[LaszloV]

Hi,

 

I just installed Farbar Recovery Scan Tool (FRST) and managed a scan, even though the langaude of the interface was German. But then I found the logs are also in German!

 

Is there any way I can get FRST to work in English, which is obviously possible for other users?

 

Thanks

 

Operating System: Windows 7 Ultimate 64-bit (6.1, Build 7601) Service Pack 1

Language: English (Regional Setting: English)

System Manufacturer: Gigabyte Technology Co., Ltd.

System Model: X58A-UD3R

BIOS: Award Modular BIOS v6.00PG

Processor: Intel® Core™ i7 CPU         950  @ 3.07GHz (8 CPUs), ~3.1GHz

Memory: 12288MB RAM

Available OS Memory: 12286MB RAM

Page File: 7135MB used, 17435MB available

Windows Dir: C:\Windows

DirectX Version: DirectX 11

Attached Thumbnails

• 

[Advertisements]

FRST seems to think your computer's language is German.  Doesn't matter to me since I also speak German so please go ahead and post copy and paste your logs so I can see what is going on.

[RKinner]

FRST seems to think your computer's language is German.  Doesn't matter to me since I also speak German so please go ahead and post copy and paste your logs so I can see what is going on.

[LaszloV]

Thanks!

 

Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:25-10-2015 02

durchgeführt von S (Administrator) auf E (28-10-2015 14:45:42)

Gestartet von C:\Program Files (x86)\Malwarebytes Anti-Malware

Geladene Profile: S (Verfügbare Profile: S)

Platform: Windows 7 Ultimate Service Pack 1 (X64) Sprache: German (Germany)

Internet Explorer Version 11 (Standard-Browser: FF)

Start-Modus: Normal

Anleitung für Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

 

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

 

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe

(Nero AG) C:\Program Files (x86)\HTC\HTC Sync Manager\HSMServiceEntry.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe

() C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe

() C:\Program Files\CyberLink\Shared files\RichVideo64.exe

() C:\Program Files (x86)\HTC\HTC Sync Manager\HTC Sync\adb.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe

(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe

(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe

(NEC Electronics Corporation) C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe

(Logitech, Inc.) C:\Program Files\Common Files\logishrd\KHAL3\KHALMNPR.exe

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe

(Opera Software) C:\Program Files (x86)\Opera\32.0.1948.69\opera.exe

(Ghisler Software GmbH) D:\Tools\WinCommander\TOTALCMD64.EXE

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe

(Opera Software) C:\Program Files (x86)\Opera\32.0.1948.69\opera.exe

(Opera Software) C:\Program Files (x86)\Opera\32.0.1948.69\opera.exe

(Opera Software) C:\Program Files (x86)\Opera\32.0.1948.69\opera.exe

(Opera Software) C:\Program Files (x86)\Opera\32.0.1948.69\opera.exe

(Opera Software) C:\Program Files (x86)\Opera\32.0.1948.69\opera.exe

(Opera Software) C:\Program Files (x86)\Opera\32.0.1948.69\opera.exe

(Opera Software) C:\Program Files (x86)\Opera\32.0.1948.69\opera.exe

(Opera Software) C:\Program Files (x86)\Opera\32.0.1948.69\opera.exe

(Opera Software) C:\Program Files (x86)\Opera\32.0.1948.69\opera.exe

(Opera Software) C:\Program Files (x86)\Opera\32.0.1948.69\opera.exe

(Opera Software) C:\Program Files (x86)\Opera\32.0.1948.69\opera.exe

(Opera Software) C:\Program Files (x86)\Opera\32.0.1948.69\opera.exe

(Opera Software) C:\Program Files (x86)\Opera\32.0.1948.69\opera.exe

(Opera Software) C:\Program Files (x86)\Opera\32.0.1948.69\opera.exe

(Opera Software) C:\Program Files (x86)\Opera\32.0.1948.69\opera.exe

(Opera Software) C:\Program Files (x86)\Opera\32.0.1948.69\opera.exe

(Opera Software) C:\Program Files (x86)\Opera\32.0.1948.69\opera.exe

(Opera Software) C:\Program Files (x86)\Opera\32.0.1948.69\opera.exe

(Opera Software) C:\Program Files (x86)\Opera\32.0.1948.69\opera.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\LogiAppBroker.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(VoiceFive, Inc.) C:\Program Files (x86)\PremierOpinion\pmservice.exe

() C:\Users\S\AppData\Local\gmsd_de_007010126\upgmsd_de_007010126.exe

() C:\Program Files (x86)\gmsd_de_007010126\gmsd_de_007010126.exe

() C:\Users\S\AppData\Local\gmsd_de_007010126\upgmsd_de_007010126.exe

(                                                            ) C:\Users\S\AppData\Local\gmsd_de_007010126\Download\myoffergroup_de.exe

() C:\Users\S\AppData\Local\Temp\is-2L3GA.tmp\myoffergroup_de.tmp

(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe

(Microsoft Corporation) C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_19_0_0_226.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_19_0_0_226.exe

(Farbar) C:\Program Files (x86)\Malwarebytes Anti-Malware\Farbar Recovery Scan Tool_FRST64.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

 

 

==================== Registry (Nicht auf der Ausnahmeliste) ===========================

 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

 

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [10135584 2010-03-26] (Realtek Semiconductor)

HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1337000 2015-04-30] (Microsoft Corporation)

HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2634896 2015-07-24] (NVIDIA Corporation)

HKLM\...\Run: [EvtMgr6] => C:\Program Files\Logitech\SetPointP\SetPoint.exe [3100440 2014-05-19] (Logitech, Inc.)

HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart

HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [106496 2009-11-20] (NEC Electronics Corporation)

HKLM-x32\...\Run: [gmsd_de_007010126] => C:\Program Files (x86)\gmsd_de_007010126\gmsd_de_007010126.exe [3971760 2015-10-25] ()

HKLM-x32\...\RunOnce: [upgmsd_de_007010126.exe] => C:\Users\S\AppData\Local\gmsd_de_007010126\upgmsd_de_007010126.exe [3308720 2015-10-25] ()

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Panda Security <====== ACHTUNG

Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)

HKU\S-1-5-19\Control Panel\Desktop\\SCRNSAVE.EXE -> 

HKU\S-1-5-20\Control Panel\Desktop\\SCRNSAVE.EXE -> 

HKU\S-1-5-21-2138198700-1450621571-450520247-1000\...\Run: [ISUSPM Startup] => C:\Program Files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe [221184 2005-02-17] (InstallShield Software Corporation)

HKU\S-1-5-21-2138198700-1450621571-450520247-1000\...\MountPoints2: {75c091ef-c014-11e3-9a14-1c6f6597f9c2} - "L:\WD SmartWare.exe" autoplay=true

HKU\S-1-5-21-2138198700-1450621571-450520247-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\scrnsave.scr [11264 2009-07-14] (Microsoft Corporation)

HKU\S-1-5-18\Control Panel\Desktop\\SCRNSAVE.EXE -> 

ShellIconOverlayIdentifiers: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\S\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-10] (Dropbox, Inc.)

ShellIconOverlayIdentifiers: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\S\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-10] (Dropbox, Inc.)

ShellIconOverlayIdentifiers: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\S\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-10] (Dropbox, Inc.)

ShellIconOverlayIdentifiers: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\S\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-10] (Dropbox, Inc.)

ShellIconOverlayIdentifiers: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\S\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-10] (Dropbox, Inc.)

ShellIconOverlayIdentifiers: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\S\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-10] (Dropbox, Inc.)

ShellIconOverlayIdentifiers: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\S\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-10] (Dropbox, Inc.)

ShellIconOverlayIdentifiers: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\S\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-10] (Dropbox, Inc.)

ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  Keine Datei

ShellIconOverlayIdentifiers-x32: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\S\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-10] (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\S\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-10] (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\S\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-10] (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\S\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-10] (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\S\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-10] (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\S\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-10] (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\S\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-10] (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\S\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-10] (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\S\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-10] (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\S\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-10] (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\S\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-10] (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\S\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-10] (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\S\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-10] (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\S\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-10] (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\S\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-10] (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\S\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-10] (Dropbox, Inc.)

GroupPolicyScripts: Beschränkung <======= ACHTUNG

GroupPolicyScripts\User: Beschränkung <======= ACHTUNG

 

==================== Internet (Nicht auf der Ausnahmeliste) ====================

 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)

 

Hosts: 104.28.28.125 www.councilofexmuslims.com

Tcpip\..\Interfaces\{71C14BA0-BB77-4AA3-A470-02D94D4A1DC3}: [NameServer] 80.69.100.174,209.244.0.4

 

Internet Explorer:

==================

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com

HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = www.google.com

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com

HKU\S-1-5-21-2138198700-1450621571-450520247-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://howzit.msn.com/?ocid=iehp

SearchScopes: HKU\S-1-5-21-2138198700-1450621571-450520247-1000 -> DefaultScope {70B61DE9-6AEF-4BC7-9B4F-BBDDB725A687} URL = hxxps://startpage.com/do/search?query={searchTerms}&cat=web&pl=ie&language=english

SearchScopes: HKU\S-1-5-21-2138198700-1450621571-450520247-1000 -> {70B61DE9-6AEF-4BC7-9B4F-BBDDB725A687} URL = hxxps://startpage.com/do/search?query={searchTerms}&cat=web&pl=ie&language=english

BHO: Logitech SetPoint -> {AF949550-9094-4807-95EC-D1C317803333} -> C:\Program Files\Logitech\SetPointP\SetPointSmooth.dll [2014-05-19] (Logitech, Inc.)

BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)

BHO-x32: Logitech SetPoint -> {AF949550-9094-4807-95EC-D1C317803333} -> C:\Program Files\Logitech\SetPointP\32-bit\SetPointSmooth.dll [2014-05-19] (Logitech, Inc.)

BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)

Toolbar: HKLM - avast! WebRep - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  Keine Datei

Toolbar: HKU\S-1-5-21-2138198700-1450621571-450520247-1000 -> Kein Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  Keine Datei

IE Session Restore: HKU\S-1-5-21-2138198700-1450621571-450520247-1000 -> ist aktiviert.

DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxps://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)

 

FireFox:

========

FF ProfilePath: C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\6yr7px34.default-1409311452730

FF DefaultSearchEngine: Startpage (SSL)

FF Session Restore: -> ist aktiviert.

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_19_0_0_226.dll [2015-10-19] ()

FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_19_0_0_226.dll [2015-10-19] ()

FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1213153.dll [2014-06-24] (Adobe Systems, Inc.)

FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/pdf -> C:\Program Files (x86)\Foxit Software\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2015-07-10] (Foxit Corporation)

FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Software\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2015-07-10] (Foxit Corporation)

FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.xdp -> C:\Program Files (x86)\Foxit Software\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2015-07-10] (Foxit Corporation)

FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.xfdf -> C:\Program Files (x86)\Foxit Software\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2015-07-10] (Foxit Corporation)

FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2015-02-11] (Foxit Corporation)

FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll [2015-07-11] (Google, Inc.)

FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)

FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2015-08-17] (NVIDIA Corporation)

FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2015-08-17] (NVIDIA Corporation)

FF Plugin-x32: @videolan.org/vlc,version=2.1.2 -> C:\Program Files (x86)\VideoLAN\npvlc.dll [2015-04-13] (VideoLAN)

FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\npvlc.dll [2015-04-13] (VideoLAN)

FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\npvlc.dll [2015-04-13] (VideoLAN)

FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> C:\Program Files (x86)\VideoLAN\npvlc.dll [2015-04-13] (VideoLAN)

FF Plugin HKU\S-1-5-21-2138198700-1450621571-450520247-1000: @Google.com/GoogleEarthPlugin -> C:\Users\S\AppData\Local\Google\Google Earth\plugin\npgeplugin.dll [2012-04-14] (Google)

FF Plugin HKU\S-1-5-21-2138198700-1450621571-450520247-1000: @talk.google.com/GoogleTalkPlugin -> C:\Users\S\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll [2014-06-06] (Google)

FF Plugin HKU\S-1-5-21-2138198700-1450621571-450520247-1000: @talk.google.com/O1DPlugin -> C:\Users\S\AppData\Roaming\Mozilla\plugins\npo1d.dll [2014-06-06] (Google)

FF Plugin HKU\S-1-5-21-2138198700-1450621571-450520247-1000: @tools.google.com/Google Update;version=3 -> C:\Users\S\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll [2014-05-07] (Google Inc.)

FF Plugin HKU\S-1-5-21-2138198700-1450621571-450520247-1000: @tools.google.com/Google Update;version=9 -> C:\Users\S\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll [2014-05-07] (Google Inc.)

FF Plugin HKU\S-1-5-21-2138198700-1450621571-450520247-1000: sony.com/MediaGoDetector -> C:\Program Files (x86)\Sony\Media Go\npMediaGoDetector.dll [2014-07-10] (Sony Network Entertainment International LLC)

FF user.js: detected! => C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\6yr7px34.default-1409311452730\user.js [2014-12-24]

FF Plugin ProgramFiles/Appdata: C:\Users\S\AppData\Roaming\mozilla\plugins\npgoogletalk.dll [2014-06-06] (Google)

FF Plugin ProgramFiles/Appdata: C:\Users\S\AppData\Roaming\mozilla\plugins\npo1d.dll [2014-06-06] (Google)

FF SearchPlugin: C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\6yr7px34.default-1409311452730\searchplugins\duckduckgo.xml [2014-11-22]

FF SearchPlugin: C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\6yr7px34.default-1409311452730\searchplugins\startpage-http.xml [2015-10-28]

FF SearchPlugin: C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\6yr7px34.default-1409311452730\searchplugins\startpage-ssl.xml [2014-08-29]

FF SearchPlugin: C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\6yr7px34.default-1409311452730\searchplugins\wolframalpha.xml [2014-11-22]

FF Extension: 20-20 3D Viewer - IKEA - C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\6yr7px34.default-1409311452730\Extensions\2020Pl[email protected] [2015-04-02] [ist nicht signiert]

FF Extension: Wörterbuch Deutsch (de-DE), Hunspell-unterstützt - C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\6yr7px34.default-1409311452730\Extensions\[email protected] [2015-09-10]

FF Extension: British English Dictionary (Updated) - C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\6yr7px34.default-1409311452730\Extensions\[email protected] [2015-04-04] [ist nicht signiert]

FF Extension: GMX MailCheck - C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\6yr7px34.default-1409311452730\Extensions\[email protected] [2015-10-20]

FF Extension: EPUBReader - C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\6yr7px34.default-1409311452730\Extensions\{5384767E-00D9-40E9-B72F-9CC39D655D6F} [2015-06-02]

FF Extension: Flash and Video Download - C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\6yr7px34.default-1409311452730\Extensions\{bee6eb20-01e0-ebd1-da83-080329fb9a3a} [2015-09-21]

FF Extension: Classic Theme Restorer - C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\6yr7px34.default-1409311452730\Extensions\[email protected] [2015-10-28]

FF Extension: ProxTube - Unblock YouTube - C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\6yr7px34.default-1409311452730\Extensions\[email protected] [2015-07-27]

FF Extension: English (GB) Language Pack - C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\6yr7px34.default-1409311452730\Extensions\langpack[email protected] [2015-10-07] [ist nicht signiert]

FF Extension: Status-4-Evar - C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\6yr7px34.default-1409311452730\Extensions\[email protected] [2015-06-02]

FF Extension: Unhide Passwords - C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\6yr7px34.default-1409311452730\Extensions\{2e17e2b2-b8d4-4a67-8d7b-fafa6cc9d1d0}.xpi [2015-06-02]

FF Extension: X-notifier - C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\6yr7px34.default-1409311452730\Extensions\{37fa1426-b82d-11db-8314-0800200c9a66}.xpi [2015-10-28]

FF Extension: AniWeather - C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\6yr7px34.default-1409311452730\Extensions\{4176DFF4-4698-11DE-BEEB-45DA55D89593}.xpi [2015-06-02]

FF Extension: Show MyIP - C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\6yr7px34.default-1409311452730\Extensions\{6D1D11DB-3C6C-4db8-96E4-20F4A1088AAC}.xpi [2015-06-02]

FF Extension: Downloads Window - C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\6yr7px34.default-1409311452730\Extensions\{a7213cf2-fa1e-4373-88ff-255d0abd3020}.xpi [2015-09-16]

FF Extension: Video DownloadHelper - C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\6yr7px34.default-1409311452730\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}.xpi [2015-08-18]

FF Extension: Adblock Plus - C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\6yr7px34.default-1409311452730\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-09-24]

FF HKLM-x32\...\Firefox\Extensions: [{F003DA68-8256-4b37-A6C4-350FA04494DF}] - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt

FF Extension: Logitech SetPoint - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt [2015-06-02] [ist nicht signiert]

 

Chrome: 

=======

CHR HKLM-x32\...\Chrome\Extension: [ihenkjeihefokohmemphikjnjbmegdik] - "C:\Program Files (x86)\Sony\Media Go\MediaGoDetector.crx" <nicht gefunden>

 

Opera: 

=======

OPR Session Restore: -> ist aktiviert.

OPR Extension: (PDF Viewer) - C:\Users\S\AppData\Roaming\Opera Software\Opera Stable\Extensions\encfpfilknmenlmjemepncnlbbjlabkc [2014-08-28]

OPR Extension: (Show passwords) - C:\Users\S\AppData\Roaming\Opera Software\Opera Stable\Extensions\hdlmkpaimhmficecljbcodelmcjbnmck [2014-08-02]

OPR Extension: (Download YouTube Videos as MP4) - C:\Users\S\AppData\Roaming\Opera Software\Opera Stable\Extensions\maeombkgfpjdnjkhohbjachnnmpbipol [2015-08-07]

OPR Extension: (FVD Video Downloader) - C:\Users\S\AppData\Roaming\Opera Software\Opera Stable\Extensions\neacgcjokggofibnbfapeaejhclmpple [2015-08-19]

OPR Extension: (Adblock Plus) - C:\Users\S\AppData\Roaming\Opera Software\Opera Stable\Extensions\oidhhegpmlfpoeialbgcdocjalghfpkp [2015-09-24]

 

==================== Dienste (Nicht auf der Ausnahmeliste) ========================

 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

 

R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [172344 2014-12-05] (SUPERAntiSpyware.com)

S3 Adobe LM Service; C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [72704 2014-05-05] (Adobe Systems) [Datei ist nicht signiert]

S3 AppleChargerSrv; C:\Windows\System32\AppleChargerSrv.exe [31272 2010-04-06] ()

R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1155216 2015-07-24] (NVIDIA Corporation)

R2 HTCMonitorService; C:\Program Files (x86)\HTC\HTC Sync Manager\HSMServiceEntry.exe [87368 2014-06-27] (Nero AG)

S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-03] (Macrovision Corporation) [Datei ist nicht signiert]

S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1135416 2015-10-05] (Malwarebytes)

R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23816 2015-04-30] (Microsoft Corporation)

R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [366544 2015-04-30] (Microsoft Corporation)

R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1871504 2015-07-24] (NVIDIA Corporation)

R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe [5544592 2015-07-24] (NVIDIA Corporation)

R2 PassThru Service; C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [166912 2013-10-17] () [Datei ist nicht signiert]

R2 PremierOpinion; C:\Program Files (x86)\PremierOpinion\pmservice.exe [213816 2014-08-18] (VoiceFive, Inc.)

R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [390672 2012-12-25] ()

S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

S2 DES2 Service; "C:\Program Files (x86)\GIGABYTE\EnergySaver2\des2svr.exe" [X]

S2 FoxitCloudUpdateService; "C:\Program Files (x86)\Foxit Reader\Foxit Cloud\FCUpdateService.exe" [X]

 

===================== Treiber (Nicht auf der Ausnahmeliste) ==========================

 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

 

R1 AppleCharger; C:\Windows\System32\DRIVERS\AppleCharger.sys [21544 2010-04-22] ()

S3 ebdrv; C:\Windows\system32\DRIVERS\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)

S3 ggsomc; C:\Windows\System32\DRIVERS\ggsomc.sys [30424 2014-11-17] (Sony Mobile Communications)

S3 GVTDrv64; C:\Windows\GVTDrv64.sys [30528 2014-04-09] ()

R3 mbamchameleon; C:\Windows\system32\drivers\mbamchameleon.sys [109272 2015-10-28] (Malwarebytes)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-10-05] (Malwarebytes)

R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [192216 2015-10-28] (Malwarebytes)

S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-10-05] (Malwarebytes Corporation)

R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [280376 2015-03-04] (Microsoft Corporation)

R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [124568 2015-03-04] (Microsoft Corporation)

R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19600 2015-07-24] (NVIDIA Corporation)

R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [47976 2015-07-03] (NVIDIA Corporation)

R3 PciPPorts; C:\Windows\System32\DRIVERS\PciPPorts.sys [96768 2009-07-23] ()

R3 PciSPorts; C:\Windows\System32\DRIVERS\PciSPorts.sys [122880 2008-12-19] ()

R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)

R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)

S3 dgderdrv; System32\drivers\dgderdrv.sys [X]

S3 SANDRA; \??\C:\Program Files\Sandra Lite\WNt500x64\Sandra.sys [X]

S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]

S3 tsusbhub; system32\drivers\tsusbhub.sys [X]

S3 VGPU; System32\drivers\rdvgkmd.sys [X]

 

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

 

 

==================== Ein Monat: Erstellte Dateien und Ordner ========

 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

 

2015-10-28 14:45 - 2015-10-28 14:45 - 00000000 ____D C:\FRST

2015-10-28 14:34 - 2015-10-28 14:38 - 00000000 ____D C:\Users\S\AppData\Local\gmsd_de_007010126

2015-10-28 14:34 - 2015-10-28 14:35 - 00000000 ____D C:\Program Files (x86)\gmsd_de_007010126

2015-10-28 14:32 - 2015-10-28 14:32 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PremierOpinion

2015-10-28 14:32 - 2015-10-28 14:32 - 00000000 ____D C:\Program Files (x86)\PremierOpinion

2015-10-28 14:32 - 2014-08-18 21:51 - 00971576 _____ (VoiceFive, Inc.) C:\Windows\system32\pmls64.dll

2015-10-28 14:32 - 2014-08-18 21:51 - 00660792 _____ (VoiceFive, Inc.) C:\Windows\SysWOW64\pmls.dll

2015-10-17 14:46 - 2015-10-23 20:54 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2015-10-14 11:56 - 2015-09-29 04:16 - 05569472 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe

2015-10-14 11:56 - 2015-09-29 04:13 - 01730496 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll

2015-10-14 11:56 - 2015-09-29 04:11 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll

2015-10-14 11:56 - 2015-09-29 04:11 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll

2015-10-14 11:56 - 2015-09-29 04:11 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll

2015-10-14 11:56 - 2015-09-29 04:11 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll

2015-10-14 11:56 - 2015-09-29 04:11 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll

2015-10-14 11:56 - 2015-09-29 04:11 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll

2015-10-14 11:56 - 2015-09-29 04:11 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll

2015-10-14 11:56 - 2015-09-29 04:11 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll

2015-10-14 11:56 - 2015-09-29 04:10 - 01216512 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll

2015-10-14 11:56 - 2015-09-29 04:10 - 01164800 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll

2015-10-14 11:56 - 2015-09-29 04:10 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll

2015-10-14 11:56 - 2015-09-29 04:10 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll

2015-10-14 11:56 - 2015-09-29 04:10 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll

2015-10-14 11:56 - 2015-09-29 04:10 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe

2015-10-14 11:56 - 2015-09-29 04:10 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe

2015-10-14 11:56 - 2015-09-29 04:10 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll

2015-10-14 11:56 - 2015-09-29 04:10 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll

2015-10-14 11:56 - 2015-09-29 04:10 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll

2015-10-14 11:56 - 2015-09-29 04:10 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll

2015-10-14 11:56 - 2015-09-29 04:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe

2015-10-14 11:56 - 2015-09-29 04:09 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe

2015-10-14 11:56 - 2015-09-29 04:05 - 03990976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe

2015-10-14 11:56 - 2015-09-29 04:05 - 03936192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe

2015-10-14 11:56 - 2015-09-29 04:05 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll

2015-10-14 11:56 - 2015-09-29 04:05 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll

2015-10-14 11:56 - 2015-09-29 04:02 - 01311768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll

2015-10-14 11:56 - 2015-09-29 04:01 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll

2015-10-14 11:56 - 2015-09-29 04:01 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll

2015-10-14 11:56 - 2015-09-29 04:01 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll

2015-10-14 11:56 - 2015-09-29 04:01 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll

2015-10-14 11:56 - 2015-09-29 04:01 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll

2015-10-14 11:56 - 2015-09-29 04:01 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll

2015-10-14 11:56 - 2015-09-29 04:01 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll

2015-10-14 11:56 - 2015-09-29 04:01 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll

2015-10-14 11:56 - 2015-09-29 04:01 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll

2015-10-14 11:56 - 2015-09-29 04:01 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll

2015-10-14 11:56 - 2015-09-29 04:01 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll

2015-10-14 11:56 - 2015-09-29 04:01 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll

2015-10-14 11:56 - 2015-09-29 04:01 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll

2015-10-14 11:56 - 2015-09-29 04:01 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll

2015-10-14 11:56 - 2015-09-29 04:01 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll

2015-10-14 11:56 - 2015-09-29 04:01 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll

2015-10-14 11:56 - 2015-09-29 04:01 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll

2015-10-14 11:56 - 2015-09-29 04:01 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll

2015-10-14 11:56 - 2015-09-29 04:01 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll

2015-10-14 11:56 - 2015-09-29 04:01 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll

2015-10-14 11:56 - 2015-09-29 04:01 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll

2015-10-14 11:56 - 2015-09-29 04:01 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll

2015-10-14 11:56 - 2015-09-29 04:01 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll

2015-10-14 11:56 - 2015-09-29 04:01 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll

2015-10-14 11:56 - 2015-09-29 04:01 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll

2015-10-14 11:56 - 2015-09-29 04:01 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll

2015-10-14 11:56 - 2015-09-29 04:01 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll

2015-10-14 11:56 - 2015-09-29 04:01 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll

2015-10-14 11:56 - 2015-09-29 04:01 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll

2015-10-14 11:56 - 2015-09-29 04:01 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll

2015-10-14 11:56 - 2015-09-29 03:59 - 00552960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll

2015-10-14 11:56 - 2015-09-29 03:59 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll

2015-10-14 11:56 - 2015-09-29 03:59 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll

2015-10-14 11:56 - 2015-09-29 03:59 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll

2015-10-14 11:56 - 2015-09-29 03:59 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll

2015-10-14 11:56 - 2015-09-29 03:59 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll

2015-10-14 11:56 - 2015-09-29 03:58 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe

2015-10-14 11:56 - 2015-09-29 03:58 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll

2015-10-14 11:56 - 2015-09-29 03:58 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe

2015-10-14 11:56 - 2015-09-29 03:58 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll

2015-10-14 11:56 - 2015-09-29 03:57 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll

2015-10-14 11:56 - 2015-09-29 03:57 - 00665088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll

2015-10-14 11:56 - 2015-09-29 03:57 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll

2015-10-14 11:56 - 2015-09-29 03:57 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll

2015-10-14 11:56 - 2015-09-29 03:53 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll

2015-10-14 11:56 - 2015-09-29 03:53 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll

2015-10-14 11:56 - 2015-09-29 03:49 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll

2015-10-14 11:56 - 2015-09-29 03:49 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll

2015-10-14 11:56 - 2015-09-29 03:49 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll

2015-10-14 11:56 - 2015-09-29 03:49 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll

2015-10-14 11:56 - 2015-09-29 03:49 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll

2015-10-14 11:56 - 2015-09-29 03:49 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll

2015-10-14 11:56 - 2015-09-29 03:49 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll

2015-10-14 11:56 - 2015-09-29 03:49 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll

2015-10-14 11:56 - 2015-09-29 03:49 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll

2015-10-14 11:56 - 2015-09-29 03:49 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll

2015-10-14 11:56 - 2015-09-29 03:49 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll

2015-10-14 11:56 - 2015-09-29 03:49 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll

2015-10-14 11:56 - 2015-09-29 03:49 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll

2015-10-14 11:56 - 2015-09-29 03:49 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll

2015-10-14 11:56 - 2015-09-29 03:49 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll

2015-10-14 11:56 - 2015-09-29 03:49 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll

2015-10-14 11:56 - 2015-09-29 03:49 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll

2015-10-14 11:56 - 2015-09-29 03:49 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll

2015-10-14 11:56 - 2015-09-29 03:49 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll

2015-10-14 11:56 - 2015-09-29 03:49 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll

2015-10-14 11:56 - 2015-09-29 03:49 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll

2015-10-14 11:56 - 2015-09-29 03:49 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll

2015-10-14 11:56 - 2015-09-29 03:49 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll

2015-10-14 11:56 - 2015-09-29 03:49 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll

2015-10-14 11:56 - 2015-09-29 03:49 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll

2015-10-14 11:56 - 2015-09-29 03:49 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll

2015-10-14 11:56 - 2015-09-29 02:50 - 00159232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys

2015-10-14 11:56 - 2015-09-29 02:49 - 00290816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys

2015-10-14 11:56 - 2015-09-29 02:49 - 00129024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys

2015-10-14 11:56 - 2015-09-29 02:43 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe

2015-10-14 11:56 - 2015-09-29 02:43 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe

2015-10-14 11:56 - 2015-09-29 02:40 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll

2015-10-14 11:56 - 2015-09-29 02:40 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll

2015-10-14 11:56 - 2015-09-29 02:40 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll

2015-10-14 11:56 - 2015-09-29 02:40 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll

2015-10-14 11:56 - 2015-09-18 20:31 - 00391784 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2015-10-14 11:56 - 2015-09-18 19:58 - 00345688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

2015-10-14 11:56 - 2015-09-16 05:48 - 25851904 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2015-10-14 11:56 - 2015-09-16 05:36 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2015-10-14 11:56 - 2015-09-16 05:36 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2015-10-14 11:56 - 2015-09-16 05:22 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2015-10-14 11:56 - 2015-09-16 05:21 - 02886656 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2015-10-14 11:56 - 2015-09-16 05:21 - 00585728 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2015-10-14 11:56 - 2015-09-16 05:21 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec

2015-10-14 11:56 - 2015-09-16 05:21 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2015-10-14 11:56 - 2015-09-16 05:21 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2015-10-14 11:56 - 2015-09-16 05:14 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2015-10-14 11:56 - 2015-09-16 05:13 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2015-10-14 11:56 - 2015-09-16 05:10 - 00616960 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2015-10-14 11:56 - 2015-09-16 05:09 - 05990912 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2015-10-14 11:56 - 2015-09-16 05:08 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2015-10-14 11:56 - 2015-09-16 05:08 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2015-10-14 11:56 - 2015-09-16 05:08 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2015-10-14 11:56 - 2015-09-16 05:08 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2015-10-14 11:56 - 2015-09-16 05:01 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2015-10-14 11:56 - 2015-09-16 04:58 - 20357632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2015-10-14 11:56 - 2015-09-16 04:58 - 00489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2015-10-14 11:56 - 2015-09-16 04:50 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2015-10-14 11:56 - 2015-09-16 04:46 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2015-10-14 11:56 - 2015-09-16 04:45 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2015-10-14 11:56 - 2015-09-16 04:45 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2015-10-14 11:56 - 2015-09-16 04:43 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2015-10-14 11:56 - 2015-09-16 04:41 - 00152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll

2015-10-14 11:56 - 2015-09-16 04:33 - 00504832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2015-10-14 11:56 - 2015-09-16 04:33 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2015-10-14 11:56 - 2015-09-16 04:32 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec

2015-10-14 11:56 - 2015-09-16 04:32 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2015-10-14 11:56 - 2015-09-16 04:31 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll

2015-10-14 11:56 - 2015-09-16 04:31 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll

2015-10-14 11:56 - 2015-09-16 04:29 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2015-10-14 11:56 - 2015-09-16 04:29 - 00720896 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2015-10-14 11:56 - 2015-09-16 04:28 - 02279936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2015-10-14 11:56 - 2015-09-16 04:28 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2015-10-14 11:56 - 2015-09-16 04:26 - 02126336 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2015-10-14 11:56 - 2015-09-16 04:26 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2015-10-14 11:56 - 2015-09-16 04:26 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2015-10-14 11:56 - 2015-09-16 04:24 - 00480256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2015-10-14 11:56 - 2015-09-16 04:23 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2015-10-14 11:56 - 2015-09-16 04:22 - 14458368 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2015-10-14 11:56 - 2015-09-16 04:22 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2015-10-14 11:56 - 2015-09-16 04:22 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2015-10-14 11:56 - 2015-09-16 04:15 - 00416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2015-10-14 11:56 - 2015-09-16 04:11 - 02487808 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2015-10-14 11:56 - 2015-09-16 04:10 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2015-10-14 11:56 - 2015-09-16 04:07 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2015-10-14 11:56 - 2015-09-16 04:06 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2015-10-14 11:56 - 2015-09-16 04:05 - 04527616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2015-10-14 11:56 - 2015-09-16 04:05 - 00279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2015-10-14 11:56 - 2015-09-16 04:04 - 00130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll

2015-10-14 11:56 - 2015-09-16 03:59 - 01546752 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2015-10-14 11:56 - 2015-09-16 03:58 - 12853760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2015-10-14 11:56 - 2015-09-16 03:58 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll

2015-10-14 11:56 - 2015-09-16 03:56 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2015-10-14 11:56 - 2015-09-16 03:55 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2015-10-14 11:56 - 2015-09-16 03:55 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll

2015-10-14 11:56 - 2015-09-16 03:48 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2015-10-14 11:56 - 2015-09-16 03:37 - 02011136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2015-10-14 11:56 - 2015-09-16 03:34 - 01311232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2015-10-14 11:56 - 2015-09-16 03:32 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2015-10-14 11:56 - 2015-09-15 19:17 - 00157016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys

2015-10-14 11:56 - 2015-09-15 19:17 - 00097112 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys

2015-10-14 11:56 - 2015-09-15 19:11 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll

2015-10-14 11:56 - 2015-09-15 19:11 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll

2015-10-14 11:56 - 2015-09-15 19:11 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll

2015-10-14 11:56 - 2015-09-15 19:11 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll

2015-10-14 11:56 - 2015-09-15 19:11 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll

2015-10-14 11:56 - 2015-09-15 19:11 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll

2015-10-14 11:56 - 2015-09-15 19:10 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe

2015-10-14 11:56 - 2015-09-15 18:36 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll

2015-10-14 11:56 - 2015-09-15 18:36 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll

2015-10-14 11:56 - 2015-09-15 18:36 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll

2015-10-14 11:56 - 2015-09-15 18:35 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll

2015-10-14 11:55 - 2015-08-06 19:04 - 14176768 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll

2015-10-14 11:55 - 2015-08-06 19:03 - 01866752 _____ (Microsoft Corporation) C:\Windows\system32\ExplorerFrame.dll

2015-10-14 11:55 - 2015-08-06 18:44 - 12875776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll

2015-10-14 11:55 - 2015-08-06 18:44 - 01498624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ExplorerFrame.dll

2015-10-14 11:55 - 2015-08-05 18:56 - 00022528 _____ (Microsoft Corporation) C:\Windows\system32\icaapi.dll

2015-10-14 11:55 - 2015-08-05 18:06 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys

2015-10-14 11:53 - 2015-10-01 19:06 - 00692672 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi

2015-10-14 11:53 - 2015-10-01 19:04 - 00616360 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi

2015-10-14 11:53 - 2015-10-01 19:00 - 00147456 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe

2015-10-14 11:53 - 2015-10-01 19:00 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll

2015-10-14 11:53 - 2015-10-01 19:00 - 00059392 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll

2015-10-14 11:53 - 2015-10-01 19:00 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll

2015-10-14 11:53 - 2015-10-01 19:00 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe

2015-10-14 11:53 - 2015-10-01 18:50 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll

2015-10-14 11:53 - 2015-10-01 18:00 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys

2015-10-13 20:58 - 2015-10-13 20:58 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Foxit PhantomPDF

2015-10-13 20:57 - 2015-10-13 20:57 - 00000000 ____D C:\Program Files (x86)\Foxit Software

2015-10-13 20:12 - 2015-10-13 20:58 - 00000000 ____D C:\Users\Public\Foxit Software

2015-10-13 20:12 - 2015-10-13 20:12 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Foxit Reader

2015-10-09 15:45 - 2015-10-16 12:32 - 00003584 _____ C:\Users\S\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

2015-10-08 13:09 - 2015-10-19 09:58 - 00002590 _____ C:\Windows\PFRO.log

2015-10-05 18:04 - 2015-10-06 14:27 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird

2015-10-02 17:03 - 2015-10-02 17:03 - 00003042 _____ C:\Windows\System32\Tasks\{AB7941C8-16AF-4A02-A414-90DA311ADB15}

2015-09-29 11:54 - 2015-09-29 11:54 - 00003088 _____ C:\Windows\System32\Tasks\{E844E15A-0A34-4B71-B785-CFD6447CE2F4}

2015-09-29 11:54 - 2015-09-29 11:54 - 00003088 _____ C:\Windows\System32\Tasks\{D0E9E33B-3EC9-4AF1-9238-E3F5B7E88BA6}

2015-09-29 11:54 - 2015-09-29 11:54 - 00003088 _____ C:\Windows\System32\Tasks\{AE0D28C2-7D6E-4562-A6A2-81A086767A02}

2015-09-29 11:54 - 2015-09-29 11:54 - 00003088 _____ C:\Windows\System32\Tasks\{9D4D70BF-3EF3-4CCA-9CB8-A52C2852BA75}

2015-09-29 11:54 - 2015-09-29 11:54 - 00003088 _____ C:\Windows\System32\Tasks\{8853068E-2BC7-47EC-9B13-D9C2AF44EF85}

2015-09-29 11:20 - 2015-09-29 11:20 - 00003088 _____ C:\Windows\System32\Tasks\{23AFF6D0-C961-4645-A1B2-D6958D860773}

 

==================== Ein Monat: Geänderte Dateien und Ordner ========

 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

 

2015-10-28 14:45 - 2014-05-26 22:26 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware

2015-10-28 14:35 - 2014-04-09 11:02 - 01220149 _____ C:\Windows\WindowsUpdate.log

2015-10-28 11:46 - 2014-05-26 22:26 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2015-10-28 11:43 - 2014-05-26 22:26 - 00109272 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys

2015-10-28 11:34 - 2009-07-14 05:45 - 00014624 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2015-10-28 11:34 - 2009-07-14 05:45 - 00014624 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2015-10-28 11:24 - 2014-05-26 22:26 - 00001102 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2015-10-28 11:24 - 2014-05-26 22:26 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2015-10-28 11:13 - 2014-05-26 22:38 - 00000000 ____D C:\Program Files\SUPERAntiSpyware

2015-10-28 11:10 - 2009-07-14 18:58 - 00704088 _____ C:\Windows\system32\perfh007.dat

2015-10-28 11:10 - 2009-07-14 18:58 - 00153804 _____ C:\Windows\system32\perfc007.dat

2015-10-28 11:10 - 2009-07-14 06:13 - 01627176 _____ C:\Windows\system32\PerfStringBackup.INI

2015-10-28 11:06 - 2015-09-22 11:38 - 00006720 _____ C:\Windows\setupact.log

2015-10-28 11:04 - 2015-03-09 22:50 - 00000000 ____D C:\Users\S\AppData\Local\HTC MediaHub

2015-10-28 11:04 - 2014-04-09 23:34 - 00000000 ____D C:\ProgramData\NVIDIA

2015-10-28 11:04 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2015-10-28 00:03 - 2014-04-09 20:13 - 00000000 ____D C:\Users\S\AppData\Roaming\Skype

2015-10-26 20:50 - 2014-04-10 14:08 - 00000000 ____D C:\Program Files (x86)\Paint Shop Pro 7

2015-10-25 21:28 - 2015-06-21 11:15 - 00000000 ____D C:\Users\S\AppData\Roaming\OBS

2015-10-25 21:21 - 2015-01-18 00:22 - 00000000 ____D C:\Users\S\AppData\Roaming\vlc

2015-10-23 21:03 - 2014-10-27 22:11 - 00000000 ____D C:\Users\S\AppData\Roaming\Audacity

2015-10-21 21:01 - 2014-04-10 14:46 - 00000000 ____D C:\ProgramData\SmartSound Software Inc

2015-10-19 20:24 - 2014-04-10 15:25 - 00000000 ____D C:\Users\S\AppData\Roaming\HandBrake

2015-10-19 10:02 - 2014-04-09 21:46 - 00780488 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2015-10-19 10:02 - 2014-04-09 21:46 - 00142536 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2015-10-19 09:58 - 2014-04-09 18:44 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2015-10-17 14:28 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache

2015-10-16 19:58 - 2014-04-09 21:41 - 00000000 ____D C:\Windows\system32\MRT

2015-10-16 19:57 - 2014-04-09 21:41 - 143481208 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2015-10-16 12:26 - 2014-04-09 20:31 - 00000000 ____D C:\ProgramData\Microsoft Help

2015-10-15 19:19 - 2009-07-14 03:34 - 00000478 _____ C:\Windows\win.ini

2015-10-14 10:29 - 2014-04-09 21:03 - 00000000 ____D C:\Users\S\AppData\Roaming\MyPhoneExplorer

2015-10-13 20:58 - 2014-04-09 20:04 - 00000000 ____D C:\Users\S\AppData\Roaming\Foxit Software

2015-10-13 20:18 - 2014-06-04 10:56 - 00000000 ____D C:\ProgramData\Package Cache

2015-10-13 20:12 - 2014-04-09 20:04 - 00000000 ____D C:\Program Files (x86)\Foxit Reader

2015-10-08 20:17 - 2014-04-09 20:12 - 00000000 ____D C:\ProgramData\Skype

2015-10-06 14:28 - 2015-06-21 11:15 - 00000000 ____D C:\Program Files (x86)\OBS

2015-10-05 09:50 - 2014-05-26 22:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2015-10-05 09:50 - 2014-05-26 22:26 - 00025816 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys

2015-10-02 17:24 - 2014-04-10 17:19 - 00000000 ____D C:\ProgramData\Oracle

2015-10-02 12:06 - 2014-09-05 19:42 - 00000000 ____D C:\Users\S\AppData\Local\Adobe

2015-10-01 11:52 - 2014-08-06 09:28 - 00003822 _____ C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1397129152

2015-10-01 11:52 - 2014-04-10 12:25 - 00000000 ____D C:\Program Files (x86)\Opera

2015-09-29 01:53 - 2015-08-15 23:54 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\K-Lite Codec Pack

2015-09-29 01:53 - 2015-08-15 23:54 - 00000000 ____D C:\Program Files (x86)\K-Lite Codec Pack

 

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======

 

2015-10-09 15:45 - 2015-10-16 12:32 - 0003584 _____ () C:\Users\S\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

2014-04-09 17:47 - 2014-06-14 21:28 - 0007661 _____ () C:\Users\S\AppData\Local\resmon.resmoncfg

 

Einige Dateien in TEMP:

====================

C:\Users\S\AppData\Local\Temp\farbar-recovery-scan-tool.exe

 

 

==================== Bamital & volsnap =================

 

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

 

C:\Windows\system32\winlogon.exe => Datei ist digital signiert

C:\Windows\system32\wininit.exe => Datei ist digital signiert

C:\Windows\SysWOW64\wininit.exe => Datei ist digital signiert

C:\Windows\explorer.exe => Datei ist digital signiert

C:\Windows\SysWOW64\explorer.exe => Datei ist digital signiert

C:\Windows\system32\svchost.exe => Datei ist digital signiert

C:\Windows\SysWOW64\svchost.exe => Datei ist digital signiert

C:\Windows\system32\services.exe => Datei ist digital signiert

C:\Windows\system32\User32.dll => Datei ist digital signiert

C:\Windows\SysWOW64\User32.dll => Datei ist digital signiert

C:\Windows\system32\userinit.exe => Datei ist digital signiert

C:\Windows\SysWOW64\userinit.exe => Datei ist digital signiert

C:\Windows\system32\rpcss.dll => Datei ist digital signiert

C:\Windows\system32\dnsapi.dll => Datei ist digital signiert

C:\Windows\SysWOW64\dnsapi.dll => Datei ist digital signiert

C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert

 

 

LastRegBack: 2015-10-21 11:44

 

==================== Ende von FRST.txt ============================

 

Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version:25-10-2015 02

durchgeführt von S (2015-10-28 14:47:00)

Gestartet von C:\Program Files (x86)\Malwarebytes Anti-Malware

Windows 7 Ultimate Service Pack 1 (X64) (2014-04-09 10:14:42)

Start-Modus: Normal

==========================================================

 

 

==================== Konten: =============================

 

Administrator (S-1-5-21-2138198700-1450621571-450520247-500 - Administrator - Disabled)

Guest (S-1-5-21-2138198700-1450621571-450520247-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-2138198700-1450621571-450520247-1003 - Limited - Enabled)

S (S-1-5-21-2138198700-1450621571-450520247-1000 - Administrator - Enabled) => C:\Users\S

 

==================== Sicherheits-Center ========================

 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)

 

AV: Microsoft Security Essentials (Enabled - Up to date) {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}

AS: Microsoft Security Essentials (Enabled - Up to date) {0C8D1929-27B2-688D-E114-9117BD2BB1B7}

AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

 

==================== Installierte Programme ======================

 

(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)

 

@BIOS Ver.2.06 (HKLM-x32\...\{B2DC3F08-2EB2-49A5-AA24-15DFC8B1CB83}) (Version: 2.06 - GIGABYTE)

ABC 3GP/MP4 Converter 3.00 (HKLM-x32\...\ABC 3GP/MP4 Converter) (Version: 3.00 - ABCMedia [email protected],Ltd.)

ACDSee 4.0.2 Suite (HKLM-x32\...\{DF53316E-CFA7-47E2-B93E-9BC7412D1EEA}) (Version: 4.00.0002 - ACD Systems Ltd)

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.8.0.870 - Adobe Systems Incorporated)

Adobe Creative Suite 2 (HKLM-x32\...\{0134A1A1-C283-4A47-91A1-92F19F960372}) (Version:  - )

Adobe Flash Player 13 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 13.0.0.214 - Adobe Systems Incorporated)

Adobe Flash Player 16 PPAPI (HKLM-x32\...\Adobe Flash Player PPAPI) (Version: 16.0.0.296 - Adobe Systems Incorporated)

Adobe Flash Player 19 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 19.0.0.226 - Adobe Systems Incorporated)

Adobe Photoshop CS2 (HKLM-x32\...\Adobe Photoshop CS2 - {236BB7C4-4419-42FD-0409-1E257A25E34D}) (Version: 9.0 - Adobe Systems, Inc.)

Adobe Shockwave Player 12.1 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.1.3.153 - Adobe Systems, Inc.)

Audacity 2.0.6 (HKLM-x32\...\Audacity_is1) (Version: 2.0.6 - Audacity Team)

Avanquest update (HKLM-x32\...\{76E41F43-59D2-4F30-BA42-9A762EE1E8DE}) (Version: 1.34 - Avanquest Software)

BB FlashBack Express 5 (HKLM-x32\...\BB FlashBack Express 5) (Version: 5.6.0.3551 - Blueberry)

Canon MP Navigator EX 3.0 (HKLM-x32\...\MP Navigator EX 3.0) (Version:  - )

Canon MP550 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP550_series) (Version:  - Canon Inc.)

CCleaner (HKLM\...\CCleaner) (Version: 5.09 - Piriform)

Core Temp 1.0 RC6 (HKLM\...\{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1) (Version: 1.0 - Alcpu)

CyberLink Holiday Pack vol 5 (HKLM-x32\...\InstallShield_{56534024-7852-4F49-A27E-02CF3F2CD540}) (Version: Holiday Pack 5 - CyberLink Corp.)

CyberLink Holiday Pack Vol.4 for PowerDirector (HKLM-x32\...\InstallShield_{847205C3-A599-4E6C-BEDB-217FABA62620}) (Version: 1.0 - CyberLink Corp.)

CyberLink PowerDirector 11 (HKLM-x32\...\InstallShield_{551F492A-01B0-4DC4-866F-875EC4EDC0A8}) (Version: 11.0.0.3625 - CyberLink Corp.)

CyberLink PowerDirector 11 (Version: 11.0.0.3625 - CyberLink Corp.) Hidden

CyberLink PowerDirector 11 Content Pack Essential (HKLM-x32\...\InstallShield_{03AD770A-1530-437E-967F-ADD4E5B23164}) (Version: 11 - CyberLink Corp.)

CyberLink PowerDirector 11 Content Pack Premium (HKLM-x32\...\InstallShield_{37672760-7930-4911-9685-227E29AE2C55}) (Version: 11 - CyberLink Corp.)

CyberLink PowerDirector 13 (HKLM-x32\...\{BA385AFC-00B1-417C-8C20-74B996EF3AF0}) (Version: 13.0.3130.0 - CyberLink Corp.)

CyberLink PowerDirector 13 Content Pack Essential (HKLM-x32\...\InstallShield_{749B310F-A489-439D-9AEF-1332222F2E04}) (Version: 13 Essential - CyberLink Corp.)

CyberLink PowerDirector 13 Content Pack Premium (HKLM-x32\...\InstallShield_{9B866025-5082-4B88-8A62-F6FBBFCBBBA1}) (Version: 13 Premium - CyberLink Corp.)

CyberLink WaveEditor 2 (HKLM-x32\...\{324F76CC-D8DD-4D87-B77D-D4AF5E1AA7B3}) (Version: 2.0 - CyberLink Corp.)

CyberLink Wedding Pack (HKLM-x32\...\InstallShield_{741635DB-36DA-4BCF-BB52-0F4C1C4E0DFB}) (Version: Wedding Pack - CyberLink Corp.)

DashWare (HKLM-x32\...\{E88D1ED6-EEA3-4420-8A1B-152ABE25BD16}) (Version: 1.7.37 - GoPro)

Dropbox (HKU\S-1-5-21-2138198700-1450621571-450520247-1000\...\Dropbox) (Version: 3.6.7 - Dropbox, Inc.)

EasyCapture 1.2.0.0 (HKLM-x32\...\EasyCapture_is1) (Version:  - )

eReg (x32 Version: 1.20.138.34 - Logitech, Inc.) Hidden

FFmpeg (Windows) for Audacity version 2.2.2 (HKLM-x32\...\{9C7E31E3-017F-434C-AC40-24431A354A1E}_is1) (Version: 2.2.2 - )

Foxit PhantomPDF Standard (HKLM-x32\...\{AB1C0A52-2305-4E7F-BB2D-8730B5AA1E69}) (Version: 7.2.2.929 - Foxit Software Inc.)

Foxit Reader (HKLM-x32\...\Foxit Reader_is1) (Version: 7.2.2.929 - Foxit Software Inc.)

Google Earth (HKLM-x32\...\{28E82311-8616-11E1-BEB0-B8AC6F97B88E}) (Version: 6.2.2.6613 - Google)

Google Talk Plugin (HKLM-x32\...\{C1E3DFE7-4EAD-3E9E-A826-E06055BA5921}) (Version: 5.4.2.18903 - Google)

Google+ Auto Backup (HKU\S-1-5-21-2138198700-1450621571-450520247-1000\...\Google+ Auto Backup) (Version: 1.0.26.151 - Google, Inc.)

HandBrake 0.10.2 (HKLM-x32\...\HandBrake) (Version: 0.10.2 - )

Helium (HKLM-x32\...\{9A781940-AC41-4D5E-8E1E-76A04B916FB9}) (Version: 1.0.0 - ClockworkMod)

HTC Driver Installer (HKLM-x32\...\{4CEEE5D0-F905-4688-B9F9-ECC710507796}) (Version: 4.14.0.001 - HTC Corporation)

HTC Sync Manager (HKLM-x32\...\{231D0C79-98A6-4693-A366-36DE7D7346EC}) (Version: 3.1.37.2 - HTC)

IPTInstaller (HKLM-x32\...\{08208143-777D-4A06-BB54-71BF0AD1BB70}) (Version: 4.0.9 - HTC)

Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)

K-Lite Codec Pack 11.4.5 Standard (HKLM-x32\...\KLiteCodecPack_is1) (Version: 11.4.5 - )

LAME v3.99.3 (for Windows) (HKLM-x32\...\LAME_is1) (Version:  - )

Logitech SetPoint 6.65 (HKLM\...\sp6) (Version: 6.65.62 - Logitech)

Logitech Unifying Software 2.50 (HKLM\...\Logitech Unifying) (Version: 2.50.25 - Logitech)

Malwarebytes Anti-Malware version 2.2.0.1024 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.0.1024 - Malwarebytes)

Media Go (HKLM-x32\...\{AF06B8FA-B916-4001-AE51-6645488DEF09}) (Version: 2.8.303 - Sony)

Media Go Network Downloader (HKLM-x32\...\{5562F05F-908C-4F15-9B3C-98D5FD32DCAB}) (Version: 1.5.19.0 - Sony)

Media Go Video Playback Engine 2.12.112.07010 (HKLM-x32\...\{2AC62059-C1F3-3332-14F7-BD4F8231FED9}) (Version: 2.12.112.07010 - Sony)

MediaInfo 0.7.69 (HKLM\...\MediaInfo) (Version: 0.7.69 - MediaArea.net)

Microsoft .NET Framework 4.5.2 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.51209 - Microsoft Corporation)

Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)

Microsoft ASP.NET MVC 4 Runtime (HKLM-x32\...\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 - Microsoft Corporation)

Microsoft Office Home and Business 2010 (HKLM\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)

Microsoft Office Language Pack 2010 - German/Deutsch (HKLM\...\Office14.OMUI.de-de) (Version: 14.0.7015.1000 - Microsoft Corporation)

Microsoft Publisher 2010 (HKLM\...\Office14.PUBLISHERR) (Version: 14.0.7015.1000 - Microsoft Corporation)

Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.8.204.0 - Microsoft Corporation)

Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}) (Version: 8.0.50727.42 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729 (HKLM\...\{2DFD8316-9EF1-3210-908C-4CB61961C1AC}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{527BBE2F-1FED-3D8B-91CB-4DB0F838E69E}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)

Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)

Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)

MozBackup 1.5.1 (HKLM-x32\...\MozBackup) (Version:  - Pavel Cvrcek)

Mozilla Firefox 41.0.2 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 41.0.2 (x86 en-US)) (Version: 41.0.2 - Mozilla)

Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 41.0.2.5765 - Mozilla)

Mozilla Thunderbird 38.3.0 (x86 en-GB) (HKLM-x32\...\Mozilla Thunderbird 38.3.0 (x86 en-GB)) (Version: 38.3.0 - Mozilla)

MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)

MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)

MyFreeCodec (HKU\S-1-5-21-2138198700-1450621571-450520247-1000\...\MyFreeCodec) (Version:  - )

MyPhoneExplorer (HKLM-x32\...\MPE) (Version: 1.8.6 - F.J. Wechselberger)

NEC Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{D7BF9739-8A68-4335-BBEE-37752AD9E86B}) (Version: 1.0.18.0 - NEC Electronics Corporation)

NEC Electronics USB 3.0 Host Controller Driver (x32 Version: 1.0.18.0 - NEC Electronics Corporation) Hidden

Newblue Art Effects for PowerDirector (HKLM\...\NewBlue Art Effects for PowerDirector) (Version: 2.0 - NewBlue)

NewBlue Titler Pro for Windows (HKLM-x32\...\NewBlue Titler Pro for Windows) (Version: 1.0 - NewBlue)

NewBlue Video Essentials for Windows (HKLM-x32\...\NewBlue Video Essentials for Windows) (Version: 3.0 - NewBlue)

NewBlue Video Essentials V for Windows (HKLM-x32\...\NewBlue Video Essentials V for Windows) (Version: 3.0 - NewBlue)

NirSoft BlueScreenView (HKLM-x32\...\NirSoft BlueScreenView) (Version:  - )

NVIDIA 3D Vision Controller Driver 340.50 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 340.50 - NVIDIA Corporation)

NVIDIA 3D Vision Driver 341.81 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 341.81 - NVIDIA Corporation)

NVIDIA GeForce Experience 2.5.12.11 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.5.12.11 - NVIDIA Corporation)

NVIDIA Graphics Driver 341.81 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 341.81 - NVIDIA Corporation)

NVIDIA PhysX System Software 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)

ON_OFF Charge B10.0422.2 (HKLM-x32\...\{3DECD372-76A1-4483-BF10-B547790A3261}) (Version: 1.00.0001 - GIGABYTE)

Open Broadcaster Software (HKLM-x32\...\Open Broadcaster Software) (Version:  - )

Opera Stable 32.0.1948.69 (HKLM-x32\...\Opera 32.0.1948.69) (Version: 32.0.1948.69 - Opera Software)

Paint Shop Pro 7 Try And Buy (HKLM-x32\...\{D6DE02C7-1F47-11D4-9515-00105AE4B89A}) (Version: 7.0.4.0000 - Jasc Software Inc)

Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9.140.239 - Google, Inc.)

PowerDirector (Version: 11.0 - CyberLink Corp.) Hidden

PremierOpinion (HKLM-x32\...\{eeb86aef-4a5d-4b75-9d74-f16d438fc286}) (Version: 1.3.337.341 - VoiceFive, Inc.) <==== ACHTUNG

proDAD Adorage 3.0 (64bit) (HKLM\...\proDAD-Adorage-3.0) (Version: 3.0.108.2 - proDAD GmbH)

QuickTime (HKLM-x32\...\{B67BAFBA-4C9F-48FA-9496-933E3B255044}) (Version: 7.74.80.86 - Apple Inc.)

QuickTime Alternative 3.2.2 (HKLM-x32\...\QuicktimeAlt_is1) (Version: 3.2.2 - )

Realtek Ethernet Controller Driver For Windows 7 (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.17.304.2010 - Realtek)

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6077 - Realtek Semiconductor Corp.)

RiskII (remove only) (HKLM-x32\...\RiskII) (Version:  - )

Samsung Kies (HKLM-x32\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.5.3.13043_14 - Samsung Electronics Co., Ltd.)

Samsung Kies (x32 Version: 2.5.3.13043_14 - Samsung Electronics Co., Ltd.) Hidden

SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.49.0 - SAMSUNG Electronics Co., Ltd.)

Security Task Manager 1.7g (HKLM-x32\...\Security Task Manager) (Version: 1.7g - Neuber GmbH)

Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (HKLM\...\{90140000-003D-0000-1000-0000000FF1CE}_Office14.SingleImage_{A3364707-2F53-4C83-8F68-C9877A9080C7}) (Version:  - Microsoft)

Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (HKLM\...\{91140000-0019-0000-1000-0000000FF1CE}_Office14.PUBLISHERR_{A3364707-2F53-4C83-8F68-C9877A9080C7}) (Version:  - Microsoft)

Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (Version:  - Microsoft) Hidden

Service Pack 2 for Microsoft Office 2010 Language Pack (KB2687449) 64-Bit Edition (HKLM\...\{90140000-0100-0407-1000-0000000FF1CE}_Office14.OMUI.de-de_{F8F9897A-AA29-43EB-8847-94E0253CD458}) (Version:  - Microsoft)

Service Pack 2 for Microsoft Office 2010 Language Pack (KB2687449) 64-Bit Edition (Version:  - Microsoft) Hidden

SES Driver (HKLM\...\{D8CC254C-C671-4664-9A38-FA368D1E2C97}) (Version: 1.0.0 - Western Digital)

Setup (HKLM-x32\...\{7ADF667E-E14D-4D2C-827C-B0108F0D93BC}) (Version:  - ) <==== ACHTUNG

SHIELD Streaming (Version: 4.1.3000 - NVIDIA Corporation) Hidden

SHIELD Wireless Controller Driver (Version: 2.5.12.11 - NVIDIA Corporation) Hidden

Shock Desktop v1.53 (HKLM-x32\...\Shock Desktop v1.53) (Version:  - )

Skype™ 7.12 (HKLM-x32\...\{6A0549A9-1B96-498C-ACBC-3943001FEB19}) (Version: 7.12.101 - Skype Technologies S.A.)

SmartSound Quicktracks 5 (HKLM-x32\...\InstallShield_{2F8BA3FD-1FA9-4279-B696-712ABB12F09F}) (Version: 5.1.8 - SmartSound Software Inc.)

SmartSound Quicktracks 5 (x32 Version: 5.1.8 - SmartSound Software Inc.) Hidden

Sony Mobile Update Engine (HKLM-x32\...\Update Engine) (Version: 2.15.1.201412301303 - Sony Mobile Communications Inc.)

Sony PC Companion 2.10.245 (HKLM-x32\...\{F09EF8F2-0976-42C1-8D9D-8DF78337C6E3}) (Version: 2.10.245 - Sony)

Suite Specific (x32 Version: 2.0.0 - Adobe Systems, Incorporated) Hidden

SUPERAntiSpyware (HKLM\...\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}) (Version: 5.7.1018 - SUPERAntiSpyware.com)

Supertintin 1.2.0.13 (HKLM-x32\...\Supertintin Skype Video Call Recorder_is1) (Version: 1.2.0.13 - Imtiger Software Inc.)

swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden

The Making Of A Prophet  (HKLM-x32\...\The Making Of A Prophet) (Version:  - MDickie.com)

The Testament of Sherlock Holmes (HKLM-x32\...\{38A96559-FF39-4089-A609-BFD76C4A6C07}_is1) (Version: 1.00.0777 - Focus Home Interactive)

Total Commander 64-bit (Remove or Repair) (HKLM\...\Totalcmd64) (Version: 8.50 - Ghisler Software GmbH)

Vista Shortcut Manager x64 (HKLM\...\{C7311329-C491-427B-8880-133E84869B3A}) (Version: 2.0 - Frameworkx)

Vivaldi (HKU\S-1-5-21-2138198700-1450621571-450520247-1000\...\Vivaldi) (Version: 1.0.83.38 - Vivaldi)

VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.1 - VideoLAN)

WinDirStat 1.1.2 (HKU\S-1-5-21-2138198700-1450621571-450520247-1000\...\WinDirStat) (Version:  - )

XMind 2012 (v3.3.1) (HKLM-x32\...\XMind_is1) (Version: 3.3.1.201212250029 - XMind Ltd.)

 

==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================

 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

 

CustomCLSID: HKU\S-1-5-21-2138198700-1450621571-450520247-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\S\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-2138198700-1450621571-450520247-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\S\AppData\Local\Google\Update\1.3.24.7\psuser_64.dll (Google Inc.)

CustomCLSID: HKU\S-1-5-21-2138198700-1450621571-450520247-1000_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\S\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-2138198700-1450621571-450520247-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\S\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-2138198700-1450621571-450520247-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\S\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-2138198700-1450621571-450520247-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\S\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-2138198700-1450621571-450520247-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\S\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-2138198700-1450621571-450520247-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\S\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-2138198700-1450621571-450520247-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\S\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-2138198700-1450621571-450520247-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\S\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-2138198700-1450621571-450520247-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\S\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-2138198700-1450621571-450520247-1000_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\S\AppData\Local\Google\Update\1.3.24.7\psuser_64.dll (Google Inc.)

 

==================== Wiederherstellungspunkte =========================

 

16-10-2015 11:51:51 Windows Update

20-10-2015 10:55:33 Windows Update

24-10-2015 13:04:42 Windows Backup

25-10-2015 11:28:03 Windows Update

 

==================== Hosts Inhalt: ===============================

 

(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)

 

2009-07-14 03:34 - 2015-08-27 12:55 - 00000866 ____A C:\Windows\system32\Drivers\etc\hosts

 

104.28.28.125 www.councilofexmuslims.com

 

==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============

 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

 

Task: {02040130-986B-4EB3-A345-18A7A63C0895} - System32\Tasks\ParetoLogic Update Version3 Startup Task => C:\Program Files (x86)\Common Files\ParetoLogic\UUS3\Pareto_Update3.exe [2014-11-20] ()

Task: {1940C3C6-3DD5-46C3-B8FF-BEB02143C104} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-2138198700-1450621571-450520247-1000UA => C:\Users\S\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-20] (Dropbox, Inc.)

Task: {32658DED-5D43-4F97-BA0A-F6C35ACE9222} - System32\Tasks\{D0E9E33B-3EC9-4AF1-9238-E3F5B7E88BA6} => Firefox.exe hxxp://ui.skype.com/ui/0/7.10.0.101/en/abandoninstall?page=tsProgressBar

Task: {3821BE18-3EF0-49EF-86D0-25BD443A5E3B} - System32\Tasks\ParetoLogic Registration3 => Rundll32.exe "C:\Program Files (x86)\Common Files\ParetoLogic\UUS3\UUS3.dll" RunUns

Task: {3E951AA9-24CC-47D6-BC2C-2EEC397FC745} - System32\Tasks\{AE0D28C2-7D6E-4562-A6A2-81A086767A02} => Firefox.exe hxxp://ui.skype.com/ui/0/7.10.0.101/en/abandoninstall?page=tsProgressBar

Task: {4035C73E-70B8-4C51-AFEB-231706D9A929} - System32\Tasks\ParetoLogic Update Version3 => C:\Program Files (x86)\Common Files\ParetoLogic\UUS3\Pareto_Update3.exe [2014-11-20] ()

Task: {5F74ACA7-D8B8-40D6-87E7-DE4C4E91DA75} - System32\Tasks\{9D4D70BF-3EF3-4CCA-9CB8-A52C2852BA75} => Firefox.exe hxxp://ui.skype.com/ui/0/7.10.0.101/en/abandoninstall?page=tsProgressBar

Task: {6FA2961D-A645-4E1B-92D4-1EC228C59146} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-08-20] (Piriform Ltd)

Task: {8B91A83B-9EC6-473D-B5FF-EA9B030A3F45} - System32\Tasks\{8853068E-2BC7-47EC-9B13-D9C2AF44EF85} => Firefox.exe hxxp://ui.skype.com/ui/0/7.10.0.101/en/abandoninstall?page=tsProgressBar

Task: {9E6C773E-F005-44B6-BB1D-39AB12310F4F} - System32\Tasks\{AB7941C8-16AF-4A02-A414-90DA311ADB15} => pcalua.exe -a E:\jxpiinstall(1).exe -d E:\

Task: {A564DA4F-1CA8-49CD-A399-D53E5E37BCB3} - System32\Tasks\Opera scheduled Autoupdate 1397129152 => C:\Program Files (x86)\Opera\launcher.exe [2015-09-25] (Opera Software)

Task: {BBD339EC-7F48-4AE9-ACA2-78B78946360E} - System32\Tasks\{23AFF6D0-C961-4645-A1B2-D6958D860773} => Firefox.exe hxxp://ui.skype.com/ui/0/7.10.0.101/en/abandoninstall?page=tsProgressBar

Task: {ED17177E-F1B5-42C2-909A-B6C9AD61A646} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-2138198700-1450621571-450520247-1000Core => C:\Users\S\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-20] (Dropbox, Inc.)

Task: {ED90D8E3-F263-4F78-8153-82362A44A89D} - System32\Tasks\klcp_update => C:\Program Files (x86)\K-Lite Codec Pack\Tools\CodecTweakTool.exe [2015-08-24] ()

Task: {FB069615-8B1A-4137-9AD3-7D45EABC9B95} - System32\Tasks\{E844E15A-0A34-4B71-B785-CFD6447CE2F4} => Firefox.exe hxxp://ui.skype.com/ui/0/7.10.0.101/en/abandoninstall?page=tsProgressBar

 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)

 

Task: C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-2138198700-1450621571-450520247-1000Core.job => C:\Users\S\AppData\Local\Dropbox\Update\DropboxUpdate.exe

Task: C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-2138198700-1450621571-450520247-1000UA.job => C:\Users\S\AppData\Local\Dropbox\Update\DropboxUpdate.exe

Task: C:\Windows\Tasks\ParetoLogic Registration3.job => C:\Windows\system32\rundll32.exeGC:\Program Files (x86)\Common Files\ParetoLogic\UUS3\UUS3.dll

Task: C:\Windows\Tasks\ParetoLogic Update Version3 Startup Task.job => C:\Program Files (x86)\Common Files\ParetoLogic\UUS3\Pareto_Update3.exe

Task: C:\Windows\Tasks\ParetoLogic Update Version3.job => C:\Program Files (x86)\Common Files\ParetoLogic\UUS3\Pareto_Update3.exe

 

==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============

 

2014-04-09 23:34 - 2015-08-18 01:07 - 00115376 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll

2013-10-17 14:27 - 2013-10-17 14:27 - 00166912 _____ () C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe

2014-04-10 14:46 - 2012-12-25 17:29 - 00390672 _____ () C:\Program Files\CyberLink\Shared files\RichVideo64.exe

2014-12-18 15:27 - 2014-12-18 15:27 - 00821600 _____ () C:\Program Files (x86)\HTC\HTC Sync Manager\HTC Sync\adb.exe

2014-08-20 20:43 - 2014-08-20 20:43 - 00040960 _____ () C:\Program Files (x86)\MyPhoneExplorer\DLL\mpe_gadget_connector_net.dll

2014-04-09 18:58 - 2014-02-19 07:50 - 00150392 _____ () D:\Tools\WinCommander\wcmzip64.dll

2015-10-28 14:35 - 2015-10-25 17:39 - 03308720 _____ () C:\Users\S\AppData\Local\gmsd_de_007010126\upgmsd_de_007010126.exe

2015-10-28 14:34 - 2015-10-25 17:39 - 03971760 _____ () C:\Program Files (x86)\gmsd_de_007010126\gmsd_de_007010126.exe

2015-10-28 14:38 - 2015-10-28 14:38 - 00707072 _____ () C:\Users\S\AppData\Local\Temp\is-2L3GA.tmp\myoffergroup_de.tmp

2014-12-18 15:25 - 2014-12-18 15:25 - 00031080 _____ () C:\Program Files (x86)\HTC\HTC Sync Manager\DbAccess.dll

2014-12-18 15:26 - 2014-12-18 15:26 - 00607376 _____ () C:\Program Files (x86)\HTC\HTC Sync Manager\sqlite3.dll

2014-12-18 15:26 - 2014-12-18 15:26 - 00059752 _____ () C:\Program Files (x86)\HTC\HTC Sync Manager\NAdvLog.dll

2014-12-18 15:26 - 2014-12-18 15:26 - 00036216 _____ () C:\Program Files (x86)\HTC\HTC Sync Manager\NFileCacheDBAccess.dll

2014-12-18 15:26 - 2014-12-18 15:26 - 00080248 _____ () C:\Program Files (x86)\HTC\HTC Sync Manager\ninstallerhelper.dll

2014-12-18 15:29 - 2014-12-18 15:29 - 00129376 _____ () C:\Program Files (x86)\HTC\HTC Sync Manager\zlib1.dll

2014-12-18 15:31 - 2014-12-18 15:31 - 00223592 _____ () C:\Program Files (x86)\HTC\HTC Sync Manager\DevConnMon.dll

2015-07-31 12:02 - 2015-07-24 05:22 - 00011920 _____ () C:\Program Files (x86)\NVIDIA Corporation\Update Core\detoured.dll

2015-10-05 18:04 - 2015-10-05 18:04 - 00153768 _____ () C:\Program Files (x86)\Mozilla Thunderbird\NSLDAP32V60.dll

2015-10-05 18:04 - 2015-10-05 18:04 - 00023208 _____ () C:\Program Files (x86)\Mozilla Thunderbird\NSLDAPPR32V60.dll

2015-10-01 11:52 - 2015-10-01 11:52 - 59639416 _____ () C:\Program Files (x86)\Opera\32.0.1948.69\opera.dll

2015-10-01 11:52 - 2015-10-01 11:52 - 01881208 _____ () C:\Program Files (x86)\Opera\32.0.1948.69\libglesv2.dll

2015-10-01 11:52 - 2015-10-01 11:52 - 00081528 _____ () C:\Program Files (x86)\Opera\32.0.1948.69\libegl.dll

 

==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========

 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)

 

AlternateDataStreams: C:\ProgramData\Temp:9A870F8B

 

==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================

 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)

 

 

==================== EXE Verknüpfungen (Nicht auf der Ausnahmeliste) ===============

 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)

 

 

==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============

 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)

 

IE restricted site: HKU\S-1-5-21-2138198700-1450621571-450520247-1000\...\skype.com -> hxxps://apps.skype.com

 

==================== Andere Bereiche ============================

 

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

 

HKU\S-1-5-21-2138198700-1450621571-450520247-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\S\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg

DNS Servers: 80.69.100.174 - 209.244.0.4

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 0) (ConsentPromptBehaviorUser: 3) (EnableLUA: 0)

Windows Firewall ist aktiviert.

 

==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==

 

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

 

MSCONFIG\startupreg: Dropbox Update => "C:\Users\S\AppData\Local\Dropbox\Update\DropboxUpdate.exe" /c

MSCONFIG\startupreg: KiesPDLR.exe => C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe Run

MSCONFIG\startupreg: KiesPreload => C:\Program Files (x86)\Samsung\Kies\Kies.exe /preload

MSCONFIG\startupreg: KiesTrayAgent => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe

MSCONFIG\startupreg: ShadowPlay => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart

 

==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============

 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

 

FirewallRules: [{57108740-248B-425B-BE65-E2FEC48733F8}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe

FirewallRules: [TCP Query User{5E8242CD-3364-4241-983A-0AB26E63855A}C:\program files (x86)\myphoneexplorer\myphoneexplorer.exe] => (Allow) C:\program files (x86)\myphoneexplorer\myphoneexplorer.exe

FirewallRules: [UDP Query User{AF95D21B-5539-4D1C-AA0B-4DA890D29C38}C:\program files (x86)\myphoneexplorer\myphoneexplorer.exe] => (Allow) C:\program files (x86)\myphoneexplorer\myphoneexplorer.exe

FirewallRules: [{57E4B3E9-CAE9-47D4-9EC2-7136DC97AA8F}] => (Allow) C:\Users\S\AppData\Roaming\Dropbox\bin\Dropbox.exe

FirewallRules: [{E2C1D1D2-D99C-4D90-9DD5-B433CBBC4F76}] => (Allow) C:\Users\S\AppData\Roaming\Dropbox\bin\Dropbox.exe

FirewallRules: [{5F6E4B2E-C7A9-4F85-A163-D01DB92FB656}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe

FirewallRules: [{9828F2EB-0896-4A9C-BBBC-9E64A6E59618}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe

FirewallRules: [{967D8855-E73E-4BE5-814C-AF1FECEFA997}] => (Allow) C:\Program Files (x86)\Sony Mobile\Update Engine\Sony Mobile Update Engine.exe

FirewallRules: [{363C0041-94AF-48A7-ABB5-B2C975566FF2}] => (Allow) C:\Program Files (x86)\Sony Mobile\Update Engine\Sony Mobile Update Engine.exe

FirewallRules: [{DA548BA8-A8BB-4090-8026-DA976C4EE352}] => (Allow) C:\Users\S\AppData\Local\Vivaldi\Application\vivaldi.exe

FirewallRules: [{21FCDBB9-6F02-4BE1-9020-F2E6570DCE9F}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

FirewallRules: [{5A15F6FB-943A-44EA-9A4F-E070A2CE95C6}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

FirewallRules: [{89E3FB7F-1CBB-48EC-A098-C6FB7478B7F5}] => (Allow) C:\Program Files (x86)\HTC\HTC Sync Manager\HTCSyncManager.exe

FirewallRules: [{4D5887DA-19E3-445C-850D-EFE8C31287CD}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe

FirewallRules: [{D51478CE-9EA8-40A9-944A-C4DE8310494F}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe

FirewallRules: [{4F1C53A5-7D1A-4186-96A0-F939EDF930FA}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe

FirewallRules: [{ED4CE5DB-1006-4D02-9B01-5FF13C4FC1B1}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe

FirewallRules: [{A94EC45D-9388-42E6-B9E6-45C0AB18B03D}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe

FirewallRules: [{00D5F78F-6178-48FA-9344-F3CC5921EF7B}] => (Allow) C:\Program Files (x86)\PremierOpinion\pmropn.exe

FirewallRules: [{0A314FCB-D2F4-4DA1-AE32-B7C9FE5620DD}] => (Allow) C:\Program Files (x86)\PremierOpinion\pmropn.exe

 

==================== Fehlerhafte Geräte im Gerätemanager =============

 

 

==================== Fehlereinträge in der Ereignisanzeige: =========================

 

Applikationsfehler:

==================

Error: (10/28/2015 02:48:21 PM) (Source: VSS) (EventID: 8194) (User: )

Description: Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface.  hr = 0x80070005, Access is denied.

.

This is often caused by incorrect security settings in either the writer or requestor process.

 

 

Operation:

   Gathering Writer Data

 

Context:

   Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}

   Writer Name: System Writer

   Writer Instance ID: {321023c4-a565-40e3-b97b-bae9611d7623}

 

Error: (10/28/2015 02:45:01 PM) (Source: System Restore) (EventID: 8193) (User: )

Description: Failed to create restore point (Process = c:\Program Files\Microsoft Security Client\MsMpEng.exe Files\Microsoft Security Client\MsMpEng.exe"; Description = Microsoft Antimalware Checkpoint; Error = 0x81000101).

 

Error: (10/28/2015 02:35:01 PM) (Source: System Restore) (EventID: 8193) (User: )

Description: Failed to create restore point (Process = C:\Windows\system32\svchost.exe -k netsvcs; Description = Windows Update; Error = 0x81000101).

 

Error: (10/25/2015 07:58:56 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: plugin-container.exe, version: 41.0.2.5765, time stamp: 0x561ef9f1

Faulting module name: mozglue.dll, version: 41.0.2.5765, time stamp: 0x561ee53f

Exception code: 0x80000003

Fault offset: 0x0000ec91

Faulting process id: 0x1848

Faulting application start time: 0xplugin-container.exe0

Faulting application path: plugin-container.exe1

Faulting module path: plugin-container.exe2

Report Id: plugin-container.exe3

 

Error: (10/25/2015 07:58:55 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: plugin-container.exe, version: 41.0.2.5765, time stamp: 0x561ef9f1

Faulting module name: mozglue.dll, version: 41.0.2.5765, time stamp: 0x561ee53f

Exception code: 0x80000003

Fault offset: 0x0000ec91

Faulting process id: 0x1610

Faulting application start time: 0xplugin-container.exe0

Faulting application path: plugin-container.exe1

Faulting module path: plugin-container.exe2

Report Id: plugin-container.exe3

 

Error: (10/25/2015 07:58:52 PM) (Source: Application Hang) (EventID: 1002) (User: )

Description: The program firefox.exe version 41.0.2.5765 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

 

Process ID: 14c4

 

Start Time: 01d10f0db29a8c98

 

Termination Time: 667

 

Application Path: C:\Program Files (x86)\Mozilla Firefox\firefox.exe

 

Report Id: 6c401fdb-7b4a-11e5-b220-1c6f6597f9c2

 

Error: (10/25/2015 07:58:52 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: plugin-container.exe, version: 41.0.2.5765, time stamp: 0x561ef9f1

Faulting module name: mozglue.dll, version: 41.0.2.5765, time stamp: 0x561ee53f

Exception code: 0x80000003

Fault offset: 0x0000ec91

Faulting process id: 0x19ec

Faulting application start time: 0xplugin-container.exe0

Faulting application path: plugin-container.exe1

Faulting module path: plugin-container.exe2

Report Id: plugin-container.exe3

 

Error: (10/24/2015 01:48:14 PM) (Source: Windows Backup) (EventID: 4104) (User: )

Description: The backup was not successful. The error is: The backup location cannot be accessed. Review your backup settings and check your backup location. (0x81000002).

 

Error: (10/23/2015 09:48:15 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: plugin-container.exe, version: 41.0.2.5765, time stamp: 0x561ef9f1

Faulting module name: mozglue.dll, version: 41.0.2.5765, time stamp: 0x561ee53f

Exception code: 0x80000003

Fault offset: 0x0000ec91

Faulting process id: 0x1a48

Faulting application start time: 0xplugin-container.exe0

Faulting application path: plugin-container.exe1

Faulting module path: plugin-container.exe2

Report Id: plugin-container.exe3

 

Error: (10/23/2015 09:48:10 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: plugin-container.exe, version: 41.0.2.5765, time stamp: 0x561ef9f1

Faulting module name: mozglue.dll, version: 41.0.2.5765, time stamp: 0x561ee53f

Exception code: 0x80000003

Fault offset: 0x0000ec91

Faulting process id: 0x57c

Faulting application start time: 0xplugin-container.exe0

Faulting application path: plugin-container.exe1

Faulting module path: plugin-container.exe2

Report Id: plugin-container.exe3

 

 

Systemfehler:

=============

Error: (10/28/2015 02:48:31 PM) (Source: Disk) (EventID: 7) (User: )

Description: The device, \Device\Harddisk5\DR5, has a bad block.

 

Error: (10/28/2015 02:48:28 PM) (Source: Disk) (EventID: 7) (User: )

Description: The device, \Device\Harddisk5\DR5, has a bad block.

 

Error: (10/28/2015 02:48:24 PM) (Source: Disk) (EventID: 7) (User: )

Description: The device, \Device\Harddisk5\DR5, has a bad block.

 

Error: (10/28/2015 02:48:21 PM) (Source: Disk) (EventID: 7) (User: )

Description: The device, \Device\Harddisk5\DR5, has a bad block.

 

Error: (10/28/2015 02:48:17 PM) (Source: Disk) (EventID: 7) (User: )

Description: The device, \Device\Harddisk5\DR5, has a bad block.

 

Error: (10/28/2015 02:48:14 PM) (Source: Disk) (EventID: 7) (User: )

Description: The device, \Device\Harddisk5\DR5, has a bad block.

 

Error: (10/28/2015 02:48:07 PM) (Source: Disk) (EventID: 7) (User: )

Description: The device, \Device\Harddisk5\DR5, has a bad block.

 

Error: (10/28/2015 02:48:02 PM) (Source: Disk) (EventID: 7) (User: )

Description: The device, \Device\Harddisk5\DR5, has a bad block.

 

Error: (10/28/2015 02:47:58 PM) (Source: Disk) (EventID: 7) (User: )

Description: The device, \Device\Harddisk5\DR5, has a bad block.

 

Error: (10/28/2015 02:47:55 PM) (Source: Disk) (EventID: 7) (User: )

Description: The device, \Device\Harddisk5\DR5, has a bad block.

 

 

==================== Speicherinformationen =========================== 

 

Prozessor: Intel® Core™ i7 CPU 950 @ 3.07GHz

Prozentuale Nutzung des RAM: 41%

Installierter physikalischer RAM: 12286.43 MB

Verfügbarer physikalischer RAM: 7186.8 MB

Summe virtueller Speicher: 24571.07 MB

Verfügbarer virtueller Speicher: 17860.28 MB

 

==================== Laufwerke ================================

 

Drive c: () (Fixed) (Total:931.41 GB) (Free:205.77 GB) NTFS

Drive d: (Dats) (Fixed) (Total:931.51 GB) (Free:391.2 GB) NTFS

Drive e: (System) (Fixed) (Total:100 GB) (Free:64.8 GB) NTFS

Drive f: (Backup) (Fixed) (Total:200 GB) (Free:58.86 GB) NTFS

Drive g: (Movs) (Fixed) (Total:400 GB) (Free:8.92 GB) NTFS

Drive h: (Data) (Fixed) (Total:231.51 GB) (Free:195.5 GB) NTFS

Drive p: (WD_ExternalDrive) (Fixed) (Total:930.86 GB) (Free:109.38 GB) NTFS

 

==================== MBR & Partitionstabelle ==================

 

========================================================

Disk: 0 (MBR Code: Windows XP) (Size: 931.5 GB) (Disk ID: F986BE2F)

Partition 1: (Active) - (Size=100 GB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=831.5 GB) - (Type=OF Extended)

 

========================================================

Disk: 1 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: E4FF57A0)

Partition 1: (Not Active) - (Size=931.5 GB) - (Type=07 NTFS)

 

========================================================

Disk: 2 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 2E88F628)

Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=931.4 GB) - (Type=07 NTFS)

 

========================================================

Disk: 4 (MBR Code: Windows XP) (Size: 930.9 GB) (Disk ID: 0002AE3F)

Partition 1: (Not Active) - (Size=930.9 GB) - (Type=07 NTFS)

 

========================================================

Disk: 5 (MBR Code: Windows XP) (Size: 931.5 GB) (Disk ID: 0006281B)

Partition 1: (Not Active) - (Size=931.5 GB) - (Type=07 NTFS)

 

==================== Ende von Addition.txt ============================

Attached Files

•  Addition_28-10-2015_15-03-26.txt   40.45KB   302 downloads
•  FRST_28-10-2015_15-03-26.txt   60KB   226 downloads

[RKinner]

Are you currently in Germany?

 

 

Download : ADWCleaner to your desktop.  Make sure you get the correct Download button.  Sometimes the ads on BleepingComputer will mimic the real Download button which should say: Download Now @BleepingComputer

 

NOTE: If using Internet Explorer and you get an alert that stops the program downloading, click on the warning and allow the download to complete.

 

Close  all programs, pause your anti-virus and run AdwCleaner (Vista or Win 7 => right click and Run As Administrator).

 

 

Click on Scan  and follow the prompts. Let it run unhindered. When done, click on the Clean button, and follow the prompts. Allow the system to reboot. You will then be presented with the report. Copy & Paste this report on your next reply.

 

The report will be saved in the C:\AdwCleaner folder.

 

 

Download the attached fixlist.txt to the same location as FRST

Run FRST and press Fix

A fix log will be generated please post that.  Run FRST again, check the Additions box and then Scan.  You will get two logs.  Post them both.

 

[LaszloV]

 

Are you currently in Germany?

 

Yes, I am.

 

 

Here's the report.

 

# AdwCleaner v5.015 - Logfile created 31/10/2015 at 23:04:07
# Updated 26/10/2015 by Xplode
# Database : 2015-10-29.1 [Server]
# Operating system : Windows 7 Ultimate Service Pack 1 (x64)
# Username : S - ELLI
# Running from : C:\Setup\Internet\Spy\adwcleaner_5.015.exe
# Option : Cleaning
# Support : http://toolslib.net/forum

***** [ Services ] *****


***** [ Folders ] *****

[-] Folder Deleted : C:\Program Files (x86)\DeviceVM
[-] Folder Deleted : C:\ProgramData\SecTaskMan
[-] Folder Deleted : C:\ProgramData\Trymedia
[-] Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\myfree codec
[-] Folder Deleted : C:\Users\S\AppData\Roaming\DriverCure
[-] Folder Deleted : C:\Users\S\Documents\Updater

***** [ Files ] *****

[-] File Deleted : C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\6yr7px34.default-1409311452730\foxydeal.sqlite
[-] File Deleted : C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\6yr7px34.default-1409311452730\user.js

***** [ DLLs ] *****


***** [ Shortcuts ] *****


***** [ Scheduled tasks ] *****


***** [ Registry ] *****

[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}
[-] Key Deleted : HKCU\Software\Classes\CLSID\{A2DF06F9-A21A-44A8-8A99-8B9C84F29160}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{11549FE4-7C5A-4C17-9FC3-56FC5162A994}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
[-] Key Deleted : HKCU\Software\Headlight
[-] Key Deleted : HKCU\Software\Myfree Codec
[-] Key Deleted : HKCU\Software\DAILYPCCLEAN
[-] Key Deleted : HKLM\SOFTWARE\InstallIQ
[-] Key Deleted : HKLM\SOFTWARE\Myfree Codec
[-] Key Deleted : HKLM\SOFTWARE\Trymedia Systems
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\MyFreeCodec
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7ADF667E-E14D-4D2C-827C-B0108F0D93BC}
[!] Key Not Deleted : [x64] HKCU\Software\Headlight
[!] Key Not Deleted : [x64] HKCU\Software\Myfree Codec
[!] Key Not Deleted : [x64] HKCU\Software\DAILYPCCLEAN

***** [ Web browsers ] *****

[x] [C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\6yr7px34.default-1409311452730\prefs.js] [Preference] Not Deleted : user_pref("browser.search.hiddenOneOffs", "Google,Yahoo,Bing,Amazon.com,Wikipedia (en),DuckDuckGo,WolframAlpha,vi-view");
[x] [C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\6yr7px34.default-1409311452730\prefs.js] [Preference] Not Deleted : user_pref("extensions.aniweather.timeShifted", 380951);
[x] [C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\6yr7px34.default-1409311452730\prefs.js] [Preference] Not Deleted : user_pref("extensions.quick_start.enable_search1", false);
[x] [C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\6yr7px34.default-1409311452730\prefs.js] [Preference] Not Deleted : user_pref("extensions.quick_start.sd.closeWindowWithLastTab_prev_state", false);

*************************

:: Winsock settings cleared

########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [3501 bytes] ##########
 

 

 

Something strange happened earlier. I tried starting Malwarebytes and since it didn't, simply left it. After an hour or so, it suddenly came up and worked like normal. No clue what is going on there.

 

Thanks for your help.

[RKinner]

Fix log and new FRSTscans?

[LaszloV]

Sorry, I thought that was all you could do.

 

Here's the log in German, why the system is identified as being German is unclear to me.

Thanks for your help, which is greatly appreciated.

 

Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:04-11-2015
durchgeführt von S (Administrator) auf E (05-11-2015 11:34:26)
Gestartet von C:\Program Files (x86)\Malwarebytes Anti-Malware
Geladene Profile: S (Verfügbare Profile: S)
Platform: Windows 7 Ultimate Service Pack 1 (X64) Sprache: German (Germany)
Internet Explorer Version 11 (Standard-Browser: FF)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(Nero AG) C:\Program Files (x86)\HTC\HTC Sync Manager\HSMServiceEntry.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe
() C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Logitech, Inc.) C:\Program Files\Common Files\logishrd\KHAL3\KHALMNPR.exe
(NEC Electronics Corporation) C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
() C:\Program Files (x86)\HTC\HTC Sync Manager\HTC Sync\adb.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe
(Opera Software) C:\Program Files (x86)\Opera\33.0.1990.58\opera.exe
(Ghisler Software GmbH) D:\Tools\WinCommander\TOTALCMD64.EXE
(Opera Software) C:\Program Files (x86)\Opera\33.0.1990.58\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\33.0.1990.58\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\33.0.1990.58\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\33.0.1990.58\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\33.0.1990.58\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\33.0.1990.58\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\33.0.1990.58\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\33.0.1990.58\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\33.0.1990.58\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\33.0.1990.58\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\33.0.1990.58\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\33.0.1990.58\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\33.0.1990.58\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\33.0.1990.58\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\33.0.1990.58\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\33.0.1990.58\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\33.0.1990.58\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\33.0.1990.58\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\33.0.1990.58\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\33.0.1990.58\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\33.0.1990.58\opera.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\LogiAppBroker.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Nicht auf der Ausnahmeliste) ===========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [10135584 2010-03-26] (Realtek Semiconductor)
HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1337000 2015-04-30] (Microsoft Corporation)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2634896 2015-07-24] (NVIDIA Corporation)
HKLM\...\Run: [EvtMgr6] => C:\Program Files\Logitech\SetPointP\SetPoint.exe [3100440 2014-05-19] (Logitech, Inc.)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [106496 2009-11-20] (NEC Electronics Corporation)
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Panda Security <====== ACHTUNG
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
HKU\S-1-5-19\Control Panel\Desktop\\SCRNSAVE.EXE ->
HKU\S-1-5-20\Control Panel\Desktop\\SCRNSAVE.EXE ->
HKU\S-1-5-21-2138198700-1450621571-450520247-1000\...\Run: [ISUSPM Startup] => C:\Program Files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe [221184 2005-02-17] (InstallShield Software Corporation)
HKU\S-1-5-21-2138198700-1450621571-450520247-1000\...\MountPoints2: {75c091ef-c014-11e3-9a14-1c6f6597f9c2} - "L:\WD SmartWare.exe" autoplay=true
HKU\S-1-5-21-2138198700-1450621571-450520247-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\scrnsave.scr [11264 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-18\Control Panel\Desktop\\SCRNSAVE.EXE ->
ShellIconOverlayIdentifiers: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\S\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\S\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\S\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\S\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\S\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\S\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\S\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\S\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  Keine Datei
ShellIconOverlayIdentifiers-x32: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\S\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\S\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\S\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\S\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\S\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\S\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\S\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\S\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\S\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\S\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\S\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\S\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\S\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\S\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\S\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\S\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-10] (Dropbox, Inc.)
GroupPolicyScripts: Beschränkung <======= ACHTUNG
GroupPolicyScripts\User: Beschränkung <======= ACHTUNG

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)

Hosts: 104.28.28.125    www.councilofexmuslims.com
Tcpip\..\Interfaces\{71C14BA0-BB77-4AA3-A470-02D94D4A1DC3}: [NameServer] 80.69.100.174,209.244.0.4

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKU\S-1-5-21-2138198700-1450621571-450520247-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://howzit.msn.com/?ocid=iehp
SearchScopes: HKU\S-1-5-21-2138198700-1450621571-450520247-1000 -> DefaultScope {70B61DE9-6AEF-4BC7-9B4F-BBDDB725A687} URL = hxxps://startpage.com/do/search?query={searchTerms}&cat=web&pl=ie&language=english
SearchScopes: HKU\S-1-5-21-2138198700-1450621571-450520247-1000 -> {70B61DE9-6AEF-4BC7-9B4F-BBDDB725A687} URL = hxxps://startpage.com/do/search?query={searchTerms}&cat=web&pl=ie&language=english
BHO: Logitech SetPoint -> {AF949550-9094-4807-95EC-D1C317803333} -> C:\Program Files\Logitech\SetPointP\SetPointSmooth.dll [2014-05-19] (Logitech, Inc.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Logitech SetPoint -> {AF949550-9094-4807-95EC-D1C317803333} -> C:\Program Files\Logitech\SetPointP\32-bit\SetPointSmooth.dll [2014-05-19] (Logitech, Inc.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
Toolbar: HKLM - avast! WebRep - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  Keine Datei
Toolbar: HKU\S-1-5-21-2138198700-1450621571-450520247-1000 -> Kein Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  Keine Datei
IE Session Restore: HKU\S-1-5-21-2138198700-1450621571-450520247-1000 -> ist aktiviert.
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxps://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)

FireFox:
========
FF ProfilePath: C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\6yr7px34.default-1409311452730
FF DefaultSearchEngine: Startpage (SSL)
FF Session Restore: -> ist aktiviert.
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_19_0_0_226.dll [2015-10-19] ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_19_0_0_226.dll [2015-10-19] ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1213153.dll [2014-06-24] (Adobe Systems, Inc.)
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/pdf -> C:\Program Files (x86)\Foxit Software\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2015-07-10] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Software\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2015-07-10] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.xdp -> C:\Program Files (x86)\Foxit Software\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2015-07-10] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.xfdf -> C:\Program Files (x86)\Foxit Software\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2015-07-10] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2015-02-11] (Foxit Corporation)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll [2015-07-11] (Google, Inc.)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2015-08-17] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2015-08-17] (NVIDIA Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 -> C:\Program Files (x86)\VideoLAN\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> C:\Program Files (x86)\VideoLAN\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin HKU\S-1-5-21-2138198700-1450621571-450520247-1000: @Google.com/GoogleEarthPlugin -> C:\Users\S\AppData\Local\Google\Google Earth\plugin\npgeplugin.dll [2012-04-14] (Google)
FF Plugin HKU\S-1-5-21-2138198700-1450621571-450520247-1000: @talk.google.com/GoogleTalkPlugin -> C:\Users\S\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll [2014-06-06] (Google)
FF Plugin HKU\S-1-5-21-2138198700-1450621571-450520247-1000: @talk.google.com/O1DPlugin -> C:\Users\S\AppData\Roaming\Mozilla\plugins\npo1d.dll [2014-06-06] (Google)
FF Plugin HKU\S-1-5-21-2138198700-1450621571-450520247-1000: @tools.google.com/Google Update;version=3 -> C:\Users\S\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll [2014-05-07] (Google Inc.)
FF Plugin HKU\S-1-5-21-2138198700-1450621571-450520247-1000: @tools.google.com/Google Update;version=9 -> C:\Users\S\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll [2014-05-07] (Google Inc.)
FF Plugin HKU\S-1-5-21-2138198700-1450621571-450520247-1000: sony.com/MediaGoDetector -> C:\Program Files (x86)\Sony\Media Go\npMediaGoDetector.dll [2014-07-10] (Sony Network Entertainment International LLC)
FF Plugin ProgramFiles/Appdata: C:\Users\S\AppData\Roaming\mozilla\plugins\npgoogletalk.dll [2014-06-06] (Google)
FF Plugin ProgramFiles/Appdata: C:\Users\S\AppData\Roaming\mozilla\plugins\npo1d.dll [2014-06-06] (Google)
FF SearchPlugin: C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\6yr7px34.default-1409311452730\searchplugins\duckduckgo.xml [2014-11-22]
FF SearchPlugin: C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\6yr7px34.default-1409311452730\searchplugins\startpage-http.xml [2015-11-04]
FF SearchPlugin: C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\6yr7px34.default-1409311452730\searchplugins\startpage-ssl.xml [2014-08-29]
FF SearchPlugin: C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\6yr7px34.default-1409311452730\searchplugins\wolframalpha.xml [2014-11-22]
FF Extension: 20-20 3D Viewer - IKEA - C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\6yr7px34.default-1409311452730\Extensions\2020Pl[email protected] [2015-04-02] [ist nicht signiert]
FF Extension: Wörterbuch Deutsch (de-DE), Hunspell-unterstützt - C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\6yr7px34.default-1409311452730\Extensions\[email protected] [2015-10-29]
FF Extension: British English Dictionary (Updated) - C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\6yr7px34.default-1409311452730\Extensions\[email protected] [2015-04-04] [ist nicht signiert]
FF Extension: GMX MailCheck - C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\6yr7px34.default-1409311452730\Extensions\[email protected] [2015-11-03]
FF Extension: EPUBReader - C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\6yr7px34.default-1409311452730\Extensions\{5384767E-00D9-40E9-B72F-9CC39D655D6F} [2015-06-02]
FF Extension: Flash and Video Download - C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\6yr7px34.default-1409311452730\Extensions\{bee6eb20-01e0-ebd1-da83-080329fb9a3a} [2015-10-29]
FF Extension: Classic Theme Restorer - C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\6yr7px34.default-1409311452730\Extensions\[email protected] [2015-10-28]
FF Extension: ProxTube - Unblock YouTube - C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\6yr7px34.default-1409311452730\Extensions\[email protected] [2015-07-27]
FF Extension: English (GB) Language Pack - C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\6yr7px34.default-1409311452730\Extensions\langpack[email protected] [2015-10-07] [ist nicht signiert]
FF Extension: Status-4-Evar - C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\6yr7px34.default-1409311452730\Extensions\[email protected] [2015-06-02]
FF Extension: Unhide Passwords - C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\6yr7px34.default-1409311452730\Extensions\{2e17e2b2-b8d4-4a67-8d7b-fafa6cc9d1d0}.xpi [2015-06-02]
FF Extension: X-notifier - C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\6yr7px34.default-1409311452730\Extensions\{37fa1426-b82d-11db-8314-0800200c9a66}.xpi [2015-10-28]
FF Extension: AniWeather - C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\6yr7px34.default-1409311452730\Extensions\{4176DFF4-4698-11DE-BEEB-45DA55D89593}.xpi [2015-06-02]
FF Extension: Show MyIP - C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\6yr7px34.default-1409311452730\Extensions\{6D1D11DB-3C6C-4db8-96E4-20F4A1088AAC}.xpi [2015-06-02]
FF Extension: Downloads Window - C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\6yr7px34.default-1409311452730\Extensions\{a7213cf2-fa1e-4373-88ff-255d0abd3020}.xpi [2015-09-16]
FF Extension: Video DownloadHelper - C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\6yr7px34.default-1409311452730\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}.xpi [2015-10-30]
FF Extension: Adblock Plus - C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\6yr7px34.default-1409311452730\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-09-24]
FF HKLM-x32\...\Firefox\Extensions: [{F003DA68-8256-4b37-A6C4-350FA04494DF}] - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt
FF Extension: Logitech SetPoint - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt [2015-06-02] [ist nicht signiert]

Chrome:
=======
CHR HKLM-x32\...\Chrome\Extension: [ihenkjeihefokohmemphikjnjbmegdik] - "C:\Program Files (x86)\Sony\Media Go\MediaGoDetector.crx" <nicht gefunden>

Opera:
=======
OPR Session Restore: -> ist aktiviert.
OPR Extension: (PDF Viewer) - C:\Users\S\AppData\Roaming\Opera Software\Opera Stable\Extensions\encfpfilknmenlmjemepncnlbbjlabkc [2014-08-28]
OPR Extension: (Show passwords) - C:\Users\S\AppData\Roaming\Opera Software\Opera Stable\Extensions\hdlmkpaimhmficecljbcodelmcjbnmck [2014-08-02]
OPR Extension: (Download YouTube Videos as MP4) - C:\Users\S\AppData\Roaming\Opera Software\Opera Stable\Extensions\maeombkgfpjdnjkhohbjachnnmpbipol [2015-08-07]
OPR Extension: (FVD Video Downloader) - C:\Users\S\AppData\Roaming\Opera Software\Opera Stable\Extensions\neacgcjokggofibnbfapeaejhclmpple [2015-08-19]
OPR Extension: (Adblock Plus) - C:\Users\S\AppData\Roaming\Opera Software\Opera Stable\Extensions\oidhhegpmlfpoeialbgcdocjalghfpkp [2015-09-24]

==================== Dienste (Nicht auf der Ausnahmeliste) ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [172344 2014-12-05] (SUPERAntiSpyware.com)
S3 Adobe LM Service; C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [72704 2014-05-05] (Adobe Systems) [Datei ist nicht signiert]
S3 AppleChargerSrv; C:\Windows\System32\AppleChargerSrv.exe [31272 2010-04-06] ()
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1155216 2015-07-24] (NVIDIA Corporation)
R2 HTCMonitorService; C:\Program Files (x86)\HTC\HTC Sync Manager\HSMServiceEntry.exe [87368 2014-06-27] (Nero AG)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-03] (Macrovision Corporation) [Datei ist nicht signiert]
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1135416 2015-10-05] (Malwarebytes)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23816 2015-04-30] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [366544 2015-04-30] (Microsoft Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1871504 2015-07-24] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe [5544592 2015-07-24] (NVIDIA Corporation)
R2 PassThru Service; C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [166912 2013-10-17] () [Datei ist nicht signiert]
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [390672 2012-12-25] ()
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S2 DES2 Service; "C:\Program Files (x86)\GIGABYTE\EnergySaver2\des2svr.exe" [X]
S2 FoxitCloudUpdateService; "C:\Program Files (x86)\Foxit Reader\Foxit Cloud\FCUpdateService.exe" [X]

===================== Treiber (Nicht auf der Ausnahmeliste) ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

R1 AppleCharger; C:\Windows\System32\DRIVERS\AppleCharger.sys [21544 2010-04-22] ()
S3 ebdrv; C:\Windows\system32\DRIVERS\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
S3 ggsomc; C:\Windows\System32\DRIVERS\ggsomc.sys [30424 2014-11-17] (Sony Mobile Communications)
S3 GVTDrv64; C:\Windows\GVTDrv64.sys [30528 2014-04-09] ()
S3 mbamchameleon; C:\Windows\system32\drivers\mbamchameleon.sys [109272 2015-10-28] (Malwarebytes)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-10-05] (Malwarebytes)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-10-05] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [280376 2015-03-04] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [124568 2015-03-04] (Microsoft Corporation)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19600 2015-07-24] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [47976 2015-07-03] (NVIDIA Corporation)
R3 PciPPorts; C:\Windows\System32\DRIVERS\PciPPorts.sys [96768 2009-07-23] ()
R3 PciSPorts; C:\Windows\System32\DRIVERS\PciSPorts.sys [122880 2008-12-19] ()
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
S3 ALSysIO; \??\C:\Users\S\AppData\Local\Temp\ALSysIO64.sys [X]
S3 dgderdrv; System32\drivers\dgderdrv.sys [X]
S3 SANDRA; \??\C:\Program Files\Sandra Lite\WNt500x64\Sandra.sys [X]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Ein Monat: Erstellte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2015-10-31 22:59 - 2015-10-31 23:04 - 00000000 ____D C:\AdwCleaner
2015-10-31 16:18 - 2015-10-31 16:18 - 00000000 ____D C:\Users\S\AppData\LocalLow\Temp
2015-10-30 19:27 - 2015-10-31 16:26 - 00000000 ____D C:\Users\S\Desktop\Nici neu
2015-10-29 00:44 - 2015-11-01 00:52 - 00000892 _____ C:\Windows\Tasks\Adobe Flash Player PPAPI Notifier.job
2015-10-29 00:44 - 2015-10-29 00:44 - 00003878 _____ C:\Windows\System32\Tasks\Adobe Flash Player PPAPI Notifier
2015-10-28 14:45 - 2015-11-05 11:34 - 00000000 ____D C:\FRST
2015-10-17 14:46 - 2015-10-23 20:54 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-10-14 11:56 - 2015-09-29 04:16 - 05569472 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-10-14 11:56 - 2015-09-29 04:13 - 01730496 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-10-14 11:56 - 2015-09-29 04:11 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-10-14 11:56 - 2015-09-29 04:11 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-10-14 11:56 - 2015-09-29 04:11 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-10-14 11:56 - 2015-09-29 04:11 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-10-14 11:56 - 2015-09-29 04:11 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-10-14 11:56 - 2015-09-29 04:11 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-10-14 11:56 - 2015-09-29 04:11 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-10-14 11:56 - 2015-09-29 04:11 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-10-14 11:56 - 2015-09-29 04:10 - 01216512 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2015-10-14 11:56 - 2015-09-29 04:10 - 01164800 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-10-14 11:56 - 2015-09-29 04:10 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-10-14 11:56 - 2015-09-29 04:10 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-10-14 11:56 - 2015-09-29 04:10 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-10-14 11:56 - 2015-09-29 04:10 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-10-14 11:56 - 2015-09-29 04:10 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-10-14 11:56 - 2015-09-29 04:10 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2015-10-14 11:56 - 2015-09-29 04:10 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-10-14 11:56 - 2015-09-29 04:10 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-10-14 11:56 - 2015-09-29 04:10 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-10-14 11:56 - 2015-09-29 04:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-10-14 11:56 - 2015-09-29 04:09 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-10-14 11:56 - 2015-09-29 04:05 - 03990976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-10-14 11:56 - 2015-09-29 04:05 - 03936192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-10-14 11:56 - 2015-09-29 04:05 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-10-14 11:56 - 2015-09-29 04:05 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-10-14 11:56 - 2015-09-29 04:02 - 01311768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-10-14 11:56 - 2015-09-29 04:01 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-10-14 11:56 - 2015-09-29 04:01 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-10-14 11:56 - 2015-09-29 04:01 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-10-14 11:56 - 2015-09-29 04:01 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-10-14 11:56 - 2015-09-29 04:01 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-10-14 11:56 - 2015-09-29 04:01 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-10-14 11:56 - 2015-09-29 04:01 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-10-14 11:56 - 2015-09-29 04:01 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-10-14 11:56 - 2015-09-29 04:01 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-10-14 11:56 - 2015-09-29 04:01 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-10-14 11:56 - 2015-09-29 04:01 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-10-14 11:56 - 2015-09-29 04:01 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-10-14 11:56 - 2015-09-29 04:01 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-10-14 11:56 - 2015-09-29 04:01 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-10-14 11:56 - 2015-09-29 04:01 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-10-14 11:56 - 2015-09-29 04:01 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-10-14 11:56 - 2015-09-29 04:01 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-10-14 11:56 - 2015-09-29 04:01 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-10-14 11:56 - 2015-09-29 04:01 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-10-14 11:56 - 2015-09-29 04:01 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-10-14 11:56 - 2015-09-29 04:01 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-10-14 11:56 - 2015-09-29 04:01 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-10-14 11:56 - 2015-09-29 04:01 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-10-14 11:56 - 2015-09-29 04:01 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-10-14 11:56 - 2015-09-29 04:01 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-10-14 11:56 - 2015-09-29 04:01 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-10-14 11:56 - 2015-09-29 04:01 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-10-14 11:56 - 2015-09-29 04:01 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-10-14 11:56 - 2015-09-29 04:01 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-10-14 11:56 - 2015-09-29 04:01 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-10-14 11:56 - 2015-09-29 03:59 - 00552960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-10-14 11:56 - 2015-09-29 03:59 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-10-14 11:56 - 2015-09-29 03:59 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-10-14 11:56 - 2015-09-29 03:59 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-10-14 11:56 - 2015-09-29 03:59 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-10-14 11:56 - 2015-09-29 03:59 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-10-14 11:56 - 2015-09-29 03:58 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-10-14 11:56 - 2015-09-29 03:58 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2015-10-14 11:56 - 2015-09-29 03:58 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-10-14 11:56 - 2015-09-29 03:58 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-10-14 11:56 - 2015-09-29 03:57 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-10-14 11:56 - 2015-09-29 03:57 - 00665088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2015-10-14 11:56 - 2015-09-29 03:57 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-10-14 11:56 - 2015-09-29 03:57 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-10-14 11:56 - 2015-09-29 03:53 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-10-14 11:56 - 2015-09-29 03:53 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-10-14 11:56 - 2015-09-29 03:49 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-10-14 11:56 - 2015-09-29 03:49 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-10-14 11:56 - 2015-09-29 03:49 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-10-14 11:56 - 2015-09-29 03:49 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-10-14 11:56 - 2015-09-29 03:49 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-10-14 11:56 - 2015-09-29 03:49 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-10-14 11:56 - 2015-09-29 03:49 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-10-14 11:56 - 2015-09-29 03:49 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-10-14 11:56 - 2015-09-29 03:49 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-10-14 11:56 - 2015-09-29 03:49 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-10-14 11:56 - 2015-09-29 03:49 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-10-14 11:56 - 2015-09-29 03:49 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-10-14 11:56 - 2015-09-29 03:49 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-10-14 11:56 - 2015-09-29 03:49 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-10-14 11:56 - 2015-09-29 03:49 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-10-14 11:56 - 2015-09-29 03:49 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-10-14 11:56 - 2015-09-29 03:49 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-10-14 11:56 - 2015-09-29 03:49 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-10-14 11:56 - 2015-09-29 03:49 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-10-14 11:56 - 2015-09-29 03:49 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-10-14 11:56 - 2015-09-29 03:49 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-10-14 11:56 - 2015-09-29 03:49 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-10-14 11:56 - 2015-09-29 03:49 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-10-14 11:56 - 2015-09-29 03:49 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-10-14 11:56 - 2015-09-29 03:49 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-10-14 11:56 - 2015-09-29 03:49 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-10-14 11:56 - 2015-09-29 02:50 - 00159232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2015-10-14 11:56 - 2015-09-29 02:49 - 00290816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2015-10-14 11:56 - 2015-09-29 02:49 - 00129024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2015-10-14 11:56 - 2015-09-29 02:43 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-10-14 11:56 - 2015-09-29 02:43 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-10-14 11:56 - 2015-09-29 02:40 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-10-14 11:56 - 2015-09-29 02:40 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-10-14 11:56 - 2015-09-29 02:40 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-10-14 11:56 - 2015-09-29 02:40 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-10-14 11:56 - 2015-09-18 20:31 - 00391784 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-10-14 11:56 - 2015-09-18 19:58 - 00345688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-10-14 11:56 - 2015-09-16 05:48 - 25851904 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-10-14 11:56 - 2015-09-16 05:36 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-10-14 11:56 - 2015-09-16 05:36 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-10-14 11:56 - 2015-09-16 05:22 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-10-14 11:56 - 2015-09-16 05:21 - 02886656 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-10-14 11:56 - 2015-09-16 05:21 - 00585728 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-10-14 11:56 - 2015-09-16 05:21 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-10-14 11:56 - 2015-09-16 05:21 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-10-14 11:56 - 2015-09-16 05:21 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-10-14 11:56 - 2015-09-16 05:14 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-10-14 11:56 - 2015-09-16 05:13 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-10-14 11:56 - 2015-09-16 05:10 - 00616960 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-10-14 11:56 - 2015-09-16 05:09 - 05990912 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-10-14 11:56 - 2015-09-16 05:08 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-10-14 11:56 - 2015-09-16 05:08 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-10-14 11:56 - 2015-09-16 05:08 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-10-14 11:56 - 2015-09-16 05:08 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-10-14 11:56 - 2015-09-16 05:01 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-10-14 11:56 - 2015-09-16 04:58 - 20357632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-10-14 11:56 - 2015-09-16 04:58 - 00489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-10-14 11:56 - 2015-09-16 04:50 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-10-14 11:56 - 2015-09-16 04:46 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-10-14 11:56 - 2015-09-16 04:45 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-10-14 11:56 - 2015-09-16 04:45 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-10-14 11:56 - 2015-09-16 04:43 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-10-14 11:56 - 2015-09-16 04:41 - 00152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2015-10-14 11:56 - 2015-09-16 04:33 - 00504832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-10-14 11:56 - 2015-09-16 04:33 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-10-14 11:56 - 2015-09-16 04:32 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-10-14 11:56 - 2015-09-16 04:32 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-10-14 11:56 - 2015-09-16 04:31 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2015-10-14 11:56 - 2015-09-16 04:31 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-10-14 11:56 - 2015-09-16 04:29 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-10-14 11:56 - 2015-09-16 04:29 - 00720896 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-10-14 11:56 - 2015-09-16 04:28 - 02279936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-10-14 11:56 - 2015-09-16 04:28 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-10-14 11:56 - 2015-09-16 04:26 - 02126336 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-10-14 11:56 - 2015-09-16 04:26 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-10-14 11:56 - 2015-09-16 04:26 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-10-14 11:56 - 2015-09-16 04:24 - 00480256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-10-14 11:56 - 2015-09-16 04:23 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-10-14 11:56 - 2015-09-16 04:22 - 14458368 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-10-14 11:56 - 2015-09-16 04:22 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-10-14 11:56 - 2015-09-16 04:22 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-10-14 11:56 - 2015-09-16 04:15 - 00416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-10-14 11:56 - 2015-09-16 04:11 - 02487808 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-10-14 11:56 - 2015-09-16 04:10 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-10-14 11:56 - 2015-09-16 04:07 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-10-14 11:56 - 2015-09-16 04:06 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-10-14 11:56 - 2015-09-16 04:05 - 04527616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-10-14 11:56 - 2015-09-16 04:05 - 00279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-10-14 11:56 - 2015-09-16 04:04 - 00130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2015-10-14 11:56 - 2015-09-16 03:59 - 01546752 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-10-14 11:56 - 2015-09-16 03:58 - 12853760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-10-14 11:56 - 2015-09-16 03:58 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2015-10-14 11:56 - 2015-09-16 03:56 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-10-14 11:56 - 2015-09-16 03:55 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-10-14 11:56 - 2015-09-16 03:55 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-10-14 11:56 - 2015-09-16 03:48 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-10-14 11:56 - 2015-09-16 03:37 - 02011136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-10-14 11:56 - 2015-09-16 03:34 - 01311232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-10-14 11:56 - 2015-09-16 03:32 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-10-14 11:56 - 2015-09-15 19:17 - 00157016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-10-14 11:56 - 2015-09-15 19:17 - 00097112 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-10-14 11:56 - 2015-09-15 19:11 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-10-14 11:56 - 2015-09-15 19:11 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-10-14 11:56 - 2015-09-15 19:11 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-10-14 11:56 - 2015-09-15 19:11 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-10-14 11:56 - 2015-09-15 19:11 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-10-14 11:56 - 2015-09-15 19:11 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-10-14 11:56 - 2015-09-15 19:10 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-10-14 11:56 - 2015-09-15 18:36 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-10-14 11:56 - 2015-09-15 18:36 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-10-14 11:56 - 2015-09-15 18:36 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-10-14 11:56 - 2015-09-15 18:35 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-10-14 11:55 - 2015-08-06 19:04 - 14176768 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2015-10-14 11:55 - 2015-08-06 19:03 - 01866752 _____ (Microsoft Corporation) C:\Windows\system32\ExplorerFrame.dll
2015-10-14 11:55 - 2015-08-06 18:44 - 12875776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2015-10-14 11:55 - 2015-08-06 18:44 - 01498624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ExplorerFrame.dll
2015-10-14 11:55 - 2015-08-05 18:56 - 00022528 _____ (Microsoft Corporation) C:\Windows\system32\icaapi.dll
2015-10-14 11:55 - 2015-08-05 18:06 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2015-10-14 11:53 - 2015-10-01 19:06 - 00692672 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2015-10-14 11:53 - 2015-10-01 19:04 - 00616360 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2015-10-14 11:53 - 2015-10-01 19:00 - 00147456 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2015-10-14 11:53 - 2015-10-01 19:00 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2015-10-14 11:53 - 2015-10-01 19:00 - 00059392 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2015-10-14 11:53 - 2015-10-01 19:00 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2015-10-14 11:53 - 2015-10-01 19:00 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2015-10-14 11:53 - 2015-10-01 18:50 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2015-10-14 11:53 - 2015-10-01 18:00 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2015-10-13 20:58 - 2015-10-13 20:58 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Foxit PhantomPDF
2015-10-13 20:57 - 2015-10-13 20:57 - 00000000 ____D C:\Program Files (x86)\Foxit Software
2015-10-13 20:12 - 2015-10-13 20:58 - 00000000 ____D C:\Users\Public\Foxit Software
2015-10-13 20:12 - 2015-10-13 20:12 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Foxit Reader
2015-10-09 15:45 - 2015-10-30 21:05 - 00005632 _____ C:\Users\S\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2015-10-08 13:09 - 2015-10-30 20:06 - 00006974 _____ C:\Windows\PFRO.log

==================== Ein Monat: Geänderte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2015-11-05 11:34 - 2014-05-26 22:26 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-11-05 11:23 - 2009-07-14 05:45 - 00014624 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-11-05 11:23 - 2009-07-14 05:45 - 00014624 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-11-05 11:10 - 2015-09-22 11:38 - 00009745 _____ C:\Windows\setupact.log
2015-11-05 11:09 - 2015-03-09 22:50 - 00000000 ____D C:\Users\S\AppData\Local\HTC MediaHub
2015-11-05 11:08 - 2014-04-09 23:34 - 00000000 ____D C:\ProgramData\NVIDIA
2015-11-05 11:08 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-11-05 01:03 - 2014-04-09 11:02 - 01664626 _____ C:\Windows\WindowsUpdate.log
2015-11-05 00:36 - 2014-04-09 20:13 - 00000000 ____D C:\Users\S\AppData\Roaming\Skype
2015-11-04 23:49 - 2015-01-18 00:22 - 00000000 ____D C:\Users\S\AppData\Roaming\vlc
2015-11-04 12:47 - 2014-08-06 09:28 - 00003822 _____ C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1397129152
2015-11-04 12:47 - 2014-04-10 12:25 - 00000000 ____D C:\Program Files (x86)\Opera
2015-11-04 00:05 - 2009-07-14 18:58 - 00704088 _____ C:\Windows\system32\perfh007.dat
2015-11-04 00:05 - 2009-07-14 18:58 - 00153804 _____ C:\Windows\system32\perfc007.dat
2015-11-04 00:05 - 2009-07-14 06:13 - 01627176 _____ C:\Windows\system32\PerfStringBackup.INI
2015-11-01 20:45 - 2015-06-21 11:15 - 00000000 ____D C:\Users\S\AppData\Roaming\OBS
2015-10-31 23:20 - 2014-05-26 22:26 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-10-31 18:50 - 2014-04-10 14:08 - 00000000 ____D C:\Program Files (x86)\Paint Shop Pro 7
2015-10-30 19:01 - 2014-04-09 20:12 - 00000000 ____D C:\ProgramData\Skype
2015-10-30 16:00 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\IME
2015-10-29 23:49 - 2014-04-10 15:25 - 00000000 ____D C:\Users\S\AppData\Roaming\HandBrake
2015-10-29 15:58 - 2014-04-09 11:15 - 00001413 _____ C:\Users\S\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-10-29 15:58 - 2009-07-14 05:57 - 00001547 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2015-10-29 00:44 - 2014-09-05 19:42 - 00000000 ____D C:\Users\S\AppData\Local\Adobe
2015-10-29 00:44 - 2014-04-09 21:46 - 00780488 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-10-29 00:44 - 2014-04-09 21:46 - 00142536 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-10-28 23:34 - 2014-10-27 22:11 - 00000000 ____D C:\Users\S\AppData\Roaming\Audacity
2015-10-28 22:13 - 2014-04-10 14:15 - 00000822 _____ C:\Users\Public\Desktop\CCleaner.lnk
2015-10-28 11:43 - 2014-05-26 22:26 - 00109272 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-10-28 11:24 - 2014-05-26 22:26 - 00001102 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-10-28 11:24 - 2014-05-26 22:26 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-10-28 11:13 - 2014-05-26 22:38 - 00000000 ____D C:\Program Files\SUPERAntiSpyware
2015-10-21 21:01 - 2014-04-10 14:46 - 00000000 ____D C:\ProgramData\SmartSound Software Inc
2015-10-19 09:58 - 2014-04-09 18:44 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-10-17 14:28 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2015-10-16 19:58 - 2014-04-09 21:41 - 00000000 ____D C:\Windows\system32\MRT
2015-10-16 19:57 - 2014-04-09 21:41 - 143481208 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-10-16 12:26 - 2014-04-09 20:31 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-10-15 19:19 - 2009-07-14 03:34 - 00000478 _____ C:\Windows\win.ini
2015-10-14 10:29 - 2014-04-09 21:03 - 00000000 ____D C:\Users\S\AppData\Roaming\MyPhoneExplorer
2015-10-13 20:58 - 2014-04-09 20:04 - 00000000 ____D C:\Users\S\AppData\Roaming\Foxit Software
2015-10-13 20:18 - 2014-06-04 10:56 - 00000000 ____D C:\ProgramData\Package Cache
2015-10-13 20:12 - 2014-04-09 20:04 - 00000000 ____D C:\Program Files (x86)\Foxit Reader
2015-10-06 14:28 - 2015-06-21 11:15 - 00000000 ____D C:\Program Files (x86)\OBS
2015-10-06 14:27 - 2015-10-05 18:04 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======

2015-10-09 15:45 - 2015-10-30 21:05 - 0005632 _____ () C:\Users\S\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-04-09 17:47 - 2014-06-14 21:28 - 0007661 _____ () C:\Users\S\AppData\Local\resmon.resmoncfg

Einige Dateien in TEMP:
====================
C:\Users\S\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap =================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

C:\Windows\system32\winlogon.exe => Datei ist digital signiert
C:\Windows\system32\wininit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\wininit.exe => Datei ist digital signiert
C:\Windows\explorer.exe => Datei ist digital signiert
C:\Windows\SysWOW64\explorer.exe => Datei ist digital signiert
C:\Windows\system32\svchost.exe => Datei ist digital signiert
C:\Windows\SysWOW64\svchost.exe => Datei ist digital signiert
C:\Windows\system32\services.exe => Datei ist digital signiert
C:\Windows\system32\User32.dll => Datei ist digital signiert
C:\Windows\SysWOW64\User32.dll => Datei ist digital signiert
C:\Windows\system32\userinit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\userinit.exe => Datei ist digital signiert
C:\Windows\system32\rpcss.dll => Datei ist digital signiert
C:\Windows\system32\dnsapi.dll => Datei ist digital signiert
C:\Windows\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert


LastRegBack: 2015-10-31 17:32

==================== Ende von FRST.txt ============================

[RKinner]

It doesn't appear that the FRST fix ran.  Can you try it again?  Download the attached fixlist.txt   to the same location as FRST

Run FRST and press Fix

A fix log will be generated please post that. 

 

Go into Control panel, Region and Language and check that you have English selected under each tab.  If you have told it that you might sometimes use German then you can try Left Alt + Shift which should switch between languages.

[LaszloV]

Thanks for the help.

 

Yes, all settings are English. I'll see if I can attach the screenshots.

 

I did another run and then clicked on a button which I thought might be "fix" and let it run.

 

I restarted and now have Firefox giving me all sorts of virus options which I should install in the form of updates for Java or Flash. Weird. I never got these before.

 

Here's the fixlog generated:

 

Entferungsergebnis von Farbar Recovery Scan Tool (x64) Version:07-11-2015
durchgeführt von S (2015-11-09 14:44:29) Run:1
Gestartet von C:\Program Files (x86)\Malwarebytes Anti-Malware\FRST-OlderVersion
Geladene Profile: S (Verfügbare Profile: S)
Start-Modus: Normal
==============================================

fixlist Inhalt:
*****************
HKLM-x32\...\Run: [gmsd_de_007010126] => C:\Program Files (x86)\gmsd_de_007010126\gmsd_de_007010126.exe [3971760 2015-10-25] ()
HKLM-x32\...\RunOnce: [upgmsd_de_007010126.exe] => C:\Users\S\AppData\Local\gmsd_de_007010126\upgmsd_de_007010126.exe [3308720 2015-10-25] ()
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Panda Security <====== ACHTUNG
HKU\S-1-5-19\Control Panel\Desktop\\SCRNSAVE.EXE ->
HKU\S-1-5-20\Control Panel\Desktop\\SCRNSAVE.EXE ->
GroupPolicyScripts: Beschränkung <======= ACHTUNG
GroupPolicyScripts\User: Beschränkung <======= ACHTUNG
SearchScopes: HKU\S-1-5-21-2138198700-1450621571-450520247-1000 -> DefaultScope {70B61DE9-6AEF-4BC7-9B4F-BBDDB725A687} URL = hxxps://startpage.com/do/search?query={searchTerms}&cat=web&pl=ie&language=english
SearchScopes: HKU\S-1-5-21-2138198700-1450621571-450520247-1000 -> {70B61DE9-6AEF-4BC7-9B4F-BBDDB725A687} URL = hxxps://startpage.com/do/search?query={searchTerms}&cat=web&pl=ie&language=english
Toolbar: HKLM - avast! WebRep - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  Keine Datei
Toolbar: HKU\S-1-5-21-2138198700-1450621571-450520247-1000 -> Kein Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  Keine Datei
FF SearchPlugin: C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\6yr7px34.default-1409311452730\searchplugins\startpage-http.xml [2015-10-28]
FF SearchPlugin: C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\6yr7px34.default-1409311452730\searchplugins\startpage-ssl.xml [2014-08-29]
FF SearchPlugin: C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\6yr7px34.default-1409311452730\searchplugins\wolframalpha.xml [2014-11-22]
FF Extension: 20-20 3D Viewer - IKEA - C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\6yr7px34.default-1409311452730\Extensions\2020Pl[email protected] [2015-04-02] [ist nicht signiert]
S2 DES2 Service; "C:\Program Files (x86)\GIGABYTE\EnergySaver2\des2svr.exe" [X]
S2 FoxitCloudUpdateService; "C:\Program Files (x86)\Foxit Reader\Foxit Cloud\FCUpdateService.exe" [X]
S3 dgderdrv; System32\drivers\dgderdrv.sys [X]
S3 SANDRA; \??\C:\Program Files\Sandra Lite\WNt500x64\Sandra.sys [X]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
2015-10-28 14:34 - 2015-10-28 14:38 - 00000000 ____D C:\Users\S\AppData\Local\gmsd_de_007010126
2015-10-28 14:34 - 2015-10-28 14:35 - 00000000 ____D C:\Program Files (x86)\gmsd_de_007010126
2015-10-28 14:32 - 2015-10-28 14:32 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PremierOpinion
2015-10-28 14:32 - 2015-10-28 14:32 - 00000000 ____D C:\Program Files (x86)\PremierOpinion
2015-10-28 14:32 - 2014-08-18 21:51 - 00971576 _____ (VoiceFive, Inc.) C:\Windows\system32\pmls64.dll
2015-10-28 14:32 - 2014-08-18 21:51 - 00660792 _____ (VoiceFive, Inc.) C:\Windows\SysWOW64\pmls.dll
Task: {02040130-986B-4EB3-A345-18A7A63C0895} - System32\Tasks\ParetoLogic Update Version3 Startup Task => C:\Program Files (x86)\Common Files\ParetoLogic\UUS3\Pareto_Update3.exe [2014-11-20] ()
Task: {3821BE18-3EF0-49EF-86D0-25BD443A5E3B} - System32\Tasks\ParetoLogic Registration3 => Rundll32.exe "C:\Program Files (x86)\Common Files\ParetoLogic\UUS3\UUS3.dll" RunUns
Task: {4035C73E-70B8-4C51-AFEB-231706D9A929} - System32\Tasks\ParetoLogic Update Version3 => C:\Program Files (x86)\Common Files\ParetoLogic\UUS3\Pareto_Update3.exe [2014-11-20] ()
Task: {9E6C773E-F005-44B6-BB1D-39AB12310F4F} - System32\Tasks\{AB7941C8-16AF-4A02-A414-90DA311ADB15} => pcalua.exe -a E:\jxpiinstall(1).exe -d E:\
Task: C:\Windows\Tasks\ParetoLogic Registration3.job => C:\Windows\system32\rundll32.exeGC:\Program Files (x86)\Common Files\ParetoLogic\UUS3\UUS3.dll
Task: C:\Windows\Tasks\ParetoLogic Update Version3 Startup Task.job => C:\Program Files (x86)\Common Files\ParetoLogic\UUS3\Pareto_Update3.exe
Task: C:\Windows\Tasks\ParetoLogic Update Version3.job => C:\Program Files (x86)\Common Files\ParetoLogic\UUS3\Pareto_Update3.exe
2015-10-28 14:35 - 2015-10-25 17:39 - 03308720 _____ () C:\Users\S\AppData\Local\gmsd_de_007010126\upgmsd_de_007010126.exe
2015-10-28 14:34 - 2015-10-25 17:39 - 03971760 _____ () C:\Program Files (x86)\gmsd_de_007010126\gmsd_de_007010126.exe
2015-10-28 14:38 - 2015-10-28 14:38 - 00707072 _____ () C:\Users\S\AppData\Local\Temp\is-2L3GA.tmp\myoffergroup_de.tmp
FirewallRules: [{00D5F78F-6178-48FA-9344-F3CC5921EF7B}] => (Allow) C:\Program Files (x86)\PremierOpinion\pmropn.exe
FirewallRules: [{0A314FCB-D2F4-4DA1-AE32-B7C9FE5620DD}] => (Allow) C:\Program Files (x86)\PremierOpinion\pmropn.exe





*****************

HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\gmsd_de_007010126 => Wert nicht gefunden.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\\upgmsd_de_007010126.exe => Wert nicht gefunden.
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Panda Security <====== ACHTUNG => erfolgreich wiederhergestellt
HKU\S-1-5-19\Control Panel\Desktop\\SCRNSAVE.EXE => Wert erfolgreich entfernt
HKU\S-1-5-20\Control Panel\Desktop\\SCRNSAVE.EXE => Wert erfolgreich entfernt
C:\Windows\system32\GroupPolicy\Machine => erfolgreich verschoben
C:\Windows\system32\GroupPolicy\GPT.ini => erfolgreich verschoben
C:\Windows\system32\GroupPolicy\User => erfolgreich verschoben
HKU\S-1-5-21-2138198700-1450621571-450520247-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Wert erfolgreich entfernt
"HKU\S-1-5-21-2138198700-1450621571-450520247-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{70B61DE9-6AEF-4BC7-9B4F-BBDDB725A687}" => Schlüssel erfolgreich entfernt
HKCR\CLSID\{70B61DE9-6AEF-4BC7-9B4F-BBDDB725A687} => Schlüssel nicht gefunden.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{318A227B-5E9F-45bd-8999-7F8F10CA4CF5} => Wert erfolgreich entfernt
"HKCR\CLSID\{318A227B-5E9F-45bd-8999-7F8F10CA4CF5}" => Schlüssel erfolgreich entfernt
HKU\S-1-5-21-2138198700-1450621571-450520247-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => Wert erfolgreich entfernt
HKCR\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => Schlüssel nicht gefunden.
"C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\6yr7px34.default-1409311452730\searchplugins\startpage-http.xml" => nicht gefunden.
"C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\6yr7px34.default-1409311452730\searchplugins\startpage-ssl.xml" => nicht gefunden.
"C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\6yr7px34.default-1409311452730\searchplugins\wolframalpha.xml" => nicht gefunden.
C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\6yr7px34.default-1409311452730\Extensions\[email protected] => nicht gefunden.
DES2 Service => Dienst erfolgreich entfernt
FoxitCloudUpdateService => Dienst erfolgreich entfernt
dgderdrv => Dienst erfolgreich entfernt
SANDRA => Dienst erfolgreich entfernt
Synth3dVsc => Dienst erfolgreich entfernt
tsusbhub => Dienst erfolgreich entfernt
VGPU => Dienst erfolgreich entfernt
"C:\Users\S\AppData\Local\gmsd_de_007010126" => nicht gefunden.
"C:\Program Files (x86)\gmsd_de_007010126" => nicht gefunden.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PremierOpinion => erfolgreich verschoben
C:\Program Files (x86)\PremierOpinion => erfolgreich verschoben
C:\Windows\system32\pmls64.dll => erfolgreich verschoben
C:\Windows\SysWOW64\pmls.dll => erfolgreich verschoben
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{02040130-986B-4EB3-A345-18A7A63C0895}" => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{02040130-986B-4EB3-A345-18A7A63C0895} => Schlüssel nicht gefunden.
C:\Windows\System32\Tasks\ParetoLogic Update Version3 Startup Task => nicht gefunden.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\ParetoLogic Update Version3 Startup Task => Schlüssel nicht gefunden.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{3821BE18-3EF0-49EF-86D0-25BD443A5E3B}" => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3821BE18-3EF0-49EF-86D0-25BD443A5E3B} => Schlüssel nicht gefunden.
C:\Windows\System32\Tasks\ParetoLogic Registration3 => nicht gefunden.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\ParetoLogic Registration3 => Schlüssel nicht gefunden.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{4035C73E-70B8-4C51-AFEB-231706D9A929}" => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4035C73E-70B8-4C51-AFEB-231706D9A929} => Schlüssel nicht gefunden.
C:\Windows\System32\Tasks\ParetoLogic Update Version3 => nicht gefunden.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\ParetoLogic Update Version3 => Schlüssel nicht gefunden.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{9E6C773E-F005-44B6-BB1D-39AB12310F4F}" => Schlüssel erfolgreich entfernt
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9E6C773E-F005-44B6-BB1D-39AB12310F4F}" => Schlüssel erfolgreich entfernt
C:\Windows\System32\Tasks\{AB7941C8-16AF-4A02-A414-90DA311ADB15} => erfolgreich verschoben
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{AB7941C8-16AF-4A02-A414-90DA311ADB15}" => Schlüssel erfolgreich entfernt
C:\Windows\Tasks\ParetoLogic Registration3.job => nicht gefunden.
C:\Windows\Tasks\ParetoLogic Update Version3 Startup Task.job => nicht gefunden.
C:\Windows\Tasks\ParetoLogic Update Version3.job => nicht gefunden.
"C:\Users\S\AppData\Local\gmsd_de_007010126\upgmsd_de_007010126.exe" => nicht gefunden.
"C:\Program Files (x86)\gmsd_de_007010126\gmsd_de_007010126.exe" => nicht gefunden.
"C:\Users\S\AppData\Local\Temp\is-2L3GA.tmp\myoffergroup_de.tmp" => nicht gefunden.
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{00D5F78F-6178-48FA-9344-F3CC5921EF7B} => Wert nicht gefunden.
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{0A314FCB-D2F4-4DA1-AE32-B7C9FE5620DD} => Wert nicht gefunden.


Das System musste neu gestartet werden.

==== Ende von Fixlog 14:44:30 ====

 

 

Attached Thumbnails

• 
• 
• 
• 

[RKinner]

 

Download : ADWCleaner to your desktop.  Make sure you get the correct Download button.  Sometimes the ads on BleepingComputer will mimic the real Download button which should say: Download Now @BleepingComputer

 

NOTE: If using Internet Explorer and you get an alert that stops the program downloading, click on the warning and allow the download to complete.

 

Close  all programs, pause your anti-virus and run AdwCleaner (Vista or Win 7 => right click and Run As Administrator).

 

 

Click on Scan  and follow the prompts. Let it run unhindered. When done, click on the Clean button, and follow the prompts. Allow the system to reboot. You will then be presented with the report. Copy & Paste this report on your next reply.

 

The report will be saved in the C:\AdwCleaner folder.

 

 

 

Junkware-Removal-Tool

 

Please download Junkware Removal Tool to your desktop.  Make sure you get the correct Download button.  Sometimes the ads on BleepingComputer will mimic the real Download button which should say: Download Now @Author's site

• Pause your anti-virus.  Close all browsers.

Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".

The tool will open and start scanning your system.

Please be patient as this can take a while to complete depending on your system's specifications.

On completion, a log (JRT.txt) is saved to your desktop and will automatically open.

Post the contents of JRT.txt into your next message.

 

 

Run FRST again, check the Additions box and then Scan.  You will get two logs.  Post them both.

[LaszloV]

I am experiencing an extremely unstable W7 system at the moment, where screens go black and the system freezes since running the cleanup FRST fix. I'm not sure what it did, so I will revert to an earlier date and see if I can stabilize it without having to re-install everything......