\HPCeeScheduleForTiedt => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2011-07-15] (Hewlett-Packard)
Task: {C9019F23-CC90-4B9E-976B-9B5B32237264} - System32\Tasks\HPCeeScheduleForTIEDT-HP$ => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2011-07-15] (Hewlett-Packard)
Task: {D7EFB4ED-17FB-45EC-9F6C-77DA5D752168} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Tuneup => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2011-09-10] (Hewlett-Packard Company)
Task: {DBE54C8B-DBD3-475D-943F-1A65D95616A7} - System32\Tasks\Microsoft\Windows\Maintenance\SMupdate2 => Rundll32.exe C:\PROGRA~1\COMMON~1\System\SysMenu.dll ,Command701 update2 <==== ATTENTION
Task: {DC99B4BE-A7E1-49CD-8301-A47730F3C92A} - System32\Tasks\Microsoft\Windows\Multimedia\SMupdate3 => Rundll32.exe C:\PROGRA~1\COMMON~1\System\SysMenu.dll ,Command701 update3 <==== ATTENTION
Task: {F9F849AC-F881-4E48-BF3C-9BDF2C4F3FFA} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-25] (Google Inc.)
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\HPCeeScheduleForTIEDT-HP$.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
Task: C:\windows\Tasks\HPCeeScheduleForTiedt.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
Task: C:\windows\Tasks\SXZQ.job => C:\Users\Tiedt\AppData\Roaming\SXZQ.exe <==== ATTENTION
Task: C:\windows\Tasks\XDKWM.job => C:\Users\Tiedt\AppData\Roaming\XDKWM.exe <==== ATTENTION

==================== Loaded Modules (whitelisted) ==============

2015-04-04 15:05 - 2015-03-30 23:07 - 01174856 _____ () C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.118\libglesv2.dll
2015-04-04 15:05 - 2015-03-30 23:07 - 00080200 _____ () C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.118\libegl.dll
2015-04-04 15:05 - 2015-03-30 23:07 - 09279304 _____ () C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.118\pdf.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\abengine => ""="service"

==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2149968534-1042019459-1302014499-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Tiedt\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.2.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== Accounts: =============================

Administrator (S-1-5-21-2149968534-1042019459-1302014499-500 - Administrator - Disabled)
Gast (S-1-5-21-2149968534-1042019459-1302014499-501 - Limited - Disabled)
Tiedt (S-1-5-21-2149968534-1042019459-1302014499-1000 - Administrator - Enabled) => C:\Users\Tiedt

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============

Microsoft Office Sessions:
=========================

==================== Memory info ===========================

Processor: Intel(R) Core(TM) i5-3450 CPU @ 3.10GHz
Percentage of memory in use: 26%
Total physical RAM: 6100.01 MB
Available physical RAM: 4461.11 MB
Total Pagefile: 12198.21 MB
Available Pagefile: 10366.26 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:914.41 GB) (Free:805.31 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (HP_RECOVERY) (Fixed) (Total:16.88 GB) (Free:2.1 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: AC56E740)

Partition: GPT Partition Type.

==================== End Of Log ============================

M-K-D-B 08.04.2015 09:12
Servus,


zur Empfehlung eines AV-Programmes kommen wir am Ende der Bereinigung, ich werde das nicht vergessen.

Hinweis:
Sollten die zu postenden Dateien zu groß werden, so zippe die Dateien und poste sie als Anhang.


Die Werbemeldungen sollten schon weniger sein, wir sind aber noch nicht fertig.
So geht es weiter:



Schritt 1
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument


Code:
start
CloseProcesses:
HKLM-x32\...\Run: [] => [X]
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKU\S-1-5-21-2149968534-1042019459-1302014499-1000\...\Run: [GoogleChromeAutoLaunch_2C142DA54B54EC24056B4AF2F6E94CF1] => "C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\crossbrowse.exe" --no-startup-window
Startup: C:\Users\Tiedt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Priceless_310315.lnk
C:\ProgramData\{3bef08e0-4997-b04c-3bef-f08e04992381}
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
Toolbar: HKU\S-1-5-21-2149968534-1042019459-1302014499-1000 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
C:\Users\Tiedt\AppData\Roaming\SXZQ
C:\Users\Tiedt\AppData\Roaming\XDKWM
C:\Users\Tiedt\Desktop\Continue installation .lnk
C:\ProgramData\36ebbb131f884f3aa5b926d4db990ab9
C:\Users\Tiedt\AppData\Roaming\lection
C:\ProgramData\3a8c9699124a4506a71d46fb652dc7b1
C:\Program Files (x86)\5eb99ca5-046a-49ee-9304-c67a0fd45030
C:\Program Files (x86)\691f0be1-5255-412a-8083-cbfcdb6532b4
C:\Users\Tiedt\AppData\Local\0406D9B4-1428434453-72AF-8C7F-B36FDEF67BEF
C:\ProgramData\{3bef08e0-4997-b04c-3bef-f08e04992381}
C:\ProgramData\5666253508951638902
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\imalicmf
C:\Program Files (x86)\imalicmf
C:\Program Files (x86)\9cb3e9f1-8ae7-4112-a04b-7199a616d34b
C:\Users\Tiedt\Downloads\ReimageRepair.exe
C:\Users\Tiedt\AppData\Local\*.tmp
CustomCLSID: HKU\S-1-5-21-2149968534-1042019459-1302014499-1000_Classes\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}\InprocServer32 -> C:\Users\Tiedt\AppData\Roaming\moters\supna.dll No File <==== ATTENTION
C:\Users\Tiedt\AppData\Roaming\moters
Task: {05C1BC02-1120-4C5E-985F-35878B05CA4C} - System32\Tasks\{72DBAEEB-80FA-4B86-9A03-BF2B50B21D4D} => pcalua.exe -a "C:\Users\Tiedt\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\60AVZVWL\f5d8053 v3011 v2.0.0.8.exe" -d C:\Users\Tiedt\Desktop
Task: {0622B4D4-E6E1-4AB6-B67A-CAF3915B3EE2} - System32\Tasks\{95E36204-5040-48CE-94C1-4930759A5044} => pcalua.exe -a "C:\Users\Tiedt\Downloads\f5d8053 v3011 v2.0.0.8 (1).exe" -d C:\Users\Tiedt\Downloads
Task: {41AF4603-7CC3-4A08-8B2A-51099108D67B} - System32\Tasks\fres3005 => C:\PROGRA~2\HIGHLI~1\fres3005.exe
Task: {76874D2D-35DF-4832-9EA0-F66A8D903A81} - \SPBIW_UpdateTask_Time_323539353732313531312d5b5b4a346c4123452a5a556c No Task File <==== ATTENTION
Task: {A1E500BA-1360-4AD2-BD94-65A9F744A1BD} - System32\Tasks\TKKMJ => C:\ProgramData\3a8c9699124a4506a71d46fb652dc7b1\3a8c9699124a4506a71d46fb652dc7b1.exe
Task: {AF25C51C-4359-4040-8224-B078C7E9E0C7} - System32\Tasks\XDKWM => C:\Users\Tiedt\AppData\Roaming\XDKWM.exe <==== ATTENTION
Task: {C06D7E4F-9B9E-4837-ABDE-7A7012773CE8} - System32\Tasks\SXZQ => C:\Users\Tiedt\AppData\Roaming\SXZQ.exe <==== ATTENTION
Task: {DBE54C8B-DBD3-475D-943F-1A65D95616A7} - System32\Tasks\Microsoft\Windows\Maintenance\SMupdate2 => Rundll32.exe C:\PROGRA~1\COMMON~1\System\SysMenu.dll ,Command701 update2 <==== ATTENTION
Task: {DC99B4BE-A7E1-49CD-8301-A47730F3C92A} - System32\Tasks\Microsoft\Windows\Multimedia\SMupdate3 => Rundll32.exe C:\PROGRA~1\COMMON~1\System\SysMenu.dll ,Command701 update3 <==== ATTENTION
Task: C:\windows\Tasks\SXZQ.job => C:\Users\Tiedt\AppData\Roaming\SXZQ.exe <==== ATTENTION
C:\Users\Tiedt\AppData\Roaming\SXZQ.exe
Task: C:\windows\Tasks\XDKWM.job => C:\Users\Tiedt\AppData\Roaming\XDKWM.exe <==== ATTENTION
C:\Users\Tiedt\AppData\Roaming\XDKWM.exe
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\abengine => ""="service"
RemoveProxy:
EmptyTemp:
end

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.







Schritt 2
  • Deaktiviere dein Anti-Viren-Programm.
  • Gehe zum Ordner C:\FRST\Quarantine.
  • Rechtsklicke auf den Ordner Quarantine und wähle > Senden an > Zip-komprimierter Ordner.
  • Es wird eine zip-Datei mit dem Namen Quarantine.zip im Ordner FRST erstellt.
  • Lade die Quarantine.zip im Upload-Channel hoch.
  • Klicke dazu auf Durchsuchen, navigiere zu der zip-Datei ( C:\FRST\Quarantine.zip ) und klicke auf Öffnen.
  • Klicke abschließend auf Hochladen.
  • Vielen Dank für deine Hilfe.
  • Aktiviere dein Anti-Viren-Programm wieder.





Schritt 3
Lade dir die passende Version von SystemLook vom folgenden Spiegel herunter und speichere das Tool auf dem Desktop:
SystemLook (32 bit) | SystemLook (64 bit)
  • Doppelklicke auf die SystemLook.exe, um das Tool zu starten.
  • Kopiere den Inhalt der folgenden Codebox in das Textfeld des Tools:

    Code:
    :filefind
    *turbodiagnosis*
    *lection*
    *Infonaut_1.10.0.13*
    *ShopperPro*
    *MyPcBackup*
    *BlockAndSurf*
    *HighlightSearches*
    *Cinema PlusV07.04*
    *imalicmf*
    *LolliScan*
    *abengine*
    *Reimage*
    *Crossbrowse*
    *IHProtectUpDate*
    *luckysearches*

    :folderfind
    *turbodiagnosis*
    *lection*
    *Infonaut_1.10.0.13*
    *ShopperPro*
    *MyPcBackup*
    *BlockAndSurf*
    *HighlightSearches*
    *Cinema PlusV07.04*
    *imalicmf*
    *LolliScan*
    *abengine*
    *Reimage*
    *Crossbrowse*
    *IHProtectUpDate*
    *luckysearches*

    :regfind
    turbodiagnosis
    lection
    Infonaut_1.10.0.13
    ShopperPro
    MyPcBackup
    BlockAndSurf
    HighlightSearches
    Cinema PlusV07.04
    imalicmf
    LolliScan
    abengine
    Reimage
    Crossbrowse
    IHProtectUpDate
    luckysearches
  • Klicke nun auf den Button Look, um den Scan zu starten.
  • Der Suchlauf kann einige Zeit dauern.
  • Wenn der Suchlauf beendet ist, wird sich dein Editor mit den Ergebnissen öffnen, poste diese in deinen Thread.
  • Die Ergebnisse werden auch auf dem Desktop als SystemLook.txt gespeichert.







Schritt 4
  • Starte die FRST.exe erneut. Setze einen Haken vor Addition.txt und vor Shortcut.txt und drücke auf Scan.
  • FRST erstellt drei Logdateien (FRST.txt, Addition.txt und Shortcut.txt).
  • Poste mir alle drei Logdateien mit deiner nächsten Antwort.




Bitte poste mit deiner nächsten Antwort
  • die Logdatei des FRST-Fix,
  • eine Rückmeldung bezüglich des Uploads,
  • die Logdatei von SystemLook,
  • die drei neuen Logdateien von FRST.

nine53 08.04.2015 13:28
Guten Tag habe ich gemacht.

Hier die Fixlog und Systemlook als zip.

Schritt 2 ging nicht, es kam immer die Meldung " Datei nicht gefunden oder keine Leseberechtigung".

FRST


FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015
Ran by Tiedt (administrator) on TIEDT-HP on 08-04-2015 13:47:27
Running from C:\Users\Tiedt\Downloads
Loaded Profiles: Tiedt (Available profiles: Tiedt)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(AVM Berlin) C:\Program Files (x86)\avmwlanstick\WLanNetService.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
(Logitech Inc.) C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Logitech Inc.) C:\Program Files (x86)\Common Files\LogiShrd\LVMVFM\LVPrS64H.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
(PDF Complete Inc) C:\Program Files (x86)\PDF Complete\pdfsvc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Auto\HPAuto.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Hewlett-Packard ) C:\Program Files\IDT\WDM\Beats64.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3520 series\Bin\ScanToPCActivationApp.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
(AVM Berlin) C:\Program Files (x86)\avmwlanstick\WLanGUI.exe
() C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe
(Cyberlink Corp.) C:\Program Files (x86)\Cyberlink\PowerDVD\PDVDServ.exe
(Hewlett-Packard) C:\Program Files (x86)\Hp\HP Software Update\hpwuschd2.exe
() C:\Program Files (x86)\Common Files\LogiShrd\LQCVFX\COCIManager.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Calendar\Service\GCalService.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Calendar\Service\HPTouchSmartSyncCalReminderApp.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1425408 2012-03-30] (IDT, Inc.)
HKLM\...\Run: [BeatsOSDApp] => C:\Program Files\IDT\WDM\beats64.exe [37888 2012-03-30] (Hewlett-Packard )
HKLM\...\Run: [HPSYSDRV] => C:\Program Files (x86)\Hewlett-Packard\HP Odometer\HPSYSDRV.EXE [62768 2008-11-20] (Hewlett-Packard)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1332296 2015-01-30] (Microsoft Corporation)
HKLM-x32\...\Run: [Norton Online Backup] => C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [1155928 2010-06-02] (Symantec Corporation)
HKLM-x32\...\Run: [Easybits Recovery] => C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe [61112 2012-02-21] (EasyBits Software AS)
HKLM-x32\...\Run: [PDF Complete] => C:\Program Files (x86)\PDF Complete\pdfsty.exe [684024 2012-04-04] (PDF Complete Inc)
HKLM-x32\...\Run: [AVMWlanClient] => C:\Program Files (x86)\avmwlanstick\wlangui.exe [2105344 2010-10-22] (AVM Berlin)
HKLM-x32\...\Run: [LogitechQuickCamRibbon] => C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe [2793304 2009-10-14] ()
HKLM-x32\...\Run: [RemoteControl] => C:\Program Files (x86)\CyberLink\PowerDVD\PDVDServ.exe [32768 2004-11-02] (Cyberlink Corp.)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKU\S-1-5-21-2149968534-1042019459-1302014499-1000\...\Run: [HP Deskjet 3520 series (NET)] => C:\Program Files\HP\HP Deskjet 3520 series\Bin\ScanToPCActivationApp.exe [2551656 2012-01-31] (Hewlett-Packard Co.)
HKU\S-1-5-21-2149968534-1042019459-1302014499-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [31087200 2015-01-23] (Skype Technologies S.A.)
HKU\S-1-5-21-2149968534-1042019459-1302014499-1000\...\Policies\system: [DisableLockWorkstation] 0
HKU\S-1-5-21-2149968534-1042019459-1302014499-1000\...\Policies\system: [DisableChangePassword] 0
HKU\S-1-5-21-2149968534-1042019459-1302014499-1000\...\MountPoints2: {21f4f905-0e3e-11e2-bb6f-ac162d091884} - G:\pushinst.exe
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
SearchScopes: HKLM -> {4709F2DE-3A4E-4C6E-BA0B-538370E51EF0} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de1-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-2/4?mpre=hxxp://www.ebay.de/sch/i.html?_nkw={searchTerms}
SearchScopes: HKLM-x32 -> {4709F2DE-3A4E-4C6E-BA0B-538370E51EF0} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de1-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-2/4?mpre=hxxp://www.ebay.de/sch/i.html?_nkw={searchTerms}
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-29] (Microsoft Corp.)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-03-07] (Google Inc.)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2014-07-14] (Microsoft Corporation)
BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll [2014-04-09] (McAfee, Inc.)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-29] (Microsoft Corp.)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-03-07] (Google Inc.)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2014-07-14] (Microsoft Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-03-07] (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-03-07] (Google Inc.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2014-07-14] (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2014-07-14] (Microsoft Corporation)
ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll [52920 2012-07-06] (EasyBits Software Corp.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Tiedt\AppData\Roaming\Mozilla\Firefox\Profiles\snq3xiqr.default
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2011-05-14] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2011-05-14] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-07] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-07] (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll [2011-09-28] ()
FF HKLM-x32\...\Firefox\Extensions: [quickprint@hp.com] - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\QPExtension
FF Extension: HP Smart Print - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\QPExtension [2012-12-26]
FF HKU\S-1-5-21-2149968534-1042019459-1302014499-1000\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: McAfee Security Scan Plus - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]
FF Extension: No Name - C:\Users\Tiedt\AppData\Roaming\Mozilla\Firefox\Profiles\snq3xiqr.default\extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF} [Not Found]

Chrome:
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR HomePage: Default ->
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.118\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.118\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.118\pdf.dll ()
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File
CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
CHR Plugin: (Windows Live™ Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll No File
CHR Profile: C:\Users\Tiedt\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (YouTube) - C:\Users\Tiedt\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-04-21]
CHR Extension: (Google Search) - C:\Users\Tiedt\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-04-21]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Tiedt\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-13]
CHR Extension: (Skype Click to Call) - C:\Users\Tiedt\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2014-04-17]
CHR Extension: (Google Wallet) - C:\Users\Tiedt\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-11-21]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AVM WLAN Connection Service; C:\Program Files (x86)\avmwlanstick\WlanNetService.exe [376832 2010-10-22] (AVM Berlin) [File not signed]
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
R2 CalendarSynchService; C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Calendar\Service\GCalService.exe [16384 2011-08-16] (Hewlett-Packard) [File not signed]
R2 ezSharedSvc; C:\windows\SysWOW64\ezSharedSvcHost.exe [514232 2010-04-23] (EasyBits Software AS) [File not signed]
R2 HPAuto; C:\Program Files\Hewlett-Packard\HP Auto\HPAuto.exe [682040 2011-02-17] (Hewlett-Packard)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2015-03-17] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1080120 2015-03-17] (Malwarebytes Corporation)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2015-01-30] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [366512 2015-01-30] (Microsoft Corporation)
R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-02] (Symantec Corporation)
R2 pdfcDispatcher; C:\Program Files (x86)\PDF Complete\pdfsvc.exe [1134584 2012-04-04] (PDF Complete Inc)
R2 STacSV; C:\Program Files\IDT\WDM\STacSV64.exe [311296 2012-03-30] (IDT, Inc.) [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 avmeject; C:\Windows\System32\drivers\avmeject.sys [14120 2010-10-25] (AVM Berlin)
R3 fwlanusbn; C:\Windows\System32\DRIVERS\fwlanusbn.sys [714368 2010-10-25] (AVM GmbH)
R3 LVPr2M64; C:\Windows\System32\DRIVERS\LVPr2M64.sys [30232 2009-10-07] ()
S3 LVPr2Mon; C:\Windows\System32\DRIVERS\LVPr2M64.sys [30232 2009-10-07] ()
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25816 2015-03-17] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\windows\system32\drivers\MBAMSwissArmy.sys [136408 2015-04-08] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\windows\system32\drivers\mwac.sys [63704 2015-03-17] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [274696 2014-11-15] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [124560 2014-11-15] (Microsoft Corporation)
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-14] (Microsoft Corporation)
S3 cpuz134; \??\C:\Users\Tiedt\AppData\Local\Temp\cpuz134\cpuz134_x64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-08 13:41 - 2015-04-08 13:41 - 00741144 _____ () C:\Users\Tiedt\Desktop\SystemLook.txt
2015-04-08 13:34 - 2015-04-08 13:41 - 00741142 _____ () C:\Users\Tiedt\Downloads\SystemLook.txt
2015-04-08 13:33 - 2015-04-08 13:33 - 00165376 _____ () C:\Users\Tiedt\Downloads\SystemLook_x64.exe
2015-04-07 23:23 - 2015-04-07 23:23 - 00041209 _____ () C:\Users\Tiedt\Downloads\mbam.txt
2015-04-07 23:10 - 2015-04-07 23:10 - 00001393 _____ () C:\Users\Tiedt\Desktop\JRT.txt
2015-04-07 23:08 - 2015-04-07 23:08 - 00000207 _____ () C:\windows\tweaking.com-regbackup-TIEDT-HP-Windows-7-Home-Premium-(64-bit).dat
2015-04-07 23:08 - 2015-04-07 23:08 - 00000000 ____D () C:\RegBackup
2015-04-07 23:07 - 2015-04-07 23:07 - 02686959 _____ (Thisisu) C:\Users\Tiedt\Downloads\JRT.exe
2015-04-07 22:37 - 2015-04-08 13:27 - 00136408 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2015-04-07 22:37 - 2015-04-07 22:37 - 00001108 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-04-07 22:37 - 2015-04-07 22:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-04-07 22:36 - 2015-04-07 22:37 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-04-07 22:36 - 2015-04-07 22:36 - 21540440 _____ (Malwarebytes Corporation ) C:\Users\Tiedt\Downloads\mbam-setup-2.1.4.1018.exe
2015-04-07 22:36 - 2015-04-07 22:36 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-04-07 22:36 - 2015-03-17 06:15 - 00107736 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2015-04-07 22:36 - 2015-03-17 06:15 - 00063704 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2015-04-07 22:36 - 2015-03-17 06:15 - 00025816 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2015-04-07 22:34 - 2015-04-07 22:34 - 00034650 _____ () C:\Users\Tiedt\Desktop\AdwCleaner[S0].txt
2015-04-07 22:29 - 2015-04-07 22:31 - 00000000 ____D () C:\AdwCleaner
2015-04-07 22:28 - 2015-04-07 22:28 - 02208768 _____ () C:\Users\Tiedt\Downloads\AdwCleaner_4.200.exe
2015-04-07 22:23 - 2015-04-07 22:23 - 00000501 _____ () C:\Users\Tiedt\Downloads\editor.txt
2015-04-07 21:09 - 2015-04-07 21:09 - 00171794 _____ () C:\Users\Tiedt\Desktop\gmer.log
2015-04-07 20:56 - 2015-04-07 22:26 - 00083675 _____ () C:\Users\Tiedt\Desktop\FRST.txt
2015-04-07 20:55 - 2015-04-07 20:55 - 00053044 _____ () C:\Users\Tiedt\Desktop\Addition.txt
2015-04-07 20:53 - 2015-04-07 20:53 - 00380416 _____ () C:\Users\Tiedt\Downloads\Gmer-19357.exe
2015-04-07 20:45 - 2015-04-07 23:15 - 00022932 _____ () C:\Users\Tiedt\Downloads\Addition.txt
2015-04-07 20:41 - 2015-04-08 13:47 - 00018660 _____ () C:\Users\Tiedt\Downloads\FRST.txt
2015-04-07 20:40 - 2015-04-08 13:47 - 00000000 ____D () C:\FRST
2015-04-07 20:39 - 2015-04-07 20:39 - 02095616 _____ (Farbar) C:\Users\Tiedt\Downloads\FRST64.exe
2015-04-07 20:29 - 2015-04-07 20:29 - 00001165 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-04-07 20:29 - 2015-04-07 20:29 - 00001153 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-04-07 20:29 - 2015-04-07 20:29 - 00000000 ____D () C:\Users\Tiedt\AppData\Roaming\Mozilla
2015-04-07 20:29 - 2015-04-07 20:29 - 00000000 ____D () C:\Users\Tiedt\AppData\Local\Mozilla
2015-04-07 20:29 - 2015-04-07 20:29 - 00000000 ____D () C:\ProgramData\Mozilla
2015-04-07 20:29 - 2015-04-07 20:29 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-04-07 20:29 - 2015-04-07 20:29 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-04-07 20:27 - 2015-04-07 20:27 - 00243656 _____ () C:\Users\Tiedt\Downloads\Firefox Setup Stub 37.0.1.exe
2015-04-07 20:04 - 2015-04-07 21:16 - 00000004 _____ () C:\windows\SysWOW64\029B560A371F4E00AB32838EBC01B9E7
2015-04-07 19:14 - 2015-04-07 19:14 - 00000000 ____D () C:\Users\Tiedt\AppData\Local\CrashRpt
2015-04-04 15:10 - 2015-04-04 15:10 - 00000000 ___SD () C:\windows\SysWOW64\GWX
2015-04-04 15:10 - 2015-04-04 15:10 - 00000000 ___SD () C:\windows\system32\GWX
2015-03-24 21:28 - 2015-03-11 06:06 - 00943616 _____ (Microsoft Corporation) C:\windows\system32\appraiser.dll
2015-03-24 21:28 - 2015-03-11 06:06 - 00760832 _____ (Microsoft Corporation) C:\windows\system32\invagent.dll
2015-03-24 21:28 - 2015-03-11 06:06 - 00677888 _____ (Microsoft Corporation) C:\windows\system32\generaltel.dll
2015-03-24 21:28 - 2015-03-11 06:06 - 00414720 _____ (Microsoft Corporation) C:\windows\system32\devinv.dll
2015-03-24 21:28 - 2015-03-11 06:05 - 00227328 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2015-03-24 21:28 - 2015-03-11 06:05 - 00192000 _____ (Microsoft Corporation) C:\windows\system32\aepic.dll
2015-03-24 21:28 - 2015-03-11 06:05 - 00030720 _____ (Microsoft Corporation) C:\windows\system32\acmigration.dll
2015-03-24 21:28 - 2015-03-11 06:02 - 01107456 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2015-03-10 19:48 - 2015-02-20 06:41 - 00041984 _____ (Microsoft Corporation) C:\windows\system32\lpk.dll
2015-03-10 19:48 - 2015-02-20 06:40 - 00100864 _____ (Microsoft Corporation) C:\windows\system32\fontsub.dll
2015-03-10 19:48 - 2015-02-20 06:40 - 00046080 _____ (Adobe Systems) C:\windows\system32\atmlib.dll
2015-03-10 19:48 - 2015-02-20 06:40 - 00014336 _____ (Microsoft Corporation) C:\windows\system32\dciman32.dll
2015-03-10 19:48 - 2015-02-20 06:13 - 00070656 _____ (Microsoft Corporation) C:\windows\SysWOW64\fontsub.dll
2015-03-10 19:48 - 2015-02-20 06:13 - 00034304 _____ (Adobe Systems) C:\windows\SysWOW64\atmlib.dll
2015-03-10 19:48 - 2015-02-20 06:13 - 00010240 _____ (Microsoft Corporation) C:\windows\SysWOW64\dciman32.dll
2015-03-10 19:48 - 2015-02-20 06:12 - 00025600 _____ (Microsoft Corporation) C:\windows\SysWOW64\lpk.dll
2015-03-10 19:48 - 2015-02-20 05:29 - 00372224 _____ (Adobe Systems Incorporated) C:\windows\system32\atmfd.dll
2015-03-10 19:48 - 2015-02-20 05:09 - 00299008 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\atmfd.dll
2015-03-10 19:48 - 2015-02-03 05:34 - 05554104 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2015-03-10 19:48 - 2015-02-03 05:34 - 00693176 _____ (Microsoft Corporation) C:\windows\system32\winload.efi
2015-03-10 19:48 - 2015-02-03 05:34 - 00094656 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mountmgr.sys
2015-03-10 19:48 - 2015-02-03 05:33 - 00616360 _____ (Microsoft Corporation) C:\windows\system32\winresume.efi
2015-03-10 19:48 - 2015-02-03 05:31 - 14632960 _____ (Microsoft Corporation) C:\windows\system32\wmp.dll
2015-03-10 19:48 - 2015-02-03 05:31 - 04121600 _____ (Microsoft Corporation) C:\windows\system32\mf.dll
2015-03-10 19:48 - 2015-02-03 05:31 - 01574400 _____ (Microsoft Corporation) C:\windows\system32\quartz.dll
2015-03-10 19:48 - 2015-02-03 05:31 - 00782848 _____ (Microsoft Corporation) C:\windows\system32\wmdrmsdk.dll
2015-03-10 19:48 - 2015-02-03 05:31 - 00641024 _____ (Microsoft Corporation) C:\windows\system32\msscp.dll
2015-03-10 19:48 - 2015-02-03 05:31 - 00503808 _____ (Microsoft Corporation) C:\windows\system32\srcore.dll
2015-03-10 19:48 - 2015-02-03 05:31 - 00500224 _____ (Microsoft Corporation) C:\windows\system32\AUDIOKSE.dll
2015-03-10 19:48 - 2015-02-03 05:31 - 00432128 _____ (Microsoft Corporation) C:\windows\system32\mfplat.dll
2015-03-10 19:48 - 2015-02-03 05:31 - 00371712 _____ (Microsoft Corporation) C:\windows\system32\qdvd.dll
2015-03-10 19:48 - 2015-02-03 05:31 - 00325632 _____ (Microsoft Corporation) C:\windows\system32\msnetobj.dll
2015-03-10 19:48 - 2015-02-03 05:31 - 00229376 _____ (Microsoft Corporation) C:\windows\system32\wintrust.dll
2015-03-10 19:48 - 2015-02-03 05:31 - 00206848 _____ (Microsoft Corporation) C:\windows\system32\mfps.dll
2015-03-10 19:48 - 2015-02-03 05:31 - 00188416 _____ (Microsoft Corporation) C:\windows\system32\pcasvc.dll
2015-03-10 19:48 - 2015-02-03 05:31 - 00063488 _____ (Microsoft Corporation) C:\windows\system32\setbcdlocale.dll
2015-03-10 19:48 - 2015-02-03 05:31 - 00050176 _____ (Microsoft Corporation) C:\windows\system32\srclient.dll
2015-03-10 19:48 - 2015-02-03 05:31 - 00037376 _____ (Microsoft Corporation) C:\windows\system32\pcadm.dll
2015-03-10 19:48 - 2015-02-03 05:31 - 00011264 _____ (Microsoft Corporation) C:\windows\system32\msmmsp.dll
2015-03-10 19:48 - 2015-02-03 05:31 - 00009728 _____ (Microsoft Corporation) C:\windows\system32\spwmp.dll
2015-03-10 19:48 - 2015-02-03 05:31 - 00005120 _____ (Microsoft Corporation) C:\windows\system32\msdxm.ocx
2015-03-10 19:48 - 2015-02-03 05:31 - 00005120 _____ (Microsoft Corporation) C:\windows\system32\dxmasf.dll
2015-03-10 19:48 - 2015-02-03 05:30 - 12625920 _____ (Microsoft Corporation) C:\windows\system32\wmploc.DLL
2015-03-10 19:48 - 2015-02-03 05:30 - 01480192 _____ (Microsoft Corporation) C:\windows\system32\crypt32.dll
2015-03-10 19:48 - 2015-02-03 05:30 - 01202176 _____ (Microsoft Corporation) C:\windows\system32\drmv2clt.dll
2015-03-10 19:48 - 2015-02-03 05:30 - 01069056 _____ (Microsoft Corporation) C:\windows\system32\cryptui.dll
2015-03-10 19:48 - 2015-02-03 05:30 - 00842240 _____ (Microsoft Corporation) C:\windows\system32\blackbox.dll
2015-03-10 19:48 - 2015-02-03 05:30 - 00680960 _____ (Microsoft Corporation) C:\windows\system32\audiosrv.dll
2015-03-10 19:48 - 2015-02-03 05:30 - 00631808 _____ (Microsoft Corporation) C:\windows\system32\evr.dll
2015-03-10 19:48 - 2015-02-03 05:30 - 00497664 _____ (Microsoft Corporation) C:\windows\system32\drmmgrtn.dll
2015-03-10 19:48 - 2015-02-03 05:30 - 00440832 _____ (Microsoft Corporation) C:\windows\system32\AudioEng.dll
2015-03-10 19:48 - 2015-02-03 05:30 - 00296960 _____ (Microsoft Corporation) C:\windows\system32\rstrui.exe
2015-03-10 19:48 - 2015-02-03 05:30 - 00296448 _____ (Microsoft Corporation) C:\windows\system32\AudioSes.dll
2015-03-10 19:48 - 2015-02-03 05:30 - 00284672 _____ (Microsoft Corporation) C:\windows\system32\EncDump.dll
2015-03-10 19:48 - 2015-02-03 05:30 - 00187904 _____ (Microsoft Corporation) C:\windows\system32\cryptsvc.dll
2015-03-10 19:48 - 2015-02-03 05:30 - 00146944 _____ (Microsoft Corporation) C:\windows\system32\appidpolicyconverter.exe
2015-03-10 19:48 - 2015-02-03 05:30 - 00140288 _____ (Microsoft Corporation) C:\windows\system32\cryptnet.dll
2015-03-10 19:48 - 2015-02-03 05:30 - 00126464 _____ (Microsoft Corporation) C:\windows\system32\audiodg.exe
2015-03-10 19:48 - 2015-02-03 05:30 - 00112640 _____ (Microsoft Corporation) C:\windows\system32\smss.exe
2015-03-10 19:48 - 2015-02-03 05:30 - 00082432 _____ (Microsoft Corporation) C:\windows\system32\cryptsp.dll
2015-03-10 19:48 - 2015-02-03 05:30 - 00058880 _____ (Microsoft Corporation) C:\windows\system32\appidapi.dll
2015-03-10 19:48 - 2015-02-03 05:30 - 00055808 _____ (Microsoft Corporation) C:\windows\system32\rrinstaller.exe
2015-03-10 19:48 - 2015-02-03 05:30 - 00043520 _____ (Microsoft Corporation) C:\windows\system32\csrsrv.dll
2015-03-10 19:48 - 2015-02-03 05:30 - 00032256 _____ (Microsoft Corporation) C:\windows\system32\appidsvc.dll
2015-03-10 19:48 - 2015-02-03 05:30 - 00024576 _____ (Microsoft Corporation) C:\windows\system32\mfpmp.exe
2015-03-10 19:48 - 2015-02-03 05:30 - 00017920 _____ (Microsoft Corporation) C:\windows\system32\appidcertstorecheck.exe
2015-03-10 19:48 - 2015-02-03 05:30 - 00011264 _____ (Microsoft Corporation) C:\windows\system32\pcawrk.exe
2015-03-10 19:48 - 2015-02-03 05:30 - 00009728 _____ (Microsoft Corporation) C:\windows\system32\pcalua.exe
2015-03-10 19:48 - 2015-02-03 05:29 - 00008704 _____ (Microsoft Corporation) C:\windows\system32\pcaevts.dll
2015-03-10 19:48 - 2015-02-03 05:28 - 00006656 _____ (Microsoft Corporation) C:\windows\system32\apisetschema.dll
2015-03-10 19:48 - 2015-02-03 05:28 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\mferror.dll
2015-03-10 19:48 - 2015-02-03 05:19 - 00663552 _____ (Microsoft Corporation) C:\windows\system32\Drivers\PEAuth.sys
2015-03-10 19:48 - 2015-02-03 05:16 - 03973048 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe
2015-03-10 19:48 - 2015-02-03 05:16 - 03917760 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe
2015-03-10 19:48 - 2015-02-03 05:12 - 11411968 _____ (Microsoft Corporation) C:\windows\SysWOW64\wmp.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 03209728 _____ (Microsoft Corporation) C:\windows\SysWOW64\mf.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 01329664 _____ (Microsoft Corporation) C:\windows\SysWOW64\quartz.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 01174528 _____ (Microsoft Corporation) C:\windows\SysWOW64\crypt32.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 01005056 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptui.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 00988160 _____ (Microsoft Corporation) C:\windows\SysWOW64\drmv2clt.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 00744960 _____ (Microsoft Corporation) C:\windows\SysWOW64\blackbox.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 00617984 _____ (Microsoft Corporation) C:\windows\SysWOW64\wmdrmsdk.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 00519680 _____ (Microsoft Corporation) C:\windows\SysWOW64\qdvd.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 00504320 _____ (Microsoft Corporation) C:\windows\SysWOW64\msscp.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 00489984 _____ (Microsoft Corporation) C:\windows\SysWOW64\evr.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 00442880 _____ (Microsoft Corporation) C:\windows\SysWOW64\AUDIOKSE.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 00406016 _____ (Microsoft Corporation) C:\windows\SysWOW64\drmmgrtn.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 00374784 _____ (Microsoft Corporation) C:\windows\SysWOW64\AudioEng.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 00354816 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfplat.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 00265216 _____ (Microsoft Corporation) C:\windows\SysWOW64\msnetobj.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 00195584 _____ (Microsoft Corporation) C:\windows\SysWOW64\AudioSes.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 00179200 _____ (Microsoft Corporation) C:\windows\SysWOW64\wintrust.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 00143872 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptsvc.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 00103936 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptnet.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 00103424 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfps.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 00081408 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptsp.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 00050688 _____ (Microsoft Corporation) C:\windows\SysWOW64\appidapi.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\srclient.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 00008192 _____ (Microsoft Corporation) C:\windows\SysWOW64\spwmp.dll
2015-03-10 19:48 - 2015-02-03 05:12 - 00004096 _____ (Microsoft Corporation) C:\windows\SysWOW64\msdxm.ocx
2015-03-10 19:48 - 2015-02-03 05:12 - 00004096 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxmasf.dll
2015-03-10 19:48 - 2015-02-03 05:11 - 12625408 _____ (Microsoft Corporation) C:\windows\SysWOW64\wmploc.DLL
2015-03-10 19:48 - 2015-02-03 05:11 - 00050176 _____ (Microsoft Corporation) C:\windows\SysWOW64\rrinstaller.exe
2015-03-10 19:48 - 2015-02-03 05:11 - 00023040 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfpmp.exe
2015-03-10 19:48 - 2015-02-03 05:09 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\mferror.dll
2015-03-10 19:48 - 2015-02-03 05:08 - 00006656 _____ (Microsoft Corporation) C:\windows\SysWOW64\apisetschema.dll
2015-03-10 19:48 - 2015-02-03 04:32 - 00061440 _____ (Microsoft Corporation) C:\windows\system32\Drivers\appid.sys
2015-03-10 19:48 - 2014-11-01 00:24 - 00619056 _____ (Microsoft Corporation) C:\windows\system32\winload.exe
2015-03-10 19:48 - 2014-06-28 02:21 - 00532176 _____ (Microsoft Corporation) C:\windows\system32\winresume.exe
2015-03-10 19:48 - 2014-06-28 02:21 - 00457400 _____ (Microsoft Corporation) C:\windows\system32\ci.dll
2015-03-10 19:47 - 2015-03-06 07:56 - 00155576 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys
2015-03-10 19:47 - 2015-03-06 07:56 - 00095680 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecdd.sys
2015-03-10 19:47 - 2015-03-06 07:42 - 01461760 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll
2015-03-10 19:47 - 2015-03-06 07:42 - 00728064 _____ (Microsoft Corporation) C:\windows\system32\kerberos.dll
2015-03-10 19:47 - 2015-03-06 07:42 - 00341504 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll
2015-03-10 19:47 - 2015-03-06 07:42 - 00314880 _____ (Microsoft Corporation) C:\windows\system32\msv1_0.dll
2015-03-10 19:47 - 2015-03-06 07:42 - 00309760 _____ (Microsoft Corporation) C:\windows\system32\ncrypt.dll
2015-03-10 19:47 - 2015-03-06 07:42 - 00210944 _____ (Microsoft Corporation) C:\windows\system32\wdigest.dll
2015-03-10 19:47 - 2015-03-06 07:42 - 00136192 _____ (Microsoft Corporation) C:\windows\system32\sspicli.dll
2015-03-10 19:47 - 2015-03-06 07:42 - 00086528 _____ (Microsoft Corporation) C:\windows\system32\TSpkg.dll
2015-03-10 19:47 - 2015-03-06 07:42 - 00029184 _____ (Microsoft Corporation) C:\windows\system32\sspisrv.dll
2015-03-10 19:47 - 2015-03-06 07:42 - 00028160 _____ (Microsoft Corporation) C:\windows\system32\secur32.dll
2015-03-10 19:47 - 2015-03-06 07:42 - 00022016 _____ (Microsoft Corporation) C:\windows\system32\credssp.dll
2015-03-10 19:47 - 2015-03-06 07:41 - 00064000 _____ (Microsoft Corporation) C:\windows\system32\auditpol.exe
2015-03-10 19:47 - 2015-03-06 07:41 - 00031232 _____ (Microsoft Corporation) C:\windows\system32\lsass.exe
2015-03-10 19:47 - 2015-03-06 07:39 - 00060416 _____ (Microsoft Corporation) C:\windows\system32\msobjs.dll
2015-03-10 19:47 - 2015-03-06 07:38 - 00146432 _____ (Microsoft Corporation) C:\windows\system32\msaudite.dll
2015-03-10 19:47 - 2015-03-06 07:36 - 00686080 _____ (Microsoft Corporation) C:\windows\system32\adtschema.dll
2015-03-10 19:47 - 2015-03-06 07:10 - 00550912 _____ (Microsoft Corporation) C:\windows\SysWOW64\kerberos.dll
2015-03-10 19:47 - 2015-03-06 07:10 - 00259584 _____ (Microsoft Corporation) C:\windows\SysWOW64\msv1_0.dll
2015-03-10 19:47 - 2015-03-06 07:10 - 00248832 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll
2015-03-10 19:47 - 2015-03-06 07:10 - 00221184 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncrypt.dll
2015-03-10 19:47 - 2015-03-06 07:10 - 00172032 _____ (Microsoft Corporation) C:\windows\SysWOW64\wdigest.dll
2015-03-10 19:47 - 2015-03-06 07:10 - 00065536 _____ (Microsoft Corporation) C:\windows\SysWOW64\TSpkg.dll
2015-03-10 19:47 - 2015-03-06 07:10 - 00022016 _____ (Microsoft Corporation) C:\windows\SysWOW64\secur32.dll
2015-03-10 19:47 - 2015-03-06 07:10 - 00017408 _____ (Microsoft Corporation) C:\windows\SysWOW64\credssp.dll
2015-03-10 19:47 - 2015-03-06 07:09 - 00096768 _____ (Microsoft Corporation) C:\windows\SysWOW64\sspicli.dll
2015-03-10 19:47 - 2015-03-06 07:09 - 00050176 _____ (Microsoft Corporation) C:\windows\SysWOW64\auditpol.exe
2015-03-10 19:47 - 2015-03-06 07:07 - 00146432 _____ (Microsoft Corporation) C:\windows\SysWOW64\msaudite.dll
2015-03-10 19:47 - 2015-03-06 07:07 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\msobjs.dll
2015-03-10 19:47 - 2015-03-06 07:06 - 00686080 _____ (Microsoft Corporation) C:\windows\SysWOW64\adtschema.dll
2015-03-10 19:47 - 2015-02-26 05:25 - 03204096 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2015-03-10 19:47 - 2015-02-24 05:15 - 00389800 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
2015-03-10 19:47 - 2015-02-24 04:32 - 00342696 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll
2015-03-10 19:47 - 2015-02-21 03:16 - 25021440 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2015-03-10 19:47 - 2015-02-21 02:41 - 12827648 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2015-03-10 19:47 - 2015-02-21 02:27 - 00418304 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
2015-03-10 19:47 - 2015-02-21 02:27 - 00285696 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
2015-03-10 19:47 - 2015-02-21 02:25 - 19720192 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2015-03-10 19:47 - 2015-02-21 01:58 - 00092160 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2015-03-10 19:47 - 2015-02-21 01:32 - 00076288 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2015-03-10 19:47 - 2015-02-20 05:06 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2015-03-10 19:47 - 2015-02-20 05:05 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
2015-03-10 19:47 - 2015-02-20 04:50 - 00066560 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2015-03-10 19:47 - 2015-02-20 04:49 - 00584192 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2015-03-10 19:47 - 2015-02-20 04:49 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
2015-03-10 19:47 - 2015-02-20 04:48 - 02886144 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2015-03-10 19:47 - 2015-02-20 04:47 - 00088064 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll
2015-03-10 19:47 - 2015-02-20 04:41 - 00054784 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2015-03-10 19:47 - 2015-02-20 04:40 - 00034304 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2015-03-10 19:47 - 2015-02-20 04:36 - 00633856 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2015-03-10 19:47 - 2015-02-20 04:35 - 00144384 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2015-03-10 19:47 - 2015-02-20 04:35 - 00114688 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
2015-03-10 19:47 - 2015-02-20 04:34 - 00814080 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
2015-03-10 19:47 - 2015-02-20 04:32 - 06035456 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2015-03-10 19:47 - 2015-02-20 04:26 - 00968704 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2015-03-10 19:47 - 2015-02-20 04:22 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2015-03-10 19:47 - 2015-02-20 04:22 - 00490496 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2015-03-10 19:47 - 2015-02-20 04:13 - 00077824 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll
2015-03-10 19:47 - 2015-02-20 04:09 - 00503296 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2015-03-10 19:47 - 2015-02-20 04:08 - 00199680 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2015-03-10 19:47 - 2015-02-20 04:08 - 00062464 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2015-03-10 19:47 - 2015-02-20 04:08 - 00047616 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll
2015-03-10 19:47 - 2015-02-20 04:06 - 00064000 _____ (Microsoft Corporation) C:\windows\SysWOW64\MshtmlDac.dll
2015-03-10 19:47 - 2015-02-20 04:05 - 00316928 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2015-03-10 19:47 - 2015-02-20 04:03 - 02278400 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2015-03-10 19:47 - 2015-02-20 04:01 - 00047104 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2015-03-10 19:47 - 2015-02-20 04:00 - 00030720 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2015-03-10 19:47 - 2015-02-20 03:58 - 00478208 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2015-03-10 19:47 - 2015-02-20 03:56 - 00620032 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll
2015-03-10 19:47 - 2015-02-20 03:56 - 00115712 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe
2015-03-10 19:47 - 2015-02-20 03:49 - 00801280 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2015-03-10 19:47 - 2015-02-20 03:49 - 00718848 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2015-03-10 19:47 - 2015-02-20 03:47 - 01359360 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll
2015-03-10 19:47 - 2015-02-20 03:46 - 02125824 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2015-03-10 19:47 - 2015-02-20 03:43 - 14398976 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2015-03-10 19:47 - 2015-02-20 03:41 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-03-10 19:47 - 2015-02-20 03:37 - 00168960 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
2015-03-10 19:47 - 2015-02-20 03:30 - 04300288 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2015-03-10 19:47 - 2015-02-20 03:28 - 02358784 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2015-03-10 19:47 - 2015-02-20 03:24 - 02052608 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2015-03-10 19:47 - 2015-02-20 03:24 - 00689152 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2015-03-10 19:47 - 2015-02-20 03:23 - 01155072 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll
2015-03-10 19:47 - 2015-02-20 03:16 - 01548288 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2015-03-10 19:47 - 2015-02-20 03:03 - 00800768 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2015-03-10 19:47 - 2015-02-20 03:01 - 01888256 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2015-03-10 19:47 - 2015-02-20 02:57 - 01311232 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2015-03-10 19:47 - 2015-02-20 02:55 - 00710144 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
2015-03-10 19:47 - 2015-02-13 07:26 - 12875264 _____ (Microsoft Corporation) C:\windows\SysWOW64\shell32.dll
2015-03-10 19:47 - 2015-02-13 07:22 - 14177280 _____ (Microsoft Corporation) C:\windows\system32\shell32.dll
2015-03-10 19:47 - 2015-02-03 05:31 - 01424896 _____ (Microsoft Corporation) C:\windows\system32\WindowsCodecs.dll
2015-03-10 19:47 - 2015-02-03 05:31 - 00215552 _____ (Microsoft Corporation) C:\windows\system32\ubpm.dll
2015-03-10 19:47 - 2015-02-03 05:12 - 01230848 _____ (Microsoft Corporation) C:\windows\SysWOW64\WindowsCodecs.dll
2015-03-10 19:47 - 2015-02-03 05:12 - 00171520 _____ (Microsoft Corporation) C:\windows\SysWOW64\ubpm.dll
2015-03-10 19:47 - 2015-01-31 01:56 - 00459336 _____ (Microsoft Corporation) C:\windows\system32\Drivers\cng.sys
2015-03-10 19:47 - 2015-01-17 04:48 - 01067520 _____ (Microsoft Corporation) C:\windows\system32\msctf.dll
2015-03-10 19:47 - 2015-01-17 04:30 - 00828928 _____ (Microsoft Corporation) C:\windows\SysWOW64\msctf.dll
2015-03-10 19:46 - 2015-02-04 05:16 - 00465920 _____ (Microsoft Corporation) C:\windows\system32\WMPhoto.dll
2015-03-10 19:46 - 2015-02-04 04:54 - 00417792 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMPhoto.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-08 13:34 - 2009-07-14 06:45 - 00024400 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-04-08 13:34 - 2009-07-14 06:45 - 00024400 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-04-08 13:31 - 2012-10-04 11:20 - 01771009 _____ () C:\windows\WindowsUpdate.log
2015-04-08 13:31 - 2012-07-06 09:19 - 00699416 _____ () C:\windows\system32\perfh007.dat
2015-04-08 13:31 - 2012-07-06 09:19 - 00149556 _____ () C:\windows\system32\perfc007.dat
2015-04-08 13:31 - 2009-07-14 07:13 - 01620612 _____ () C:\windows\system32\PerfStringBackup.INI
2015-04-08 13:28 - 2012-10-04 20:26 - 00000000 ____D () C:\Users\Tiedt\AppData\Roaming\Skype
2015-04-08 13:27 - 2013-04-21 21:14 - 00001106 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-04-08 13:27 - 2012-07-06 09:53 - 00000000 ____D () C:\ProgramData\PDFC
2015-04-08 13:27 - 2009-07-14 07:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2015-04-08 13:27 - 2009-07-14 06:51 - 00142907 _____ () C:\windows\setupact.log
2015-04-08 13:26 - 2010-11-21 05:47 - 01485278 _____ () C:\windows\PFRO.log
2015-04-08 00:03 - 2013-04-21 21:14 - 00001110 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-04-07 23:54 - 2012-07-06 09:48 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2015-04-07 22:58 - 2012-10-04 18:17 - 00000000 ____D () C:\Program Files (x86)\avmwlanstick
2015-04-07 22:31 - 2013-04-21 21:14 - 00001284 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-04-07 22:31 - 2013-04-21 21:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-04-07 22:31 - 2012-12-26 22:58 - 00001154 _____ () C:\Users\Tiedt\Desktop\Internet Explorer.lnk
2015-04-07 22:31 - 2012-10-04 11:29 - 00000997 _____ () C:\Users\Tiedt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-04-07 22:31 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2015-04-07 22:30 - 2012-10-04 11:22 - 00000000 ____D () C:\Users\Tiedt
2015-04-07 21:53 - 2012-10-04 20:36 - 00000000 ____D () C:\Users\Tiedt\AppData\Local\CrashDumps
2015-04-07 19:16 - 2009-07-14 05:20 - 00000000 ____D () C:\Program Files\Common Files\System
2015-04-07 17:39 - 2012-10-04 22:53 - 00000000 ____D () C:\Users\Tiedt\Desktop\Bilder
2015-04-07 13:54 - 2012-10-04 11:29 - 00003930 _____ () C:\windows\System32\Tasks\User_Feed_Synchronization-{7D6F304C-B00A-4C98-8F21-73A9DAAE244A}
2015-04-04 15:09 - 2013-09-08 20:18 - 00003186 _____ () C:\windows\System32\Tasks\HPCeeScheduleForTiedt
2015-04-04 15:09 - 2013-09-08 20:18 - 00000332 _____ () C:\windows\Tasks\HPCeeScheduleForTiedt.job
2015-04-04 15:09 - 2012-10-06 10:39 - 00000000 ____D () C:\Users\Tiedt\AppData\Roaming\HpUpdate
2015-04-04 15:09 - 2012-10-06 10:39 - 00000000 ____D () C:\Users\Tiedt\AppData\Roaming\HP Support Assistant
2015-04-01 19:55 - 2012-10-04 22:51 - 00000000 ____D () C:\Users\Tiedt\Desktop\Christine
2015-03-31 19:10 - 2014-01-13 19:53 - 00040448 _____ () C:\Users\Tiedt\Desktop\Betriebskosten ab 2014.xls
2015-03-31 08:56 - 2012-10-06 10:41 - 00003218 _____ () C:\windows\System32\Tasks\HPCeeScheduleForTIEDT-HP$
2015-03-31 08:56 - 2012-10-06 10:41 - 00000342 _____ () C:\windows\Tasks\HPCeeScheduleForTIEDT-HP$.job
2015-03-25 20:48 - 2014-12-11 20:08 - 00000000 ____D () C:\windows\system32\appraiser
2015-03-25 20:48 - 2014-05-08 16:45 - 00000000 ___SD () C:\windows\system32\CompatTel
2015-03-14 10:18 - 2009-07-14 07:09 - 00000000 ____D () C:\windows\System32\Tasks\WPD
2015-03-13 17:25 - 2009-07-14 07:08 - 00032632 _____ () C:\windows\Tasks\SCHEDLGU.TXT
2015-03-12 21:03 - 2009-07-14 05:20 - 00000000 ____D () C:\windows\rescache
2015-03-11 17:21 - 2009-07-14 06:45 - 00356936 _____ () C:\windows\system32\FNTCACHE.DAT
2015-03-11 17:19 - 2009-07-14 05:20 - 00000000 ____D () C:\windows\SysWOW64\Dism
2015-03-11 17:19 - 2009-07-14 05:20 - 00000000 ____D () C:\windows\system32\Dism
2015-03-10 20:25 - 2013-08-14 20:25 - 00000000 ____D () C:\windows\system32\MRT
2015-03-10 20:22 - 2012-10-05 12:14 - 122905848 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe

==================== Files in the root of some directories =======

2012-12-26 11:10 - 2012-12-26 11:10 - 0000057 _____ () C:\ProgramData\Ament.ini

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-03-28 19:41

==================== End Of Log ============================
--- --- ---


Addition

Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-03-2015
Ran by Tiedt at 2015-04-08 13:48:50
Running from C:\Users\Tiedt\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Enabled - Up to date) {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}
AS: Microsoft Security Essentials (Enabled - Up to date) {0C8D1929-27B2-688D-E114-9117BD2BB1B7}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

ABBYY FineReader 6.0 Sprint (HKLM-x32\...\{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}) (Version: 6.00.1395.4512 - ABBYY Software House)
Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.305 - Adobe Systems Incorporated)
AVM FRITZ!WLAN (HKLM-x32\...\AVMWLANCLI) (Version:  - AVM Berlin)
Bejeweled 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Belkin F5D8053 N Wireless USB Adapter (HKLM-x32\...\InstallShield_{E6607F5B-50E7-4B54-81B7-F0600E3C8CF4}) (Version: 2.0.0.10 - Belkin)
Belkin F5D8053 N Wireless USB Adapter (x32 Version: 2.0.0.10 - Belkin) Hidden
Cake Mania (x32 Version: 2.2.0.98 - WildTangent) Hidden
Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Compatibility Pack für 2007 Office System (HKLM-x32\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Cradle of Rome 2 (x32 Version: 2.2.0.98 - WildTangent) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DirectX for Managed Code Update (Summer 2004) (x32 Version: 9.02.2904 - Microsoft) Hidden
Facebook (HKLM-x32\...\{8AE50893-3A87-4439-9A57-942ED43F7189}) (Version: 1.1.0004 - Hewlett-Packard)
Farm Frenzy (x32 Version: 2.2.0.98 - WildTangent) Hidden
Farmscapes (x32 Version: 2.2.0.97 - WildTangent) Hidden
FATE (x32 Version: 2.2.0.97 - WildTangent) Hidden
Final Drive Fury (x32 Version: 2.2.0.95 - WildTangent) Hidden
Fishdom (TM) 2 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 41.0.2272.118 - Google Inc.)
Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.6227.252 - Google Inc.)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
Hewlett-Packard ACLM.NET v1.1.2.0 (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden
HP Calendar (HKLM-x32\...\{2B38E0FA-D8A5-4EBF-A018-E3C1C8E7A2E2}) (Version: 5.1.4245.23508 - Hewlett-Packard)
HP Clock (HKLM-x32\...\{750E9D0F-B188-4A7E-ADD2-84B7ED7D32F6}) (Version: 5.1.4281.27332 - Hewlett-Packard)
HP Deskjet 3520 series - Grundlegende Software für das Gerät (HKLM\...\{A9C5381E-F415-4EDC-95A2-9164218FEA8A}) (Version: 27.0.847.0 - Hewlett-Packard Co.)
HP Deskjet 3520 series Hilfe (HKLM-x32\...\{6B953497-169C-4929-9AA9-A9F510347468}) (Version: 27.0.0 - Hewlett Packard)
HP Deskjet 3520 series Setup Guide (HKLM-x32\...\{AEEDCEB7-00B8-4BE1-B492-AB04803D5F1E}) (Version: 27.0.0 - Hewlett Packard)
HP Games (HKLM-x32\...\WildTangent hp Master Uninstall) (Version: 1.0.2.5 - WildTangent)
HP Magic Canvas (HKLM-x32\...\{DDFDC9D6-4220-41F8-BF9A-8E7512C4EF52}) (Version: 5.1.15.0 - Hewlett-Packard)
HP Magic Canvas Tutorials (HKLM-x32\...\{858FCB65-7C6D-4BA4-AD80-A3CB3744CE09}_is1) (Version: 6.0.0.0 - Hewlett-Packard)
HP Notes (HKLM-x32\...\{86BAB08A-5E66-4C53-82E3-C1E91673C7CA}) (Version: 5.1.4274.30382 - Hewlett-Packard)
HP Odometer (HKLM-x32\...\{B8AC1A89-FFD1-4F97-8051-E505A160F562}) (Version: 2.10.0000 - Hewlett-Packard)
HP Photo Creations (HKLM-x32\...\HP Photo Creations) (Version: 1.0.0.3341 - HP Photo Creations Powered by RocketLife)
HP RSS (HKLM-x32\...\{452479C5-0118-48E9-AA69-0A7339F95FC8}) (Version: 5.1.4289.23799 - Hewlett-Packard)
HP Setup (HKLM-x32\...\{438363A8-F486-4C37-834C-4955773CB3D3}) (Version: 9.1.15430.4033 - Hewlett-Packard Company)
HP Support Assistant (HKLM-x32\...\{6F44AF95-3CDE-4513-AD3F-6D45F17BF324}) (Version: 6.1.12.1 - Hewlett-Packard Company)
HP Support Information (HKLM-x32\...\{B2B7B1C8-7C8B-476C-BE2C-049731C55992}) (Version: 11.00.0001 - Hewlett-Packard)
HP TouchSmart Background - Beats (HKLM-x32\...\{6A6F8D36-04BA-41E9-9004-1789BD545874}) (Version: 1.0.1.0 - Hewlett-Packard)
HP TouchSmart RecipeBox (HKLM-x32\...\{20714B53-FC73-4F9C-9687-49EB237D6FD7}) (Version: 3.0.3830.27730 - Hewlett-Packard)
HP Update (HKLM-x32\...\{6F1C00D2-25C2-4CBA-8126-AE9A6E2E9CD5}) (Version: 5.003.003.001 - Hewlett-Packard)
Insaniquarium Deluxe (x32 Version: 2.2.0.97 - WildTangent) Hidden
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.0.0.1351 - Intel Corporation)
Jewel Match 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Jewel Quest II (x32 Version: 2.2.0.97 - WildTangent) Hidden
Jewel Quest Solitaire 2 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
LabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.4507 - CyberLink Corp.)
LabelPrint (x32 Version: 2.5.4507 - CyberLink Corp.) Hidden
lection (HKLM-x32\...\{55d4b236-fe79-4782-cc2d-55acaf147087}) (Version: 1.0.0 - subpar)
Logitech Vid HD (HKLM-x32\...\Logitech Vid) (Version: 7.2 (7259) - Logitech Inc..)
Logitech Webcam Software (HKLM\...\{987FE247-4E69-4A2E-A961-D14F901FDBF6}) (Version: 12.10.1113 - Logitech Inc.)
Logitech Webcam Software-Treiberpaket (HKLM\...\lvdrivers_12.10) (Version: 12.10.1110 - Logitech Inc.)
LolliScan (HKLM-x32\...\LolliScan) (Version:  - )
Magic Desktop (HKLM-x32\...\EasyBits Magic Desktop) (Version: 3.0 - EasyBits Software AS)
Mahjongg Artifacts (x32 Version: 2.2.0.95 - WildTangent) Hidden
Malwarebytes Anti-Malware Version 2.1.4.1018 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.4.1018 - Malwarebytes Corporation)
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.150.1 - McAfee, Inc.)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Mathematics (HKLM-x32\...\{4D090F70-6F08-4B60-9357-A1DFD4458F09}) (Version: 4.0 - Microsoft Corporation)
Microsoft Office 2003 Web Components (HKLM-x32\...\{90A40407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Professional Edition 2003 (HKLM-x32\...\{90110407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.7.205.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 37.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 37.0.1 (x86 de)) (Version: 37.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 37.0.1 - Mozilla)
Mystery of Mortlake Mansion (x32 Version: 2.2.0.98 - WildTangent) Hidden
Norton Online Backup (HKLM-x32\...\{40A66DF6-22D3-44B5-A7D3-83B118A2C0DC}) (Version: 2.1.17869 - Symantec Corporation)
NVIDIA Graphics Driver 296.28 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 296.28 - NVIDIA Corporation)
NVIDIA HD Audio Driver 1.3.14.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.14.1 - NVIDIA Corporation)
NVIDIA PhysX System Software 9.12.0213 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.12.0213 - NVIDIA Corporation)
opensource (x32 Version: 1.0.14960.3876 - Your Company Name) Hidden
PDF Complete Corporate Edition (HKLM-x32\...\PDF Complete) (Version: 4.0.95 - PDF Complete, Inc)
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.98 - WildTangent) Hidden
PlayReady PC Runtime amd64 (HKLM\...\{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}) (Version: 1.3.0 - Microsoft Corporation)
Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden
Power2Go (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.1.6207 - CyberLink Corp.)
Power2Go (x32 Version: 6.1.6207 - CyberLink Corp.) Hidden
PowerDVD (HKLM-x32\...\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}) (Version:  - )
Ranch Rush 2 - Premium Edition (x32 Version: 2.2.0.98 - WildTangent) Hidden
Recovery Manager (x32 Version: 5.5.0.5119 - CyberLink Corp.) Hidden
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)
Skype™ 7.1 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.1.105 - Skype Technologies S.A.)
Studie zur Verbesserung von HP Deskjet 3520 series Produkten (HKLM\...\{E75A77D7-A854-44D6-A46B-82332AD79E9E}) (Version: 27.0.847.0 - Hewlett-Packard Co.)
TI USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{355FBD67-5A4F-44DA-86A1-56EEC4C20EC0}) (Version: 1.12.18.0 - Texas Instruments Inc.)
TI USB3 Host Driver (x32 Version: 1.12.18.0 - Texas Instruments Inc.) Hidden
Torchlight (x32 Version: 2.2.0.98 - WildTangent) Hidden
TSHostedAppLauncher (x32 Version: 5.1.15.0 - Hewlett-Packard) Hidden
turbodiagnosis version 1.02 (HKLM-x32\...\{365C5DC2-679A-4A5D-B40B-5096A49087A8}_is1) (Version: 1.02 - )
Update Installer for WildTangent Games App (x32 Version:  - WildTangent) Hidden
Virtual Families (x32 Version: 2.2.0.98 - WildTangent) Hidden
Virtual Villagers 4 - The Tree of Life (x32 Version: 2.2.0.98 - WildTangent) Hidden
Wedding Dash (x32 Version: 2.2.0.95 - WildTangent) Hidden
WildTangent Games App (HP Games) (x32 Version: 4.0.5.36 - WildTangent) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3538.0513 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
WinZip 16.0 (HKLM\...\{CD95F661-A5C4-44F5-A6AA-ECDD91C240CD}) (Version: 16.0.9715 - WinZip Computing, S.L. )
Zuma's Revenge (x32 Version: 2.2.0.98 - WildTangent) Hidden

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

25-02-2015 16:34:49 Windows Update
25-02-2015 21:10:30 Windows Update
01-03-2015 10:48:32 Windows Update
05-03-2015 10:31:35 Windows Update
08-03-2015 21:09:08 Windows Update
10-03-2015 20:20:52 Windows Update
15-03-2015 17:23:57 Windows Update
18-03-2015 20:38:40 Windows Update
21-03-2015 21:05:39 Windows Update
24-03-2015 21:31:27 Windows Update
28-03-2015 19:22:30 Windows Update
01-04-2015 11:37:52 Windows Update
04-04-2015 15:09:31 Windows Update
07-04-2015 16:17:17 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____N C:\windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {176D5C2E-04BF-4FBC-98F4-F46C10ED93F8} - System32\Tasks\HPCustParticipation HP Deskjet 3520 series => C:\Program Files\HP\HP Deskjet 3520 series\Bin\HPCustPartic.exe [2012-01-31] (Hewlett-Packard Co.)
Task: {18543076-B6EA-4506-95AD-5A6C14521B23} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater\HPSFUpdater.exe [2011-06-14] (Hewlett-Packard)
Task: {1D002410-9FEF-4D70-B8D1-7E29E284BBB2} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-05] (Adobe Systems Incorporated)
Task: {4CE3B0F3-D021-4CFC-85CF-BD4556246AB2} - System32\Tasks\Microsoft\Windows\Setup\gwx\runappraiser => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-25] (Microsoft Corporation)
Task: {5DDAB2C5-E5A1-4AF7-8A6B-210560D285EC} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2011-09-10] (Hewlett-Packard Company)
Task: {7067FACB-8C8C-41AE-9706-FA4C470F126C} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPSFMessenger\HPSFMsgr.exe [2011-09-10] (Hewlett-Packard Company)
Task: {73FBD61A-1A2D-4B23-804F-E331166EFDB3} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-03-25] (Microsoft Corporation)
Task: {8F03C14B-A158-42F5-BB79-4D248D1D43F9} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxcontent => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-25] (Microsoft Corporation)
Task: {9FF8CE88-68CA-4497-BDCD-E0162962516C} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-25] (Microsoft Corporation)
Task: {B4EEDE97-A226-4246-A9AD-0C65CA3E86A6} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Total Care Tune-Up => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPTuneUp.exe [2011-03-23] (Hewlett-Packard Company)
Task: {B7804514-7C87-4E0C-BD7A-C92932553D63} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-25] (Google Inc.)
Task: {B890224F-C601-465D-8611-27C429FB41F6} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2015-03-10] (Hewlett-Packard)
Task: {C6FED5E7-525C-4DC4-B30C-AC8B1894D20F} - System32\Tasks\HPCeeScheduleForTiedt => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2011-07-15] (Hewlett-Packard)
Task: {C9019F23-CC90-4B9E-976B-9B5B32237264} - System32\Tasks\HPCeeScheduleForTIEDT-HP$ => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2011-07-15] (Hewlett-Packard)
Task: {D7EFB4ED-17FB-45EC-9F6C-77DA5D752168} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Tuneup => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2011-09-10] (Hewlett-Packard Company)
Task: {F9F849AC-F881-4E48-BF3C-9BDF2C4F3FFA} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-25] (Google Inc.)
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\HPCeeScheduleForTIEDT-HP$.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
Task: C:\windows\Tasks\HPCeeScheduleForTiedt.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe

==================== Loaded Modules (whitelisted) ==============

2009-10-14 13:36 - 2009-10-14 13:36 - 02793304 _____ () C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe
2009-10-14 13:34 - 2009-10-14 13:34 - 00560472 _____ () C:\Program Files (x86)\Common Files\Logishrd\LQCVFX\COCIManager.exe
2015-04-04 15:05 - 2015-03-30 23:07 - 01174856 _____ () C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.118\libglesv2.dll
2015-04-04 15:05 - 2015-03-30 23:07 - 00080200 _____ () C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.118\libegl.dll
2015-04-04 15:05 - 2015-03-30 23:07 - 09279304 _____ () C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.118\pdf.dll
2015-04-04 15:05 - 2015-03-30 23:07 - 14974280 _____ () C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.118\PepperFlash\pepflashplayer.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2149968534-1042019459-1302014499-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Tiedt\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.2.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== Accounts: =============================

Administrator (S-1-5-21-2149968534-1042019459-1302014499-500 - Administrator - Disabled)
Gast (S-1-5-21-2149968534-1042019459-1302014499-501 - Limited - Disabled)
Tiedt (S-1-5-21-2149968534-1042019459-1302014499-1000 - Administrator - Enabled) => C:\Users\Tiedt

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============
Error: (04/08/2015 01:24:24 PM) (Source: Service Control Manager) (EventID: 7032) (User: )
Description: Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden des Dienstes "Windows Search" Korrekturmaßnahmen (Neustart des Diensts) durchzuführen, ist fehlgeschlagen. Fehler:
%%1056

Error: (04/08/2015 01:23:54 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "MBAMService" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (04/08/2015 01:23:54 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (04/08/2015 01:23:54 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Intel(R) Management and Security Application Local Management Service" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 10000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (04/08/2015 01:23:54 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "HP Support Assistant Service" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (04/08/2015 01:23:54 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "CalendarSynchService" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (04/08/2015 01:23:54 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "HP Auto" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (04/08/2015 01:23:54 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Live ID Sign-in Assistant" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 10000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (04/08/2015 01:23:54 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "PDF Document Manager" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (04/08/2015 01:23:54 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Norton Online Backup" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.


Microsoft Office Sessions:
=========================

==================== Memory info ===========================

Processor: Intel(R) Core(TM) i5-3450 CPU @ 3.10GHz
Percentage of memory in use: 37%
Total physical RAM: 6100.01 MB
Available physical RAM: 3839.28 MB
Total Pagefile: 12198.21 MB
Available Pagefile: 9653.41 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:914.41 GB) (Free:819.04 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (HP_RECOVERY) (Fixed) (Total:16.88 GB) (Free:2.1 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: AC56E740)

Partition: GPT Partition Type.

==================== End Of Log ============================


und ja es kommt keine Werbung mehr.Anhang 73578

Anhang 73579

nine53 08.04.2015 13:29
und Shortcut

Code:
Users shortcut scan result (x64) Version: 11-03-2015
Ran by Tiedt at 2015-04-08 13:49:14
Running from C:\Users\Tiedt\Downloads
Boot Mode: Normal
==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)



Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\WinZip.lnk -> C:\Program Files\WinZip\WINZIP64.EXE (WinZip Computing, S.L.)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk -> C:\Windows\ehome\ehshell.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk -> C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk -> C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Anytime Upgrade.lnk -> C:\Windows\System32\WindowsAnytimeUpgradeUI.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk -> C:\Program Files\DVD Maker\DVDMaker.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Fax and Scan.lnk -> C:\Windows\System32\WFS.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Mail.lnk -> C:\Program Files (x86)\Windows Live\Mail\wlmail.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Messenger.lnk -> C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Movie Maker.lnk -> C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMaker.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Photo Gallery.lnk -> C:\Program Files (x86)\Windows Live\Photo Gallery\WLXPhotoGallery.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XPS Viewer.lnk -> C:\Windows\System32\xpsrchvw.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live\Windows Live Mesh.lnk -> C:\Program Files (x86)\Windows Live\Mesh\WLSync.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live\Windows Live Writer.lnk -> C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriter.exe (Microsoft Corp.)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype\Skype.lnk -> C:\Program Files (x86)\Skype\Phone\Skype.exe (Skype Technologies S.A.)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Security and Protection\Recovery Manager\PowerRecover.lnk -> C:\Program Files (x86)\Hewlett-Packard\Recovery\RecoveryMgr.exe (CyberLink)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Security and Protection\Recovery Manager\Recovery Disc Creation.lnk -> C:\Program Files (x86)\Hewlett-Packard\Recovery\CDCreator.exe (CyberLink)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Productivity and Tools\CyberLink LabelPrint.lnk -> C:\Program Files (x86)\Cyberlink\LabelPrint\LabelPrint.exe (CyberLink Corp.)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Productivity and Tools\CyberLink Power2Go.lnk -> C:\Program Files (x86)\Cyberlink\Power2Go\Power2Go.exe (CyberLink Corp.)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Productivity and Tools\PDF Complete.lnk -> C:\Program Files (x86)\PDF Complete\pdfvista.exe (PDF Complete Inc)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Productivity and Tools\WinZip 16.0.lnk -> C:\Program Files\WinZip\WINZIP64.EXE (WinZip Computing, S.L.)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Music, Photos and Videos\Beats Audio Control Panel.lnk -> C:\Windows\System32\IDTNC64.cpl (IDT, Inc.)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight\Microsoft Silverlight.lnk -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\Silverlight.Configuration.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Access 2003.lnk -> C:\Windows\Installer\{90110407-6000-11D3-8CFE-0150048383C9}\accicons.exe ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Excel 2003.lnk -> C:\Windows\Installer\{90110407-6000-11D3-8CFE-0150048383C9}\xlicons.exe ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office InfoPath 2003.lnk -> C:\Windows\Installer\{90110407-6000-11D3-8CFE-0150048383C9}\inficon.exe ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Outlook 2003.lnk -> C:\Windows\Installer\{90110407-6000-11D3-8CFE-0150048383C9}\outicon.exe ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office PowerPoint 2003.lnk -> C:\Windows\Installer\{90110407-6000-11D3-8CFE-0150048383C9}\pptico.exe ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Publisher 2003.lnk -> C:\Windows\Installer\{90110407-6000-11D3-8CFE-0150048383C9}\pubs.exe ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Word 2003.lnk -> C:\Windows\Installer\{90110407-6000-11D3-8CFE-0150048383C9}\wordicon.exe ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\Digitale Signatur für VBA-Projekte.lnk -> C:\Windows\Installer\{90110407-6000-11D3-8CFE-0150048383C9}\misc.exe ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\Microsoft Clip Organizer.lnk -> C:\Windows\Installer\{90110407-6000-11D3-8CFE-0150048383C9}\cagicon.exe ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\Microsoft Office 2003 Spracheinstellungen.lnk -> C:\Windows\Installer\{90110407-6000-11D3-8CFE-0150048383C9}\misc.exe ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\Microsoft Office Access Snapshot Viewer.lnk -> C:\Windows\Installer\{90110407-6000-11D3-8CFE-0150048383C9}\misc.exe ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\Microsoft Office Document Imaging.lnk -> C:\Windows\Installer\{90110407-6000-11D3-8CFE-0150048383C9}\mspicons.exe ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\Microsoft Office Document Scanning.lnk -> C:\Windows\Installer\{90110407-6000-11D3-8CFE-0150048383C9}\mspicons.exe ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\Microsoft Office Picture Manager.lnk -> C:\Windows\Installer\{90110407-6000-11D3-8CFE-0150048383C9}\oisicon.exe ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Mathematics\Microsoft Mathematics.lnk -> C:\Program Files (x86)\Microsoft Mathematics\MathApp.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware\Malwarebytes Anti-Malware entfernen.lnk -> C:\Program Files (x86)\Malwarebytes Anti-Malware\unins000.exe ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware\Malwarebytes Anti-Malware.lnk -> C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe (Malwarebytes Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware\Tools\Malwarebytes Anti-Malware Chameleon.lnk -> C:\Program Files (x86)\Malwarebytes Anti-Malware\Chameleon\Windows\chameleon.chm ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Create Recovery Disc.lnk -> C:\Windows\System32\recdisc.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Remote Assistance.lnk -> C:\Windows\System32\msra.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Logitech\Logitech Vid HD.lnk -> C:\Program Files (x86)\Logitech\Vid HD\Vid.exe (Logitech Inc.)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Logitech\Logitech Webcam Software\Logitech-Webkamera-Software.lnk -> C:\Windows\Installer\{987FE247-4E69-4A2E-A961-D14F901FDBF6}\QuickCamStartMenuS_65895B9BA1A04BCBAB7BF5673B44A0E4.exe (Acresso Software Inc.)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP TouchSmart\HP TouchSmart Magic Canvas.lnk -> C:\Program Files (x86)\Hewlett-Packard\TouchSmart\SmartCenter\SmartCenter.exe (Hewlett-Packard)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP TouchSmart\More HP TouchSmart Apps\Updates.lnk -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\TSUpdates\TSUpdatesLauncher.exe (Hewlett-Packard)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP Help and Support\HP Support Assistant.lnk -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe (Hewlett-Packard Company)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP Help and Support\HP support information.lnk -> C:\Program Files (x86)\Hewlett-Packard\HP Support Information\HPSysInfo.exe (Hewlett-Packard Development Company, L.P.)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP\HP*Update.lnk -> C:\Program Files (x86)\Hp\HP Software Update\hpwucli.exe (Hewlett-Packard)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP\HP Photo Creations\ HP Photo Creations deinstallieren.lnk -> C:\Program Files (x86)\HP Photo Creations\uninst.exe ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP\HP Photo Creations\HP Photo Creations.lnk -> C:\Program Files (x86)\HP Photo Creations\PhotoProduct.exe (Visan / RocketLife)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP\HP Deskjet 3520 series\Druckereinrichtung & -software.lnk -> C:\Program Files\HP\HP Deskjet 3520 series\Bin\DeviceSetupLauncher.exe (Hewlett-Packard Co.)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP\HP Deskjet 3520 series\Hilfe.lnk -> C:\Program Files (x86)\Hp\HP Deskjet 3520 series\bin\HelpViewer\hpqlpvwr.exe (Hewlett-Packard Co.)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP\HP Deskjet 3520 series\HP Deskjet 3520 series.lnk -> C:\Program Files\HP\HP Deskjet 3520 series\Bin\HP Deskjet 3520 series.exe (Hewlett-Packard Co.)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP\HP Deskjet 3520 series\HP Scan.lnk -> C:\Program Files (x86)\Hp\HP Deskjet 3520 series\bin\HPScan.exe (Hewlett-Packard Co.)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP\HP Deskjet 3520 series\Shop für Zubehör.lnk -> C:\Program Files\HP\HP Deskjet 3520 series\Bin\hpqDTSS.exe (Hewlett-Packard Co.)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP\HP Deskjet 3520 series\Website für Produktsupport.lnk -> C:\Program Files\HP\HP Deskjet 3520 series\ProductSupportShortcut.url ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP\HP Deskjet 3520 series\Wireless-Druck - Onlinehilfe.lnk -> C:\Program Files\HP\HP Deskjet 3520 series\WirelessEasyShortcut.url ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\It Girl!.lnk -> C:\Program Files (x86)\HP Games\Web Link - It Girl!\launcher.exe (WildTangent)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Magic Desktop.lnk -> C:\Program Files (x86)\EasyBits For Kids\ezSecShield.exe (EasyBits Software AS)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Marvel Super Hero Squad Online.lnk -> C:\Program Files (x86)\HP Games\Web Link - Marvel Super Hero Squad Online\launcher.exe (WildTangent)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FRITZ!WLAN\FRITZ!WLAN Hilfe Stick N.lnk -> C:\Program Files (x86)\avmwlanstick\FRITZ!WLAN_N.chm ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FRITZ!WLAN\FRITZ!WLAN Readme.lnk -> C:\Program Files (x86)\avmwlanstick\readme.htm ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD\CyberLink PowerDVD.lnk -> C:\Program Files (x86)\Cyberlink\PowerDVD\PowerDVD.exe (CyberLink Corp.)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD\Online-Registrierung.lnk -> C:\Program Files (x86)\Cyberlink\PowerDVD\OLRSubmission\OLRSubmission.exe ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD\PowerDVD-Hilfe.lnk -> C:\Program Files (x86)\Cyberlink\PowerDVD\PowerDVD.CHM ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD\Readme.lnk -> C:\Program Files (x86)\Cyberlink\PowerDVD\Readme.htm ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD\Systemdiagnose.lnk -> C:\Program Files (x86)\Cyberlink\PowerDVD\CLDMA.exe (CyberLink Corp.)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Communication and Chat\Skype.lnk -> C:\Program Files (x86)\Online Services\Skype\SkypeLauncher.exe (Microsoft)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Component Services.lnk -> C:\Windows\System32\comexp.msc ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Data Sources (ODBC).lnk -> C:\Windows\System32\odbcad32.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\iSCSI Initiator.lnk -> C:\Windows\System32\iscsicpl.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Memory Diagnostics Tool.lnk -> C:\Windows\System32\MdSched.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk -> C:\Windows\System32\services.msc ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration.lnk -> C:\Windows\System32\msconfig.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Windows Firewall with Advanced Security.lnk -> C:\Windows\System32\WF.msc ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Calculator.lnk -> C:\Windows\System32\calc.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\displayswitch.lnk -> C:\Windows\System32\displayswitch.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Math Input Panel.lnk -> C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Paint.lnk -> C:\Windows\System32\mspaint.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Remote Desktop Connection.lnk -> C:\Windows\System32\mstsc.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Snipping Tool.lnk -> C:\Windows\System32\SnippingTool.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Sound Recorder.lnk -> C:\Windows\System32\SoundRecorder.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Sticky Notes.lnk -> C:\Windows\System32\StikyNot.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Sync Center.lnk -> C:\Windows\System32\mobsync.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Wordpad.lnk -> C:\Program Files\Windows NT\Accessories\wordpad.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell (x86).lnk -> C:\Windows\SysWOW64\Windowspowershell\v1.0\powershell.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell ISE (x86).lnk -> C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShell_ISE.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell ISE.lnk -> C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell_ISE.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk -> C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\ShapeCollector.lnk -> C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\TabTip.lnk -> C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Windows Journal.lnk -> C:\Program Files\Windows Journal\Journal.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Character Map.lnk -> C:\Windows\System32\charmap.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\dfrgui.lnk -> C:\Windows\System32\dfrgui.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Disk Cleanup.lnk -> C:\Windows\System32\cleanmgr.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\System Information.lnk -> C:\Windows\System32\msinfo32.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\System Restore.lnk -> C:\Windows\System32\rstrui.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Windows Easy Transfer Reports.lnk -> C:\Windows\System32\migwiz\PostMig.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Windows Easy Transfer.lnk -> C:\Windows\System32\migwiz\migwiz.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ABBYY FineReader 6.0 Sprint\ABBYY FineReader 6.0 Sprint.lnk -> C:\Windows\Installer\{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}\_SHCT_Sprint.exe.exe (InstallShield Software Corp.)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ABBYY FineReader 6.0 Sprint\Benutzerhandbuch.lnk -> C:\Program Files (x86)\ABBYY FineReader 6.0 Sprint\Sprint2.chm ()
Shortcut: C:\ProgramData\Hewlett-Packard\Recovery\Links\RM.lnk -> C:\Program Files (x86)\Hewlett-Packard\Recovery\RecoveryMgr.exe (CyberLink)
Shortcut: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Command Prompt.lnk -> C:\Windows\System32\cmd.exe (Microsoft Corporation)
Shortcut: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Notepad.lnk -> C:\Windows\System32\notepad.exe (Microsoft Corporation)
Shortcut: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnk -> C:\Windows\explorer.exe (Microsoft Corporation)
Shortcut: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Private Character Editor.lnk -> C:\Windows\System32\eudcedit.exe (Microsoft Corporation)
Shortcut: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Magnify.lnk -> C:\Windows\System32\Magnify.exe (Microsoft Corporation)
Shortcut: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Narrator.lnk -> C:\Windows\System32\Narrator.exe (Microsoft Corporation)
Shortcut: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\On-Screen Keyboard.lnk -> C:\Windows\System32\osk.exe (Microsoft Corporation)
Shortcut: C:\Users\Public\Desktop\CyberLink PowerDVD.lnk -> C:\Program Files (x86)\Cyberlink\PowerDVD\PowerDVD.exe (CyberLink Corp.)
Shortcut: C:\Users\Public\Desktop\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)
Shortcut: C:\Users\Public\Desktop\HP Deskjet 3520 series.lnk -> C:\Program Files\HP\HP Deskjet 3520 series\Bin\HP Deskjet 3520 series.exe (Hewlett-Packard Co.)
Shortcut: C:\Users\Public\Desktop\HP Photo Creations.lnk -> C:\Program Files (x86)\HP Photo Creations\PhotoProduct.exe (Visan / RocketLife)
Shortcut: C:\Users\Public\Desktop\HP Support Assistant.lnk -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe (Hewlett-Packard Company)
Shortcut: C:\Users\Public\Desktop\Logitech-Webkamera-Software.lnk -> C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe ()
Shortcut: C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk -> C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe (Malwarebytes Corporation)
Shortcut: C:\Users\Public\Desktop\Mozilla Firefox.lnk -> C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
Shortcut: C:\Users\Public\Desktop\Shop für Zubehör - HP Deskjet 3520 series.lnk -> C:\Program Files\HP\HP Deskjet 3520 series\Bin\hpqDTSS.exe (Hewlett-Packard Co.)
Shortcut: C:\Users\Public\Desktop\Skype.lnk -> C:\Windows\Installer\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}\SkypeIcon.exe ()
Shortcut: C:\Users\Tiedt\Links\Desktop.lnk -> C:\Users\Tiedt\Desktop ()
Shortcut: C:\Users\Tiedt\Links\Downloads.lnk -> C:\Users\Tiedt\Downloads ()
Shortcut: C:\Users\Tiedt\Desktop\Internet Explorer.lnk -> C:\Program Files (x86)\Internet Explorer\iexplore.exe (Microsoft Corporation)
Shortcut: C:\Users\Tiedt\Desktop\Microsoft Office Excel 2003.lnk -> C:\Windows\Installer\{90110407-6000-11D3-8CFE-0150048383C9}\xlicons.exe ()
Shortcut: C:\Users\Tiedt\Desktop\Microsoft Office Outlook 2003.lnk -> C:\Windows\Installer\{90110407-6000-11D3-8CFE-0150048383C9}\outicon.exe ()
Shortcut: C:\Users\Tiedt\Desktop\Microsoft Office Word 2003.lnk -> C:\Windows\Installer\{90110407-6000-11D3-8CFE-0150048383C9}\wordicon.exe ()
Shortcut: C:\Users\Tiedt\Desktop\Scanordner.lnk -> C:\Users\Tiedt\Documents ()
Shortcut: C:\Users\Tiedt\Desktop\TeamViewer.lnk -> C:\Users\Tiedt\Downloads\TeamViewer_Setup_de-ckc.exe (TeamViewer GmbH)
Shortcut: C:\Users\Tiedt\Desktop\Eigene Daten\Logitech Vid HD.lnk -> C:\Programme\Logitech\Vid HD\Vid.exe (No File)
Shortcut: C:\Users\Tiedt\Desktop\Eigene Daten\Logitech-Webkamera-Software.lnk -> C:\Programme\Logitech\Logitech WebCam Software\LWS.exe (No File)
Shortcut: C:\Users\Tiedt\Desktop\Eigene Daten\McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\2.0.181\McUICnt.exe (No File)
Shortcut: C:\Users\Tiedt\Desktop\Eigene Daten\Skype.lnk -> C:\WINDOWS\Installer\{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}\SkypeIcon.exe (No File)
Shortcut: C:\Users\Tiedt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
Shortcut: C:\Users\Tiedt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Command Prompt.lnk -> C:\Windows\System32\cmd.exe (Microsoft Corporation)
Shortcut: C:\Users\Tiedt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Notepad.lnk -> C:\Windows\System32\notepad.exe (Microsoft Corporation)
Shortcut: C:\Users\Tiedt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnk -> C:\Windows\explorer.exe (Microsoft Corporation)
Shortcut: C:\Users\Tiedt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
Shortcut: C:\Users\Tiedt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Private Character Editor.lnk -> C:\Windows\System32\eudcedit.exe (Microsoft Corporation)
Shortcut: C:\Users\Tiedt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Magnify.lnk -> C:\Windows\System32\Magnify.exe (Microsoft Corporation)
Shortcut: C:\Users\Tiedt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Narrator.lnk -> C:\Windows\System32\Narrator.exe (Microsoft Corporation)
Shortcut: C:\Users\Tiedt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\On-Screen Keyboard.lnk -> C:\Windows\System32\osk.exe (Microsoft Corporation)
Shortcut: C:\Users\Tiedt\AppData\Roaming\Microsoft\Office\Zuletzt verwendet\40.Hochzeitstag Gartz.LNK -> C:\Users\Tiedt\Desktop\Bilder\40.Hochzeitstag Gartz ()
Shortcut: C:\Users\Tiedt\AppData\Roaming\Microsoft\Office\Zuletzt verwendet\Alex Kindermund rot!.LNK -> C:\Users\Tiedt\Desktop\Eigene Daten\Alex Kindermund rot!.xls ()
Shortcut: C:\Users\Tiedt\AppData\Roaming\Microsoft\Office\Zuletzt verwendet\Betriebskosten 2014.LNK -> C:\Users\Tiedt\Desktop\Betriebskosten 2014.xls (No File)
Shortcut: C:\Users\Tiedt\AppData\Roaming\Microsoft\Office\Zuletzt verwendet\Betriebskosten ab 2014.LNK -> C:\Users\Tiedt\Desktop\Betriebskosten ab 2014.xls ()
Shortcut: C:\Users\Tiedt\AppData\Roaming\Microsoft\Office\Zuletzt verwendet\Betriebskosten bis 2013.LNK -> C:\Users\Tiedt\Desktop\Betriebskosten bis 2013.xls ()
Shortcut: C:\Users\Tiedt\AppData\Roaming\Microsoft\Office\Zuletzt verwendet\Betriebskosten.LNK -> C:\Users\Tiedt\Desktop\Betriebskosten.xls (No File)
Shortcut: C:\Users\Tiedt\AppData\Roaming\Microsoft\Office\Zuletzt verwendet\BV 305  Massenprüfung Lüftung  SG Haustechnik 09 12 2014.LNK -> C:\Users\Tiedt\AppData\Local\Microsoft\Windows\Temporary Internet Files\OLKD68\BV 305  Massenprüfung Lüftung  SG Haustechnik 09 12 2014.doc (No File)
Shortcut: C:\Users\Tiedt\AppData\Roaming\Microsoft\Office\Zuletzt verwendet\Christine.LNK -> C:\Users\Tiedt\Desktop\Christine ()
Shortcut: C:\Users\Tiedt\AppData\Roaming\Microsoft\Office\Zuletzt verwendet\Desktop.LNK -> C:\Users\Tiedt\Desktop ()
Shortcut: C:\Users\Tiedt\AppData\Roaming\Microsoft\Office\Zuletzt verwendet\Eigene Daten.LNK -> C:\Users\Tiedt\Desktop\Eigene Daten ()
Shortcut: C:\Users\Tiedt\AppData\Roaming\Microsoft\Office\Zuletzt verwendet\Eigene Dokumente.LNK -> C:\Users\Tiedt\Documents ()
Shortcut: C:\Users\Tiedt\AppData\Roaming\Microsoft\Office\Zuletzt verwendet\EUROTOOL.LNK -> C:\Program Files (x86)\Microsoft Office\OFFICE11\Makro\EUROTOOL.XLA ()
Shortcut: C:\Users\Tiedt\AppData\Roaming\Microsoft\Office\Zuletzt verwendet\Fragespiel zur Weihnachtsfeier.LNK -> C:\Users\Tiedt\Desktop\Christine\Fragespiel zur Weihnachtsfeier.xls ()
Shortcut: C:\Users\Tiedt\AppData\Roaming\Microsoft\Office\Zuletzt verwendet\H.J. Handy 2015 Neu.LNK -> C:\Users\Tiedt\Desktop\Bilder\H.J. Handy 2015 Neu ()
Shortcut: C:\Users\Tiedt\AppData\Roaming\Microsoft\Office\Zuletzt verwendet\Jahreswechsel 2013-2014 Schweiz Bilder Kai.LNK -> C:\Users\Tiedt\Desktop\Bilder\Tiedts in der Schweiz\Jahreswechsel 2013-2014 Schweiz Bilder Kai (No File)
Shortcut: C:\Users\Tiedt\AppData\Roaming\Microsoft\Office\Zuletzt verwendet\Kowalski - Würfelspiel von Lisa.LNK -> C:\Users\Tiedt\AppData\Local\Microsoft\Windows\Temporary Internet Files\OLKD68\Kowalski - Würfelspiel von Lisa.doc (No File)
Shortcut: C:\Users\Tiedt\AppData\Roaming\Microsoft\Office\Zuletzt verwendet\Lebenslauf Hans-Jürgen.LNK -> C:\Users\Tiedt\Desktop\Christine\Lebenslauf Hans-Jürgen.xls ()
Shortcut: C:\Users\Tiedt\AppData\Roaming\Microsoft\Office\Zuletzt verwendet\Makro.LNK -> C:\Program Files (x86)\Microsoft Office\OFFICE11\Makro ()
Shortcut: C:\Users\Tiedt\AppData\Roaming\Microsoft\Office\Zuletzt verwendet\Mappe1.LNK -> C:\Users\Tiedt\Desktop\Eigene Daten\Mappe1.xls (No File)
Shortcut: C:\Users\Tiedt\AppData\Roaming\Microsoft\Office\Zuletzt verwendet\Namen 10b.LNK -> C:\Users\Tiedt\Desktop\Christine\Namen 10b.xls (No File)
Shortcut: C:\Users\Tiedt\AppData\Roaming\Microsoft\Office\Zuletzt verwendet\Normal.LNK -> C:\Users\Tiedt\AppData\Roaming\Microsoft\Vorlagen\Normal.dot ()
Shortcut: C:\Users\Tiedt\AppData\Roaming\Microsoft\Office\Zuletzt verwendet\OLKD68.LNK -> C:\Users\Tiedt\AppData\Local\Microsoft\Windows\Temporary Internet Files\OLKD68 (No File)
Shortcut: C:\Users\Tiedt\AppData\Roaming\Microsoft\Office\Zuletzt verwendet\Oma Thurow erzählt aus ihrem Leben.LNK -> C:\Users\Tiedt\Desktop\Christine\Oma Thurow erzählt aus ihrem Leben.doc ()
Shortcut: C:\Users\Tiedt\AppData\Roaming\Microsoft\Office\Zuletzt verwendet\Rezeptordner Christine.LNK -> C:\Users\Tiedt\Desktop\Rezeptordner Christine ()
Shortcut: C:\Users\Tiedt\AppData\Roaming\Microsoft\Office\Zuletzt verwendet\Sprüche.LNK -> C:\Users\Tiedt\Desktop\Eigene Daten\Sprüche.doc ()
Shortcut: C:\Users\Tiedt\AppData\Roaming\Microsoft\Office\Zuletzt verwendet\Steuererklärung FA Waren.LNK -> C:\Users\Tiedt\Desktop\Eigene Daten\Steuererklärung FA Waren ()
Shortcut: C:\Users\Tiedt\AppData\Roaming\Microsoft\Office\Zuletzt verwendet\Steuerfälle.LNK -> C:\Users\Tiedt\Desktop\Eigene Daten\Steuerfälle (No File)
Shortcut: C:\Users\Tiedt\AppData\Roaming\Microsoft\Office\Zuletzt verwendet\Süßigkeitenquiz.LNK -> C:\Users\Tiedt\Desktop\Eigene Daten\Süßigkeitenquiz.doc ()
Shortcut: C:\Users\Tiedt\AppData\Roaming\Microsoft\Office\Zuletzt verwendet\Tagesablaufplan EGFB-Sportevent Wochenende 2015 (2).LNK -> C:\Users\Tiedt\AppData\Local\Microsoft\Windows\Temporary Internet Files\OLKD68\Tagesablaufplan EGFB-Sportevent Wochenende 2015 (2).docx (No File)
Shortcut: C:\Users\Tiedt\AppData\Roaming\Microsoft\Office\Zuletzt verwendet\Tagesablaufplan EGFB-Sportevent Wochenende 2015.LNK -> C:\Users\Tiedt\AppData\Local\Microsoft\Windows\Temporary Internet Files\OLKD68\Tagesablaufplan EGFB-Sportevent Wochenende 2015.docx (No File)
Shortcut: C:\Users\Tiedt\AppData\Roaming\Microsoft\Office\Zuletzt verwendet\Take-it-easy.LNK -> C:\Users\Tiedt\AppData\Local\Microsoft\Windows\Temporary Internet Files\OLKD68\Take-it-easy.ppsx (No File)
Shortcut: C:\Users\Tiedt\AppData\Roaming\Microsoft\Office\Zuletzt verwendet\Unfall Tante Helga 30.06.06.LNK -> C:\Users\Tiedt\Desktop\Eigene Daten\Unfall Tante Helga 30.06.06.xls ()
Shortcut: C:\Users\Tiedt\AppData\Roaming\Microsoft\Office\Zuletzt verwendet\Unser Jahr  2009.LNK -> C:\Users\Tiedt\Desktop\Unser Jahr Christine\Unser Jahr  2009.doc ()
Shortcut: C:\Users\Tiedt\AppData\Roaming\Microsoft\Office\Zuletzt verwendet\Unser Jahr 2014.LNK -> C:\Users\Tiedt\Desktop\Unser Jahr Christine\Unser Jahr 2014.doc ()
Shortcut: C:\Users\Tiedt\AppData\Roaming\Microsoft\Office\Zuletzt verwendet\Unser Jahr Christine.LNK -> C:\Users\Tiedt\Desktop\Unser Jahr Christine ()
Shortcut: C:\Users\Tiedt\AppData\Roaming\Microsoft\Office\Zuletzt verwendet\Urlaub Italien 2014.LNK -> C:\Users\Tiedt\Desktop\Bilder\Urlaub Ch+H.J\Urlaub Italien 2014 (No File)
Shortcut: C:\Users\Tiedt\AppData\Roaming\Microsoft\Office\Zuletzt verwendet\Vorlagen.LNK -> C:\Users\Tiedt\AppData\Roaming\Microsoft\Vorlagen ()
Shortcut: C:\Users\Tiedt\AppData\Roaming\Microsoft\Office\Zuletzt verwendet\Weihnachten 2013 Gedicht v. Marianne.LNK -> C:\Users\Tiedt\Documents\Weihnachten 2013 Gedicht v. Marianne.doc ()
Shortcut: C:\Users\Tiedt\AppData\Roaming\Microsoft\Office\Zuletzt verwendet\Weihnachten 2014 Gedicht für Hanne.LNK -> C:\Users\Tiedt\Documents\Weihnachten 2014 Gedicht für Hanne.doc ()
Shortcut: C:\Users\Tiedt\AppData\Roaming\Microsoft\Office\Zuletzt verwendet\Weihnachtszeit.LNK -> C:\Users\Tiedt\Documents\Weihnachtszeit.doc ()
Shortcut: C:\Users\Tiedt\AppData\Roaming\Microsoft\Office\Zuletzt verwendet\Überlass es der Zeit - Gedicht Fontane.LNK -> C:\Users\Tiedt\AppData\Local\Microsoft\Windows\Temporary Internet Files\OLKD68\Überlass es der Zeit - Gedicht Fontane.doc (No File)
Shortcut: C:\Users\Tiedt\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)
Shortcut: C:\Users\Tiedt\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk -> C:\Program Files (x86)\Internet Explorer\iexplore.exe (Microsoft Corporation)
Shortcut: C:\Users\Tiedt\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)
Shortcut: C:\Users\Tiedt\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
Shortcut: C:\Users\Tiedt\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk -> C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
Shortcut: C:\Users\Tiedt\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Explorer.lnk -> C:\Windows\explorer.exe (Microsoft Corporation)


ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Shopping and Services\eBay.lnk -> C:\Program Files (x86)\Hewlett-Packard\Shared\WizLink.exe () -> hxxp://redirect.hp.com/svs/rdr?TYPE=4&tp=onlinesvs&s=ebay&pf=cndt&locale=de_de&bd=all&c=123
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Music, Photos and Videos\rara Music.lnk -> C:\Program Files (x86)\Hewlett-Packard\Shared\WizLink.exe () -> hxxp://redirect.hp.com/svs/rdr?locale=de_de&bd=pavilion&tp=onlinesvs&pf=cndt&c=121&s=RaRa&TYPE=4
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Music, Photos and Videos\Snapfish Fotos.lnk -> C:\Program Files (x86)\Hewlett-Packard\Shared\WizLink.exe () -> hxxp://www.snapfish.com/hp_desktop_desktopicon_2012_de


ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Default Programs.lnk -> C:\Windows\System32\control.exe (Microsoft Corporation) -> /name Microsoft.DefaultPrograms
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Windows Update.lnk -> C:\Windows\System32\wuapp.exe (Microsoft Corporation) -> startmenu
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sidebar.lnk -> C:\Program Files\Windows Sidebar\sidebar.exe (Microsoft Corporation) -> /showgadgets
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk -> C:\Program Files (x86)\Windows Media Player\wmplayer.exe (Microsoft Corporation) -> /prefetch:1
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Online Backup\Norton Online Backup.lnk -> C:\Windows\Installer\{40A66DF6-22D3-44B5-A7D3-83B118A2C0DC}\MainIcon.ico () -> OPEN
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\Microsoft Office 2003 Assistent zum Speichern eigener Einstellungen.lnk -> C:\Windows\Installer\{90110407-6000-11D3-8CFE-0150048383C9}\opwicon.exe () -> /u
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\Microsoft Office Anwendungswiederherstellung.lnk -> C:\Windows\Installer\{90110407-6000-11D3-8CFE-0150048383C9}\misc.exe () -> -c
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus\Deinstallieren.lnk -> C:\Program Files\McAfee Security Scan\uninstall.exe (McAfee, Inc.) -> C:\Program Files\McAfee Security Scan\3.8.150\McAfee.ico
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus\McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\McUICnt.exe (McAfee, Inc.) -> SecurityScanner.dll
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Backup and Restore Center.lnk -> C:\Windows\System32\control.exe (Microsoft Corporation) -> /name Microsoft.BackupAndRestore
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP TouchSmart\Calendar.lnk -> C:\Program Files (x86)\Hewlett-Packard\TouchSmart\SmartCenter\TSHostedAppLauncher.exe (Hewlett-Packard) -> "C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Calendar\CalendarRequest.xml"
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP TouchSmart\Clock.lnk -> C:\Program Files (x86)\Hewlett-Packard\TouchSmart\SmartCenter\TSHostedAppLauncher.exe (Hewlett-Packard) -> "C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Clock\ClockRequest.xml"
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP TouchSmart\Notes.lnk -> C:\Program Files (x86)\Hewlett-Packard\TouchSmart\SmartCenter\TSHostedAppLauncher.exe (Hewlett-Packard) -> "C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Notes\NotesRequest.xml"
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP TouchSmart\Recipe Box.lnk -> C:\Program Files (x86)\Hewlett-Packard\TouchSmart\SmartCenter\TSHostedAppLauncher.exe (Hewlett-Packard) -> TSRecipeBoxREG.xml
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP TouchSmart\RSS.lnk -> C:\Program Files (x86)\Hewlett-Packard\TouchSmart\SmartCenter\TSHostedAppLauncher.exe (Hewlett-Packard) -> "C:\Program Files (x86)\Hewlett-Packard\TouchSmart\RSS\RssRequest.xml"
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP TouchSmart\More HP TouchSmart Apps\Facebook.lnk -> C:\Program Files (x86)\Hewlett-Packard\TouchSmart\SmartCenter\TSHostedAppLauncher.exe (Hewlett-Packard) -> TSFacebookREG.xml
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP TouchSmart\More HP TouchSmart Apps\ResMon.lnk -> C:\Program Files (x86)\Hewlett-Packard\TouchSmart\SmartCenter\TSHostedAppLauncher.exe (Hewlett-Packard) -> ResMonReq.xml
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP TouchSmart\More HP TouchSmart Apps\Tutorials.lnk -> C:\Program Files (x86)\Hewlett-Packard\TouchSmart\SmartCenter\TSHostedAppLauncher.exe (Hewlett-Packard) -> TutorialsReq.xml
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP Help and Support\WSG.lnk -> C:\SWSETUP\HP Documentation\eDocLauncher.exe (Hewlett-Packard) -> P004H7B2 WSG
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP Help and Support\HP User Manuals\OPS.lnk -> C:\SWSETUP\HP Documentation\eDocLauncher.exe (Hewlett-Packard) -> P004GZB2 OPS
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP Help and Support\HP User Manuals\SCG.lnk -> C:\SWSETUP\HP Documentation\eDocLauncher.exe (Hewlett-Packard) -> P004GZB2 SCG
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP Help and Support\HP User Manuals\SRI.lnk -> C:\SWSETUP\HP Documentation\eDocLauncher.exe (Hewlett-Packard) -> P004GZB2 SRI
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP Help and Support\HP User Manuals\TMG.lnk -> C:\SWSETUP\HP Documentation\eDocLauncher.exe (Hewlett-Packard) -> P004GZB2 TMG
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP\HP Deskjet 3520 series\Deinstallieren.lnk -> C:\Windows\SysWOW64\msiexec.exe (Microsoft Corporation) -> /qb /x {A9C5381E-F415-4EDC-95A2-9164218FEA8A}
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP\HP Deskjet 3520 series\HP Setup-Anleitung.lnk -> C:\Program Files\HP\HP Deskjet 3520 series\Bin\HWSetup.exe (Hewlett-Packard Co.) -> /flow standalone
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP\HP Deskjet 3520 series\IP-Adresse aktualisieren.lnk -> C:\Program Files\HP\HP Deskjet 3520 series\Bin\DeviceSetup.exe (Hewlett-Packard Co.) -> /changeip ""
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP\HP Deskjet 3520 series\Studie zur Verbesserung von HP Produkten.lnk -> C:\Program Files\HP\HP Deskjet 3520 series\Bin\HPCustPartic.exe (Hewlett-Packard Co.) -> /changesettings /UA 11.0 /DDV 0x0a00
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\All Casual Games.lnk -> C:\Program Files (x86)\HP Games\Game Explorer Categories - genres\provider.exe (WildTangent) -> /id=000d96f5-8034-4b74-a429-b6f0b04c75f4 /src gamesmenuoem
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\All Enthusiast Games.lnk -> C:\Program Files (x86)\HP Games\Game Explorer Categories - genres\provider.exe (WildTangent) -> /id=26352374-af55-4b53-b07b-6b0288ed97df /src gamesmenuoem
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\All Family Games.lnk -> C:\Program Files (x86)\HP Games\Game Explorer Categories - genres\provider.exe (WildTangent) -> /id=d58eecb0-0816-11de-8c30-0800200c9a66 /src gamesmenuoem
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\All Kids Games.lnk -> C:\Program Files (x86)\HP Games\Game Explorer Categories - genres\provider.exe (WildTangent) -> /id=3eda1e54-8889-41f5-a649-5a306789b7ef /src gamesmenuoem
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\All MMO Games.lnk -> C:\Program Files (x86)\HP Games\Game Explorer Categories - genres\provider.exe (WildTangent) -> /id=c3c636e0-1b04-11de-8c30-0800200c9a66 /src gamesmenuoem
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Bejeweled 3.lnk -> C:\Program Files (x86)\HP Games\onplay\onplay.exe () -> "C:\Program Files (x86)\HP Games\Bejeweled 3\bejeweled3-WT.exe" /launchgc /src gamesmenuoem
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Chuzzle Deluxe.lnk -> C:\Program Files (x86)\HP Games\onplay\onplay.exe () -> "C:\Program Files (x86)\HP Games\Chuzzle Deluxe\Chuzzle Deluxe-WT.exe" /launchgc /src gamesmenuoem
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Farmscapes.lnk -> C:\Program Files (x86)\HP Games\onplay\onplay.exe () -> "C:\Program Files (x86)\HP Games\Farmscapes\Farmscapes-WT.exe" /launchgc /src gamesmenuoem
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\FATE.lnk -> C:\Program Files (x86)\HP Games\onplay\onplay.exe () -> "C:\Program Files (x86)\HP Games\FATE\Fate-WT.exe" /launchgc /src gamesmenuoem
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Jewel Quest II.lnk -> C:\Program Files (x86)\HP Games\onplay\onplay.exe () -> "C:\Program Files (x86)\HP Games\Jewel Quest II\Jewel Quest II-WT.exe" /launchgc /src gamesmenuoem
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Mahjongg Artifacts.lnk -> C:\Program Files (x86)\HP Games\onplay\onplay.exe () -> "C:\Program Files (x86)\HP Games\Mahjongg Artifacts\Mahjongg Artifacts-WT.exe" /launchgc /src gamesmenuoem
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\More Games from HP Games.lnk -> C:\Program Files (x86)\HP Games\Game Explorer Categories - main\provider.exe (WildTangent) -> /id=977b5905-4d14-47f1-bbbf-7b92f596695d /src gamesmenuoem
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Plants vs. Zombies - Game of the Year.lnk -> C:\Program Files (x86)\HP Games\onplay\onplay.exe () -> "C:\Program Files (x86)\HP Games\Plants vs Zombies - Game of the Year\plantsvszombies-WT.exe" /launchgc /src gamesmenuoem
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\WildTangent Games App - hp.lnk -> C:\Program Files (x86)\HP Games\onplay\onplay.exe () -> "C:\Program Files (x86)\WildTangent Games\App\GameConsole-wt.exe" /src gamesmenuoem /dp hpcpc2c12
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Zuma's Revenge.lnk -> C:\Program Files (x86)\HP Games\onplay\onplay.exe () -> "C:\Program Files (x86)\HP Games\Zumas Revenge\zumasrevenge-WT.exe" /launchgc /src gamesmenuoem
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FRITZ!WLAN\FRITZ!WLAN.lnk -> C:\Program Files (x86)\avmwlanstick\WLanGUI.exe (AVM Berlin) -> -1
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD\PowerDVD deinstallieren.lnk -> C:\Windows\System32\rundll32.exe (Microsoft Corporation) -> C:\PROGRA~2\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\Setup.exe"  -uninstall
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Communication and Chat\getonline.lnk -> C:\Program Files (x86)\Hewlett-Packard\HP Setup\NativeClient\hptcs.exe (Hewlett-Packard) -> MODE=GETONLINE URL=ReminderPage.html
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Computer Management.lnk -> C:\Windows\System32\compmgmt.msc () -> /s
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Event Viewer.lnk -> C:\Windows\System32\eventvwr.msc () -> /s
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Performance Monitor.lnk -> C:\Windows\System32\perfmon.msc () -> /s
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Task Scheduler.lnk -> C:\Windows\System32\taskschd.msc () -> /s
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Windows PowerShell Modules.lnk -> C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (Microsoft Corporation) -> -NoExit -ImportSystemModules
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Mobility Center.lnk -> C:\Windows\System32\mblctr.exe (Microsoft Corporation) -> /open
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Welcome Center.lnk -> C:\Windows\System32\rundll32.exe (Microsoft Corporation) -> %SystemRoot%\system32\OobeFldr.dll,ShowWelcomeCenter LaunchedBy_StartMenuShortcut
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Resource Monitor.lnk -> C:\Windows\System32\perfmon.exe (Microsoft Corporation) -> /res
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Task Scheduler.lnk -> C:\Windows\System32\taskschd.msc () -> /s
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Speech Recognition.lnk -> C:\Windows\Speech\Common\sapisvr.exe (Microsoft Corporation) -> -SpeechUX
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\GameExplorer\{fcedd1a0-cbd2-4697-8c5d-107bfeb05ff5}\PlayTasks\0\Farmscapes.lnk -> C:\Program Files (x86)\HP Games\onplay\onplay.exe () -> "C:\Program Files (x86)\HP Games\Farmscapes\Farmscapes-WT.exe" /launchgc /src gameexploreroem
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\GameExplorer\{fb65380e-3812-44f7-bbec-128e82369adf}\PlayTasks\0\Jewel Quest Solitaire 2.lnk -> C:\Program Files (x86)\HP Games\onplay\onplay.exe () -> "C:\Program Files (x86)\HP Games\Jewel Quest Solitaire 2\jewelquestsolitaire2-WT.exe" /launchgc /src gameexploreroem
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\GameExplorer\{f10f89f1-9c08-4d85-9169-a28ba1fc6ab0}\PlayTasks\0\Farm Frenzy.lnk -> C:\Program Files (x86)\HP Games\onplay\onplay.exe () -> "C:\Program Files (x86)\HP Games\Farm Frenzy\Farm Frenzy-WT.exe" /launchgc /src gameexploreroem
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\GameExplorer\{ed7e4b33-7f4e-48c9-947d-dfff27b576b6}\PlayTasks\0\Cradle of Rome 2.lnk -> C:\Program Files (x86)\HP Games\onplay\onplay.exe () -> "C:\Program Files (x86)\HP Games\Cradle of Rome 2\cradleofrome2-WT.exe" /launchgc /src gameexploreroem
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\GameExplorer\{e948cdf1-377b-41e3-a9b0-c3785955c2df}\PlayTasks\0\Ranch Rush 2 - Premium Edition.lnk -> C:\Program Files (x86)\HP Games\onplay\onplay.exe () -> "C:\Program Files (x86)\HP Games\Ranch Rush 2 - Premium Edition\ranchrush2collectorsedition-WT.exe" /launchgc /src gameexploreroem
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\GameExplorer\{e923cba5-ed90-4670-bf07-064d14a1cd55}\PlayTasks\0\web.lnk -> C:\Program Files (x86)\HP Games\Web Link - Mahjongg Dark Dimensions\launcher.exe (WildTangent) -> "C:\Program Files (x86)\HP Games\Web Link - Mahjongg Dark Dimensions\launcher.exe" /src gameexploreroem
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\GameExplorer\{d8addf57-a369-460f-8a5c-2f240d8e33b7}\PlayTasks\0\Virtual Villagers 4 - The Tree of Life.lnk -> C:\Program Files (x86)\HP Games\onplay\onplay.exe () -> "C:\Program Files (x86)\HP Games\Virtual Villagers 4 - The Tree of Life\virtualvillagers4thetreeoflife-WT.exe" /launchgc /src gameexploreroem
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\GameExplorer\{d58eecb0-0816-11de-8c30-0800200c9a66}\PlayTasks\0\provider.lnk -> C:\Program Files (x86)\HP Games\Game Explorer Categories - genres\provider.exe (WildTangent) -> /id=d58eecb0-0816-11de-8c30-0800200c9a66 /src gameexploreroem
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\GameExplorer\{d0dc6569-7b4e-4707-b589-ea594b6d8d31}\PlayTasks\0\Mahjongg Artifacts.lnk -> C:\Program Files (x86)\HP Games\onplay\onplay.exe () -> "C:\Program Files (x86)\HP Games\Mahjongg Artifacts\Mahjongg Artifacts-WT.exe" /launchgc /src gameexploreroem
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\GameExplorer\{ca4ed303-5737-4b13-9aff-3f92aa8e364d}\PlayTasks\0\web.lnk -> C:\Program Files (x86)\HP Games\Web Link - It Girl!\launcher.exe (WildTangent) -> "C:\Program Files (x86)\HP Games\Web Link - It Girl!\launcher.exe" /src gameexploreroem
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\GameExplorer\{c8f4bd34-d7cd-40fd-a437-35cb021410e8}\PlayTasks\0\web.lnk -> C:\Program Files (x86)\HP Games\Web Link - Penguin World\launcher.exe (WildTangent) -> "C:\Program Files (x86)\HP Games\Web Link - Penguin World\launcher.exe" /src gameexploreroem
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\GameExplorer\{c8c605c6-cd2a-4242-9b27-b8b27bdf6684}\PlayTasks\0\web.lnk -> C:\Program Files (x86)\HP Games\Web Link - Gun Bros\launcher.exe (WildTangent) -> "C:\Program Files (x86)\HP Games\Web Link - Gun Bros\launcher.exe" /src gameexploreroem
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\GameExplorer\{c3c636e0-1b04-11de-8c30-0800200c9a66}\PlayTasks\0\provider.lnk -> C:\Program Files (x86)\HP Games\Game Explorer Categories - genres\provider.exe (WildTangent) -> /id=c3c636e0-1b04-11de-8c30-0800200c9a66 /src gameexploreroem
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\GameExplorer\{bf3485ba-306e-4774-bf8e-403bf8535439}\PlayTasks\0\web.lnk -> C:\Program Files (x86)\HP Games\Web Link - Battlestar Galactica Online\launcher.exe (WildTangent) -> "C:\Program Files (x86)\HP Games\Web Link - Battlestar Galactica Online\launcher.exe" /src gameexploreroem
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\GameExplorer\{bba80652-58a7-4320-a64f-475fdbda4363}\PlayTasks\0\Virtual Families.lnk -> C:\Program Files (x86)\HP Games\onplay\onplay.exe () -> "C:\Program Files (x86)\HP Games\Virtual Families\virtualfamilies-WT.exe" /launchgc /src gameexploreroem
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\GameExplorer\{b87f2bde-5d44-4e86-bd37-a71616b35ea6}\PlayTasks\0\Bejeweled 3.lnk -> C:\Program Files (x86)\HP Games\onplay\onplay.exe () -> "C:\Program Files (x86)\HP Games\Bejeweled 3\bejeweled3-WT.exe" /launchgc /src gameexploreroem
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\GameExplorer\{af7a9bad-f0f1-4fe3-87a1-676657bed867}\PlayTasks\0\Cake Mania.lnk -> C:\Program Files (x86)\HP Games\onplay\onplay.exe () -> "C:\Program Files (x86)\HP Games\Cake Mania\Cake Mania-WT.exe" /launchgc /src gameexploreroem
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\GameExplorer\{A4B598D2-9BFF-456F-A667-D3B8A0849286}\PlayTasks\0\Insaniquarium Deluxe.lnk -> C:\Program Files (x86)\HP Games\onplay\onplay.exe () -> "C:\Program Files (x86)\HP Games\Insaniquarium Deluxe\Insaniquarium Deluxe-WT.exe" /launchgc /src gameexploreroem
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\GameExplorer\{992f66c3-df2c-43d7-96c0-67d0f46b56f8}\PlayTasks\0\Jewel Quest II.lnk -> C:\Program Files (x86)\HP Games\onplay\onplay.exe () -> "C:\Program Files (x86)\HP Games\Jewel Quest II\Jewel Quest II-WT.exe" /launchgc /src gameexploreroem
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\GameExplorer\{977b5905-4d14-47f1-bbbf-7b92f596695d}\PlayTasks\0\provider.lnk -> C:\Program Files (x86)\HP Games\Game Explorer Categories - main\provider.exe (WildTangent) -> /id=977b5905-4d14-47f1-bbbf-7b92f596695d /src gameexploreroem
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\GameExplorer\{951226E3-26FC-40BC-8085-3677B1128F59}\PlayTasks\0\Polar Bowler.lnk -> C:\Program Files (x86)\HP Games\onplay\onplay.exe () -> "C:\Program Files (x86)\HP Games\Polar Bowler\Polar-WT.exe" /launchgc /src gameexploreroem
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\GameExplorer\{8d1038f5-9e51-4c97-b363-e0d7a6725e9a}\PlayTasks\0\web.lnk -> C:\Program Files (x86)\HP Games\Web Link - Organized Crime\launcher.exe (WildTangent) -> "C:\Program Files (x86)\HP Games\Web Link - Organized Crime\launcher.exe" /src gameexploreroem
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\GameExplorer\{82cff345-989a-4f4d-94de-db6de238eb5f}\PlayTasks\0\Mystery of Mortlake Mansion.lnk -> C:\Program Files (x86)\HP Games\onplay\onplay.exe () -> "C:\Program Files (x86)\HP Games\Mystery of Mortlake Mansion\mysteryofmortlakemansion-WT.exe" /launchgc /src gameexploreroem
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\GameExplorer\{6E7DD52D-205E-4D6D-AF6A-0C34703DFA61}\PlayTasks\0\Chuzzle Deluxe.lnk -> C:\Program Files (x86)\HP Games\onplay\onplay.exe () -> "C:\Program Files (x86)\HP Games\Chuzzle Deluxe\Chuzzle Deluxe-WT.exe" /launchgc /src gameexploreroem
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\GameExplorer\{6BDF3201-10E6-46ED-9A87-7FD18C418CFD}\PlayTasks\0\FATE.lnk -> C:\Program Files (x86)\HP Games\onplay\onplay.exe () -> "C:\Program Files (x86)\HP Games\FATE\Fate-WT.exe" /launchgc /src gameexploreroem
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\GameExplorer\{677247CF-4120-46DC-A3DF-71588CC9CB7E}\PlayTasks\0\web.lnk -> C:\Program Files (x86)\HP Games\Web Link - Shaiya\launcher.exe (WildTangent) -> "C:\Program Files (x86)\HP Games\Web Link - Shaiya\launcher.exe" /src gameexploreroem
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\GameExplorer\{5f828e7a-066c-4d4a-ada6-8b2494b859db}\PlayTasks\0\web.lnk -> C:\Program Files (x86)\HP Games\Web Link - Polar Bowler Strike!\launcher.exe (WildTangent) -> "C:\Program Files (x86)\HP Games\Web Link - Polar Bowler Strike!\launcher.exe" /src gameexploreroem
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\GameExplorer\{5d1b040e-e496-4a7b-ae4e-9b17eb28a7e2}\PlayTasks\0\Final Drive Fury.lnk -> C:\Program Files (x86)\HP Games\onplay\onplay.exe () -> "C:\Program Files (x86)\HP Games\Final Drive Fury\Racing-WT.exe" /launchgc /src gameexploreroem
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\GameExplorer\{5ae0d760-ddcf-4247-85df-eacefd518e86}\PlayTasks\0\Plants vs. Zombies - Game of the Year.lnk -> C:\Program Files (x86)\HP Games\onplay\onplay.exe () -> "C:\Program Files (x86)\HP Games\Plants vs Zombies - Game of the Year\plantsvszombies-WT.exe" /launchgc /src gameexploreroem
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\GameExplorer\{502CF397-846F-459B-AB59-9826E34B7ECE}\PlayTasks\0\web.lnk -> C:\Program Files (x86)\HP Games\Web Link - Club Penguin\launcher.exe (WildTangent) -> "C:\Program Files (x86)\HP Games\Web Link - Club Penguin\launcher.exe" /src gameexploreroem
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\GameExplorer\{4e625a41-ccdd-4571-bf53-12288f43c73e}\PlayTasks\0\web.lnk -> C:\Program Files (x86)\HP Games\Web Link - Build-A-Lot Metropolis\launcher.exe (WildTangent) -> "C:\Program Files (x86)\HP Games\Web Link - Build-A-Lot Metropolis\launcher.exe" /src gameexploreroem
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\GameExplorer\{49bddb7b-1943-4156-a1a3-d00b5789d29c}\PlayTasks\0\Fishdom (TM) 2.lnk -> C:\Program Files (x86)\HP Games\onplay\onplay.exe () -> "C:\Program Files (x86)\HP Games\Fishdom (TM) 2\Fishdom2-WT.exe" /launchgc /src gameexploreroem
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\GameExplorer\{471351f0-4e8a-47bf-a6b3-3de3c99ae340}\PlayTasks\0\Jewel Match 3.lnk -> C:\Program Files (x86)\HP Games\onplay\onplay.exe () -> "C:\Program Files (x86)\HP Games\Jewel Match 3\jewelmatch3-WT.exe" /launchgc /src gameexploreroem
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\GameExplorer\{3eda1e54-8889-41f5-a649-5a306789b7ef}\PlayTasks\0\provider.lnk -> C:\Program Files (x86)\HP Games\Game Explorer Categories - genres\provider.exe (WildTangent) -> /id=3eda1e54-8889-41f5-a649-5a306789b7ef /src gameexploreroem
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\GameExplorer\{3266d333-42e6-4cb3-a50a-a87067dede95}\PlayTasks\0\Torchlight.lnk -> C:\Program Files (x86)\HP Games\onplay\onplay.exe () -> "C:\Program Files (x86)\HP Games\Torchlight\torchlight-WT.exe" /launchgc /src gameexploreroem
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\GameExplorer\{2D080D0F-37EF-433E-90F1-CE36EB0205F6}\PlayTasks\0\web.lnk -> C:\Program Files (x86)\HP Games\Web Link - Seafight\launcher.exe (WildTangent) -> "C:\Program Files (x86)\HP Games\Web Link - Seafight\launcher.exe" /src gameexploreroem
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\GameExplorer\{29556c6b-abba-4173-8102-4642846d5b4f}\PlayTasks\0\Wedding Dash.lnk -> C:\Program Files (x86)\HP Games\onplay\onplay.exe () -> "C:\Program Files (x86)\HP Games\Wedding Dash\Wedding Dash-WT.exe" /launchgc /src gameexploreroem
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\GameExplorer\{26352374-af55-4b53-b07b-6b0288ed97df}\PlayTasks\0\provider.lnk -> C:\Program Files (x86)\HP Games\Game Explorer Categories - genres\provider.exe (WildTangent) -> /id=26352374-af55-4b53-b07b-6b0288ed97df /src gameexploreroem
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\GameExplorer\{25bcd516-b0c6-4f76-98b1-b22b35615883}\PlayTasks\0\web.lnk -> C:\Program Files (x86)\HP Games\Web Link - Salon Street\launcher.exe (WildTangent) -> "C:\Program Files (x86)\HP Games\Web Link - Salon Street\launcher.exe" /src gameexploreroem
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\GameExplorer\{22A975C0-D22F-482C-A387-637EEC15870F}\PlayTasks\0\web.lnk -> C:\Program Files (x86)\HP Games\Web Link - World of Warcraft\launcher.exe (WildTangent) -> "C:\Program Files (x86)\HP Games\Web Link - World of Warcraft\launcher.exe" /src gameexploreroem
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\GameExplorer\{227680FF-28CE-48EE-AADF-8D009B2813A9}\PlayTasks\0\web.lnk -> C:\Program Files (x86)\HP Games\Web Link - Dark Orbit\launcher.exe (WildTangent) -> "C:\Program Files (x86)\HP Games\Web Link - Dark Orbit\launcher.exe" /src gameexploreroem
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\GameExplorer\{1475fe75-62f8-40e1-a988-a4dd9ce581e3}\PlayTasks\0\web.lnk -> C:\Program Files (x86)\HP Games\Web Link - Marvel Super Hero Squad Online\launcher.exe (WildTangent) -> "C:\Program Files (x86)\HP Games\Web Link - Marvel Super Hero Squad Online\launcher.exe" /src gameexploreroem
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\GameExplorer\{0334682e-f04f-4f03-8b56-d518fdcb7661}\PlayTasks\0\Zuma's Revenge.lnk -> C:\Program Files (x86)\HP Games\onplay\onplay.exe () -> "C:\Program Files (x86)\HP Games\Zumas Revenge\zumasrevenge-WT.exe" /launchgc /src gameexploreroem
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\GameExplorer\{000d96f5-8034-4b74-a429-b6f0b04c75f4}\PlayTasks\0\provider.lnk -> C:\Program Files (x86)\HP Games\Game Explorer Categories - genres\provider.exe (WildTangent) -> /id=000d96f5-8034-4b74-a429-b6f0b04c75f4 /src gameexploreroem
ShortcutWithArgument: C:\ProgramData\Hewlett-Packard\Recovery\Links\Apps.lnk -> C:\Program Files (x86)\Hewlett-Packard\Recovery\RecoveryMgr.exe (CyberLink) -> /ReinstallApp
ShortcutWithArgument: C:\ProgramData\Hewlett-Packard\Recovery\Links\DelRP.lnk -> C:\Program Files (x86)\Hewlett-Packard\Recovery\RecoveryMgr.exe (CyberLink) -> /DelRP
ShortcutWithArgument: C:\ProgramData\Hewlett-Packard\Recovery\Links\Driver.lnk -> C:\Program Files (x86)\Hewlett-Packard\Recovery\RecoveryMgr.exe (CyberLink) -> /ReinstallDriver
ShortcutWithArgument: C:\ProgramData\Hewlett-Packard\Recovery\Links\Report.lnk -> C:\Program Files (x86)\Hewlett-Packard\Recovery\RecoveryMgr.exe (CyberLink) -> /RecoveryReport
ShortcutWithArgument: C:\ProgramData\Hewlett-Packard\Recovery\Links\RMC.lnk -> C:\Program Files (x86)\Hewlett-Packard\Recovery\RecoveryMgr.exe (CyberLink) -> /CDCreator
ShortcutWithArgument: C:\ProgramData\Hewlett-Packard\HP Setup\launchreg.lnk -> C:\Program Files (x86)\Hewlett-Packard\HP Setup\Dependencies\RunOnceHPTCS.exe () -> MODE=REGISTRATION URL=ReminderPage.html
ShortcutWithArgument: C:\ProgramData\Hewlett-Packard\HP Setup\NativeClient\launchreg.lnk -> C:\Program Files (x86)\Hewlett-Packard\HP Setup\NativeClient\hptcs.exe (Hewlett-Packard) -> MODE=REGISTRATION
ShortcutWithArgument: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Ease of Access.lnk -> C:\Windows\System32\control.exe (Microsoft Corporation) -> /name Microsoft.EaseOfAccessCenter
ShortcutWithArgument: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Fax Recipient.lnk -> C:\Windows\System32\WFS.exe (Microsoft Corporation) -> /SendTo
ShortcutWithArgument: C:\Users\Public\Desktop\Browserwahl.lnk -> C:\Windows\System32\browserchoice.exe (Microsoft Corporation) -> /launch
ShortcutWithArgument: C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\McUICnt.exe (McAfee, Inc.) -> SecurityScanner.dll
ShortcutWithArgument: C:\Users\Tiedt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Ease of Access.lnk -> C:\Windows\System32\control.exe (Microsoft Corporation) -> /name Microsoft.EaseOfAccessCenter
ShortcutWithArgument: C:\Users\Tiedt\AppData\Roaming\Microsoft\Windows\SendTo\Fax Recipient.lnk -> C:\Windows\System32\WFS.exe (Microsoft Corporation) -> /SendTo
ShortcutWithArgument: C:\Users\Tiedt\AppData\Roaming\Microsoft\Windows\SendTo\Skype.lnk -> C:\Program Files (x86)\Skype\Phone\Skype.exe (Skype Technologies S.A.) -> /sendto:
ShortcutWithArgument: C:\Users\Tiedt\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Outlook starten.lnk -> C:\Program Files (x86)\Microsoft Office\OFFICE11\OUTLOOK.EXE (Microsoft Corporation) ->  /recycle
ShortcutWithArgument: C:\Users\Tiedt\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Media Player.lnk -> C:\Program Files (x86)\Windows Media Player\wmplayer.exe (Microsoft Corporation) -> /prefetch:1


InternetURL: C:\Users\Default\Favorites\Links\Amazon.de – online einkaufen.url -> hxxp://redirect.hp.com/svs/rdr?locale=de_de&c=123&bd=pavilion&tp=iefavbar&s=amazon&pf=cndt&TYPE=4
InternetURL: C:\Users\Default\Favorites\HP\Amazon.de – online einkaufen.url -> hxxp://redirect.hp.com/svs/rdr?locale=de_de&c=123&bd=pavilion&tp=iefavs&s=amazon&pf=cndt&TYPE=4
InternetURL: C:\Users\Default\Favorites\HP\eBay.url -> hxxp://redirect.hp.com/svs/rdr?TYPE=4&tp=iefavs&s=ebay&pf=cndt&locale=de_de&bd=all&c=123
InternetURL: C:\Users\Default\Favorites\HP\HP Games.url -> hxxp://redirect.hp.com/svs/rdr?TYPE=4&tp=iefavs&s=myhpgames&pf=cndt&locale=de_DE&bd=all&c=123
InternetURL: C:\Users\Default\Favorites\HP\HP+.url -> hxxp://redirect.hp.com/svs/rdr?TYPE=4&tp=iefavs&s=hp_plus&pf=cndt&locale=de_de&bd=all&c=123
InternetURL: C:\Users\Default\Favorites\HP\Skype herunterladen – kostenlos.url -> hxxp://redirect.hp.com/svs/rdr?TYPE=4&tp=iefavs&s=skype&pf=cndt&locale=de_ww&bd=all&c=123
InternetURL: C:\Users\Default\Favorites\HP\Snapfish.url -> hxxp://www.snapfish.com/hp_desktop_desktopicon_2012_de
InternetURL: C:\Users\Tiedt\Favorites\AKON Präventionsreise nach Seebad Ahlbeck - TRYP Ahlbeck Strandhotel.url -> hxxp://www.akon.de/praeventionsreise-nach-seebad-ahlbeck-124.html?token=2e62e8ad01409f51ab7aabeaca8a7ac1&utm_source=&utm_medium=
InternetURL: C:\Users\Tiedt\Favorites\Bild.de.url -> hxxp://www.bild.de/
InternetURL: C:\Users\Tiedt\Favorites\DB BAHN - Verbindungen - Ihre Anfrage.url -> hxxp://reiseauskunft.bahn.de/bin/query.exe/dn?revia=yes&existOptimizePrice=1&country=DEU&dbkanal_007=L01_S01_D001_KIN0001_qf-bahn_LZ003&S=&REQ0JourneyStopsSID=&REQ0JourneyStopsS0A=7&Z=&REQ0JourneyStopsZID=&REQ0JourneyStopsZ0A=7&trip-type=single&date=Do%2C+04.10.12&time=19%3A21&timesel=depart&returnTimesel=depart&optimize=0&travelProfile=-1&adult-number=1&children-number=0&infant-number=0&tariffTravellerType.1=E&tariffTravellerReductionClass.1=0&tariffTravellerAge.1=&qf-trav-bday-1=&tariffTravellerReductionClass.2=0&tariffTravellerReductionClass.3=0&tariffTravellerReductionClass.4=0&tariffTravellerReductionClass.5=0&tariffClass=2&start=1&qf.bahn.button.suchen=
InternetURL: C:\Users\Tiedt\Favorites\Duden online.url -> hxxp://www.duden.de/
InternetURL: C:\Users\Tiedt\Favorites\easyJet.com.url -> hxxp://www.easyjet.com/de?utm_source=google&utm_medium=cpc&utm_term=easyjet&utm_campaign=Brand+-+Rest+of+Germany&kword=easyjet
InternetURL: C:\Users\Tiedt\Favorites\F.C. Hansa Rostock e.V..url -> hxxp://www.fc-hansa.de/
InternetURL: C:\Users\Tiedt\Favorites\Facebook.url -> https://www.facebook.com/
InternetURL: C:\Users\Tiedt\Favorites\Google.url -> hxxp://www.google.de/
InternetURL: C:\Users\Tiedt\Favorites\Kicktipp EGFB.url -> hxxp://www.kicktipp.de/egfb/profil/login
InternetURL: C:\Users\Tiedt\Favorites\NDR 1 Radio MV.url -> hxxp://www.ndr.de/radiomv/index.html
InternetURL: C:\Users\Tiedt\Favorites\Nordkurier.url -> hxxp://www.nordkurier.de/cmlink/nordkurier/
InternetURL: C:\Users\Tiedt\Favorites\sportschau.de.url -> hxxp://www.sportschau.de/
InternetURL: C:\Users\Tiedt\Favorites\TSG Neustrelitz.url -> hxxp://www.tsg-neustrelitz.de/
InternetURL: C:\Users\Tiedt\Favorites\WEB.DE.url -> hxxp://www.web.de/
InternetURL: C:\Users\Tiedt\Favorites\Wikipedia.url -> hxxp://de.wikipedia.org/wiki/Wikipedia:Hauptseite
InternetURL: C:\Users\Tiedt\Favorites\YouTube.url -> hxxp://www.youtube.com/?gl=DE&hl=de
InternetURL: C:\Users\Tiedt\Favorites\Links\http--hp-desktop.de.msn.url -> hxxp://hp-desktop.de.msn.com/?pc=HPDTDF&OCID=HPDHP
InternetURL: C:\Users\Tiedt\Favorites\Links\Vorgeschlagene Sites.url -> https://ieonline.microsoft.com/#ieslice
InternetURL: C:\Users\Tiedt\Favorites\Links\Web Slice-Katalog.url -> hxxp://go.microsoft.com/fwlink/?LinkId=121315

==================== End of log =============================

M-K-D-B 08.04.2015 14:09
Wir entfernen die letzten Reste und kontrollieren nochmal alles. ESET kann länger (> 2 h) dauern.
Im Anschluss entfernen wir alle verwendeten Tools und ich gebe dir noch ein paar Tipps mit auf den Weg.




Schritt 1
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument


Code:
start
CloseProcesses:
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\abengine
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{365C5DC2-679A-4A5D-B40B-5096A49087A8}_is1
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{028F96B8-C73A-4C60-B82F-3944A19B046E}
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{51F7DE65-A990-4213-BDB9-C2657FA7F3F4}
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{879F721E-7F23-4B7F-B65B-F5A8F518864A}
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A5544F7B-C413-4CAC-8DB4-9A8D1986DD86}
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B9EE49F9-62A3-408D-858F-4ED9A23BAA24}
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BF6D8439-BAC1-4E73-94FE-9910D098AE00}
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4F14684-336F-44FC-8D9E-8A73DAE003EC}
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\LolliScan
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\abengine.EXE
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{D1AACF27-6B3D-47D7-AF24-5D48828C0953}
DeleteKey: HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\Reimage - Windows Problem Relief.
DeleteKey: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\DOMStorage\de.reimageplus.com
DeleteKey: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\DOMStorage\reimageplus.com
DeleteKey: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\DOMStorage\www.reimageplus.com
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2A563926-CF4B-4363-A760-F71E46205B7E}
EmptyTemp:
end

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.






Schritt 2
Downloade dir die passende Version von HitmanPro auf deinen Desktop: HitmanPro - 32 Bit | HitmanPro - 64 Bit.
  • Starte die HitmanPro.exe
  • Klicke auf
  • Entferne den Haken bei
  • Klicke auf
    und
  • Akzeptiere die Lizenzbedingungen und klicke auf
  • Klicke auf

    und auf
  • Wenn der Scan beendet wurde, nichts löschen lassen etc. sondern wähle unten links auf der Button-Leiste
    und speichere die Logdatei auf Deinem Desktop.
  • Schließe HitmanPro und poste mir das Log.

 






Schritt 3

ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset






Schritt 4
Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.






Bitte poste mit deiner nächsten Antwort
  • die Logdatei des FRST-Fix,
  • die Logdatei von HitmanPro,
  • die Logdatei von ESET,
  • die Logdatei von SecurityCheck.

nine53 08.04.2015 19:51
hier die Daten

FRST

Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 11-03-2015
Ran by Tiedt at 2015-04-08 15:45:08 Run:2
Running from C:\Users\Tiedt\Downloads
Loaded Profiles: Tiedt (Available profiles: Tiedt)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
start
CloseProcesses:
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\abengine
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{365C5DC2-679A-4A5D-B40B-5096A49087A8}_is1
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{028F96B8-C73A-4C60-B82F-3944A19B046E}
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{51F7DE65-A990-4213-BDB9-C2657FA7F3F4}
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{879F721E-7F23-4B7F-B65B-F5A8F518864A}
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A5544F7B-C413-4CAC-8DB4-9A8D1986DD86}
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B9EE49F9-62A3-408D-858F-4ED9A23BAA24}
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BF6D8439-BAC1-4E73-94FE-9910D098AE00}
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4F14684-336F-44FC-8D9E-8A73DAE003EC}
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\LolliScan
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\abengine.EXE
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{D1AACF27-6B3D-47D7-AF24-5D48828C0953}
DeleteKey: HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\Reimage - Windows Problem Relief.
DeleteKey: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\DOMStorage\de.reimageplus.com
DeleteKey: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\DOMStorage\reimageplus.com
DeleteKey: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\DOMStorage\www.reimageplus.com
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2A563926-CF4B-4363-A760-F71E46205B7E}
EmptyTemp:
end
*****************

Processes closed successfully.
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\abengine => Moved successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{365C5DC2-679A-4A5D-B40B-5096A49087A8}_is1 => Key Deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{028F96B8-C73A-4C60-B82F-3944A19B046E} => Failed to delete key at first attempt (Error: C0000121), see next line.
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{028F96B8-C73A-4C60-B82F-3944A19B046E} => Key Deleted Successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{51F7DE65-A990-4213-BDB9-C2657FA7F3F4} => Failed to delete key at first attempt (Error: C0000121), see next line.
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{51F7DE65-A990-4213-BDB9-C2657FA7F3F4} => Key Deleted Successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{879F721E-7F23-4B7F-B65B-F5A8F518864A} => Failed to delete key at first attempt (Error: C0000121), see next line.
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{879F721E-7F23-4B7F-B65B-F5A8F518864A} => Key Deleted Successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A5544F7B-C413-4CAC-8DB4-9A8D1986DD86} => Failed to delete key at first attempt (Error: C0000121), see next line.
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A5544F7B-C413-4CAC-8DB4-9A8D1986DD86} => Key Deleted Successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B9EE49F9-62A3-408D-858F-4ED9A23BAA24} => Failed to delete key at first attempt (Error: C0000121), see next line.
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B9EE49F9-62A3-408D-858F-4ED9A23BAA24} => Key Deleted Successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BF6D8439-BAC1-4E73-94FE-9910D098AE00} => Failed to delete key at first attempt (Error: C0000121), see next line.
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BF6D8439-BAC1-4E73-94FE-9910D098AE00} => Key Deleted Successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4F14684-336F-44FC-8D9E-8A73DAE003EC} => Failed to delete key at first attempt (Error: C0000121), see next line.
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4F14684-336F-44FC-8D9E-8A73DAE003EC} => Key Deleted Successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\LolliScan => Key Deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\abengine.EXE => Key Deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{D1AACF27-6B3D-47D7-AF24-5D48828C0953} => Key Deleted successfully.
HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\Reimage - Windows Problem Relief. => Failed to delete key at first attempt (Error: C0000121), see next line.
HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\Reimage - Windows Problem Relief. => Key Deleted Successfully.
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\DOMStorage\de.reimageplus.com => Key Deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\DOMStorage\reimageplus.com => Key Deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\DOMStorage\www.reimageplus.com => Key Deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2A563926-CF4B-4363-A760-F71E46205B7E} => Failed to delete key at first attempt (Error: C0000121), see next line.
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2A563926-CF4B-4363-A760-F71E46205B7E} => Key Deleted Successfully.
EmptyTemp: => Removed 370.6 MB temporary data.


The system needed a reboot.

==== End of Fixlog 15:45:10 ====
Hitman

Code:

       
Code:

       
HitmanPro 3.7.9.240
www.hitmanpro.com

   Computer name . . . . : TIEDT-HP
   Windows . . . . . . . : 6.1.1.7601.X64/4
   User name . . . . . . : Tiedt-HP\Tiedt
   UAC . . . . . . . . . : Enabled
   License . . . . . . . : Trial (30 days left)

   Scan date . . . . . . : 2015-04-08 16:00:18
   Scan mode . . . . . . : Normal
   Scan duration . . . . : 2m 10s
   Disk access mode  . . : Direct disk access (SRB)
   Cloud . . . . . . . . : Internet
   Reboot  . . . . . . . : Yes

   Threats . . . . . . . : 1
   Traces  . . . . . . . : 27

   Objects scanned . . . : 1.255.073
   Files scanned . . . . : 28.458
   Remnants scanned  . . : 225.938 files / 1.000.677 keys

Malware _____________________________________________________________________

   C:\Users\Tiedt\AppData\Local\Installer\Install_10974\DCytdieamodc_amodc_setup.exe -> Deleted
      Size . . . . . . . : 1.427.968 bytes
      Age  . . . . . . . : 0.9 days (2015-04-07 19:14:44)
      Entropy  . . . . . : 6.5
      SHA-256  . . . . . : E8D3D03C4BAF7C138A6B7331027795E82E54915DCB3559AA78C7E4624F3A28B5
    > Bitdefender  . . . : Gen:Variant.Adware.Graftor.171097
    > Kaspersky  . . . . : Trojan-Dropper.Win32.Agent.spjk
      Fuzzy  . . . . . . : 108.0
      Forensic Cluster
         -128.9s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Results\Resource\{4518E77E-2E94-456F-AEE2-785573BAC21D}
         -128.8s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\MetaStore\2\05\
         -128.8s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\MetaStore\2\05\F563C40F472A94A9.dat
         -120.4s C:\Windows\Prefetch\TABNAV_4435.EXE-D5AA49FF.pf
         -102.7s C:\Windows\Prefetch\SC.EXE-F4E1A8F7.pf
         -102.5s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Results\Resource\{7C18C648-126C-4672-8FB2-DDB6767F5A81}
         -101.5s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Store\144919143D70258A82DB539B4D45A302
         -101.0s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Store\F7482CDDECC90BBAA1391FFBDBD78BC6
         -100.1s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Store\618E7D358EE90AD38AECC95FAD77B540
         -99.1s C:\Windows\Prefetch\ABENGINE.EXE-17189E51.pf
         -98.9s C:\Windows\Prefetch\LENGINE.EXE-CC8E97F6.pf
         -98.4s C:\AdwCleaner\Quarantine\C\windows\System32\abengine64.dll.vir
         -97.8s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Results\Resource\{43AEA8E5-B7DE-4818-863A-C72DA650F33E}
         -97.2s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Results\Resource\{29798246-DC18-4F31-9B51-4921A0A494E8}
         -95.5s C:\Windows\System32\winevt\Logs\Microsoft-Windows-Winsock-WS2HELP%4Operational.evtx
         -94.1s C:\Windows\Prefetch\SETUPTN_4435.EXE-F5E8FDA2.pf
         -93.8s C:\Windows\Prefetch\LENGINE64.EXE-6A86CF78.pf
         -93.6s C:\AdwCleaner\Quarantine\C\windows\SysWOW64\abengine.dll.vir
         -93.0s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Results\Resource\{6ABE3558-2341-4176-B8F5-C3B2C2198F28}
         -87.3s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Results\Resource\{FEA57D0E-3C25-45C7-9C53-94887CD982F6}
         -86.1s C:\FRST\Quarantine\C\Windows\SysWOW64\config\systemprofile\AppData\Local\abengine\
         -86.1s C:\FRST\Quarantine\C\Windows\SysWOW64\config\systemprofile\AppData\Local\abengine\abengine.ini
         -86.1s C:\AdwCleaner\Quarantine\C\windows\SysWOW64\abengineOff.ini.vir
         -86.1s C:\AdwCleaner\Quarantine\C\windows\System32\abengineOff.ini.vir
         -85.3s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\MetaStore\1\93\
         -85.3s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\MetaStore\1\93\AAC791E53DBDD705.dat
         -80.4s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Results\Resource\{958674CD-3A3A-4EF7-ABD6-659F6530C69A}
         -80.2s C:\Windows\Prefetch\NJS.EXE-F90E1743.pf
         -80.1s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\MetaStore\2\93\
         -80.1s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\MetaStore\2\93\AAC791E53DBDD705.dat
         -79.9s C:\FRST\Quarantine\C\Windows\System32\Tasks\fres3005.xBAD
         -77.8s C:\Windows\Prefetch\SCHTASKS.EXE-DC1676CD.pf
         -77.7s C:\AdwCleaner\Quarantine\C\END.vir
         -77.3s C:\Windows\Prefetch\SLITE.EXE-F3068031.pf
         -72.3s C:\Windows\Installer\SourceHash{55d4b236-fe79-4782-cc2d-55acaf147087}
         -72.0s C:\FRST\Quarantine\C\Users\Tiedt\AppData\Roaming\lection\
         -72.0s C:\FRST\Quarantine\C\Users\Tiedt\AppData\Roaming\lection\subcalal.dll
         -71.9s C:\FRST\Quarantine\C\Users\Tiedt\AppData\Roaming\lection\gendaqof.dll
         -71.9s C:\Windows\Installer\903ad.msi
         -71.5s C:\Windows\Prefetch\MSIEXEC.EXE-CDBFC0F7.pf
         -71.3s C:\Users\Tiedt\AppData\Local\Programs\Common\
         -71.3s C:\Users\Tiedt\AppData\Local\Programs\
         -70.5s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\MetaStore\2\36\6F926D772711E560.dat
         -70.0s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Results\Resource\{78404BDA-F8E3-47F8-B081-278CA44C913C}
         -69.9s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Results\Resource\{E955BC7C-6741-4A96-8412-735CFC2EE2B7}
         -66.9s C:\Windows\Prefetch\MSIEXEC.EXE-8FFB1633.pf
         -61.8s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Results\Resource\{4F784882-2E8E-4BDA-9875-FAF4124AF69F}
         -61.5s C:\Windows\Prefetch\SETUP_MBOT_DE.EXE-DF834E92.pf
         -61.3s C:\Windows\Prefetch\SETUP_MBOT_DE.TMP-9357C6E0.pf
         -60.8s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\MetaStore\2\38\AE77D90CFE9D1A5E.dat
         -60.7s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Results\Resource\{BD45C6A0-865B-40C7-8E63-5B48DA9BC70D}
         -53.0s C:\Windows\Prefetch\POWERSHELL.EXE-AE8EDC9B.pf
         -53.0s C:\Windows\Prefetch\CMD.EXE-6D6290C5.pf
         -52.5s C:\Windows\Prefetch\TASKKILL.EXE-0ECD41EC.pf
         -52.3s C:\AdwCleaner\Quarantine\C\Program Files (x86)\mbot_de_587\unins000.dat.vir
         -52.3s C:\AdwCleaner\Quarantine\C\Program Files (x86)\mbot_de_587\unins000.exe.vir
         -52.3s C:\Windows\Prefetch\INST.EXE-C5BDE4C8.pf
         -52.3s C:\AdwCleaner\Quarantine\C\Program Files (x86)\mbot_de_587\mbot_de_587.exe.vir
         -52.2s C:\Windows\Prefetch\INST.TMP-E0175F07.pf
         -52.0s C:\AdwCleaner\Quarantine\C\Users\Tiedt\AppData\Local\mbot_de_587\upmbot_de_587.exe.vir
         -52.0s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Store\10ACB4BA71410D30111B01321B5E2907
         -51.7s C:\AdwCleaner\Quarantine\C\Program Files (x86)\mbot_de_587\predm.exe.vir
         -51.1s C:\AdwCleaner\Quarantine\C\Program Files (x86)\mbot_de_587\mybestofferstoday_widget.exe.vir
         -51.0s C:\AdwCleaner\Quarantine\C\ProgramData\Microsoft\Windows\Start Menu\Programs\MyBestOffersToday\MyBestOffersToday.lnk.vir
         -50.7s C:\AdwCleaner\Quarantine\C\Users\Tiedt\AppData\Local\mbot_de_587\mbot_de_587\1.10\cnf.cyl.vir
         -50.5s C:\AdwCleaner\Quarantine\C\Users\Tiedt\AppData\Local\mbot_de_587\upmbot_de_587.cyl.vir
         -49.7s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\MetaStore\2\48\16361F44051EE4DC.dat
         -49.7s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\MetaStore\2\48\
         -49.4s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Results\Resource\{87C87883-6CB8-4577-80D8-F6B5EF62C2B9}
         -49.1s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Results\Resource\{5BF8E67C-5805-444C-A478-AB95D68AE36A}
         -46.3s C:\Windows\Installer\SourceHash{c8730ca5-3f82-41cc-65e2-01b87600cd89}
         -46.0s C:\Windows\Installer\903b3.msi
         -45.6s C:\AdwCleaner\Quarantine\C\ProgramData\LolliScan\RfndNSIS.dll.vir
         -44.8s C:\FRST\Quarantine\C\ProgramData\36ebbb131f884f3aa5b926d4db990ab9\
         -44.7s C:\FRST\Quarantine\C\ProgramData\36ebbb131f884f3aa5b926d4db990ab9\6aee9945a65e48c698eb18daa385ec92
         -44.2s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Results\Resource\{1D0719B3-B1C4-429E-921F-26562A39F1D7}
         -44.1s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\MetaStore\2\99\
         -44.1s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\MetaStore\2\99\D8D21AFD879D7FAF.dat
         -43.5s C:\Windows\Prefetch\NET1.EXE-091D8149.pf
         -43.5s C:\Windows\Prefetch\NET.EXE-0225D674.pf
         -43.1s C:\FRST\Quarantine\C\ProgramData\3a8c9699124a4506a71d46fb652dc7b1\
         -43.1s C:\AdwCleaner\Quarantine\C\ProgramData\LolliScan\SoftConfigTest.exe.vir
         -43.1s C:\AdwCleaner\Quarantine\C\ProgramData\LolliScan\LolliScan.exe.vir
         -41.8s C:\Windows\Prefetch\LOLLISCAN.EXE-1C162728.pf
         -40.9s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Results\Resource\{00196EAA-B2B7-4205-A05D-29B2CF24059B}
         -40.7s C:\Windows\Prefetch\MBOT_DE_587.EXE-F0F0C2F0.pf
         -40.6s C:\Windows\Prefetch\UPMBOT_DE_587.EXE-CE66D00D.pf
         -39.8s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\MetaStore\2\64\8BF564494A49ABF4.dat
         -35.8s C:\Windows\Prefetch\SETUP.EXE-D642F94D.pf
         -34.3s C:\FRST\Quarantine\C\Windows\System32\Tasks\TKKMJ.xBAD
         -32.2s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\MetaStore\2\35\F6725D8F1DC29F93.dat
         -31.9s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Results\Resource\{2EB52047-57FF-407F-B424-E26E9667389D}
         -30.7s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Results\Resource\{26346469-8154-4E87-8331-74FBF649AA2A}
         -23.8s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Results\Resource\{BBE7D431-1AA4-43A5-97B8-1108226A75B4}
         -23.4s C:\Windows\Prefetch\AMT_LUCKYSEARCHES.EXE-B303A98B.pf
         -22.5s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\MetaStore\2\39\9EDECF548F3AACD7.dat
         -17.8s C:\AdwCleaner\Quarantine\C\Users\Tiedt\AppData\Roaming\luckysearches\UninstallManager.exe.vir
         -17.8s C:\AdwCleaner\Quarantine\C\Users\Tiedt\AppData\Roaming\luckysearches\uninstallDlg2.xml.vir
         -17.8s C:\AdwCleaner\Quarantine\C\Users\Tiedt\AppData\Roaming\luckysearches\MessageBox.xml.vir
         -17.7s C:\AdwCleaner\Quarantine\C\Users\Tiedt\AppData\Roaming\luckysearches\images\bg.png.vir
         -17.7s C:\AdwCleaner\Quarantine\C\Users\Tiedt\AppData\Roaming\luckysearches\images\bg1.png.vir
         -17.7s C:\AdwCleaner\Quarantine\C\Users\Tiedt\AppData\Roaming\luckysearches\images\bk_shadow.png.vir
         -17.7s C:\AdwCleaner\Quarantine\C\Users\Tiedt\AppData\Roaming\luckysearches\images\button.png.vir
         -17.7s C:\AdwCleaner\Quarantine\C\Users\Tiedt\AppData\Roaming\luckysearches\images\button1.png.vir
         -17.7s C:\AdwCleaner\Quarantine\C\Users\Tiedt\AppData\Roaming\luckysearches\images\checkbox.png.vir
         -17.7s C:\AdwCleaner\Quarantine\C\Users\Tiedt\AppData\Roaming\luckysearches\images\checkbox_select.png.vir
         -17.7s C:\AdwCleaner\Quarantine\C\Users\Tiedt\AppData\Roaming\luckysearches\images\checked.png.vir
         -17.7s C:\AdwCleaner\Quarantine\C\Users\Tiedt\AppData\Roaming\luckysearches\images\close.png.vir
         -17.7s C:\AdwCleaner\Quarantine\C\Users\Tiedt\AppData\Roaming\luckysearches\images\loading_bg.png.vir
         -17.7s C:\AdwCleaner\Quarantine\C\Users\Tiedt\AppData\Roaming\luckysearches\images\loading_light.png.vir
         -17.7s C:\AdwCleaner\Quarantine\C\Users\Tiedt\AppData\Roaming\luckysearches\images\min.png.vir
         -17.7s C:\AdwCleaner\Quarantine\C\Users\Tiedt\AppData\Roaming\luckysearches\images\scrollbar.bmp.vir
         -17.7s C:\AdwCleaner\Quarantine\C\Users\Tiedt\AppData\Roaming\luckysearches\images\Thumbs.db.vir
         -17.7s C:\AdwCleaner\Quarantine\C\Users\Tiedt\AppData\Roaming\luckysearches\images\unchecked.png.vir
         -17.7s C:\AdwCleaner\Quarantine\C\Users\Tiedt\AppData\Roaming\luckysearches\499.json.vir
         -17.7s C:\AdwCleaner\Quarantine\C\Users\Tiedt\AppData\Roaming\luckysearches\images\code\code1.jpg.vir
         -17.7s C:\AdwCleaner\Quarantine\C\Users\Tiedt\AppData\Roaming\luckysearches\images\code\code2.jpg.vir
         -17.7s C:\AdwCleaner\Quarantine\C\Users\Tiedt\AppData\Roaming\luckysearches\images\code\code3.jpg.vir
         -17.7s C:\AdwCleaner\Quarantine\C\Users\Tiedt\AppData\Roaming\luckysearches\images\code\code4.jpg.vir
         -17.7s C:\AdwCleaner\Quarantine\C\Users\Tiedt\AppData\Roaming\luckysearches\images\code\code5.jpg.vir
         -17.7s C:\AdwCleaner\Quarantine\C\Users\Tiedt\AppData\Roaming\luckysearches\images\code\code6.jpg.vir
         -17.7s C:\AdwCleaner\Quarantine\C\Users\Tiedt\AppData\Roaming\luckysearches\images\code\Thumbs.db.vir
         -17.3s C:\Windows\Prefetch\QQBROWSER.EXE-FD1E8B19.pf
         -9.3s C:\AdwCleaner\Quarantine\C\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe.vir
         -8.4s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Results\Resource\{54A4CA40-1832-4116-823C-1CDC5925DF36}
         -8.4s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Results\Resource\{B1C4328A-E445-4E00-A860-84723676C0F3}
         -8.1s C:\Windows\Prefetch\WPM_V20.0.0.1953_0302.EXE-65D917AB.pf
         -8.1s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\MetaStore\2\49\
         -8.1s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\MetaStore\2\49\1CC129D5E4CBE171.dat
         -7.2s C:\Windows\Prefetch\PROTECTWINDOWSMANAGER.EXE-252F7FE7.pf
         -7.1s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\MetaStore\2\36\10A3F60557218A94.dat
         -4.1s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Results\Resource\{25CCDE4F-780E-46B7-9882-C9A6874326CD}
         -2.1s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\MetaStore\2\45\
         -2.1s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\MetaStore\2\45\E3D5C015E1D6BAD9.dat
         -2.1s C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\install.data.vir
         -0.7s C:\Users\Tiedt\AppData\Local\CrashRpt\UnsentCrashReports\YTDi 1.0.0.1_1.0.0.1\
         -0.7s C:\Users\Tiedt\AppData\Local\CrashRpt\
         -0.7s C:\Users\Tiedt\AppData\Local\CrashRpt\UnsentCrashReports\
         -0.2s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Results\Resource\{9A74A595-6C12-4311-B6AF-C3DEEB333FF6}
         -0.2s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Results\Resource\{006F25C5-1BA5-4D15-9030-8E9B5CDE8CF8}
         -0.0s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\MetaStore\2\69\7E63DDE3D4774349.dat
          0.0s C:\Users\Tiedt\AppData\Local\Installer\
          0.0s C:\Users\Tiedt\AppData\Local\Installer\Install_10974\
          0.0s C:\Users\Tiedt\AppData\Local\Installer\Install_10974\DCytdieamodc_amodc_setup.exe
          0.6s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Mput\MputHistory\21\1358
          2.0s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Mput\MputHistory\15\1289
          2.2s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Mput\MputHistory\22\190
          5.2s C:\Windows\Prefetch\XTAB_SETUP2121.EXE-C5C61745.pf
          5.8s C:\Windows\Prefetch\YTDIEAMODC_AMODC_SETUP.EXE-F5A7EC96.pf
          9.3s C:\Windows\Prefetch\DCYTDIEAMODC_AMODC_SETUP.EXE-33282A2B.pf
         11.4s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Results\Resource\{7F104E89-10A6-413F-AB81-7766945411A6}
         11.7s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Results\Resource\{77A31C04-AB5C-4C1C-ACE8-EB94FF30E48D}
         11.9s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\MetaStore\2\07\C6966A51D738CCA7.dat
         11.9s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\MetaStore\2\07\
         13.9s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\MetaStore\2\69\DF60ED7BABA19419.dat
         14.8s C:\Windows\Prefetch\PROTECTSERVICE.EXE-94593BF3.pf
         15.2s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Results\Resource\{5C7F8846-D523-4268-AB0D-B2C4F76BCDDE}
         15.7s C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\uninstall.exe.vir
         21.2s C:\Windows\Prefetch\CMDSHELL.EXE-F45ABD5D.pf
         24.0s C:\Windows\Prefetch\HPNOTIFY.EXE-17F47CEE.pf
         31.8s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\MetaStore\4\88\00F813AB46AE888C.dat
         31.8s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\MetaStore\4\88\
         33.6s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Store\DBDCD2503FD31C6A7CA0DA2C7F9A7E03
         37.2s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Store\7A135EDF671AE9FD737BF8A534461B37
         37.4s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Results\Resource\{18268D40-4EE8-41A3-AF96-3159EC19E39B}
         39.7s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Results\Resource\{1715B762-2C22-4806-8810-8594BE37DBD1}
         44.9s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Results\Resource\{9E5441A9-DE11-4696-BAFD-526F0AAA52FA}
         46.9s C:\Windows\Prefetch\INS_SHOPPERPRO.EXE-45FF7519.pf
         48.5s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Results\Resource\{45A0BB47-EBB4-420A-8ED3-79715E310559}
         52.6s C:\AdwCleaner\Quarantine\C\Program Files (x86)\ShopperPro\config.json.vir
         52.7s C:\AdwCleaner\Quarantine\C\ProgramData\ShopperPro\ShopperPro.dll.vir
         52.7s C:\AdwCleaner\Quarantine\C\ProgramData\ShopperPro\ShopperPro64.dll.vir
         53.3s C:\AdwCleaner\Quarantine\C\ProgramData\ShopperPro\database1_0_0.json.vir
         53.6s C:\AdwCleaner\Quarantine\C\ProgramData\ShopperPro\config.json.vir
         53.8s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\MetaStore\2\16\7E172E64090849B0.dat
         53.8s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\MetaStore\2\16\
         54.0s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Results\Resource\{1C1B7F2A-D6DB-4D0E-A03E-11B3662CA175}
         54.5s C:\AdwCleaner\Quarantine\C\Program Files (x86)\ShopperPro\JSDriver\1.38.1.1735\jsdrv.exe.vir
         54.7s C:\AdwCleaner\Quarantine\C\Program Files (x86)\ShopperPro\JSDriver\1.38.1.1735\jsdrv.sys.vir
         54.7s C:\AdwCleaner\Quarantine\C\Program Files (x86)\ShopperPro\JSDriver\1.38.1.1735\database1_0_0.json.vir
         54.7s C:\AdwCleaner\Quarantine\C\Program Files (x86)\ShopperPro\JSDriver\1.38.1.1735\config.json.vir
         60.9s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Results\Resource\{A20294EB-22D4-4286-88E9-688CA807CBA5}
         65.2s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\MetaStore\2\23\401D54518778410F.dat
         78.2s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Results\Resource\{5D63FD00-9BFA-4CF7-8AC5-53D1B4234333}
         78.9s C:\AdwCleaner\Quarantine\C\ProgramData\ShopperPro\spbihe.js.vir
         82.6s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Results\Resource\{1E2D9440-DA8C-4B46-B742-53FB169FFCE8}
         84.3s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\MetaStore\2\81\2D8485D08C9E4371.dat
         89.5s C:\Program Files\Common Files\System\SysMenu64.dll
         89.6s C:\Program Files\Common Files\System\SysMenu.dll
         90.0s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Results\Resource\{566042E5-AA2E-4D86-8C0E-434FFEA7C7F1}
         91.8s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Results\Resource\{FE9831BE-F9B2-471E-96A3-B8DABA9CC3D9}
         92.4s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Results\Resource\{B2F03039-B3AF-4050-A310-CB5F0C9BB09D}
         93.0s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\MetaStore\2\94\21244DC072D918E2.dat
         93.5s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Results\Resource\{E20A8DDF-FA2E-473D-BBE5-7261F6CBC2B5}
         101.4s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Results\Resource\{BB43C63E-3710-40EE-8650-6BDA7A8ED4FB}
         101.9s C:\AdwCleaner\Quarantine\C\Program Files (x86)\iWebar\utils.exe.vir
         102.4s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\MetaStore\2\15\412EBB334F0FBB0F.dat
         104.0s C:\AdwCleaner\Quarantine\C\Program Files (x86)\iWebar\Uninstall.exe.vir
         106.6s C:\AdwCleaner\Quarantine\C\Program Files (x86)\globalUpdate\Update\1.3.25.0\GoogleUpdate.exe.vir
         106.6s C:\AdwCleaner\Quarantine\C\Program Files (x86)\globalUpdate\Update\1.3.25.0\goopdate.dll.vir
         106.7s C:\AdwCleaner\Quarantine\C\Program Files (x86)\globalUpdate\Update\1.3.25.0\GoogleCrashHandler.exe.vir
         106.8s C:\AdwCleaner\Quarantine\C\Program Files (x86)\globalUpdate\Update\1.3.25.0\goopdateres_en.dll.vir
         106.8s C:\AdwCleaner\Quarantine\C\Program Files (x86)\globalUpdate\Update\1.3.25.0\GoogleUpdateHelper.msi.vir
         106.8s C:\AdwCleaner\Quarantine\C\Program Files (x86)\globalUpdate\Update\1.3.25.0\psuser.dll.vir
         106.9s C:\AdwCleaner\Quarantine\C\Program Files (x86)\globalUpdate\Update\1.3.25.0\psmachine.dll.vir
         106.9s C:\AdwCleaner\Quarantine\C\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe.vir
         106.9s C:\FRST\Quarantine\C\Program Files (x86)\5eb99ca5-046a-49ee-9304-c67a0fd45030\
         106.9s C:\AdwCleaner\Quarantine\C\Program Files (x86)\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll.vir
         107.0s C:\AdwCleaner\Quarantine\C\Program Files (x86)\globalUpdate\Update\1.3.25.0\GoogleUpdateBroker.exe.vir
         107.0s C:\AdwCleaner\Quarantine\C\Program Files (x86)\globalUpdate\Update\1.3.25.0\GoogleUpdateOnDemand.exe.vir
         107.1s C:\AdwCleaner\Quarantine\C\Program Files (x86)\Object Browser\utils.exe.vir
         107.9s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Results\Resource\{8EC9B767-B650-4639-A572-E1A99D58F0E9}
         108.3s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Results\Resource\{973688C2-3586-49BC-B5C5-BB05C5B007D3}
         108.9s C:\AdwCleaner\Quarantine\C\Program Files (x86)\Object Browser\Uninstall.exe.vir
         111.6s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Results\Resource\{501C3D46-6D7D-4A7E-821E-CA1834863B93}
         112.0s C:\AdwCleaner\Quarantine\C\Users\Tiedt\AppData\Local\BrowserHelper\BrowserHelperBk.txt.vir
         112.5s C:\FRST\Quarantine\C\Windows\Tasks\XDKWM.job.xBAD
         112.6s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\MetaStore\2\48\11D31D0E1CEA7080.dat
         113.1s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Results\Resource\{C89A834A-46BE-4EBB-A5CE-5DD8897101C0}
         117.7s C:\FRST\Quarantine\C\Windows\System32\Tasks\XDKWM.xBAD
         121.0s C:\FRST\Quarantine\C\Program Files (x86)\691f0be1-5255-412a-8083-cbfcdb6532b4\
         124.5s C:\FRST\Quarantine\C\Windows\System32\Tasks\Microsoft\Windows\Maintenance\SMupdate2.xBAD
         130.9s C:\FRST\Quarantine\C\Windows\System32\Tasks\Microsoft\Windows\Multimedia\SMupdate3.xBAD
         133.7s C:\AdwCleaner\Quarantine\C\Users\Tiedt\AppData\Local\mbot_de_587\user_profil.cyp.vir
         134.1s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\MetaStore\2\74\FDDCE270482B2BD2.dat
         134.1s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\MetaStore\2\74\
         134.9s C:\AdwCleaner\Quarantine\C\Users\Tiedt\AppData\Local\mbot_de_587\Download\majmp_gentleeu.exe.vir
         136.1s C:\AdwCleaner\Quarantine\C\Program Files (x86)\iWebar\4947097a-efd7-4265-be23-25706c1bf1f3-6.exe.vir
         136.3s C:\AdwCleaner\Quarantine\C\Program Files (x86)\iWebar\8c03bd5d-6391-4d30-941c-bf9bd1df506f.dll.vir
         138.4s C:\AdwCleaner\Quarantine\C\Program Files (x86)\iWebar\4947097a-efd7-4265-be23-25706c1bf1f3-7.exe.vir
         138.9s C:\AdwCleaner\Quarantine\C\Program Files (x86)\iWebar\4947097a-efd7-4265-be23-25706c1bf1f3-64.exe.vir
         138.9s C:\AdwCleaner\Quarantine\C\Program Files (x86)\iWebar\82dbdb1c-f9f2-4d53-8854-0ad8f6274787.dll.vir
         139.0s C:\FRST\Quarantine\C\Program Files (x86)\5eb99ca5-046a-49ee-9304-c67a0fd45030\2d103b14-f968-42fb-bf5b-59a2ce8eddff.dll
         139.1s C:\Program Files (x86)\avmwlanstick\5eb99ca5-046a-49ee-9304-c67a0fd45030.dll
         140.8s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Results\Resource\{1AFDAD0B-A320-47DA-BDF0-92F87FB2E2C5}
         145.2s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\MetaStore\2\05\56D4A6C90573A98D.dat
         145.6s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Results\Resource\{714A8DB5-F34F-4260-A5F7-6E0E3D670823}
         151.5s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Results\Resource\{001DF0E1-7ECF-4FDE-95B3-E620E78FACD0}
         154.0s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Results\Resource\{AEB3B1A2-27D6-4737-A036-D22CE79C99F9}
         155.4s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\MetaStore\2\06\
         155.4s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\MetaStore\2\06\BF34C06ED931BAD6.dat
         159.7s C:\AdwCleaner\Quarantine\C\Program Files (x86)\Object Browser\ebbe3f26-9d77-42bb-9f0a-fa747484c8f2-6.exe.vir
         159.9s C:\AdwCleaner\Quarantine\C\Program Files (x86)\Object Browser\84fbb313-ac12-4011-83b2-604424784096.dll.vir
         160.5s C:\AdwCleaner\Quarantine\C\Program Files (x86)\Object Browser\ebbe3f26-9d77-42bb-9f0a-fa747484c8f2-7.exe.vir
         160.7s C:\AdwCleaner\Quarantine\C\Program Files (x86)\Object Browser\ebbe3f26-9d77-42bb-9f0a-fa747484c8f2-64.exe.vir
         160.7s C:\AdwCleaner\Quarantine\C\Program Files (x86)\Object Browser\025f8c07-b636-4fdc-bc8f-51be9e7cc4f7.dll.vir
         160.7s C:\FRST\Quarantine\C\Program Files (x86)\691f0be1-5255-412a-8083-cbfcdb6532b4\8d2babc2-ed36-4dd9-9e53-3dd6c0dff870.dll
         160.8s C:\FRST\Quarantine\C\Program Files (x86)\691f0be1-5255-412a-8083-cbfcdb6532b4\691f0be1-5255-412a-8083-cbfcdb6532b4.dll
         163.1s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Store\7B08BEBA69B9F29220C521B350D192E1
         163.8s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Results\Resource\{FE878378-04BA-4675-8576-2017A7FB408D}
         165.7s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Results\Resource\{A611AB82-30D7-4F84-9290-B5BFCE1ACEC5}
         169.5s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Results\Resource\{51D04033-60FA-4A06-A0BB-DB9D5DD7DEED}
         169.8s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Results\Resource\{8672B3CD-44CA-4BB9-A403-57BEE11199E8}
         178.2s C:\AdwCleaner\Quarantine\C\Program Files (x86)\iWebar\4947097a-efd7-4265-be23-25706c1bf1f3-1-6.exe.vir
         179.5s C:\AdwCleaner\Quarantine\C\Program Files (x86)\iWebar\4947097a-efd7-4265-be23-25706c1bf1f3-1-7.exe.vir
         181.5s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Results\Resource\{9BA243F1-4E45-44C0-91E0-2AA0EC393573}
         184.9s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\MetaStore\2\49\466CF932EA0E4E8D.dat
         186.2s C:\AdwCleaner\Quarantine\C\Program Files (x86)\Object Browser\ebbe3f26-9d77-42bb-9f0a-fa747484c8f2-1-6.exe.vir
         186.8s C:\AdwCleaner\Quarantine\C\Program Files (x86)\Object Browser\ebbe3f26-9d77-42bb-9f0a-fa747484c8f2-1-7.exe.vir
         188.6s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Results\Resource\{78BED387-06C2-483D-955E-8DBD32983C35}
         188.9s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\MetaStore\2\69\FEBA7B0DB1F3B241.dat
         199.5s C:\Windows\System32\SMI\Store\Machine\schema.dat{08ee0084-dd48-11e4-9ea8-bc05430e1a38}.TM.blf
         201.0s C:\Windows\System32\SMI\Store\Machine\schema.dat{08ee0084-dd48-11e4-9ea8-bc05430e1a38}.TMContainer00000000000000000001.regtrans-ms
         202.3s C:\Windows\System32\SMI\Store\Machine\schema.dat{08ee0084-dd48-11e4-9ea8-bc05430e1a38}.TMContainer00000000000000000002.regtrans-ms
         203.8s C:\AdwCleaner\Quarantine\C\Program Files (x86)\iWebar\4947097a-efd7-4265-be23-25706c1bf1f3-5.exe.vir
         204.7s C:\AdwCleaner\Quarantine\C\Program Files (x86)\Object Browser\ebbe3f26-9d77-42bb-9f0a-fa747484c8f2-5.exe.vir
         213.1s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Results\Resource\{DEA329AB-2790-4309-AFD2-BFCE9BDD9007}
         213.2s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\MetaStore\2\60\
         213.2s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\MetaStore\2\60\8EFDDA7439C2E024.dat
         241.2s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\MetaStore\2\82\98D7CFC10A37B522.dat
         241.2s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\MetaStore\2\82\
         241.3s C:\AdwCleaner\Quarantine\C\Users\Tiedt\AppData\Local\Temp\Uninstall.exe.vir
         241.7s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Results\Resource\{158BC9AF-5273-4834-B1A3-3E22003CDD9C}
         251.4s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\MetaStore\2\71\
         251.4s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\MetaStore\2\71\0987C3480F11F5B7.dat
         251.4s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Results\Resource\{FF1ABD11-E2CB-4DDB-B8CD-1D62E00C3618}
         253.5s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\MetaStore\2\07\19F925E126F5E8E7.dat
         253.9s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Results\Resource\{9F27F2AA-0639-4DD1-9C1C-5EF927A2795F}


Suspicious files ____________________________________________________________

   C:\Users\Tiedt\Downloads\FRST64.exe
      Size . . . . . . . : 2.095.616 bytes
      Age  . . . . . . . : 0.8 days (2015-04-07 20:39:19)
      Entropy  . . . . . : 7.5
      SHA-256  . . . . . : 72AAB1C62CF0BC00F5B102954B603D1509B2AF5F0BD1911E9CAE98C4DDE2D152
      Needs elevation  . : Yes
      Fuzzy  . . . . . . : 24.0
         Program has no publisher information but prompts the user for permission elevation.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Time indicates that the file appeared recently on this computer.


Potential Unwanted Programs _________________________________________________

   HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\Stats\{5645E0E7-FC12-43BF-A6E4-F9751942B298}\ (DomalQ) -> Deleted
   HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\Stats\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}\ (DomalQ) -> Deleted
   HKLM\SYSTEM\ControlSet001\Control\Class\{0014298C-A9BA-440D-AAA8-AD12C7010EE5}\ (ShopperPro) -> Deleted
   HKLM\SYSTEM\ControlSet001\Control\Class\{181A06EA-B82C-47DE-B851-E20FD0E1CC7D}\ (ShopperPro) -> Deleted
   HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_SBMNTR\ (Goobzo) -> Deleted
   HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_SPBIUPDD\ (ShopperPro) -> Deleted
   HKLM\SYSTEM\ControlSet002\Control\Class\{0014298C-A9BA-440D-AAA8-AD12C7010EE5}\ (ShopperPro) -> Deleted
   HKLM\SYSTEM\ControlSet002\Control\Class\{181A06EA-B82C-47DE-B851-E20FD0E1CC7D}\ (ShopperPro) -> Deleted
   HKLM\SYSTEM\ControlSet002\Enum\Root\LEGACY_SBMNTR\ (Goobzo) -> Deleted
   HKLM\SYSTEM\ControlSet002\Enum\Root\LEGACY_SPBIUPDD\ (ShopperPro) -> Deleted
   HKLM\SYSTEM\CurrentControlSet\Control\Class\{0014298C-A9BA-440D-AAA8-AD12C7010EE5}\ (ShopperPro) -> PendingDelete
   HKLM\SYSTEM\CurrentControlSet\Control\Class\{181A06EA-B82C-47DE-B851-E20FD0E1CC7D}\ (ShopperPro) -> PendingDelete
   HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SBMNTR\ (Goobzo) -> PendingDelete
   HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SPBIUPDD\ (ShopperPro) -> PendingDelete
   HKU\.DEFAULT\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\ (UniDeals) -> Deleted
   HKU\S-1-5-18\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\ (UniDeals) -> PendingDelete
   HKU\S-1-5-21-2149968534-1042019459-1302014499-1000\Software\Classes\*\ShellEx\ContextMenuHandlers\SysMenuExt\ (YTDownloader) -> Deleted
   HKU\S-1-5-21-2149968534-1042019459-1302014499-1000\Software\Linkey\ (Linkey) -> Deleted
   HKU\S-1-5-21-2149968534-1042019459-1302014499-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\shoppingate.info\ (ShopperPro) -> Deleted
   HKU\S-1-5-21-2149968534-1042019459-1302014499-1000_Classes\*\ShellEx\ContextMenuHandlers\SysMenuExt\ (YTDownloader) -> PendingDelete
   HKU\S-1-5-21-2149968534-1042019459-1302014499-1000_Classes\Wow6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\ (UniDeals) -> Deleted

Cookies _____________________________________________________________________

   C:\Users\Tiedt\AppData\Local\Google\Chrome\User Data\Default\Cookies:ad.ad-srv.net
   C:\Users\Tiedt\AppData\Local\Google\Chrome\User Data\Default\Cookies:doubleclick.net
   C:\Users\Tiedt\AppData\Local\Google\Chrome\User Data\Default\Cookies:track.adform.net
   C:\Users\Tiedt\AppData\Local\Google\Chrome\User Data\Default\Cookies:www.googleadservices.com

ESET

Code:
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=984f9cd6472d8e44b92ffe158244bc61
# engine=23286
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-04-08 06:24:01
# local_time=2015-04-08 08:24:01 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Microsoft Security Essentials'
# compatibility_mode=5895 16777213 100 100 4840543 99811063 0 0
# scanned=161116
# found=92
# cleaned=0
# scan_time=14833
sh=42B0B52862CD43A13329BC54A94A5FC6A532D514 ft=1 fh=07bd90fb442214a1 vn="Win32/ReImageRepair.F evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Reimage\Reimage Repair\ReimageRepair.exe.vir"
sh=CCA82AF8D85AB2B3312B401602EAE26CF7F4840F ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Cinema PlusV07.04\019b7c5c-5928-4f7e-947d-a1eb4b7a7f2e.crx.vir"
sh=C328404390F740BFDC5AA432E225C71E88E03D95 ft=1 fh=c71c00114fe77bce vn="Variante von Win32/Toolbar.CrossRider.CG evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Cinema PlusV07.04\019b7c5c-5928-4f7e-947d-a1eb4b7a7f2e.dll.vir"
sh=625EE90D34309BB44E0DD190A58FACDC934E32E9 ft=1 fh=c71c0011058c98f3 vn="Variante von Win32/Toolbar.CrossRider.AV evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Cinema PlusV07.04\f7c60be6-f43e-478e-86f2-92730f6935fd-1-6.exe.vir"
sh=6B314DFBA0B0316348C8902E4ACDD56B5FB393F6 ft=1 fh=d13782c5dc8da742 vn="Variante von Win32/Toolbar.CrossRider.CD evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Cinema PlusV07.04\f7c60be6-f43e-478e-86f2-92730f6935fd-1-7.exe.vir"
sh=00A3E71EC5FD807D67FD7A9A0CB785771D3E1D82 ft=1 fh=e4a40290d6312e41 vn="Variante von Win32/Toolbar.CrossRider.CH evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Cinema PlusV07.04\f7c60be6-f43e-478e-86f2-92730f6935fd-3.exe.vir"
sh=3D966C41C29F11C3B92E0380DBC4DABF4D1EA8D0 ft=1 fh=b659a738739db20a vn="Variante von Win32/Toolbar.CrossRider.CC evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Cinema PlusV07.04\f7c60be6-f43e-478e-86f2-92730f6935fd-5.exe.vir"
sh=3A8A9A474272A80FDABE7D3E7F89B8C50134E459 ft=1 fh=c71c0011c0fab0d7 vn="Variante von Win32/Toolbar.CrossRider.CD evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Cinema PlusV07.04\f7c60be6-f43e-478e-86f2-92730f6935fd-6.exe.vir"
sh=B60EDFA91D680699E41A077A5EB86540469B3E82 ft=1 fh=c71c00117b67c48d vn="Variante von Win64/Toolbar.Crossrider.N evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Cinema PlusV07.04\f7c60be6-f43e-478e-86f2-92730f6935fd-64.exe.vir"
sh=6B314DFBA0B0316348C8902E4ACDD56B5FB393F6 ft=1 fh=d13782c5dc8da742 vn="Variante von Win32/Toolbar.CrossRider.CD evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Cinema PlusV07.04\f7c60be6-f43e-478e-86f2-92730f6935fd-7.exe.vir"
sh=38AE348CDFC7BDCDD659E8187A50FD57E587AF40 ft=1 fh=c71c00115f9e3993 vn="Variante von Win32/Toolbar.CrossRider.CD evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Cinema PlusV07.04\UninstallBrw.exe.vir"
sh=38BB6A593FD4A0DCE25539633924CFC119664FB5 ft=1 fh=cf44f6ac695855d8 vn="Win32/Packed.VMDetector.I evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Cinema PlusV07.04\utils.exe.vir"
sh=C3ABBA35226125A4240D5D2131EE91941C04BBB8 ft=1 fh=c7845aba6e5f2dda vn="Variante von Win32/Toolbar.CrossRider.CH evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Crossbrowse\Crossbrowse\Application\utility.exe.vir"
sh=B2256E8864ABAEC3D005434713797B0B4604B0E2 ft=1 fh=8c5912609fc6ee9d vn="Variante von Win32/AdWare.EoRezo.AU Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\gmsd_de_385\gamesdesktop_widget.exe.vir"
sh=D7C2511EFD98F5A7B4A6A3ED881B39F83323C952 ft=1 fh=7fe1905a3612c560 vn="Variante von Win32/AdWare.EoRezo.AU Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\gmsd_de_385\gmsd_de_385.exe.vir"
sh=31720C87BB976D6B8955C83BCA3DD9B6DAD30B85 ft=1 fh=c71c0011058c98f3 vn="Variante von Win32/Toolbar.CrossRider.AV evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\iWebar\4947097a-efd7-4265-be23-25706c1bf1f3-1-6.exe.vir"
sh=99229E8A9EC4AD9E09D89A41A60182BB33EB7088 ft=1 fh=b1d3bc9edc8da742 vn="Variante von Win32/Toolbar.CrossRider.CD evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\iWebar\4947097a-efd7-4265-be23-25706c1bf1f3-1-7.exe.vir"
sh=02BDAB601029A09B7DF4C595E0BAA6DBA77B4669 ft=1 fh=1fe851ec739db20a vn="Variante von Win32/Toolbar.CrossRider.CC evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\iWebar\4947097a-efd7-4265-be23-25706c1bf1f3-5.exe.vir"
sh=507BD7764A11AA4B3E008E298A47FA845F06AD6D ft=1 fh=c71c0011c0fab0d7 vn="Variante von Win32/Toolbar.CrossRider.CD evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\iWebar\4947097a-efd7-4265-be23-25706c1bf1f3-6.exe.vir"
sh=1305B30AB56B5A3BA22C8066D9E27ECAFC7DDCB2 ft=1 fh=c71c00117b67c48d vn="Variante von Win64/Toolbar.Crossrider.N evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\iWebar\4947097a-efd7-4265-be23-25706c1bf1f3-64.exe.vir"
sh=99229E8A9EC4AD9E09D89A41A60182BB33EB7088 ft=1 fh=b1d3bc9edc8da742 vn="Variante von Win32/Toolbar.CrossRider.CD evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\iWebar\4947097a-efd7-4265-be23-25706c1bf1f3-7.exe.vir"
sh=C328404390F740BFDC5AA432E225C71E88E03D95 ft=1 fh=c71c00114fe77bce vn="Variante von Win32/Toolbar.CrossRider.CG evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\iWebar\8c03bd5d-6391-4d30-941c-bf9bd1df506f.dll.vir"
sh=1C036D8B18FCC628D016A7BB37F99DB1EE7DD3B7 ft=1 fh=b8a0fbd6b8804808 vn="Win32/Packed.VMDetector.I evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\iWebar\utils.exe.vir"
sh=D14CCEDE2CCF5EF9824DB4D11F9FBDA743D9F2A5 ft=1 fh=6f8119d4f829c9e5 vn="Variante von Win32/AdWare.EoRezo.AU Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\mbot_de_587\mbot_de_587.exe.vir"
sh=49E5B3CE1B8675A04F1391E5930852547F3320EF ft=1 fh=49bef2e287500969 vn="Variante von Win32/AdWare.EoRezo.AU Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\mbot_de_587\mybestofferstoday_widget.exe.vir"
sh=AAA623029121715DD514658EB72C344C182CE5D4 ft=1 fh=2063f527e15bc225 vn="Variante von MSIL/MyPCBackup.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\MyPC Backup\BackupStackUI.dll.vir"
sh=BAFC87AA0D99C347EA00A77BB09CE78915DF75E5 ft=1 fh=edcb43f436e617cd vn="MSIL/MyPCBackup.E evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\MyPC Backup\MyPC Backup.exe.vir"
sh=C328404390F740BFDC5AA432E225C71E88E03D95 ft=1 fh=c71c00114fe77bce vn="Variante von Win32/Toolbar.CrossRider.CG evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Object Browser\84fbb313-ac12-4011-83b2-604424784096.dll.vir"
sh=72D58B45BE7EEDC28D598B1F67172441A1E449B8 ft=1 fh=c71c0011058c98f3 vn="Variante von Win32/Toolbar.CrossRider.AV evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Object Browser\ebbe3f26-9d77-42bb-9f0a-fa747484c8f2-1-6.exe.vir"
sh=2C6623EFE5201F470309576FFCCA46492EAAD6F8 ft=1 fh=02891ef4dc8da742 vn="Variante von Win32/Toolbar.CrossRider.CD evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Object Browser\ebbe3f26-9d77-42bb-9f0a-fa747484c8f2-1-7.exe.vir"
sh=1A5887B35C9BB4E9158C181FAD5E3150A50509D0 ft=1 fh=efcfedb3739db20a vn="Variante von Win32/Toolbar.CrossRider.CC evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Object Browser\ebbe3f26-9d77-42bb-9f0a-fa747484c8f2-5.exe.vir"
sh=2DFB408032C00822543D98384C69680064476F79 ft=1 fh=c71c0011c0fab0d7 vn="Variante von Win32/Toolbar.CrossRider.CD evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Object Browser\ebbe3f26-9d77-42bb-9f0a-fa747484c8f2-6.exe.vir"
sh=AF7378EC515C40A46EE7598C14E5AC1F856ACC55 ft=1 fh=c71c00117b67c48d vn="Variante von Win64/Toolbar.Crossrider.N evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Object Browser\ebbe3f26-9d77-42bb-9f0a-fa747484c8f2-64.exe.vir"
sh=2C6623EFE5201F470309576FFCCA46492EAAD6F8 ft=1 fh=02891ef4dc8da742 vn="Variante von Win32/Toolbar.CrossRider.CD evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Object Browser\ebbe3f26-9d77-42bb-9f0a-fa747484c8f2-7.exe.vir"
sh=17FF38D1C361824D35AD9C7AD8DE80C0C0A7979B ft=1 fh=1145b4526ed58e53 vn="Win32/Packed.VMDetector.I evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Object Browser\utils.exe.vir"
sh=F5D3BCB1EEB709AB33B0CB9DD80DCEF1495E5E61 ft=1 fh=c71c00119cf6e0f2 vn="Variante von Win32/Adware.MultiPlug.FL Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\PoriceLesS\88GrgormqUgNCm.dll.vir"
sh=D7691A8B454B7D3E4BB9294382D33AC8CC0EB92F ft=1 fh=c71c0011335faa6d vn="Variante von Win32/BHOUninstaller.AB evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\PoriceLesS\88GrgormqUgNCm.exe.vir"
sh=8EE5DDA1604B696109EC4F34B834643DECD5480D ft=1 fh=fbab10f1fc7e4c3a vn="Variante von Win64/Adware.MultiPlug.G Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\PoriceLesS\88GrgormqUgNCm.x64.dll.vir"
sh=CFE3525AF38B3A0953FD2E80A1AB94B5B323983B ft=1 fh=832a03bed0772d4b vn="Variante von Win32/Adware.MultiPlug.HC Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Priceless\Priceless_310315.exe.vir"
sh=0CACF65C99062D1F6839DA2755D4437B85B98627 ft=0 fh=0000000000000000 vn="JS/ShopperPro.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\ShopperPro\manifest.json.vir"
sh=9F2BE81F436B2F28753796FF3CDAE6C0C4E10FC0 ft=1 fh=8f58c0dee2253364 vn="Variante von Win32/ShopperPro.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\ShopperPro\ShopperPro.dll.vir"
sh=2C8D199F5F311D34493DC49C45040150B4C9E3CD ft=1 fh=a931688e3f3e1571 vn="Variante von Win32/ShopperPro.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\ShopperPro\ShopperPro.exe.vir"
sh=38461EDADD137CDD8D8EEFBAC8AE973373F0A81A ft=1 fh=6cc0fdc869e57964 vn="Variante von Win64/ShopperPro.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\ShopperPro\ShopperPro64.dll.vir"
sh=BD84400276C89806CCE0835F3B15E806D14F21F2 ft=1 fh=53b589624de70334 vn="Win32/SpeedBit.B.gen evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\ShopperPro\SPRemove.exe.vir"
sh=6503F247CC3D47AB17991E3C7BB5523D3E3EC7A7 ft=1 fh=b32181e6f82106c8 vn="Variante von Win32/ShopperPro.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\ShopperPro\Updater.exe.vir"
sh=5C2AF274C2BB1CC81F0D36C71F94C7004D46FEB2 ft=0 fh=0000000000000000 vn="JS/ShopperPro.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\ShopperPro\FireFox\content\overlay.js.vir"
sh=073A26E20638CD5781D82F4DDDE856CA764E058A ft=1 fh=c71c001128b44089 vn="Variante von Win32/ShopperPro.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\ShopperPro\JSDriver\jsdrv.exe.vir"
sh=D8B9DFE504A392806C78AB8F53DEC4EDCF416F06 ft=1 fh=6d3f2b89aec4f047 vn="Variante von Win64/ShopperPro.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\ShopperPro\JSDriver\jsdrv.sys.vir"
sh=073A26E20638CD5781D82F4DDDE856CA764E058A ft=1 fh=c71c001128b44089 vn="Variante von Win32/ShopperPro.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\ShopperPro\JSDriver\1.38.1.1735\jsdrv.exe.vir"
sh=D8B9DFE504A392806C78AB8F53DEC4EDCF416F06 ft=1 fh=6d3f2b89aec4f047 vn="Variante von Win64/ShopperPro.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\ShopperPro\JSDriver\1.38.1.1735\jsdrv.sys.vir"
sh=A1CA516F7D5562233B1A5506668D9B1470F16E48 ft=1 fh=c71c001118f11470 vn="Variante von Win32/SProtector.P evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\supporter\Supporter.dll.vir"
sh=D4003B60BEBD5F83600BD63D64D41B139CEC31CE ft=1 fh=c71c0011be63cce5 vn="Variante von Win32/Adware.AddLyrics.DY Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\version85BlockAndSurf\191.dll.vir"
sh=7FB9E044661F6A72D76F122F29325F0FA22AAFCD ft=1 fh=d7df3f6af1546100 vn="Variante von Win64/Adware.AddLyrics.I Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\version85BlockAndSurf\191_x64.dll.vir"
sh=5CDF2B92990BC0ED0B5251CAD25BDAB949C3C7B9 ft=1 fh=c71c0011466b7ed8 vn="Variante von Win32/Adware.AddLyrics.DK Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\version85BlockAndSurf\BlockAndSurf.exe.vir"
sh=603690E21BD4576F6B18377E5E2F7B813442EFF0 ft=1 fh=c71c0011be5d5f06 vn="Variante von Win32/Adware.AddLyrics.DW Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\version85BlockAndSurf\J4BlockAndSurfJ52.exe.vir"
sh=772EAA106CC31418A16C636326211409932FD205 ft=1 fh=f3297a50d3665975 vn="Variante von Win32/Adware.AddLyrics.DY Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\version85BlockAndSurf\Uninstall.exe.vir"
sh=BF401BD89D19E6C1100A9AD0D1280A443801B2C7 ft=1 fh=df686e1c835fcb67 vn="Variante von Win64/Adware.AddLyrics.H Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\version85BlockAndSurf\x64\i3S9YNnZ.exe.vir"
sh=8736AD81CA53FF379F8228E3F60BD7FF1BC07F50 ft=1 fh=6a1f8b1581cb98b2 vn="Variante von Win64/Adware.AddLyrics.H Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\version85BlockAndSurf\x64\webTinstMKTN.sys.vir"
sh=D8A432E7784541A14190CED4B417751E608AB898 ft=1 fh=8c7411c32dae415b vn="Win32/ELEX.BM evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\BrowerWatchCH.dll.vir"
sh=826B181CF4FE507BC697F5B137E9A4704FB6131B ft=1 fh=741299c35f05bcb1 vn="Win32/ELEX.BM evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\BrowerWatchFF.dll.vir"
sh=5D628376391A827A818B0A079B64EE457AE9B82A ft=1 fh=c71c0011e2e7a7a5 vn="Variante von Win32/ELEX.BM evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\BrowserAction.dll.vir"
sh=93FC0A3CB25B7C0E809AEEFFBAD7DB747FDD9422 ft=1 fh=ed247d535bbf55fa vn="Win32/ELEX.BM evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\CmdShell.exe.vir"
sh=D62E826B13E242DC0BABCAD05E3A4613795A024F ft=0 fh=0000000000000000 vn="Win32/Toolbar.TNT2.I evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\ffsearch_toolbar!1.0.0.1025.xpi.vir"
sh=0DCB6451E8AE2DC56847E34CF7F1A560E4C212F5 ft=0 fh=0000000000000000 vn="Win32/Toolbar.TNT2.I evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\ffsearch_toolbar!1.0.0.1028.xpi.vir"
sh=50DE2C19D202A64208CDD00C991388D70A5E0059 ft=1 fh=0ac46496ca382a6c vn="Win32/ELEX.BM evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\HPNotify.exe.vir"
sh=23BE39FD9F8F48F573314FBA50192D607C7DC5C8 ft=1 fh=73e334723c1913a1 vn="Win32/ELEX.BM evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\IeWatchDog.dll.vir"
sh=F4D7B96DBC76788089DE6A1FABCC0FA20292B1F7 ft=1 fh=c92d8361ff53e603 vn="Win32/ELEX.BM evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\ProtectService.exe.vir"
sh=A511D45EF634098C7366FD403A87FA3A20AB536A ft=1 fh=2648d0cf6422928c vn="Win32/ELEX.BM evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\ProtectService_Bak.exe.vir"
sh=4ABFC256653DDB2078242A8183B2E279DF6FE52B ft=1 fh=84f15d895c33e9e3 vn="Variante von Win32/Thinknice.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\SupTab.dll.vir"
sh=8797BCC84139AD1317B991862CFEF6101030A12B ft=1 fh=9b2885dbf5f75b97 vn="Variante von Win32/Adware.PicColor.X Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\LolliScan\LolliScan.exe.vir"
sh=9F2BE81F436B2F28753796FF3CDAE6C0C4E10FC0 ft=1 fh=8f58c0dee2253364 vn="Variante von Win32/ShopperPro.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\ShopperPro\ShopperPro.dll.vir"
sh=38461EDADD137CDD8D8EEFBAC8AE973373F0A81A ft=1 fh=6cc0fdc869e57964 vn="Variante von Win64/ShopperPro.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\ShopperPro\ShopperPro64.dll.vir"
sh=E527BBCAFEDDC287A621A2DB49A1F10502C1E3D0 ft=1 fh=4c77490216ec3f95 vn="Variante von Win32/ELEX.BH evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe.vir"
sh=BEFF808E5E1081700E6136B5D216E5D4CEEDA007 ft=1 fh=176c21238cc833f2 vn="Variante von Win32/Adware.EoRezo.AJ Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Tiedt\AppData\Local\gmsd_de_385\upgmsd_de_385.exe.vir"
sh=C9D706420374877A0ABE4367811BBF67F10C075D ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Tiedt\AppData\Local\Google\Chrome\User Data\Default\Extensions\papbadoldddalgcjcicnikcfenodpghp\1.26.28_0\extensionData\plugins\91.js.vir"
sh=662A3968ACD63ACEA1AE555DB02CB15D6572B7C1 ft=1 fh=52d900842fcbee50 vn="Variante von Win32/Adware.EoRezo.AJ Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Tiedt\AppData\Local\mbot_de_587\upmbot_de_587.exe.vir"
sh=6142578CD21CF27FD3C1B3A4F0626DE9FC6DF275 ft=1 fh=a0b7e9a9340cf144 vn="Variante von Win32/PriceGong.C evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Tiedt\AppData\Local\SmartWeb\SmartWebApp.exe.vir"
sh=AA2BA9D6607589A3C93D1C760E3512EC8E61F968 ft=1 fh=f770637cdb111250 vn="Variante von Win32/PriceGong.C evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Tiedt\AppData\Local\SmartWeb\SmartWebHelper.exe.vir"
sh=080016256C564232771ED8D6EFFC94ECAECAD316 ft=1 fh=bfc1d533ef10baf8 vn="Variante von Win32/PriceGong.C evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Tiedt\AppData\Local\SmartWeb\swhk.dll.vir"
sh=32BE00C9B8BD83BF621E433EC87DE21B08F82098 ft=1 fh=a4fbdca8e8e73dc7 vn="Variante von Win32/PriceGong.C evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Tiedt\AppData\Local\SmartWeb\__u.exe.vir"
sh=C880190A021A901F56211523756120A0FD01B414 ft=1 fh=defa400271098cd8 vn="Variante von Win32/Adware.Hicosmea.A Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Tiedt\AppData\Roaming\moters\mentste.dll.vir"
sh=5C2AF274C2BB1CC81F0D36C71F94C7004D46FEB2 ft=0 fh=0000000000000000 vn="JS/ShopperPro.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Tiedt\AppData\Roaming\Mozilla\Firefox\Profiles\snq3xiqr.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\overlay.js.vir"
sh=8736AD81CA53FF379F8228E3F60BD7FF1BC07F50 ft=1 fh=6a1f8b1581cb98b2 vn="Variante von Win64/Adware.AddLyrics.H Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\windows\System32\drivers\webTinstMKTN.sys.vir"
sh=6FA07C781B84151C862A8FACD4E2EFB7D8DA3E2F ft=1 fh=ebf21d2230451b57 vn="Win32/AnyProtect.G evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\Tiedt\AppData\Local\nsh1D35.tmp.xBAD"
sh=BCF9EB2D1F76D8AEE6221EE6EC94F35F2F0E583E ft=1 fh=cc257dce89ecc5f6 vn="Win32/Adware.ConvertAd.ET Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\Tiedt\AppData\Local\0406D9B4-1428434453-72AF-8C7F-B36FDEF67BEF\bnsbDCCA.exe"
sh=C151B196E08025374EC9C2E713FEA45EB2B82F5C ft=1 fh=e809d806953702a4 vn="Win32/Adware.ConvertAd.ET Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\Tiedt\AppData\Local\0406D9B4-1428434453-72AF-8C7F-B36FDEF67BEF\Uninstall.exe"
sh=147E7AEBDEBB6E9F8FF6421745782501C2C5B245 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.C evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\Tiedt\AppData\Roaming\SXZQ.xBAD"
sh=147E7AEBDEBB6E9F8FF6421745782501C2C5B245 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.C evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\Tiedt\AppData\Roaming\XDKWM.xBAD"
sh=42B0B52862CD43A13329BC54A94A5FC6A532D514 ft=1 fh=07bd90fb442214a1 vn="Win32/ReImageRepair.F evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\Tiedt\Downloads\ReimageRepair.exe.xBAD"
sh=71D99FDEF48B6FDB438667909B2890E1EE58F983 ft=1 fh=ee8c3f688aac34ed vn="Variante von Win32/Systweak.L evtl. unerwünschte Anwendung" ac=I fn="C:\SWSETUP\APP\Applications\Corel\WinZipTrial\16.0\src\winzip160.exe"
sh=300123F2DC7FD15213E0E891949B7CAAC870B890 ft=0 fh=0000000000000000 vn="Variante von Win32/Systweak.L evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\Installer\2eb20.msi"
sh=A3237ED7B0323377ACDCE02E94D12CB17F793ED0 ft=0 fh=0000000000000000 vn="Variante von Win32/Adware.Hicosmea.A Anwendung" ac=I fn="C:\Windows\Installer\903b3.msi"

Security Check

Code:
Results of screen317's Security Check version 0.99.99 
 Windows 7 Service Pack 1 x64 (UAC is enabled) 
 Internet Explorer 11 
``````````````Antivirus/Firewall Check:``````````````
Microsoft Security Essentials 
 Antivirus up to date! 
`````````Anti-malware/Other Utilities Check:`````````
 Mozilla Firefox (37.0.1)
 Google Chrome (41.0.2272.101)
 Google Chrome (41.0.2272.118)
````````Process Check: objlist.exe by Laurent```````` 
 Microsoft Security Essentials MSMpEng.exe
 Microsoft Security Essentials msseces.exe
 Malwarebytes Anti-Malware mbamservice.exe 
 Malwarebytes Anti-Malware mbam.exe 
 Malwarebytes Anti-Malware mbamscheduler.exe 
 Symantec Norton Online Backup NOBuAgent.exe 
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C: 
````````````````````End of Log``````````````````````

Bis dann

M-K-D-B 09.04.2015 08:05
Servus,


wir haben es bald geschafft. :)





Schritt 1
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument


Code:
start
CloseProcesses:
C:\Windows\Installer\2eb20.msi
C:\Windows\Installer\903b3.msi
end

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.







Schritt 2
  • Deaktiviere dein Anti-Viren-Programm.
  • Gehe zum Ordner C:\FRST\Quarantine.
  • Rechtsklicke auf den Ordner Quarantine und wähle > Senden an > Zip-komprimierter Ordner.
  • Es wird eine zip-Datei mit dem Namen Quarantine.zip im Ordner FRST erstellt.
  • Lade die Quarantine.zip im Upload-Channel hoch.
  • Klicke dazu auf Durchsuchen, navigiere zu der zip-Datei ( C:\FRST\Quarantine.zip ) und klicke auf Öffnen.
  • Klicke abschließend auf Hochladen.
  • Vielen Dank für deine Hilfe.
  • Aktiviere dein Anti-Viren-Programm wieder.





Wie läuft der Rechner aktuell?







Bitte poste mit deiner nächsten Antwort
  • die Logdatei des FRST-Fix,
  • eine Rückmeldung bezüglich des Uploads,
  • die Beantwortung der gestellten Frage.

nine53 09.04.2015 09:52
Guten Morgen,

hier fixlog

Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 11-03-2015
Ran by Tiedt at 2015-04-09 10:41:57 Run:3
Running from C:\Users\Tiedt\Downloads
Loaded Profiles: Tiedt &  (Available profiles: Tiedt)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
start
CloseProcesses:
C:\Windows\Installer\2eb20.msi
C:\Windows\Installer\903b3.msi
end
*****************

Processes closed successfully.
C:\Windows\Installer\2eb20.msi => Moved successfully.
C:\Windows\Installer\903b3.msi => Moved successfully.


The system needed a reboot.

==== End of Fixlog 10:41:57 ====
Ich kann leider weiterhin nicht an zipkomprimierter Ordner senden und Schritt 2 daher nicht ausführen.

Wie läuft der Rechner? Nicht schlecht, es öffnen sich keine Werbefenster mehr und auch die Geschwindigkeit ist wieder deutlich besser.

Jedoch kann ich jetzt den McAffee SecurityScan nicht mehr öffnen und wie gesagt ein anderes Virenprogramm habe ich nicht finden können und konnte es daher zwischdurch auch nicht deaktivieren, als es gewünscht war.

Aber sonst läuft alles gut.

M-K-D-B 09.04.2015 16:29
Zitat:
Zitat von nine53 (Beitrag 1453141)
Jedoch kann ich jetzt den McAffee SecurityScan nicht mehr öffnen und wie gesagt ein anderes Virenprogramm habe ich nicht finden können und konnte es daher zwischdurch auch nicht deaktivieren, als es gewünscht war.
McAffee SecurityScan kannst du deinstallieren, das ist lediglich ein Online Scanner vom Prinzip her.

Auf deinem Rechner ist Microsoft Security Essentials als AV Programm installiert.





Wenn du keine Probleme mehr mit Malware hast, dann sind wir hier fertig. Deine Logdateien sind sauber. :daumenhoc
Zum Schluss müssen wir noch ein paar abschließende Schritte unternehmen, um deinen Pc aufzuräumen und abzusichern.

http://deeprybka.trojaner-board.de/b...cleanupneu.png
Cleanup:
(Die Reihenfolge ist hier entscheidend)

Falls Defogger verwendet wurde: Erneut starten und auf Re-enable klicken.

Falls Combofix verwendet wurde:
http://deeprybka.trojaner-board.de/b.../combofix2.pngCombofix deinstallieren
  • Wichtig: Bitte Antivirus-Programm, evtl. vorhandenes Skript-Blocking und Anti-Malware Programme deaktivieren.
  • Drücke bitte die http://deeprybka.trojaner-board.de/b...ne/revo/w7.png + R Taste und schreibe Combofix /Uninstall in das Ausführen-Fenster.
  • Klicke auf OK.
    Damit wird Combofix komplett entfernt und der Cache der Systemwiederherstellung geleert.
  • Nun die eben deaktivierten Programme wieder aktivieren.

Alle Logs gepostet? Dann lade Dir bitte http://filepony.de/icon/tiny/delfix.pngDelFix herunter.
  • Schließe alle offenen Programme.
  • Starte die delfix.exe mit einem Doppelklick.
  • Setze vor jede Funktion ein Häkchen.
  • Klicke auf Start.

Hinweis: DelFix entfernt u.a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
Starte Deinen Rechner abschließend neu. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein, kannst Du diese bedenkenlos löschen.

Wenn Du möchtest, kannst Du hier sagen, ob Du mit mir und meiner Hilfe zufrieden warst...:dankeschoen:und/oder das Forum mit einer kleinen Spende http://www.trojaner-board.de/extra/spende.png unterstützen. :applaus:

http://deeprybka.trojaner-board.de/b...ast/schild.png
Absicherung:
Beim Betriebsystem Windows die automatischen Updates aktivieren. Auch die sicherheitsrelevante Software sollte immer nur in der aktuellsten Version vorliegen:

Browser
Java
 Flash-Player
PDF-Reader

Sicherheitslücken in deren alten Versionen werden dazu ausgenutzt, um beim einfachen Besuch einer manipulierten Website per "Drive-by" Malware zu installieren.
Ich empfehle z.B. die Verwendung von Mozilla Firefox statt des Internet Explorers. Zudem lassen sich mit dem Firefox auch PDF-Dokumente öffnen.

Aktiviere eine Firewall. Die in Windows integrierte genügt im Normalfall völlig.

Verwende ein einziges der folgenden Antivirusprogramme mit Echtzeitscanner und stets aktueller Signaturendatenbank:

   
   


Zusätzlich kannst Du Deinen PC regelmäßig mit Malwarebytes Anti-Malware und ESET scannen.

Optional:
http://filepony.de/icon/noscript.png NoScript verhindert das Ausführen von aktiven Inhalten (Java, JavaScript, Flash,...) für sämtliche Websites. Man kann aber nach dem Prinzip einer Whitelist festlegen, auf welchen Seiten Scripts erlaubt werden sollen.
http://filepony.de/icon/malwarebytes_anti_exploit.pngMalwarebytes Anti Exploit: Schützt die Anwendungen des Computers vor der Ausnutzung bekannter Schwachstellen.


Lade Software von einem sauberen Portal wie http://filepony.de/images/microbanner.gif.
Wähle beim Installieren von Software immer die benutzerdefinierte Option und entferne den Haken bei allen optional angebotenen Toolbars oder sonstigen, fürs Programm, irrelevanten Ergänzungen.
Um Adware wieder los zu werden, empfiehlt sich zunächst die Deinstallation sowie die anschließende Resteentfernung mit Adwcleaner .


Abschließend noch ein paar grundsätzliche Bemerkungen:
Ändere regelmäßig Deine wichtigen Online-Passwörter und erstelle regelmäßig Backups Deiner wichtigen Dateien oder des Systems.
Der Nutzen von Registry-Cleanern, Optimizern usw. zur Performancesteigerung ist umstritten. Ich empfehle deshalb, die Finger von der Registry zu lassen und lieber die windowseigene Datenträgerbereinigung zu verwenden.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so dass ich dieses Thema aus meinen Abos löschen kann.

M-K-D-B 12.04.2015 09:51
Ich bin froh, dass wir helfen konnten :abklatsch:

In diesem Forum kannst du eine kurze Rückmeldung zur Bereinigung abgeben, sofern du das möchtest:
Lob, Kritik und Wünsche
Klicke dazu auf den Button "NEUES THEMA" und poste ein kleines Feedback. Vielen Dank! :)

Dieses Thema scheint erledigt und wird aus meinen Abos gelöscht. Solltest Du das Thema erneut brauchen, schicke mir bitte eine PM.

Jeder andere bitte hier klicken und einen eigenen Thread erstellen.

nine53 12.04.2015 16:45
ja vielen Dank, es hat alles wunderbar funktioniert.

Vielen Dank


Alle Zeitangaben in WEZ +1. Es ist jetzt 15:19 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131