Schönen Guten Morgen, ich habe ein Problem zu solch Unchristlicher Zeit.
Mein Physikalischer Speicher ist seit 2 Stunden von 4% auf 50% gesprungen und zwar habe ich lediglich einen neuen Treiber für meine Grafikkarte installiert, da ich zurzeit Beruflich noch am Computer sitze und das Gleichzeitig mein "Zocker" Rechner ist kann ich nicht einmal mehr Spiele wie Rust oder Total War 2 ohne das es sich aufhängt spielen.

Mein System: Windows 7 Home Premium Service Pack 1

Hersteller: Wortmann Ag

Modell: Terra Pc

Prozessor: Intel core i5-3570K CPU 3,40 Ghz

Arbeitsspeicher: 8gb

Systemtyp:64 bit

Grafikkarte: Gtx 560 Ti Treiberversion 347.09

Würde mich um eine Antwort freuen

Mfg Sebastian

hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

• Starte jetzt FRST.
• Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
• Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
• Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 18-01-2015 03
Ran by sebastian (administrator) on SEBASTIAN-PC on 19-01-2015 07:06:42
Running from C:\Users\sebastian\Downloads
Loaded Profiles: sebastian (Available profiles: sebastian)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlX64.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe
(AVM Berlin) C:\Program Files (x86)\avmwlanstick\WLanNetService.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\GdBgInx64.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\GDKBFltExe32.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AvkBap64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Valve Corporation) D:\steam\Steam.exe
(Spotify Ltd) C:\Users\sebastian\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Spotify Ltd) C:\Users\sebastian\AppData\Roaming\Spotify\spotify.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe
(AVM Berlin) C:\Program Files (x86)\avmwlanstick\WLanGUI.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler64.exe
(Valve Corporation) D:\steam\bin\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Valve Corporation) D:\steam\bin\steamwebhelper.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(AVG Technologies) C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe
(AVG Technologies) C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesApp64.exe
() C:\Users\sebastian\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\sebastian\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\sebastian\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\sebastian\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\sebastian\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Wargaming.net) D:\Wot\WorldOfTanks.exe
() C:\Users\sebastian\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6548112 2012-06-12] (Realtek Semiconductor)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2531472 2014-12-13] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\windows\system32\rundll32.exe C:\windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284480 2012-05-30] (Intel Corporation)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [GDFirewallTray] => C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe [1756792 2014-05-20] (G Data Software AG)
HKLM-x32\...\Run: [AVMWlanClient] => C:\Program Files (x86)\avmwlanstick\wlangui.exe [2105344 2010-10-22] (AVM Berlin)
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe,
HKU\S-1-5-21-526734976-3399402404-692726830-1001\...\Run: [Steam] => D:\steam\steam.exe [1940160 2014-11-18] (Valve Corporation)
HKU\S-1-5-21-526734976-3399402404-692726830-1001\...\Run: [SSync] => C:\Users\sebastian\AppData\Roaming\SSync\SSync.exe [36864 2013-04-09] ()
HKU\S-1-5-21-526734976-3399402404-692726830-1001\...\Run: [Spotify Web Helper] => C:\Users\sebastian\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1676344 2015-01-16] (Spotify Ltd)
HKU\S-1-5-21-526734976-3399402404-692726830-1001\...\Run: [EADM] => D:\Origin\Origin.exe [3618648 2015-01-16] (Electronic Arts)
HKU\S-1-5-21-526734976-3399402404-692726830-1001\...\Run: [Spotify] => C:\Users\sebastian\AppData\Roaming\Spotify\spotify.exe [6737976 2015-01-16] (Spotify Ltd)
HKU\S-1-5-21-526734976-3399402404-692726830-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [30872168 2014-12-11] (Skype Technologies S.A.)
HKU\S-1-5-21-526734976-3399402404-692726830-1001\...\Policies\Explorer: [NoDriveTypeAutoRun] 0xDD000000
HKU\S-1-5-21-526734976-3399402404-692726830-1001\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-21-526734976-3399402404-692726830-1001\...\MountPoints2: {d7900115-bcd9-11e2-977d-10bf4873b070} - G:\pushinst.exe
Startup: C:\Users\sebastian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Officejet 4620 series.lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Officejet 4620 series.lnk -> C:\Program Files\HP\HP Officejet 4620 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.)
BootExecute: autocheck autochk /p \??\C:autocheck autochk * 

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Google
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKU\S-1-5-21-526734976-3399402404-692726830-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKLM -> DefaultScope {37CCD3B4-715F-400C-9023-2EC5F815AAB0} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=ir_14_12_ch&cd=2XzuyEtN2Y1L1QzutCtD0B0FyEzzyBtA0BtDyBtD0EyE0CtDtN0D0Tzu0SzztDzytN1L2XzutCtFtCtFtCtFtCtN1L1CzutCyEtDtAtDyD1V1OtN1L1G1B1V1N2Y1L1Qzu2StAtCzy0ByBtDzztAtGyB0CyDtCtG0D0FyE0FtGtA0FyC0CtGtAtCyD0AtAyDyDzy0EtBtBtC2QtN1M1F1B2Z1V1N2Y1L1Qzu2StCzzyBzz0FtA0CtDtG0FyEtC0FtG0CyD0BzztGzy0AzztAtGtC0CtDyCtB0DyEyC0BtAyDyD2Q&cr=1434241063&ir=
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM -> {37CCD3B4-715F-400C-9023-2EC5F815AAB0} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=ir_14_12_ch&cd=2XzuyEtN2Y1L1QzutCtD0B0FyEzzyBtA0BtDyBtD0EyE0CtDtN0D0Tzu0SzztDzytN1L2XzutCtFtCtFtCtFtCtN1L1CzutCyEtDtAtDyD1V1OtN1L1G1B1V1N2Y1L1Qzu2StAtCzy0ByBtDzztAtGyB0CyDtCtG0D0FyE0FtGtA0FyC0CtGtAtCyD0AtAyDyDzy0EtBtBtC2QtN1M1F1B2Z1V1N2Y1L1Qzu2StCzzyBzz0FtA0CtDtG0FyEtC0FtG0CyD0BzztGzy0AzztAtGtC0CtDyCtB0DyEyC0BtAyDyD2Q&cr=1434241063&ir=
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-526734976-3399402404-692726830-1001 -> DefaultScope {37CCD3B4-715F-400C-9023-2EC5F815AAB0} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=ir_14_12_ch&cd=2XzuyEtN2Y1L1QzutCtD0B0FyEzzyBtA0BtDyBtD0EyE0CtDtN0D0Tzu0SzztDzytN1L2XzutCtFtCtFtCtFtCtN1L1CzutCyEtDtAtDyD1V1OtN1L1G1B1V1N2Y1L1Qzu2StAtCzy0ByBtDzztAtGyB0CyDtCtG0D0FyE0FtGtA0FyC0CtGtAtCyD0AtAyDyDzy0EtBtBtC2QtN1M1F1B2Z1V1N2Y1L1Qzu2StCzzyBzz0FtA0CtDtG0FyEtC0FtG0CyD0BzztGzy0AzztAtGtC0CtDyCtB0DyEyC0BtAyDyD2Q&cr=1434241063&ir=
SearchScopes: HKU\S-1-5-21-526734976-3399402404-692726830-1001 -> {121EFDA4-E46E-4E8A-A61C-D08E5240A29D} URL = hxxp://search.softonic.com/MOY00621/tb_v1?q={searchTerms}&SearchSource=4&cc=&mi=2c9ae4c0000000000000bc054306f36a&r=722
SearchScopes: HKU\S-1-5-21-526734976-3399402404-692726830-1001 -> {37CCD3B4-715F-400C-9023-2EC5F815AAB0} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=ir_14_12_ch&cd=2XzuyEtN2Y1L1QzutCtD0B0FyEzzyBtA0BtDyBtD0EyE0CtDtN0D0Tzu0SzztDzytN1L2XzutCtFtCtFtCtFtCtN1L1CzutCyEtDtAtDyD1V1OtN1L1G1B1V1N2Y1L1Qzu2StAtCzy0ByBtDzztAtGyB0CyDtCtG0D0FyE0FtGtA0FyC0CtGtAtCyD0AtAyDyDzy0EtBtBtC2QtN1M1F1B2Z1V1N2Y1L1Qzu2StCzzyBzz0FtA0CtDtG0FyEtC0FtG0CyD0BzztGzy0AzztAtGtC0CtDyCtB0DyEyC0BtAyDyD2Q&cr=1434241063&ir=
SearchScopes: HKU\S-1-5-21-526734976-3399402404-692726830-1001 -> {5A216F10-2590-4A5E-948E-B309BDBAB3D2} URL = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=937811&p={searchTerms}
SearchScopes: HKU\S-1-5-21-526734976-3399402404-692726830-1001 -> {F2696A27-B928-422D-8341-6451691C5B35} URL = hxxp://www.bing.com/search?FORM=UP97DF&PC=UP97&dt=071213&q={searchTerms}&src=IE-SearchBox
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: ChromeFrame BHO -> {ECB3C477-1A0A-44BD-BB57-78F9EFE34FA7} -> C:\Program Files (x86)\Google\Chrome Frame\Application\32.0.1700.107\npchrome_frame.dll (Google Inc.)
DPF: HKLM-x32 {784797A8-342D-4072-9486-03C8D0F2F0A1} hxxp://www.battlefieldheroes.com/static/updater/BFHUpdater_5.0.203.0.cab
Handler-x32: gcf - {9875BFAF-B04D-445E-8A69-BE36838CDE3E} - C:\Program Files (x86)\Google\Chrome Frame\Application\32.0.1700.107\npchrome_frame.dll (Google Inc.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\my710sjh.default
FF DefaultSearchEngine: Yahoo DE
FF SelectedSearchEngine: Yahoo DE
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_16_0_0_257.dll ()
FF Plugin: @microsoft.com/GENUINE -> C:\windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_257.dll ()
FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 -> C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=2.3.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.3.0\npesnlaunch.dll (ESN Social Software AB)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> C:\windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKU\S-1-5-21-526734976-3399402404-692726830-1001: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\sebastian\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF user.js: detected! => C:\Users\sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\my710sjh.default\user.js
FF SearchPlugin: C:\Users\sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\my710sjh.default\searchplugins\bingp.xml
FF SearchPlugin: C:\Users\sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\my710sjh.default\searchplugins\yahoo-msd.xml
FF Extension: Fireforce - C:\Users\sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\my710sjh.default\Extensions\fireforce@scrt.ch.xpi [2014-05-29]
FF Extension: Search Manager for Moziila Firefox ™ - C:\Users\sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\my710sjh.default\Extensions\{71e6896a-7bed-49b8-bb69-e641e983b31b}.xpi [2015-01-19]

Chrome: 
=======
CHR Profile: C:\Users\sebastian\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2015-01-16]
CHR Extension: (Google Wallet) - C:\Users\sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-01-16]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AVKProxy; C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe [2250360 2014-10-14] (G Data Software AG)
R2 AVKService; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe [914552 2013-12-19] (G Data Software AG)
R2 AVKWCtl; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlX64.exe [2683760 2014-05-20] (G Data Software AG)
R2 AVM WLAN Connection Service; C:\Program Files (x86)\avmwlanstick\WlanNetService.exe [376832 2010-10-22] (AVM Berlin) [File not signed]
S3 EasyAntiCheat; C:\windows\SysWOW64\EasyAntiCheat.exe [174624 2015-01-16] (EasyAntiCheat Ltd)
R3 GDFwSvc; C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe [3228136 2014-08-21] (G Data Software AG)
R3 GDScan; C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe [700536 2014-05-20] (G Data Software AG)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1148560 2014-12-13] (NVIDIA Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165144 2012-05-15] (Intel Corporation)
S3 npggsvc; C:\windows\SysWOW64\GameMon.des [4784312 2013-04-23] (INCA Internet Co., Ltd.) [File not signed]
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1701520 2014-12-13] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19823248 2014-12-13] (NVIDIA Corporation)
S3 Origin Client Service; D:\Origin\OriginClientService.exe [1903472 2015-01-16] (Electronic Arts)
R2 PnkBstrA; C:\windows\SysWOW64\PnkBstrA.exe [76888 2014-11-07] ()
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe [2604856 2014-11-24] (AVG Technologies)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 avmeject; C:\Windows\System32\drivers\avmeject.sys [14120 2010-10-22] (AVM Berlin)
R3 fwlanusbn; C:\Windows\System32\DRIVERS\fwlanusbn.sys [714368 2010-10-25] (AVM GmbH)
R0 GDBehave; C:\Windows\System32\drivers\GDBehave.sys [55808 2014-06-27] (G Data Software AG)
R1 GDKBFlt; C:\windows\system32\drivers\GDKBFlt64.sys [20992 2015-01-16] (G Data Software AG)
R1 GDMnIcpt; C:\windows\system32\drivers\MiniIcpt.sys [142336 2015-01-16] (G Data Software AG)
R3 GDPkIcpt; C:\windows\system32\drivers\PktIcpt.sys [64000 2014-06-27] (G Data Software AG)
R1 gdwfpcd; C:\Windows\System32\drivers\gdwfpcd64.sys [64512 2015-01-16] (G Data Software AG)
R1 GRD; C:\windows\system32\drivers\GRD.sys [106272 2014-04-12] (G Data Software)
R1 HookCentre; C:\windows\system32\drivers\HookCentre.sys [61440 2014-06-27] (G Data Software AG)
S2 lirsgt; C:\Windows\SysWOW64\DRIVERS\lirsgt.sys [18048 2013-10-11] () [File not signed]
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19600 2014-12-13] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38032 2014-11-22] (NVIDIA Corporation)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [386680 2014-03-19] (Duplex Secure Ltd.)
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesDriver64.sys [14112 2014-11-24] (TuneUp Software)
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-14] (Microsoft Corporation)
S3 cpuz135; \??\C:\Users\ADMINI~1\AppData\Local\Temp\cpuz135\cpuz135_x64.sys [X]
R3 MBAMSwissArmy; \??\C:\windows\system32\drivers\MBAMSwissArmy.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-19 07:06 - 2015-01-19 07:06 - 02126848 _____ (Farbar) C:\Users\sebastian\Downloads\FRST64.exe
2015-01-19 07:06 - 2015-01-19 07:06 - 00021282 _____ () C:\Users\sebastian\Downloads\FRST.txt
2015-01-19 04:26 - 2015-01-19 04:26 - 00002225 _____ () C:\Users\Public\Desktop\AVG 1-Klick-Wartung.lnk
2015-01-19 04:26 - 2015-01-19 04:26 - 00002213 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG PC TuneUp 2015.lnk
2015-01-19 04:26 - 2015-01-19 04:26 - 00002201 _____ () C:\Users\Public\Desktop\AVG PC TuneUp 2015.lnk
2015-01-19 04:26 - 2015-01-19 04:26 - 00000000 ____D () C:\Users\sebastian\AppData\Roaming\AVG
2015-01-19 04:26 - 2015-01-19 04:26 - 00000000 ____D () C:\Users\sebastian\AppData\Local\Avg
2015-01-19 04:26 - 2015-01-19 04:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG PC TuneUp 2015
2015-01-19 04:26 - 2015-01-19 04:26 - 00000000 ____D () C:\ProgramData\AVG
2015-01-19 04:26 - 2015-01-19 04:26 - 00000000 ____D () C:\Program Files (x86)\AVG
2015-01-19 04:26 - 2014-11-24 12:48 - 00040248 _____ (AVG Technologies) C:\windows\system32\TURegOpt.exe
2015-01-19 04:26 - 2014-11-24 12:48 - 00029496 _____ (AVG Technologies) C:\windows\system32\authuitu.dll
2015-01-19 04:26 - 2014-11-24 12:48 - 00025400 _____ (AVG Technologies) C:\windows\SysWOW64\authuitu.dll
2015-01-19 04:17 - 2015-01-19 04:18 - 47839032 _____ (AVG Technologies) C:\Users\sebastian\Downloads\avg_tuht_stf_de_2015_238_15cmp16.exe
2015-01-19 03:46 - 2015-01-19 07:06 - 00000000 ____D () C:\FRST
2015-01-19 03:39 - 2015-01-19 03:39 - 00000000 ____D () C:\Users\sebastian\AppData\Local\G DATA
2015-01-19 03:05 - 2015-01-19 03:18 - 00011240 _____ () C:\windows\PFRO.log
2015-01-19 02:47 - 2015-01-19 02:47 - 00000000 ____D () C:\Program Files (x86)\Microsoft ASP.NET
2015-01-19 02:44 - 2015-01-19 02:51 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-01-19 02:43 - 2015-01-19 02:43 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies
2015-01-19 02:43 - 2014-12-13 01:47 - 00620176 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvStreaming.exe
2015-01-19 02:42 - 2014-12-13 11:08 - 32099472 _____ (NVIDIA Corporation) C:\windows\system32\nvoglv64.dll
2015-01-19 02:42 - 2014-12-13 11:08 - 25460552 _____ (NVIDIA Corporation) C:\windows\system32\nvcompiler.dll
2015-01-19 02:42 - 2014-12-13 11:08 - 24764232 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvoglv32.dll
2015-01-19 02:42 - 2014-12-13 11:08 - 20465808 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvcompiler.dll
2015-01-19 02:42 - 2014-12-13 11:08 - 17264312 _____ (NVIDIA Corporation) C:\windows\system32\nvd3dumx.dll
2015-01-19 02:42 - 2014-12-13 11:08 - 13288360 _____ (NVIDIA Corporation) C:\windows\system32\nvopencl.dll
2015-01-19 02:42 - 2014-12-13 11:08 - 13202520 _____ (NVIDIA Corporation) C:\windows\system32\nvcuda.dll
2015-01-19 02:42 - 2014-12-13 11:08 - 10770120 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvopencl.dll
2015-01-19 02:42 - 2014-12-13 11:08 - 10710160 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvcuda.dll
2015-01-19 02:42 - 2014-12-13 11:08 - 10345280 _____ (NVIDIA Corporation) C:\windows\system32\Drivers\nvlddmkm.sys
2015-01-19 02:42 - 2014-12-13 11:08 - 03610440 _____ (NVIDIA Corporation) C:\windows\system32\nvcuvid.dll
2015-01-19 02:42 - 2014-12-13 11:08 - 03248968 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvcuvid.dll
2015-01-19 02:42 - 2014-12-13 11:08 - 01895056 _____ (NVIDIA Corporation) C:\windows\system32\nvdispco6434709.dll
2015-01-19 02:42 - 2014-12-13 11:08 - 01556624 _____ (NVIDIA Corporation) C:\windows\system32\nvdispgenco6434709.dll
2015-01-19 02:42 - 2014-12-13 11:08 - 00994384 _____ (NVIDIA Corporation) C:\windows\system32\nvumdshimx.dll
2015-01-19 02:42 - 2014-12-13 11:08 - 00968336 _____ (NVIDIA Corporation) C:\windows\system32\NvIFR64.dll
2015-01-19 02:42 - 2014-12-13 11:08 - 00942400 _____ (NVIDIA Corporation) C:\windows\system32\NvFBC64.dll
2015-01-19 02:42 - 2014-12-13 11:08 - 00928072 _____ (NVIDIA Corporation) C:\windows\SysWOW64\NvIFR.dll
2015-01-19 02:42 - 2014-12-13 11:08 - 00906560 _____ (NVIDIA Corporation) C:\windows\SysWOW64\NvFBC.dll
2015-01-19 02:42 - 2014-12-13 11:08 - 00876976 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvumdshim.dll
2015-01-19 02:42 - 2014-12-13 11:08 - 00353224 _____ (NVIDIA Corporation) C:\windows\system32\nvoglshim64.dll
2015-01-19 02:42 - 2014-12-13 11:08 - 00306328 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvoglshim32.dll
2015-01-19 02:42 - 2014-12-13 11:08 - 00178632 _____ (NVIDIA Corporation) C:\windows\system32\nvinitx.dll
2015-01-19 02:42 - 2014-12-13 11:08 - 00165760 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvinit.dll
2015-01-19 02:42 - 2014-10-09 18:02 - 00195728 _____ (NVIDIA Corporation) C:\windows\system32\Drivers\nvhda64v.sys
2015-01-19 02:42 - 2014-10-09 18:02 - 00030536 _____ (NVIDIA Corporation) C:\windows\system32\nvhdap64.dll
2015-01-19 02:33 - 2015-01-19 02:34 - 00000000 ____D () C:\Users\sebastian\AppData\Local\NVIDIA Corporation
2015-01-19 02:32 - 2015-01-19 03:20 - 00001243 _____ () C:\windows\setupact.log
2015-01-19 02:32 - 2015-01-19 02:32 - 00000000 _____ () C:\windows\setuperr.log
2015-01-19 02:32 - 2014-12-13 01:11 - 02824504 _____ (NVIDIA Corporation) C:\windows\system32\nvspcap64.dll
2015-01-19 02:32 - 2014-12-13 01:11 - 02210040 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvspcap.dll
2015-01-19 02:32 - 2014-12-13 01:11 - 01715224 _____ (NVIDIA Corporation) C:\windows\system32\nvspbridge64.dll
2015-01-19 02:32 - 2014-12-13 01:11 - 01291464 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvspbridge.dll
2015-01-18 11:44 - 2015-01-18 11:47 - 00000000 ____D () C:\Users\sebastian\AppData\Local\HP
2015-01-18 11:44 - 2015-01-18 11:44 - 00003642 _____ () C:\windows\System32\Tasks\HPCustParticipation HP Officejet 4620 series
2015-01-18 11:44 - 2015-01-18 11:44 - 00002236 _____ () C:\Users\Public\Desktop\HP Officejet 4620 series.lnk
2015-01-18 11:44 - 2015-01-18 11:44 - 00001173 _____ () C:\Users\Public\Desktop\Shop für Zubehör - HP Officejet 4620 series.lnk
2015-01-18 11:44 - 2015-01-18 11:44 - 00000968 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\I.R.I.S. OCR-Registrierung.lnk
2015-01-18 11:44 - 2015-01-18 11:44 - 00000057 _____ () C:\ProgramData\Ament.ini
2015-01-18 11:44 - 2015-01-18 11:44 - 00000000 ____D () C:\Users\sebastian\AppData\Roaming\HpUpdate
2015-01-18 11:44 - 2015-01-18 11:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP
2015-01-18 11:44 - 2015-01-18 11:44 - 00000000 ____D () C:\ProgramData\HP
2015-01-18 11:44 - 2015-01-18 11:44 - 00000000 ____D () C:\Program Files\HP
2015-01-18 11:44 - 2015-01-18 11:44 - 00000000 ____D () C:\Program Files (x86)\HP
2015-01-18 11:44 - 2012-10-17 04:31 - 00741480 ____N (Hewlett-Packard Co.) C:\windows\system32\HPDiscoPM6412.dll
2015-01-17 19:07 - 2015-01-17 19:13 - 00000000 ____D () C:\ProgramData\BlueStacksSetup
2015-01-17 19:06 - 2015-01-17 19:06 - 00000000 ____D () C:\windows\System32\Tasks\Abelssoft
2015-01-17 19:06 - 2015-01-17 19:06 - 00000000 ____D () C:\Users\sebastian\AppData\Roaming\DesktopIconForAmazon
2015-01-17 19:06 - 2015-01-17 19:06 - 00000000 ____D () C:\Users\sebastian\AppData\Roaming\Abelssoft
2015-01-17 19:06 - 2015-01-17 19:06 - 00000000 ____D () C:\Users\sebastian\AppData\Local\Abelssoft
2015-01-17 19:06 - 2015-01-17 19:06 - 00000000 ____D () C:\ProgramData\XDMessagingv4
2015-01-17 10:41 - 2014-12-13 06:09 - 00144384 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2015-01-17 10:41 - 2014-12-13 04:33 - 00115712 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe
2015-01-17 10:41 - 2014-07-09 03:03 - 00007168 _____ (Microsoft Corporation) C:\windows\system32\KBDYAK.DLL
2015-01-17 10:41 - 2014-07-09 03:03 - 00007168 _____ (Microsoft Corporation) C:\windows\system32\KBDTAT.DLL
2015-01-17 10:41 - 2014-07-09 03:03 - 00007168 _____ (Microsoft Corporation) C:\windows\system32\KBDRU1.DLL
2015-01-17 10:41 - 2014-07-09 03:03 - 00007168 _____ (Microsoft Corporation) C:\windows\system32\KBDBASH.DLL
2015-01-17 10:41 - 2014-07-09 03:03 - 00006656 _____ (Microsoft Corporation) C:\windows\system32\KBDRU.DLL
2015-01-17 10:41 - 2014-07-09 02:31 - 00007168 _____ (Microsoft Corporation) C:\windows\SysWOW64\KBDYAK.DLL
2015-01-17 10:41 - 2014-07-09 02:31 - 00007168 _____ (Microsoft Corporation) C:\windows\SysWOW64\KBDTAT.DLL
2015-01-17 10:41 - 2014-07-09 02:31 - 00006656 _____ (Microsoft Corporation) C:\windows\SysWOW64\KBDRU1.DLL
2015-01-17 10:41 - 2014-07-09 02:31 - 00006656 _____ (Microsoft Corporation) C:\windows\SysWOW64\KBDRU.DLL
2015-01-17 10:41 - 2014-07-09 02:31 - 00006656 _____ (Microsoft Corporation) C:\windows\SysWOW64\KBDBASH.DLL
2015-01-17 10:41 - 2014-07-08 23:38 - 00419992 _____ () C:\windows\system32\locale.nls
2015-01-17 10:41 - 2014-07-08 23:30 - 00419992 _____ () C:\windows\SysWOW64\locale.nls
2015-01-16 15:57 - 2015-01-16 15:57 - 00000202 _____ () C:\Users\sebastian\Desktop\Company of Heroes 2.url
2015-01-16 15:41 - 2015-01-16 15:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FRITZ!WLAN
2015-01-16 15:41 - 2015-01-16 15:41 - 00000000 ____D () C:\Program Files (x86)\avmwlanstick
2015-01-16 15:41 - 2015-01-16 15:41 - 00000000 ____D () C:\Program Files (x86)\AVM_update
2015-01-16 13:41 - 2015-01-16 13:41 - 00000000 ____D () C:\windows\system32\appraiser
2015-01-16 13:31 - 2015-01-16 13:31 - 00000000 ____D () C:\Program Files (x86)\MSXML 4.0
2015-01-16 13:27 - 2014-10-18 03:05 - 04121600 _____ (Microsoft Corporation) C:\windows\system32\mf.dll
2015-01-16 13:27 - 2014-10-18 02:33 - 03209728 _____ (Microsoft Corporation) C:\windows\SysWOW64\mf.dll
2015-01-16 13:27 - 2014-07-07 03:06 - 00206848 _____ (Microsoft Corporation) C:\windows\system32\mfps.dll
2015-01-16 13:27 - 2014-07-07 03:06 - 00055808 _____ (Microsoft Corporation) C:\windows\system32\rrinstaller.exe
2015-01-16 13:27 - 2014-07-07 03:06 - 00024576 _____ (Microsoft Corporation) C:\windows\system32\mfpmp.exe
2015-01-16 13:27 - 2014-07-07 03:02 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\mferror.dll
2015-01-16 13:27 - 2014-07-07 02:40 - 00103424 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfps.dll
2015-01-16 13:27 - 2014-07-07 02:39 - 00050176 _____ (Microsoft Corporation) C:\windows\SysWOW64\rrinstaller.exe
2015-01-16 13:27 - 2014-07-07 02:39 - 00023040 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfpmp.exe
2015-01-16 13:27 - 2014-07-07 02:37 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\mferror.dll
2015-01-16 13:23 - 2014-06-27 03:08 - 02777088 _____ (Microsoft Corporation) C:\windows\system32\msmpeg2vdec.dll
2015-01-16 13:23 - 2014-06-27 02:45 - 02285056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msmpeg2vdec.dll
2015-01-16 13:20 - 2014-06-30 23:24 - 00008856 _____ (Microsoft Corporation) C:\windows\system32\icardres.dll
2015-01-16 13:20 - 2014-06-30 23:14 - 00008856 _____ (Microsoft Corporation) C:\windows\SysWOW64\icardres.dll
2015-01-16 13:20 - 2014-06-06 07:16 - 00035480 _____ (Microsoft Corporation) C:\windows\SysWOW64\TsWpfWrp.exe
2015-01-16 13:20 - 2014-06-06 07:12 - 00035480 _____ (Microsoft Corporation) C:\windows\system32\TsWpfWrp.exe
2015-01-16 13:20 - 2014-03-09 22:48 - 01389208 _____ (Microsoft Corporation) C:\windows\system32\icardagt.exe
2015-01-16 13:20 - 2014-03-09 22:48 - 00171160 _____ (Microsoft Corporation) C:\windows\system32\infocardapi.dll
2015-01-16 13:20 - 2014-03-09 22:47 - 00619672 _____ (Microsoft Corporation) C:\windows\SysWOW64\icardagt.exe
2015-01-16 13:20 - 2014-03-09 22:47 - 00099480 _____ (Microsoft Corporation) C:\windows\SysWOW64\infocardapi.dll
2015-01-16 13:19 - 2014-11-27 02:43 - 00389296 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
2015-01-16 13:19 - 2014-11-27 02:10 - 00342200 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll
2015-01-16 13:19 - 2014-11-22 04:13 - 25059840 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2015-01-16 13:19 - 2014-11-22 04:06 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2015-01-16 13:19 - 2014-11-22 04:06 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
2015-01-16 13:19 - 2014-11-22 03:50 - 00580096 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2015-01-16 13:19 - 2014-11-22 03:50 - 00066560 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2015-01-16 13:19 - 2014-11-22 03:49 - 02885120 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2015-01-16 13:19 - 2014-11-22 03:49 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
2015-01-16 13:19 - 2014-11-22 03:48 - 00088064 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll
2015-01-16 13:19 - 2014-11-22 03:41 - 00054784 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2015-01-16 13:19 - 2014-11-22 03:40 - 00034304 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2015-01-16 13:19 - 2014-11-22 03:37 - 00633856 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2015-01-16 13:19 - 2014-11-22 03:35 - 00114688 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
2015-01-16 13:19 - 2014-11-22 03:34 - 06039552 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2015-01-16 13:19 - 2014-11-22 03:34 - 00814080 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
2015-01-16 13:19 - 2014-11-22 03:26 - 00968704 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2015-01-16 13:19 - 2014-11-22 03:22 - 19749376 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2015-01-16 13:19 - 2014-11-22 03:22 - 00490496 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2015-01-16 13:19 - 2014-11-22 03:20 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2015-01-16 13:19 - 2014-11-22 03:14 - 00077824 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll
2015-01-16 13:19 - 2014-11-22 03:09 - 00199680 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2015-01-16 13:19 - 2014-11-22 03:08 - 00092160 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2015-01-16 13:19 - 2014-11-22 03:07 - 00501248 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2015-01-16 13:19 - 2014-11-22 03:07 - 00062464 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2015-01-16 13:19 - 2014-11-22 03:06 - 00047616 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll
2015-01-16 13:19 - 2014-11-22 03:05 - 00316928 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2015-01-16 13:19 - 2014-11-22 03:05 - 00064000 _____ (Microsoft Corporation) C:\windows\SysWOW64\MshtmlDac.dll
2015-01-16 13:19 - 2014-11-22 03:01 - 02277888 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2015-01-16 13:19 - 2014-11-22 02:59 - 00047104 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2015-01-16 13:19 - 2014-11-22 02:58 - 00030720 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2015-01-16 13:19 - 2014-11-22 02:56 - 00478208 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2015-01-16 13:19 - 2014-11-22 02:54 - 00620032 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll
2015-01-16 13:19 - 2014-11-22 02:49 - 00800768 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2015-01-16 13:19 - 2014-11-22 02:49 - 00718848 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2015-01-16 13:19 - 2014-11-22 02:47 - 01359360 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll
2015-01-16 13:19 - 2014-11-22 02:46 - 02125312 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2015-01-16 13:19 - 2014-11-22 02:45 - 00418304 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
2015-01-16 13:19 - 2014-11-22 02:43 - 14412800 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2015-01-16 13:19 - 2014-11-22 02:40 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-01-16 13:19 - 2014-11-22 02:36 - 00168960 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
2015-01-16 13:19 - 2014-11-22 02:35 - 00076288 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2015-01-16 13:19 - 2014-11-22 02:33 - 00285696 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
2015-01-16 13:19 - 2014-11-22 02:29 - 04299264 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2015-01-16 13:19 - 2014-11-22 02:28 - 02358272 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2015-01-16 13:19 - 2014-11-22 02:23 - 00688640 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2015-01-16 13:19 - 2014-11-22 02:22 - 02052096 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2015-01-16 13:19 - 2014-11-22 02:21 - 01155072 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll
2015-01-16 13:19 - 2014-11-22 02:15 - 01548288 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2015-01-16 13:19 - 2014-11-22 02:13 - 12836864 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2015-01-16 13:19 - 2014-11-22 02:03 - 00800768 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2015-01-16 13:19 - 2014-11-22 02:00 - 01888256 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2015-01-16 13:19 - 2014-11-22 01:56 - 01307136 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2015-01-16 13:19 - 2014-11-22 01:54 - 00710144 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
2015-01-16 13:18 - 2014-12-19 04:06 - 00210432 _____ (Microsoft Corporation) C:\windows\system32\profsvc.dll
2015-01-16 13:18 - 2014-12-19 02:46 - 00141312 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxdav.sys
2015-01-16 13:18 - 2014-12-12 06:35 - 05553592 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2015-01-16 13:18 - 2014-12-12 06:31 - 00503808 _____ (Microsoft Corporation) C:\windows\system32\srcore.dll
2015-01-16 13:18 - 2014-12-12 06:31 - 00296960 _____ (Microsoft Corporation) C:\windows\system32\rstrui.exe
2015-01-16 13:18 - 2014-12-12 06:31 - 00050176 _____ (Microsoft Corporation) C:\windows\system32\srclient.dll
2015-01-16 13:18 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe
2015-01-16 13:18 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe
2015-01-16 13:18 - 2014-12-12 06:07 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\srclient.dll
2015-01-16 13:18 - 2014-12-11 18:47 - 00087040 _____ (Microsoft Corporation) C:\windows\system32\TSWbPrxy.exe
2015-01-16 13:18 - 2014-12-06 05:17 - 00303616 _____ (Microsoft Corporation) C:\windows\system32\nlasvc.dll
2015-01-16 13:18 - 2014-12-06 04:50 - 00156672 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncsi.dll
2015-01-16 13:18 - 2014-12-06 04:50 - 00052224 _____ (Microsoft Corporation) C:\windows\SysWOW64\nlaapi.dll
2015-01-16 13:18 - 2014-12-04 03:50 - 00830976 _____ (Microsoft Corporation) C:\windows\system32\appraiser.dll
2015-01-16 13:18 - 2014-12-04 03:50 - 00741376 _____ (Microsoft Corporation) C:\windows\system32\invagent.dll
2015-01-16 13:18 - 2014-12-04 03:50 - 00413184 _____ (Microsoft Corporation) C:\windows\system32\generaltel.dll
2015-01-16 13:18 - 2014-12-04 03:50 - 00396800 _____ (Microsoft Corporation) C:\windows\system32\devinv.dll
2015-01-16 13:18 - 2014-12-04 03:50 - 00227328 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2015-01-16 13:18 - 2014-12-04 03:50 - 00192000 _____ (Microsoft Corporation) C:\windows\system32\aepic.dll
2015-01-16 13:18 - 2014-12-04 03:44 - 01083392 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2015-01-16 13:18 - 2014-12-02 00:28 - 01232040 _____ (Microsoft Corporation) C:\windows\system32\aitstatic.exe
2015-01-16 13:18 - 2014-11-11 04:09 - 01424384 _____ (Microsoft Corporation) C:\windows\system32\WindowsCodecs.dll
2015-01-16 13:18 - 2014-11-11 04:08 - 00728064 _____ (Microsoft Corporation) C:\windows\system32\kerberos.dll
2015-01-16 13:18 - 2014-11-11 04:08 - 00241152 _____ (Microsoft Corporation) C:\windows\system32\pku2u.dll
2015-01-16 13:18 - 2014-11-11 03:44 - 01230336 _____ (Microsoft Corporation) C:\windows\SysWOW64\WindowsCodecs.dll
2015-01-16 13:18 - 2014-11-11 03:44 - 00550912 _____ (Microsoft Corporation) C:\windows\SysWOW64\kerberos.dll
2015-01-16 13:18 - 2014-11-11 03:44 - 00186880 _____ (Microsoft Corporation) C:\windows\SysWOW64\pku2u.dll
2015-01-16 13:18 - 2014-11-11 02:46 - 00119296 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tdx.sys
2015-01-16 13:18 - 2014-11-08 04:16 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\tzres.dll
2015-01-16 13:18 - 2014-11-08 03:45 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\tzres.dll
2015-01-16 13:18 - 2014-10-30 03:03 - 00165888 _____ (Microsoft Corporation) C:\windows\system32\charmap.exe
2015-01-16 13:18 - 2014-10-30 02:45 - 00155136 _____ (Microsoft Corporation) C:\windows\SysWOW64\charmap.exe
2015-01-16 13:18 - 2014-10-25 02:57 - 00077824 _____ (Microsoft Corporation) C:\windows\system32\packager.dll
2015-01-16 13:18 - 2014-10-25 02:32 - 00067584 _____ (Microsoft Corporation) C:\windows\SysWOW64\packager.dll
2015-01-16 13:18 - 2014-10-18 03:05 - 00861696 _____ (Microsoft Corporation) C:\windows\system32\oleaut32.dll
2015-01-16 13:18 - 2014-10-18 02:33 - 00571904 _____ (Microsoft Corporation) C:\windows\SysWOW64\oleaut32.dll
2015-01-16 13:18 - 2014-10-14 03:16 - 00155064 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys
2015-01-16 13:18 - 2014-10-14 03:13 - 03241984 _____ (Microsoft Corporation) C:\windows\system32\msi.dll
2015-01-16 13:18 - 2014-10-14 03:13 - 00683520 _____ (Microsoft Corporation) C:\windows\system32\termsrv.dll
2015-01-16 13:18 - 2014-10-14 03:12 - 01460736 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll
2015-01-16 13:18 - 2014-10-14 03:09 - 00146432 _____ (Microsoft Corporation) C:\windows\system32\msaudite.dll
2015-01-16 13:18 - 2014-10-14 03:07 - 00681984 _____ (Microsoft Corporation) C:\windows\system32\adtschema.dll
2015-01-16 13:18 - 2014-10-14 02:50 - 02363904 _____ (Microsoft Corporation) C:\windows\SysWOW64\msi.dll
2015-01-16 13:18 - 2014-10-14 02:50 - 00022016 _____ (Microsoft Corporation) C:\windows\SysWOW64\secur32.dll
2015-01-16 13:18 - 2014-10-14 02:49 - 00096768 _____ (Microsoft Corporation) C:\windows\SysWOW64\sspicli.dll
2015-01-16 13:18 - 2014-10-14 02:47 - 00146432 _____ (Microsoft Corporation) C:\windows\SysWOW64\msaudite.dll
2015-01-16 13:18 - 2014-10-14 02:46 - 00681984 _____ (Microsoft Corporation) C:\windows\SysWOW64\adtschema.dll
2015-01-16 13:18 - 2014-10-10 01:57 - 03198976 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2015-01-16 13:18 - 2014-10-03 03:12 - 02020352 _____ (Microsoft Corporation) C:\windows\system32\WsmSvc.dll
2015-01-16 13:18 - 2014-10-03 03:12 - 00500224 _____ (Microsoft Corporation) C:\windows\system32\AUDIOKSE.dll
2015-01-16 13:18 - 2014-10-03 03:12 - 00346624 _____ (Microsoft Corporation) C:\windows\system32\WSManMigrationPlugin.dll
2015-01-16 13:18 - 2014-10-03 03:12 - 00310272 _____ (Microsoft Corporation) C:\windows\system32\WsmWmiPl.dll
2015-01-16 13:18 - 2014-10-03 03:12 - 00181248 _____ (Microsoft Corporation) C:\windows\system32\WsmAuto.dll
2015-01-16 13:18 - 2014-10-03 03:11 - 00680960 _____ (Microsoft Corporation) C:\windows\system32\audiosrv.dll
2015-01-16 13:18 - 2014-10-03 03:11 - 00440832 _____ (Microsoft Corporation) C:\windows\system32\AudioEng.dll
2015-01-16 13:18 - 2014-10-03 03:11 - 00296448 _____ (Microsoft Corporation) C:\windows\system32\AudioSes.dll
2015-01-16 13:18 - 2014-10-03 03:11 - 00284672 _____ (Microsoft Corporation) C:\windows\system32\EncDump.dll
2015-01-16 13:18 - 2014-10-03 03:11 - 00266240 _____ (Microsoft Corporation) C:\windows\system32\WSManHTTPConfig.exe
2015-01-16 13:18 - 2014-10-03 02:45 - 01177088 _____ (Microsoft Corporation) C:\windows\SysWOW64\WsmSvc.dll
2015-01-16 13:18 - 2014-10-03 02:45 - 00248832 _____ (Microsoft Corporation) C:\windows\SysWOW64\WSManMigrationPlugin.dll
2015-01-16 13:18 - 2014-10-03 02:45 - 00214016 _____ (Microsoft Corporation) C:\windows\SysWOW64\WsmWmiPl.dll
2015-01-16 13:18 - 2014-10-03 02:45 - 00145920 _____ (Microsoft Corporation) C:\windows\SysWOW64\WsmAuto.dll
2015-01-16 13:18 - 2014-10-03 02:44 - 00442880 _____ (Microsoft Corporation) C:\windows\SysWOW64\AUDIOKSE.dll
2015-01-16 13:18 - 2014-10-03 02:44 - 00374784 _____ (Microsoft Corporation) C:\windows\SysWOW64\AudioEng.dll
2015-01-16 13:18 - 2014-10-03 02:44 - 00198656 _____ (Microsoft Corporation) C:\windows\SysWOW64\WSManHTTPConfig.exe
2015-01-16 13:18 - 2014-10-03 02:44 - 00195584 _____ (Microsoft Corporation) C:\windows\SysWOW64\AudioSes.dll
2015-01-16 13:18 - 2014-09-25 03:08 - 00371712 _____ (Microsoft Corporation) C:\windows\system32\qdvd.dll
2015-01-16 13:18 - 2014-09-25 02:40 - 00519680 _____ (Microsoft Corporation) C:\windows\SysWOW64\qdvd.dll
2015-01-16 13:18 - 2014-09-19 10:42 - 00342016 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll
2015-01-16 13:18 - 2014-09-19 10:42 - 00314880 _____ (Microsoft Corporation) C:\windows\system32\msv1_0.dll
2015-01-16 13:18 - 2014-09-19 10:42 - 00309760 _____ (Microsoft Corporation) C:\windows\system32\ncrypt.dll
2015-01-16 13:18 - 2014-09-19 10:42 - 00210944 _____ (Microsoft Corporation) C:\windows\system32\wdigest.dll
2015-01-16 13:18 - 2014-09-19 10:42 - 00086528 _____ (Microsoft Corporation) C:\windows\system32\TSpkg.dll
2015-01-16 13:18 - 2014-09-19 10:42 - 00022016 _____ (Microsoft Corporation) C:\windows\system32\credssp.dll
2015-01-16 13:18 - 2014-09-19 10:23 - 00259584 _____ (Microsoft Corporation) C:\windows\SysWOW64\msv1_0.dll
2015-01-16 13:18 - 2014-09-19 10:23 - 00248832 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll
2015-01-16 13:18 - 2014-09-19 10:23 - 00221184 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncrypt.dll
2015-01-16 13:18 - 2014-09-19 10:23 - 00172032 _____ (Microsoft Corporation) C:\windows\SysWOW64\wdigest.dll
2015-01-16 13:18 - 2014-09-19 10:23 - 00065536 _____ (Microsoft Corporation) C:\windows\SysWOW64\TSpkg.dll
2015-01-16 13:18 - 2014-09-19 10:23 - 00017408 _____ (Microsoft Corporation) C:\windows\SysWOW64\credssp.dll
2015-01-16 13:18 - 2014-09-05 03:11 - 06584320 _____ (Microsoft Corporation) C:\windows\system32\mstscax.dll
2015-01-16 13:18 - 2014-09-05 02:52 - 05703168 _____ (Microsoft Corporation) C:\windows\SysWOW64\mstscax.dll
2015-01-16 13:18 - 2014-09-04 06:23 - 00424448 _____ (Microsoft Corporation) C:\windows\system32\rastls.dll
2015-01-16 13:18 - 2014-09-04 06:04 - 00372736 _____ (Microsoft Corporation) C:\windows\SysWOW64\rastls.dll
2015-01-16 13:18 - 2014-08-29 03:07 - 03179520 _____ (Microsoft Corporation) C:\windows\system32\rdpcorets.dll
2015-01-16 13:18 - 2014-08-23 03:07 - 00404480 _____ (Microsoft Corporation) C:\windows\system32\gdi32.dll
2015-01-16 13:18 - 2014-08-23 02:45 - 00311808 _____ (Microsoft Corporation) C:\windows\SysWOW64\gdi32.dll
2015-01-16 13:18 - 2014-08-21 07:43 - 01882624 _____ (Microsoft Corporation) C:\windows\system32\msxml3.dll
2015-01-16 13:18 - 2014-08-21 07:40 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\msxml3r.dll
2015-01-16 13:18 - 2014-08-21 07:26 - 01237504 _____ (Microsoft Corporation) C:\windows\SysWOW64\msxml3.dll
2015-01-16 13:18 - 2014-08-21 07:23 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\msxml3r.dll
2015-01-16 13:18 - 2014-08-12 03:02 - 00878080 _____ (Microsoft Corporation) C:\windows\system32\IMJP10K.DLL
2015-01-16 13:18 - 2014-08-12 02:36 - 00701440 _____ (Microsoft Corporation) C:\windows\SysWOW64\IMJP10K.DLL
2015-01-16 13:18 - 2014-08-01 12:53 - 01031168 _____ (Microsoft Corporation) C:\windows\system32\TSWorkspace.dll
2015-01-16 13:18 - 2014-08-01 12:35 - 00793600 _____ (Microsoft Corporation) C:\windows\SysWOW64\TSWorkspace.dll
2015-01-16 13:18 - 2014-07-17 03:07 - 00455168 _____ (Microsoft Corporation) C:\windows\system32\winlogon.exe
2015-01-16 13:18 - 2014-07-17 03:07 - 00235520 _____ (Microsoft Corporation) C:\windows\system32\winsta.dll
2015-01-16 13:18 - 2014-07-17 03:07 - 00150528 _____ (Microsoft Corporation) C:\windows\system32\rdpcorekmts.dll
2015-01-16 13:18 - 2014-07-17 02:40 - 00157696 _____ (Microsoft Corporation) C:\windows\SysWOW64\winsta.dll
2015-01-16 13:18 - 2014-07-17 02:21 - 00212480 _____ (Microsoft Corporation) C:\windows\system32\Drivers\rdpwd.sys
2015-01-16 13:18 - 2014-07-17 02:21 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tssecsrv.sys
2015-01-16 13:18 - 2014-07-14 03:02 - 01216000 _____ (Microsoft Corporation) C:\windows\system32\rpcrt4.dll
2015-01-16 13:18 - 2014-07-14 02:40 - 00664064 _____ (Microsoft Corporation) C:\windows\SysWOW64\rpcrt4.dll
2015-01-16 13:18 - 2014-06-25 03:05 - 14175744 _____ (Microsoft Corporation) C:\windows\system32\shell32.dll
2015-01-16 13:18 - 2014-06-25 02:41 - 12874240 _____ (Microsoft Corporation) C:\windows\SysWOW64\shell32.dll
2015-01-16 13:18 - 2014-06-24 04:29 - 02565120 _____ (Microsoft Corporation) C:\windows\system32\d3d10warp.dll
2015-01-16 13:18 - 2014-06-24 03:59 - 01987584 _____ (Microsoft Corporation) C:\windows\SysWOW64\d3d10warp.dll
2015-01-16 13:18 - 2014-06-18 23:23 - 01943696 _____ (Microsoft Corporation) C:\windows\system32\dfshim.dll
2015-01-16 13:18 - 2014-06-18 23:23 - 01131664 _____ (Microsoft Corporation) C:\windows\SysWOW64\dfshim.dll
2015-01-16 13:18 - 2014-06-18 23:23 - 00156824 _____ (Microsoft Corporation) C:\windows\SysWOW64\mscorier.dll
2015-01-16 13:18 - 2014-06-18 23:23 - 00156312 _____ (Microsoft Corporation) C:\windows\system32\mscorier.dll
2015-01-16 13:18 - 2014-06-18 23:23 - 00081560 _____ (Microsoft Corporation) C:\windows\SysWOW64\mscories.dll
2015-01-16 13:18 - 2014-06-18 23:23 - 00073880 _____ (Microsoft Corporation) C:\windows\system32\mscories.dll
2015-01-16 13:18 - 2014-06-16 03:10 - 00985536 _____ (Microsoft Corporation) C:\windows\system32\Drivers\dxgkrnl.sys
2015-01-16 13:18 - 2014-06-03 11:02 - 01941504 _____ (Microsoft Corporation) C:\windows\system32\authui.dll
2015-01-16 13:18 - 2014-06-03 11:02 - 00504320 _____ (Microsoft Corporation) C:\windows\system32\msihnd.dll
2015-01-16 13:18 - 2014-06-03 11:02 - 00112064 _____ (Microsoft Corporation) C:\windows\system32\consent.exe
2015-01-16 13:18 - 2014-06-03 10:29 - 01805824 _____ (Microsoft Corporation) C:\windows\SysWOW64\authui.dll
2015-01-16 13:18 - 2014-06-03 10:29 - 00337408 _____ (Microsoft Corporation) C:\windows\SysWOW64\msihnd.dll
2015-01-16 13:15 - 2015-01-16 13:15 - 00001978 _____ () C:\Users\Public\Desktop\G DATA INTERNET SECURITY.lnk
2015-01-16 13:15 - 2015-01-16 13:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G DATA INTERNET SECURITY
2015-01-16 13:13 - 2015-01-16 13:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-19 06:56 - 2013-07-09 12:45 - 00001110 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-01-19 06:55 - 2013-05-14 23:19 - 00000000 ____D () C:\Users\sebastian\AppData\Roaming\Skype
2015-01-19 06:27 - 2013-05-14 23:33 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2015-01-19 06:06 - 2013-09-20 18:09 - 00000000 ____D () C:\Users\sebastian\AppData\Roaming\Spotify
2015-01-19 05:00 - 2013-07-08 20:14 - 01467794 _____ () C:\windows\WindowsUpdate.log
2015-01-19 04:36 - 2012-07-23 05:03 - 00000000 ____D () C:\Program Files (x86)\Windows Live
2015-01-19 04:32 - 2014-04-04 14:31 - 00000000 ____D () C:\Users\sebastian\AppData\Roaming\DeepBurner
2015-01-19 04:31 - 2014-12-15 13:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hegemony Gold
2015-01-19 04:31 - 2009-07-14 04:20 - 00000000 ____D () C:\windows\system32\sysprep
2015-01-19 04:10 - 2013-05-14 23:40 - 00000000 ____D () C:\ProgramData\Origin
2015-01-19 04:07 - 2014-09-10 22:55 - 00007599 _____ () C:\Users\sebastian\AppData\Local\Resmon.ResmonCfg
2015-01-19 04:02 - 2009-07-14 05:45 - 00021872 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-01-19 04:02 - 2009-07-14 05:45 - 00021872 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-01-19 03:26 - 2011-02-23 13:12 - 05745942 _____ () C:\windows\system32\perfh007.dat
2015-01-19 03:26 - 2011-02-23 13:12 - 01717496 _____ () C:\windows\system32\perfc007.dat
2015-01-19 03:26 - 2009-07-14 06:13 - 00006548 _____ () C:\windows\system32\PerfStringBackup.INI
2015-01-19 03:21 - 2013-07-09 12:44 - 00001106 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-01-19 03:20 - 2012-07-20 10:28 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-01-19 03:20 - 2009-07-14 06:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2015-01-19 03:03 - 2013-07-09 12:45 - 00000000 ____D () C:\Users\sebastian\AppData\Roaming\DataMgr
2015-01-19 03:03 - 2013-07-09 12:13 - 00000000 ____D () C:\Users\sebastian\AppData\Roaming\SoftGrid Client
2015-01-19 03:03 - 2013-07-06 19:19 - 00000000 ____D () C:\Users\sebastian\AppData\Roaming\BabSolution
2015-01-19 03:02 - 2013-07-04 23:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EA Games
2015-01-19 03:02 - 2013-05-15 10:23 - 00000000 ____D () C:\Users\sebastian\AppData\Local\CrashDumps
2015-01-19 03:02 - 2012-07-20 10:23 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-01-19 02:57 - 2013-07-08 10:38 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-01-19 02:43 - 2012-07-23 05:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2015-01-19 02:43 - 2012-07-20 10:28 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation
2015-01-19 02:42 - 2012-07-20 10:28 - 00000000 ____D () C:\Program Files\NVIDIA Corporation
2015-01-19 02:33 - 2013-06-22 09:27 - 00001347 _____ () C:\Users\Public\Desktop\GeForce Experience.lnk
2015-01-19 02:33 - 2013-06-22 09:27 - 00000000 ____D () C:\Users\sebastian\AppData\Local\NVIDIA
2015-01-19 02:33 - 2012-07-20 10:28 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation
2015-01-18 20:00 - 2014-12-02 13:35 - 00000474 _____ () C:\windows\Tasks\Wise Registry Cleaner Schedule Task.job
2015-01-18 14:54 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Public\Libraries
2015-01-18 11:48 - 2013-05-14 22:05 - 00000000 ____D () C:\Users\sebastian\AppData\Local\VirtualStore
2015-01-18 11:14 - 2013-10-15 13:08 - 00000000 ____D () C:\ProgramData\YTD Video Downloader
2015-01-18 11:14 - 2013-07-09 12:45 - 00000000 ____D () C:\Users\sebastian\AppData\Roaming\Intermediate
2015-01-18 03:16 - 2009-07-14 05:45 - 00278624 _____ () C:\windows\system32\FNTCACHE.DAT
2015-01-17 19:07 - 2013-05-14 22:06 - 00062008 _____ () C:\Users\sebastian\AppData\Local\GDIPFONTCACHEV1.DAT
2015-01-17 10:28 - 2013-09-20 18:09 - 00000000 ____D () C:\Users\sebastian\AppData\Local\Spotify
2015-01-16 23:27 - 2009-07-14 04:20 - 00000000 ____D () C:\windows\rescache
2015-01-16 22:13 - 2014-12-11 16:39 - 00174624 _____ (EasyAntiCheat Ltd) C:\windows\SysWOW64\EasyAntiCheat.exe
2015-01-16 14:27 - 2013-05-14 23:33 - 00701616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2015-01-16 14:27 - 2013-05-14 23:33 - 00071344 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-16 14:27 - 2013-05-14 23:33 - 00003822 _____ () C:\windows\System32\Tasks\Adobe Flash Player Updater
2015-01-16 13:45 - 2013-11-21 14:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Origin
2015-01-16 13:41 - 2014-05-06 20:49 - 00000000 ___SD () C:\windows\system32\CompatTel
2015-01-16 13:41 - 2009-07-14 04:20 - 00000000 ____D () C:\windows\PolicyDefinitions
2015-01-16 13:41 - 2009-07-14 04:20 - 00000000 ____D () C:\windows\AppCompat
2015-01-16 13:23 - 2013-07-18 23:49 - 00000000 ____D () C:\windows\system32\MRT
2015-01-16 13:15 - 2014-04-06 23:50 - 00020992 _____ (G Data Software AG) C:\windows\system32\Drivers\GDKBFlt64.sys
2015-01-16 13:15 - 2013-05-14 23:00 - 00142336 _____ (G Data Software AG) C:\windows\system32\Drivers\MiniIcpt.sys
2015-01-16 13:15 - 2013-05-14 23:00 - 00064512 _____ (G Data Software AG) C:\windows\system32\Drivers\gdwfpcd64.sys
2015-01-16 13:13 - 2014-03-19 00:57 - 00002699 _____ () C:\Users\Public\Desktop\Skype.lnk
2015-01-16 13:13 - 2014-03-19 00:57 - 00000000 ___RD () C:\Program Files (x86)\Skype
2015-01-16 13:13 - 2013-05-14 23:19 - 00000000 ____D () C:\ProgramData\Skype
2015-01-16 12:58 - 2014-03-11 21:59 - 00002175 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-01-16 12:51 - 2013-07-09 12:45 - 00004106 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-01-16 12:51 - 2013-07-09 12:45 - 00003854 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-01-16 12:36 - 2009-07-14 04:20 - 00000000 ____D () C:\windows\system32\NDF
2015-01-08 09:55 - 2010-11-21 04:27 - 00298120 ____N (Microsoft Corporation) C:\windows\system32\MpSigStub.exe
2014-12-31 13:12 - 2013-05-15 10:07 - 113365784 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2014-12-20 14:14 - 2009-07-14 06:08 - 00032640 _____ () C:\windows\Tasks\SCHEDLGU.TXT

==================== Files in the root of some directories =======
2013-11-27 11:08 - 2013-11-27 11:09 - 0000478 _____ () C:\Users\sebastian\AppData\Roaming\com.zoosk.Desktop_state.xml
2014-03-19 13:19 - 2014-03-31 14:19 - 0000091 _____ () C:\Users\sebastian\AppData\Roaming\WB.CFG
2014-09-10 22:55 - 2015-01-19 04:07 - 0007599 _____ () C:\Users\sebastian\AppData\Local\Resmon.ResmonCfg
2015-01-18 11:44 - 2015-01-18 11:44 - 0000057 _____ () C:\ProgramData\Ament.ini

Some content of TEMP:
====================
C:\Users\sebastian\AppData\Local\Temp\nvStInst.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-01-16 23:00

==================== End Of Log ============================
         

--- --- ---
FRST Additions Logfile:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 18-01-2015 03
Ran by sebastian at 2015-01-19 07:07:05
Running from C:\Users\sebastian\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: G DATA INTERNET SECURITY (Enabled - Up to date) {545C8713-0744-B079-87F8-349A6D5C8CF0}
AS: G DATA INTERNET SECURITY (Enabled - Up to date) {EF3D66F7-217E-BFF7-BD48-0FE816DBC64D}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: G Data Personal Firewall (Enabled) {6C670636-4D2B-B121-ACA7-9DAF938FCB8B}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.257 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.257 - Adobe Systems Incorporated)
Afterfall InSanity Extended Edition (HKLM-x32\...\Steam App 224420) (Version:  - Intoxicate Studios)
Age of Empires Online (HKLM-x32\...\GFWL_{4D530FA3-9B89-4186-98B7-F51000000100}) (Version: 1.0.0000.1 - Microsoft Studios)
Age of Empires Online (x32 Version: 1.0.0000.1 - Microsoft Studios) Hidden
Age of Empires® III: Complete Collection (HKLM-x32\...\Steam App 105450) (Version:  - Ensemble Studios)
Age of Mythology - The Titans Expansion (HKLM-x32\...\Age of Mythology Expansion Pack 1.0) (Version:  - )
Age of Mythology (HKLM-x32\...\Age of Mythology 1.0) (Version:  - )
Alien Swarm (HKLM-x32\...\Steam App 630) (Version:  - Valve)
Assassin's Creed (HKLM-x32\...\Steam App 15100) (Version:  - Ubisoft Montreal)
AVG PC TuneUp 2015 (de-DE) (x32 Version: 15.0.1001.238 - AVG Technologies) Hidden
AVG PC TuneUp 2015 (HKLM-x32\...\AVG PC TuneUp) (Version: 15.0.1001.238 - AVG Technologies)
AVG PC TuneUp 2015 (x32 Version: 15.0.1001.238 - AVG Technologies) Hidden
AVM FRITZ!WLAN (HKLM-x32\...\AVMWLANCLI) (Version:  - AVM Berlin)
Battlefield 1942 (HKLM-x32\...\{698D7E61-E4BF-4CA6-8A09-CF6BDBFDEF65}) (Version:  - )
Battlefield 3™ (HKLM-x32\...\{76285C16-411A-488A-BCE3-C83CB933D8CF}) (Version: 1.6.0.0 - Electronic Arts)
Battlefield 4™ (HKLM-x32\...\{ABADE36E-EC37-413B-8179-B432AD3FACE7}) (Version: 1.4.2.23831 - Electronic Arts)
Call of Duty: Modern Warfare 3 - Multiplayer (HKLM-x32\...\Steam App 42690) (Version:  - Infinity Ward)
CCleaner (HKLM\...\CCleaner) (Version: 4.03 - Piriform)
Command & Conquer™ 3 Tiberium Wars and Kane's Wrath (HKLM-x32\...\{35A2FE53-CC80-4D17-941F-3A7C82824FC7}) (Version: 1.0.0.0 - Electronic Arts, Inc.)
Command & Conquer™ 4 Tiberian Twilight (HKLM-x32\...\{BA4C8F9F-D81B-4AFE-AE5A-3837830F5B89}) (Version: 1.0.0.0 - Electronic Arts, Inc.)
Command & Conquer™ and The Covert Operations™ (HKLM-x32\...\{050E298D-C9B8-4582-A332-26201268A297}) (Version: 1.0.0.0 - Electronic Arts, Inc.)
Command & Conquer™ Red Alert, Counterstrike and The Aftermath (HKLM-x32\...\{25456D58-2414-4CC4-AA1B-CF3A2BE00A79}) (Version: 1.0.0.0 - Electronic Arts, Inc.)
Command & Conquer™ Red Alert™ 3 and Uprising (HKLM-x32\...\{3C315BF7-4B64-4024-8102-174A197437FA}) (Version: 1.0.0.0 - Electronic Arts, Inc.)
Command & Conquer™ The Ultimate Collection Additional Content (HKLM-x32\...\{1A882F29-BC18-4AC2-A71E-0FC30FA32568}) (Version: 1.0.0.0 - Electronic Arts)
Command & Conquer™ Tiberian Sun™ and Firestorm™ (HKLM-x32\...\{517FAF1E-3045-49DE-8079-107C2851389E}) (Version: 1.0.0.0 - Electronic Arts, Inc.)
Command & Conquer™: Generals and Zero Hour (HKLM-x32\...\{609F6FD5-4B22-4D7A-AD30-8C9DD480D5BE}) (Version: 1.0.0.0 - Electronic Arts, Inc.)
Company of Heroes - FAKEMSI (x32 Version: 2.0.0.0 - THQ Inc.) Hidden
Company of Heroes (HKLM-x32\...\Company of Heroes) (Version: 2.0.0.1 - THQ Inc.)
Company of Heroes 2 (HKLM-x32\...\Steam App 231430) (Version:  - Relic Entertainment)
Counter-Strike: Source (HKLM-x32\...\{9580813D-94B1-4C28-9426-A441E2BB29A5}) (Version: 1.0.0.0 - Valve)
Cry of Fear (HKLM-x32\...\Steam App 223710) (Version:  - Team Psykskallar)
Crysis 2 Maximum Edition (HKLM-x32\...\Steam App 108800) (Version:  - Crytek Studios)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Day of Defeat: Source (HKLM-x32\...\Steam App 300) (Version:  - Valve)
Dead Island (HKLM-x32\...\Steam App 91310) (Version:  - Techland)
Dead Island: Epidemic (HKLM-x32\...\Steam App 222900) (Version:  - Stunlock Studios)
Dead Space (HKLM-x32\...\{025A585C-0C66-413D-80D2-4C05CB699771}) (Version: 1.0.0.222 - Electronic Arts)
Defiance (HKLM-x32\...\Steam App 224600) (Version:  - Trion Worlds, Inc.)
Die Siedler 7 (HKLM-x32\...\{9C916142-C18C-429D-BFED-40094A7E0BEB}) (Version: 1.00.0000 - Ubisoft)
EA Sports FIFA World (HKLM-x32\...\{8F9AC744-EEF6-43DB-A4B6-FA1A18F1C640}) (Version: 7.0.0.47449 - Electronic Arts, Inc.)
EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version:  - Seiko Epson Corporation)
EPSON SX125 Series Printer Uninstall (HKLM\...\EPSON SX125 Series) (Version:  - SEIKO EPSON Corporation)
ESN Sonar (HKLM-x32\...\ESN Sonar-0.70.4) (Version: 0.70.4 - ESN Social Software AB)
Far Cry 3 (HKLM-x32\...\{E3B9C5A9-BD7A-4B56-B754-FAEA7DD6FA88}) (Version: 1.05 - Ubisoft)
G DATA INTERNET SECURITY (HKLM-x32\...\{85203592-3610-4FB9-AA11-15B2255B5A12}) (Version: 25.0.2.4 - G DATA Software AG)
Gemeinsam genutzte Internet-Komponenten von Westwood (HKLM-x32\...\WOLAPI) (Version:  - )
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 39.0.2171.99 - Google Inc.)
Google Chrome Frame (HKLM-x32\...\{1F0342F5-8369-3CD1-99DD-E9BC44473708}) (Version: 65.107.16500 - Google, Inc.)
Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
HAWKEN (HKLM-x32\...\Steam App 271290) (Version:  - Adhesive Games)
HD Tune 2.55 (HKLM-x32\...\HD Tune_is1) (Version:  - EFD Software)
HP Officejet 4620 series - Grundlegende Software für das Gerät (HKLM\...\{B16F9E6E-1388-472C-98C3-F32D397EF85D}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
HP Officejet 4620 series Hilfe (HKLM-x32\...\{72EDA2AC-2908-4BB3-97E5-4F9DDEBF9731}) (Version: 6.0.0 - Hewlett Packard)
HP Update (HKLM-x32\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
I.R.I.S. OCR (HKLM-x32\...\{CA6BCA2F-EDEB-408F-850B-31404BE16A61}) (Version: 12.3.4.0 - HP)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1008 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.0.12.1498 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.2.0.1006 - Intel Corporation)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Just Cause 2 (HKLM-x32\...\Steam App 8190) (Version:  - Avalanche)
Just Cause 2: Multiplayer Mod (HKLM-x32\...\Steam App 259080) (Version:  - JC2-MP Team)
Men of War (HKLM-x32\...\Steam App 7830) (Version:  - Best Way)
Men of War: Assault Squad (HKLM-x32\...\Steam App 64000) (Version:  - Digitalmindsoft)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Metro 2033 (HKLM-x32\...\Steam App 43110) (Version:  - THQ)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Age of Empires (HKLM-x32\...\Age of Empires) (Version:  - )
Microsoft ASP.NET MVC 4 Runtime (HKLM-x32\...\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 - Microsoft Corporation)
Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{832D9DE0-8AFC-4689-9819-4DBBDEBD3E4F}) (Version: 3.5.92.0 - Microsoft Corporation)
Microsoft Games for Windows Marketplace (HKLM-x32\...\{67F42018-F647-4D3C-BE62-F8CB4FE2FCD5}) (Version: 3.5.67.0 - Microsoft Corporation)
Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Klick-und-Los 2010 (HKLM-x32\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Starter 2010 - Deutsch (HKLM-x32\...\{90140011-0066-0407-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)
MotioninJoy Gamepad tool 0.7.1001 (HKLM\...\{330DAC67-5B62-452A-A0E4-6B4A5923940F}_is1) (Version: 0.7.1001 - MotioninJoy | Playstation 3|Xbox 360|Dualshock 3|Sixaxis|Game|Driver|)
Mozilla Firefox 29.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 29.0.1 (x86 de)) (Version: 29.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML4 Parser (HKLM-x32\...\{01501EBA-EC35-4F9F-8889-3BE346E5DA13}) (Version: 1.0.0 - Microsoft Game Studios)
Napoleon: Total War (HKLM-x32\...\Steam App 34030) (Version:  - The Creative Assembly)
Need For Speed™ World (HKLM-x32\...\{3AF1B16A-7DC9-4C80-BAEC-70B088A7C5B8}) (Version: 1.0.0.0 - Electronic Arts)
NVIDIA 3D Vision Controller-Treiber 347.09 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 347.09 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 347.09 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 347.09 - NVIDIA Corporation)
NVIDIA GeForce Experience 2.1.5 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.1.5 - NVIDIA Corporation)
NVIDIA Grafiktreiber 347.09 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 347.09 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.33.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.33.0 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.14.0702 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.14.0702 - NVIDIA Corporation)
Origin (HKLM-x32\...\Origin) (Version: 9.3.11.2762 - Electronic Arts, Inc.)
Pflanzen gegen Zombies™ (HKLM-x32\...\{5E6536C2-E79A-49CF-83EA-817AD81F9FC8}) (Version: 1.2.0.1093 - Electronic Arts, Inc.)
PlanetSide 2 (HKLM-x32\...\Steam App 218230) (Version:  - Sony Online Entertainment)
PunkBuster für Battlefield 1942 (HKLM-x32\...\{127B684B-A002-44C8-99A7-6CF8F1E26873}) (Version:  - )
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.58.411.2012 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6662 - Realtek Semiconductor Corp.)
Rust (HKLM-x32\...\Steam App 252490) (Version:  - Facepunch Studios)
Saints Row 2 (HKLM-x32\...\Steam App 9480) (Version:  - Volition)
Saints Row: The Third (HKLM-x32\...\Steam App 55230) (Version:  - Volition)
SHIELD Streaming (Version: 3.1.3000 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 16.18.9 - NVIDIA Corporation) Hidden
Sid Meier's Civilization V (HKLM-x32\...\Steam App 8930) (Version:  - 2K Games, Inc.)
Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)
Spotify (HKU\S-1-5-21-526734976-3399402404-692726830-1001\...\Spotify) (Version: 0.9.15.27.g87efe634 - Spotify AB)
Star Wars: The Old Republic (HKLM-x32\...\{3B11D799-48E0-48ED-BFD7-EA655676D8BB}) (Version: 1.00 - Electronic Arts, Inc.)
StarCraft II (HKLM-x32\...\StarCraft II) (Version:  - Blizzard Entertainment)
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
Studie zur Verbesserung von HP Officejet 4620 series Produkten (HKLM\...\{ABBC6F00-E9C9-4B1E-B046-8FFD7BA3A456}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
Supreme Commander 2 (HKLM-x32\...\Steam App 40100) (Version:  - Gas Powered Games)
Supreme Commander: Forged Alliance (HKLM-x32\...\Steam App 9420) (Version:  - Gas Powered Games)
System Requirements Lab for Intel (HKLM-x32\...\{C7CA731B-BF9A-46D9-92CF-8A8737AE9240}) (Version: 4.5.13.0 - Husdawg, LLC)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.15 - TeamSpeak Systems GmbH)
The Elder Scrolls Online (HKLM-x32\...\The Elder Scrolls Online) (Version: 1.0.0.0 - Zenimax Online Studios)
Titanfall™ (HKLM-x32\...\{347EE0C3-0690-48F6-A231-53853C2A80D6}) (Version: 1.0.3.7 - Electronic Arts)
Tom Clancy's Ghost Recon Phantoms - EU (HKLM-x32\...\Steam App 272350) (Version:  - Ubisoft Singapore)
Total War: ROME II (HKLM-x32\...\Steam App 214950) (Version:  - Creative Assembly)
Total War: Rome II Additional Depots (HKLM-x32\...\Steam App 243660) (Version:  - )
Tropico 4 (HKLM-x32\...\Steam App 57690) (Version:  - Haemimont Games)
Unity Web Player (HKU\S-1-5-21-526734976-3399402404-692726830-1001\...\UnityWebPlayer) (Version:  - Unity Technologies ApS)
Uplay (HKLM-x32\...\Uplay) (Version: 3.0 - Ubisoft)
War Thunder (HKLM-x32\...\Steam App 236390) (Version:  - Gaijin Entertainment)
Warcraft III (HKLM-x32\...\Warcraft III) (Version:  - )
Warcraft III: All Products (HKU\S-1-5-21-526734976-3399402404-692726830-1001\...\Warcraft III) (Version:  - )
Warhammer 40,000 Space Marine (HKLM-x32\...\Steam App 55150) (Version:  - Relic)
Warhammer® 40,000™: Dawn of War® II – Retribution™ (HKLM-x32\...\Steam App 56400) (Version:  - Relic)
WestwoodChat (HKLM-x32\...\{7CAE6A67-AF7B-4A6A-8705-8AFACA45BB60}) (Version: 1.0.0.0 - WestwoodChat)
WestwoodOnline (HKLM-x32\...\{BBCD6D56-8A26-4DDE-9482-DBC9C7B7341D}) (Version: 1.0.0.0 - WestwoodOnline)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3538.0513 - Microsoft Corporation)
Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
WinRAR 4.20 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
Wise Registry Cleaner 7.71 (HKLM-x32\...\Wise Registry Cleaner_is1) (Version: 7.71 - WiseCleaner.com, Inc.)
World of Tanks (HKLM-x32\...\{1EAC1D02-C6AC-4FA6-9A44-96258C37C812EU}_is1) (Version:  - Wargaming.net)
World of Warcraft (HKLM-x32\...\World of Warcraft) (Version:  - Blizzard Entertainment)
World of Warplanes (HKLM-x32\...\{1EAC1D02-C6AC-4FA6-9A44-96258C37C813EU}_is1) (Version:  - Wargaming.net)
YTD Video Downloader 4.8.2 (HKLM-x32\...\{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}) (Version: 4.8.2 - GreenTree Applications SRL) <==== ATTENTION

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

19-01-2015 03:43:01 Removed Java 7 Update 65
19-01-2015 04:26:15 AVG PC TuneUp 2015 wird installiert
19-01-2015 04:36:04 Windows Live Essentials
19-01-2015 04:36:09 WLSetup

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {06D34F94-D85D-44E8-B968-645A95E1B1FE} - System32\Tasks\{131A993B-9603-4F3A-8798-7B0684DA3A38} => pcalua.exe -a "D:\Zona Downloads\Generals.exe" -d "D:\Zona Downloads"
Task: {09894AFF-5B15-4424-9F12-39D832613E16} - System32\Tasks\Wise Registry Cleaner Schedule Task => C:\Program Files (x86)\Wise\Wise Registry Cleaner\WiseRegCleaner.exe [2013-05-20] (WiseCleaner.com)
Task: {19F9F983-83E4-49B7-B961-F9F95A8E895A} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {3BAD1BFD-34BD-4F4D-B72A-3AA3C4F77896} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-07-09] (Google Inc.)
Task: {405A686B-8B18-4570-9CF3-767620A1335D} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-06-19] (Piriform Ltd)
Task: {4A7FBE01-4261-4510-A302-B2ED45F206D0} - System32\Tasks\{C9F36A68-B9BD-4791-9833-9A4B5F960B58} => pcalua.exe -a E:\setup.exe -d E:\
Task: {5DCE32BD-C16F-4B12-A2D4-5995A0C1CA0E} - System32\Tasks\{69F00A85-BEF4-43EA-AF71-350B44AB7875} => D:\Dawn of War\WinterAssault.exe
Task: {7177E461-FE81-4025-8B29-F5BB0D65E3C9} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-07-09] (Google Inc.)
Task: {76F81BEA-7033-4533-AE07-7F4A76B48D75} - System32\Tasks\Games\UpdateCheck_S-1-5-21-526734976-3399402404-692726830-1001
Task: {7953623A-ACC5-4BF2-BE42-5783382E1714} - System32\Tasks\{DAC4CD0D-37EB-4257-B734-990C68B1F027} => pcalua.exe -a "D:\steam\SteamApps\common\Total War Rome II\redist\vcredist_x86-90.exe" -d "D:\steam\SteamApps\common\Total War Rome II\redist"
Task: {AE094664-759B-40ED-A2B5-EEB401CA6957} - System32\Tasks\{E0992F84-2B20-4F75-9A61-BE19156027E6} => pcalua.exe -a E:\autorun.exe -d E:\
Task: {B73A3AB7-3F8E-4332-8AB0-7841F8CD74BE} - System32\Tasks\{F186E46A-4982-422A-8AD0-B3C0D12DADB2} => pcalua.exe -a "D:\Far cry 3\ACTOFWAR.EXE" -d "D:\Far cry 3"
Task: {B80F1FB9-C582-4983-9580-603663C17845} - System32\Tasks\Abelssoft\Updater scan => C:\Program Files (x86)\CHIP Updater\CHIPUpdater.exe
Task: {BB89643F-B716-4D96-9278-4CD4D1E0F74A} - System32\Tasks\4806 => Wscript.exe C:\Users\SEBAST~1\AppData\Local\Temp\launchie.vbs //B <==== ATTENTION
Task: {C3468234-E5DF-492C-A62A-86A23A4018FE} - System32\Tasks\{80C9C5B4-3E46-40F9-984D-2D0026DED395} => pcalua.exe -a C:\Users\sebastian\Downloads\DeepBurner19.exe -d C:\Users\sebastian\Downloads
Task: {D5C20E4A-6E01-4390-BFFA-330577BC2F91} - System32\Tasks\HPCustParticipation HP Officejet 4620 series => C:\Program Files\HP\HP Officejet 4620 series\Bin\HPCustPartic.exe [2012-10-17] (Hewlett-Packard Co.)
Task: {DA4D60FF-5008-4037-A513-450DBAD8C0C4} - System32\Tasks\{5F6B2641-5231-4EE9-9443-4EA3359C38E4} => pcalua.exe -a E:\Launch.exe -d E:\
Task: {DE2FDFF1-8F10-4D38-96EC-5536CB9397BA} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-01-16] (Adobe Systems Incorporated)
Task: {E331E689-EA59-4B1B-AE90-A9E86C8F0D3E} - System32\Tasks\0 => Iexplore.exe  <==== ATTENTION
Task: {F089C2B5-E48F-414A-BE82-C260A6395CB7} - System32\Tasks\{A387FFCA-74DE-4D32-979E-74CD023CAA1E} => pcalua.exe -a C:\Users\sebastian\Downloads\ProMod.exe -d C:\Users\sebastian\Downloads
Task: {FBF314B2-A5B8-4969-86D8-C570A1D354B7} - System32\Tasks\{95988ECE-552A-4137-BEC4-BCE9D40D15AC} => pcalua.exe -a E:\DirectX9\dxsetup.exe -d E:\DirectX9
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\Wise Registry Cleaner Schedule Task.job => C:\Program Files (x86)\Wise\Wise Registry Cleaner\WiseRegCleaner.exe

==================== Loaded Modules (whitelisted) =============

2012-07-20 10:28 - 2014-12-13 09:03 - 00117576 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2013-05-15 16:10 - 2014-11-07 15:42 - 00076888 _____ () C:\windows\SysWOW64\PnkBstrA.exe
2014-05-20 02:38 - 2014-05-20 02:38 - 00340088 ____N () C:\Program Files (x86)\Common Files\G Data\AVKProxy\PktIcpt2x64.dll
2014-11-24 12:48 - 2014-11-24 12:48 - 00713528 _____ () C:\Program Files (x86)\AVG\AVG PC TuneUp\avgrepliba.dll
2014-11-24 12:49 - 2014-11-24 12:49 - 00856888 _____ () C:\Program Files (x86)\AVG\AVG PC TuneUp\tulnga.dll
2013-09-24 15:23 - 2015-01-16 13:44 - 00374840 _____ () C:\Users\sebastian\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
2015-01-16 15:22 - 2014-11-11 19:48 - 01171456 _____ () D:\steam\libavcodec-56.dll
2015-01-16 15:22 - 2014-11-11 19:48 - 00442368 _____ () D:\steam\libavutil-54.dll
2015-01-16 15:22 - 2014-11-11 19:48 - 00332800 _____ () D:\steam\libavresample-2.dll
2013-04-23 17:30 - 2014-11-11 19:47 - 00774656 _____ () D:\steam\SDL2.dll
2014-05-22 19:15 - 2014-11-18 21:23 - 02227904 _____ () D:\steam\video.dll
2015-01-16 15:22 - 2014-11-11 19:48 - 00403968 _____ () D:\steam\libavformat-56.dll
2015-01-16 15:22 - 2014-11-11 19:48 - 00485888 _____ () D:\steam\libswscale-3.dll
2013-05-03 14:35 - 2014-11-18 21:23 - 00690880 _____ () D:\steam\bin\chromehtml.DLL
2013-09-20 18:09 - 2015-01-16 13:44 - 36966968 _____ () C:\Users\sebastian\AppData\Roaming\Spotify\Data\libcef.dll
2013-03-26 15:16 - 2014-11-11 19:48 - 34589888 _____ () D:\steam\bin\libcef.dll
2015-01-16 15:22 - 2014-11-11 19:48 - 00837824 _____ () D:\steam\bin\ffmpegsumo.dll
2015-01-16 17:04 - 2015-01-16 17:04 - 00172544 _____ () C:\windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\2dace9622c68c6ce58d55a6950eeaa95\IsdiInterop.ni.dll
2012-07-20 10:25 - 2012-05-30 12:55 - 00059904 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2012-07-20 10:24 - 2012-05-10 14:03 - 01198872 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2014-07-25 08:11 - 2015-01-16 13:44 - 00867896 _____ () C:\Users\sebastian\AppData\Roaming\Spotify\Data\ffmpegsumo.dll
2013-09-24 15:23 - 2015-01-16 13:44 - 00886840 _____ () C:\Users\sebastian\AppData\Roaming\Spotify\Data\libglesv2.dll
2013-09-24 15:23 - 2015-01-16 13:44 - 00108600 _____ () C:\Users\sebastian\AppData\Roaming\Spotify\Data\libegl.dll
2014-05-29 18:39 - 2014-05-29 18:39 - 03839088 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2013-05-15 01:09 - 2014-12-17 22:37 - 00044544 _____ () D:\Wot\voip.dll
2013-05-15 01:09 - 2014-12-17 22:37 - 00323568 _____ () D:\Wot\ortp.dll
2013-05-15 01:09 - 2014-12-17 22:37 - 00270336 _____ () D:\Wot\libcurl.dll
2014-07-10 02:00 - 2015-01-09 11:31 - 00109832 _____ () D:\Wot\librsync.dll
2013-05-15 01:09 - 2014-12-17 22:37 - 00386600 _____ () D:\Wot\NxCooking.dll
2013-05-15 01:09 - 2014-12-17 22:37 - 00071208 _____ () D:\Wot\PhysXLoader.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData\TEMP:56E2E879

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


========================= Accounts: ==========================

Administrator (S-1-5-21-526734976-3399402404-692726830-500 - Administrator - Disabled)
Gast (S-1-5-21-526734976-3399402404-692726830-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-526734976-3399402404-692726830-1003 - Limited - Enabled)
sebastian (S-1-5-21-526734976-3399402404-692726830-1001 - Administrator - Enabled) => C:\Users\sebastian

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (01/19/2015 03:26:53 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.

Error: (01/19/2015 03:26:53 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (01/19/2015 03:26:53 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (01/19/2015 03:22:48 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/19/2015 03:11:59 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.

Error: (01/19/2015 03:11:59 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (01/19/2015 03:11:59 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (01/19/2015 03:07:52 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/19/2015 03:02:00 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Au_.exe, Version: 0.0.0.0, Zeitstempel: 0x4bc06cd3
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea8e7
Ausnahmecode: 0xc00000fd
Fehleroffset: 0x0002e270
ID des fehlerhaften Prozesses: 0x2f6c
Startzeit der fehlerhaften Anwendung: 0xAu_.exe0
Pfad der fehlerhaften Anwendung: Au_.exe1
Pfad des fehlerhaften Moduls: Au_.exe2
Berichtskennung: Au_.exe3

Error: (01/19/2015 02:50:32 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "ASP.NET" (ASP.NET). Der Fehlercode ist das erste DWORD im Datenbereich.


System errors:
=============
Error: (01/19/2015 03:20:57 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "lirsgt" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1275

Error: (01/19/2015 03:20:57 AM) (Source: Application Popup) (EventID: 1060) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\DRIVERS\lirsgt.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.

Error: (01/19/2015 03:20:56 AM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎19.‎01.‎2015 um 03:19:56 unerwartet heruntergefahren.

Error: (01/19/2015 03:20:16 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst wlidsvc erreicht.

Error: (01/19/2015 03:18:57 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "lirsgt" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1275

Error: (01/19/2015 03:18:57 AM) (Source: Application Popup) (EventID: 1060) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\DRIVERS\lirsgt.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.

Error: (01/19/2015 03:06:01 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "lirsgt" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1275

Error: (01/19/2015 03:06:01 AM) (Source: Application Popup) (EventID: 1060) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\DRIVERS\lirsgt.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.

Error: (01/18/2015 02:54:05 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "BlueStacks Updater Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (01/18/2015 10:24:45 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
GDKBFlt


Microsoft Office Sessions:
=========================
Error: (01/19/2015 03:26:53 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000

Error: (01/19/2015 03:26:53 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (01/19/2015 03:26:53 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (01/19/2015 03:22:48 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/19/2015 03:11:59 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000

Error: (01/19/2015 03:11:59 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (01/19/2015 03:11:59 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (01/19/2015 03:07:52 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/19/2015 03:02:00 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Au_.exe0.0.0.04bc06cd3ntdll.dll6.1.7601.18247521ea8e7c00000fd0002e2702f6c01d0338bdc3a7ef4C:\Users\SEBAST~1\AppData\Local\Temp\~nsu.tmp\Au_.exeC:\windows\SysWOW64\ntdll.dll26e75a80-9f7f-11e4-8842-bc054306f36a

Error: (01/19/2015 02:50:32 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: ASP.NETASP.NET8F20300004D070000


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i5-3570K CPU @ 3.40GHz
Percentage of memory in use: 63%
Total physical RAM: 8143 MB
Available physical RAM: 2938 MB
Total Pagefile: 24439.18 MB
Available Pagefile: 18707.84 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:89.99 GB) (Free:20.04 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: () (Fixed) (Total:931.51 GB) (Free:215.54 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 111.8 GB) (Disk ID: 99E7CC43)
Partition 1: (Not Active) - (Size=90 GB) - (Type=07 NTFS)
Partition 2: (Active) - (Size=21.8 GB) - (Type=27)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 3E0A2CC3)
Partition 1: (Not Active) - (Size=931.5 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

--- --- ---
Das hat er mir ausgespuckt.

Gruß Sebastian

Lade Dir bitte von hier Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.

• Installiere und starte das Programm. (Bebilderte Anleitung zu Revo Uninstaller)
• Klicke auf Optionen und wähle als Sprache Deutsch.
• Suche im Uninstallerfeld nach den Programmen:
  
  YTD Video Downloader 4.8.2
  
  
  
• Wähle die Programme nacheinander aus und klicke jedes Mal auf Uninstall.
• Wähle anschließend den Modus "Moderat" aus.
  
• Reste löschen:
  Klicke auf dann auf und dann auf .

 

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

• WICHTIG: Speichere Combofix auf deinem Desktop.
• Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
• Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
• Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
• Wenn Combofix fertig ist, wird es ein Logfile erstellen.
• Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

Entschuldigen Sie die späte Nachricht, ich war die letzten Tage nicht zugegen

ComboFix 15-01-18.01 - sebastian 21.01.2015  16:48:19.1.4 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.8143.5427 [GMT 1:00]
ausgeführt von:: c:\users\sebastian\Downloads\ComboFix.exe
AV: G DATA INTERNET SECURITY *Enabled/Updated* {545C8713-0744-B079-87F8-349A6D5C8CF0}
FW: G Data Personal Firewall *Disabled* {6C670636-4D2B-B121-ACA7-9DAF938FCB8B}
SP: G DATA INTERNET SECURITY *Enabled/Updated* {EF3D66F7-217E-BFF7-BD48-0FE816DBC64D}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Im Speicher befindliches AV aktiv.
.
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\END
c:\users\sebastian\AppData\Roaming\0ad
c:\users\sebastian\AppData\Roaming\0ad\config\user.cfg
c:\users\sebastian\AppData\Roaming\Common\LuaRT
c:\users\sebastian\AppData\Roaming\Common\LuaRT\alien\core.dll
c:\users\sebastian\AppData\Roaming\Common\LuaRT\alien\struct.dll
c:\users\sebastian\AppData\Roaming\Common\LuaRT\json\decode.lua
c:\users\sebastian\AppData\Roaming\Common\LuaRT\json\decode\array.lua
c:\users\sebastian\AppData\Roaming\Common\LuaRT\json\decode\calls.lua
c:\users\sebastian\AppData\Roaming\Common\LuaRT\json\decode\number.lua
c:\users\sebastian\AppData\Roaming\Common\LuaRT\json\decode\object.lua
c:\users\sebastian\AppData\Roaming\Common\LuaRT\json\decode\others.lua
c:\users\sebastian\AppData\Roaming\Common\LuaRT\json\decode\strings.lua
c:\users\sebastian\AppData\Roaming\Common\LuaRT\json\decode\util.lua
c:\users\sebastian\AppData\Roaming\Common\LuaRT\json\encode.lua
c:\users\sebastian\AppData\Roaming\Common\LuaRT\json\encode\array.lua
c:\users\sebastian\AppData\Roaming\Common\LuaRT\json\encode\calls.lua
c:\users\sebastian\AppData\Roaming\Common\LuaRT\json\encode\number.lua
c:\users\sebastian\AppData\Roaming\Common\LuaRT\json\encode\object.lua
c:\users\sebastian\AppData\Roaming\Common\LuaRT\json\encode\others.lua
c:\users\sebastian\AppData\Roaming\Common\LuaRT\json\encode\output.lua
c:\users\sebastian\AppData\Roaming\Common\LuaRT\json\encode\output_utility.lua
c:\users\sebastian\AppData\Roaming\Common\LuaRT\json\encode\strings.lua
c:\users\sebastian\AppData\Roaming\Common\LuaRT\json\util.lua
c:\users\sebastian\AppData\Roaming\Common\LuaRT\lfs.dll
c:\users\sebastian\AppData\Roaming\Common\LuaRT\lpeg.dll
c:\users\sebastian\AppData\Roaming\Common\LuaRT\lua5.1.dll
c:\users\sebastian\AppData\Roaming\Common\LuaRT\luacom.dll
c:\users\sebastian\AppData\Roaming\Common\LuaRT\luasql\sqlite3.dll
c:\users\sebastian\AppData\Roaming\Common\LuaRT\Microsoft.VC80.CRT\Microsoft.VC80.CRT.manifest
c:\users\sebastian\AppData\Roaming\Common\LuaRT\Microsoft.VC80.CRT\msvcm80.dll
c:\users\sebastian\AppData\Roaming\Common\LuaRT\Microsoft.VC80.CRT\msvcp80.dll
c:\users\sebastian\AppData\Roaming\Common\LuaRT\Microsoft.VC80.CRT\msvcr80.dll
c:\users\sebastian\AppData\Roaming\Common\LuaRT\mime\core.dll
c:\users\sebastian\AppData\Roaming\Common\LuaRT\socket\core.dll
c:\users\sebastian\AppData\Roaming\Common\LuaRT\socket\http.lua
c:\users\sebastian\AppData\Roaming\Common\LuaRT\socket\url.lua
c:\users\sebastian\AppData\Roaming\Common\LuaRT\string_ext.lua
c:\users\sebastian\AppData\Roaming\Common\LuaRT\table_ext.lua
c:\users\sebastian\AppData\Roaming\Common\LuaRT\tree.lua
c:\users\sebastian\AppData\Roaming\Common\LuaRT\wlua.exe
c:\windows\IsUn0407.exe
c:\windows\wininit.ini
.
.
(((((((((((((((((((((((   Dateien erstellt von 2014-12-21 bis 2015-01-21  ))))))))))))))))))))))))))))))
.
.
2015-01-21 15:52 . 2015-01-21 15:52	--------	d-----w-	c:\users\Default\AppData\Local\temp
2015-01-21 15:29 . 2014-12-15 03:13	11870360	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{7D814E1B-8312-42FF-B5F9-C6699693CEDB}\mpengine.dll
2015-01-19 14:38 . 2015-01-19 14:38	--------	d-----w-	c:\program files (x86)\VS Revo Group
2015-01-19 03:26 . 2014-11-24 11:48	40248	----a-w-	c:\windows\system32\TURegOpt.exe
2015-01-19 03:26 . 2014-11-24 11:48	29496	----a-w-	c:\windows\system32\authuitu.dll
2015-01-19 03:26 . 2014-11-24 11:48	25400	----a-w-	c:\windows\SysWow64\authuitu.dll
2015-01-19 03:26 . 2015-01-19 03:26	--------	d-----w-	c:\users\sebastian\AppData\Roaming\AVG
2015-01-19 03:26 . 2015-01-19 03:26	--------	d-----w-	c:\program files (x86)\AVG
2015-01-19 03:26 . 2015-01-19 03:26	--------	d-----w-	c:\users\sebastian\AppData\Local\Avg
2015-01-19 03:26 . 2015-01-19 03:26	--------	d-----w-	c:\programdata\AVG
2015-01-19 02:46 . 2015-01-19 06:07	--------	d-----w-	C:\FRST
2015-01-19 02:39 . 2015-01-19 02:39	--------	d-----w-	c:\users\sebastian\AppData\Local\G DATA
2015-01-19 01:47 . 2015-01-19 01:47	--------	d-----w-	c:\program files (x86)\Microsoft ASP.NET
2015-01-19 01:44 . 2015-01-19 01:51	--------	d-----w-	c:\programdata\Malwarebytes' Anti-Malware (portable)
2015-01-19 01:43 . 2015-01-19 01:43	--------	d-----w-	c:\program files (x86)\AGEIA Technologies
2015-01-19 01:43 . 2014-12-13 00:47	620176	----a-w-	c:\windows\SysWow64\nvStreaming.exe
2015-01-19 01:33 . 2015-01-19 01:34	--------	d-----w-	c:\users\sebastian\AppData\Local\NVIDIA Corporation
2015-01-19 01:32 . 2014-12-13 00:11	2210040	----a-w-	c:\windows\SysWow64\nvspcap.dll
2015-01-19 01:32 . 2014-12-13 00:11	1291464	----a-w-	c:\windows\SysWow64\nvspbridge.dll
2015-01-19 01:32 . 2014-12-13 00:11	2824504	----a-w-	c:\windows\system32\nvspcap64.dll
2015-01-19 01:32 . 2014-12-13 00:11	1715224	----a-w-	c:\windows\system32\nvspbridge64.dll
2015-01-18 10:44 . 2015-01-18 10:44	--------	d-----w-	c:\users\sebastian\AppData\Roaming\HpUpdate
2015-01-18 10:44 . 2012-10-17 03:31	741480	------w-	c:\windows\system32\HPDiscoPM6412.dll
2015-01-18 10:44 . 2015-01-18 10:44	--------	d-----w-	c:\program files (x86)\HP
2015-01-18 10:44 . 2015-01-18 10:44	--------	d-----w-	c:\programdata\HP
2015-01-18 10:44 . 2015-01-18 10:44	--------	d-----w-	c:\program files\HP
2015-01-18 10:44 . 2015-01-18 10:47	--------	d-----w-	c:\users\sebastian\AppData\Local\HP
2015-01-17 18:07 . 2015-01-17 18:13	--------	d-----w-	c:\programdata\BlueStacksSetup
2015-01-17 18:06 . 2015-01-17 18:06	--------	d-----w-	c:\programdata\XDMessagingv4
2015-01-17 18:06 . 2015-01-17 18:06	--------	d-----w-	c:\users\sebastian\AppData\Roaming\Abelssoft
2015-01-17 18:06 . 2015-01-17 18:06	--------	d-----w-	c:\users\sebastian\AppData\Local\Abelssoft
2015-01-17 18:06 . 2015-01-17 18:06	--------	d-----w-	c:\users\sebastian\AppData\Roaming\DesktopIconForAmazon
2015-01-17 09:41 . 2014-07-09 02:03	7168	----a-w-	c:\windows\system32\KBDYAK.DLL
2015-01-17 09:41 . 2014-07-09 02:03	7168	----a-w-	c:\windows\system32\KBDTAT.DLL
2015-01-17 09:41 . 2014-07-09 02:03	7168	----a-w-	c:\windows\system32\KBDRU1.DLL
2015-01-17 09:41 . 2014-07-09 02:03	6656	----a-w-	c:\windows\system32\KBDRU.DLL
2015-01-17 09:41 . 2014-07-09 02:03	7168	----a-w-	c:\windows\system32\KBDBASH.DLL
2015-01-17 09:41 . 2014-07-09 01:31	7168	----a-w-	c:\windows\SysWow64\KBDYAK.DLL
2015-01-17 09:41 . 2014-07-09 01:31	6656	----a-w-	c:\windows\SysWow64\KBDBASH.DLL
2015-01-17 09:41 . 2014-12-13 05:09	144384	----a-w-	c:\windows\system32\ieUnatt.exe
2015-01-17 09:41 . 2014-12-13 03:33	115712	----a-w-	c:\windows\SysWow64\ieUnatt.exe
2015-01-16 14:41 . 2015-01-16 14:41	--------	d-----w-	c:\program files (x86)\avmwlanstick
2015-01-16 14:41 . 2015-01-16 14:41	--------	d-----w-	c:\program files (x86)\AVM_update
2015-01-16 12:41 . 2015-01-16 12:41	--------	d-----w-	c:\windows\system32\appraiser
2015-01-16 12:31 . 2015-01-16 12:31	--------	d-----w-	c:\program files (x86)\MSXML 4.0
2015-01-16 12:27 . 2014-10-18 01:33	3209728	----a-w-	c:\windows\SysWow64\mf.dll
2015-01-16 12:27 . 2014-07-07 02:06	206848	----a-w-	c:\windows\system32\mfps.dll
2015-01-16 12:27 . 2014-07-07 02:06	55808	----a-w-	c:\windows\system32\rrinstaller.exe
2015-01-16 12:27 . 2014-07-07 02:06	24576	----a-w-	c:\windows\system32\mfpmp.exe
2015-01-16 12:27 . 2014-07-07 02:02	2048	----a-w-	c:\windows\system32\mferror.dll
2015-01-16 12:27 . 2014-07-07 01:40	103424	----a-w-	c:\windows\SysWow64\mfps.dll
2015-01-16 12:27 . 2014-07-07 01:39	50176	----a-w-	c:\windows\SysWow64\rrinstaller.exe
2015-01-16 12:27 . 2014-07-07 01:39	23040	----a-w-	c:\windows\SysWow64\mfpmp.exe
2015-01-16 12:27 . 2014-07-07 01:37	2048	----a-w-	c:\windows\SysWow64\mferror.dll
2015-01-16 12:27 . 2014-10-18 02:05	4121600	----a-w-	c:\windows\system32\mf.dll
2015-01-16 12:23 . 2014-06-27 02:08	2777088	----a-w-	c:\windows\system32\msmpeg2vdec.dll
2015-01-16 12:23 . 2014-06-27 01:45	2285056	----a-w-	c:\windows\SysWow64\msmpeg2vdec.dll
2015-01-16 12:20 . 2014-03-09 21:48	171160	----a-w-	c:\windows\system32\infocardapi.dll
2015-01-16 12:20 . 2014-03-09 21:48	1389208	----a-w-	c:\windows\system32\icardagt.exe
2015-01-16 12:20 . 2014-03-09 21:47	99480	----a-w-	c:\windows\SysWow64\infocardapi.dll
2015-01-16 12:20 . 2014-03-09 21:47	619672	----a-w-	c:\windows\SysWow64\icardagt.exe
2015-01-16 12:20 . 2014-06-30 22:24	8856	----a-w-	c:\windows\system32\icardres.dll
2015-01-16 12:20 . 2014-06-30 22:14	8856	----a-w-	c:\windows\SysWow64\icardres.dll
2015-01-16 12:20 . 2014-06-06 06:16	35480	----a-w-	c:\windows\SysWow64\TsWpfWrp.exe
2015-01-16 12:20 . 2014-06-06 06:12	35480	----a-w-	c:\windows\system32\TsWpfWrp.exe
2015-01-16 12:18 . 2014-08-29 02:07	3179520	----a-w-	c:\windows\system32\rdpcorets.dll
2015-01-16 12:13 . 2015-01-16 12:13	--------	d-----w-	c:\program files (x86)\Common Files\Skype
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-01-16 21:13 . 2014-12-11 15:39	174624	----a-w-	c:\windows\SysWow64\EasyAntiCheat.exe
2015-01-16 13:27 . 2013-05-14 22:33	71344	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2015-01-16 13:27 . 2013-05-14 22:33	701616	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2015-01-16 12:44 . 2011-03-28 16:36	23256	----a-w-	c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2015-01-16 12:15 . 2014-04-06 22:50	20992	----a-w-	c:\windows\system32\drivers\GDKBFlt64.sys
2015-01-16 12:15 . 2013-05-14 22:00	64512	----a-w-	c:\windows\system32\drivers\gdwfpcd64.sys
2015-01-16 12:15 . 2013-05-14 22:00	142336	----a-w-	c:\windows\system32\drivers\MiniIcpt.sys
2015-01-08 08:55 . 2010-11-21 03:27	298120	------w-	c:\windows\system32\MpSigStub.exe
2014-12-31 12:12 . 2013-05-15 09:07	113365784	----a-w-	c:\windows\system32\MRT.exe
2014-12-13 10:08 . 2014-03-20 21:03	16040184	----a-w-	c:\windows\SysWow64\nvwgf2um.dll
2014-12-13 10:08 . 2013-07-10 00:03	2897824	----a-w-	c:\windows\SysWow64\nvapi.dll
2014-12-13 10:08 . 2013-07-10 00:03	14128496	----a-w-	c:\windows\SysWow64\nvd3dum.dll
2014-12-13 10:08 . 2012-07-20 09:28	18594432	----a-w-	c:\windows\system32\nvwgf2umx.dll
2014-12-13 10:08 . 2012-07-20 09:28	3293136	----a-w-	c:\windows\system32\nvapi64.dll
2014-12-13 08:03 . 2012-07-20 09:28	6859408	----a-w-	c:\windows\system32\nvcpl.dll
2014-12-13 08:03 . 2012-07-20 09:28	3513488	----a-w-	c:\windows\system32\nvsvc64.dll
2014-12-13 08:03 . 2012-07-20 09:28	935240	----a-w-	c:\windows\system32\nvvsvc.exe
2014-12-13 08:03 . 2012-07-20 09:28	62608	----a-w-	c:\windows\system32\nvshext.dll
2014-12-13 08:03 . 2012-07-20 09:28	386368	----a-w-	c:\windows\system32\nvmctray.dll
2014-12-13 08:03 . 2012-07-20 09:28	2558608	----a-w-	c:\windows\system32\nvsvcr.dll
2014-12-12 23:11 . 2012-07-20 09:28	4151176	----a-w-	c:\windows\system32\nvcoproc.bin
2014-11-25 22:55 . 2013-05-30 12:00	281688	----a-w-	c:\windows\SysWow64\PnkBstrB.xtr
2014-11-25 22:55 . 2013-05-15 15:10	281688	----a-w-	c:\windows\SysWow64\PnkBstrB.exe
2014-11-22 10:46 . 2013-08-29 14:51	38032	----a-w-	c:\windows\system32\drivers\nvvad64v.sys
2014-11-22 10:46 . 2013-08-29 14:51	32400	----a-w-	c:\windows\SysWow64\nvaudcap32v.dll
2014-11-22 10:46 . 2013-07-30 18:55	35472	----a-w-	c:\windows\system32\nvaudcap64v.dll
2014-11-10 07:53 . 2013-05-15 15:10	281688	----a-w-	c:\windows\SysWow64\PnkBstrB.ex0
2014-11-07 14:42 . 2013-05-15 15:10	76888	----a-w-	c:\windows\SysWow64\PnkBstrA.exe
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
"Steam"="d:\steam\steam.exe" [2014-11-18 1940160]
"SSync"="c:\users\sebastian\AppData\Roaming\SSync\SSync.exe" [2013-04-09 36864]
"Spotify Web Helper"="c:\users\sebastian\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2015-01-16 1676344]
"EADM"="d:\origin\Origin.exe" [2015-01-16 3618648]
"Spotify"="c:\users\sebastian\AppData\Roaming\Spotify\spotify.exe" [2015-01-16 6737976]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2014-12-11 30872168]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe" [2012-06-07 56128]
"GDFirewallTray"="c:\program files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe" [2014-05-20 1756792]
"AVMWlanClient"="c:\program files (x86)\avmwlanstick\wlangui.exe" [2010-10-22 2105344]
.
c:\users\sebastian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Tintenwarnungen überwachen - HP Officejet 4620 series.lnk - c:\windows\system32\RunDll32.exe "c:\program files\HP\HP Officejet 4620 series\bin\HPStatusBL.dll",RunDLLEntry SERIALNUMBER=TH397140PB05S1;CONNECTION=USB;MONITOR=1; [2009-7-14 45568]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux5"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"HP Software Update"=c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 avmeject;AVM Eject;c:\windows\system32\drivers\avmeject.sys;c:\windows\SYSNATIVE\drivers\avmeject.sys [x]
R3 cpuz135;cpuz135;c:\users\ADMINI~1\AppData\Local\Temp\cpuz135\cpuz135_x64.sys;c:\users\ADMINI~1\AppData\Local\Temp\cpuz135\cpuz135_x64.sys [x]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x]
R3 EasyAntiCheat;EasyAntiCheat;c:\windows\system32\EasyAntiCheat.exe;c:\windows\SYSNATIVE\EasyAntiCheat.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys;c:\windows\SYSNATIVE\drivers\MBAMSwissArmy.sys [x]
R3 MotioninJoyXFilter;MotioninJoy Virtual Xinput device Filter Driver;c:\windows\system32\DRIVERS\MijXfilt.sys;c:\windows\SYSNATIVE\DRIVERS\MijXfilt.sys [x]
R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des;c:\windows\SYSNATIVE\GameMon.des [x]
R3 NvStUSB;NVIDIA Stereoscopic 3D USB driver;c:\windows\system32\drivers\nvstusb.sys;c:\windows\SYSNATIVE\drivers\nvstusb.sys [x]
R3 Origin Client Service;Origin Client Service;d:\origin\OriginClientService.exe;d:\origin\OriginClientService.exe [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 ssudmdm;SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S0 GDBehave;GDBehave;c:\windows\system32\drivers\GDBehave.sys;c:\windows\SYSNATIVE\drivers\GDBehave.sys [x]
S0 iusb3hcs;Intel(R) USB 3.0 Hostcontroller-Switchtreiber;c:\windows\system32\drivers\iusb3hcs.sys;c:\windows\SYSNATIVE\drivers\iusb3hcs.sys [x]
S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S1 GDKBFlt;G Data GDKBFlt Driver;c:\windows\system32\drivers\GDKBFlt64.sys;c:\windows\SYSNATIVE\drivers\GDKBFlt64.sys [x]
S1 GDMnIcpt;GDMnIcpt;c:\windows\system32\drivers\MiniIcpt.sys;c:\windows\SYSNATIVE\drivers\MiniIcpt.sys [x]
S1 gdwfpcd;G Data WFP CD;c:\windows\system32\drivers\gdwfpcd64.sys;c:\windows\SYSNATIVE\drivers\gdwfpcd64.sys [x]
S1 GRD;G Data Rootkit Detector Driver;c:\windows\system32\drivers\GRD.sys;c:\windows\SYSNATIVE\drivers\GRD.sys [x]
S1 HookCentre;HookCentre;c:\windows\system32\drivers\HookCentre.sys;c:\windows\SYSNATIVE\drivers\HookCentre.sys [x]
S2 AVKProxy;G Data AntiVirus Proxy;c:\program files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe;c:\program files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe [x]
S2 AVKService;G DATA Scheduler;c:\program files (x86)\G Data\InternetSecurity\AVK\AVKService.exe;c:\program files (x86)\G Data\InternetSecurity\AVK\AVKService.exe [x]
S2 AVKWCtl;G Data Dateisystem Wächter;c:\program files (x86)\G Data\InternetSecurity\AVK\AVKWCtlX64.exe;c:\program files (x86)\G Data\InternetSecurity\AVK\AVKWCtlX64.exe [x]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [x]
S2 EPSON_EB_RPCV4_04;EPSON V5 Service4(04);c:\program files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE;c:\program files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE [x]
S2 EPSON_PM_RPCV4_04;EPSON V3 Service4(04);c:\program files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE;c:\program files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE [x]
S2 GfExperienceService;NVIDIA GeForce Experience Service;c:\program files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe;c:\program files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe;c:\program files\Intel\iCLS Client\HeciServer.exe [x]
S2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [x]
S2 NvNetworkService;NVIDIA Network Service;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [x]
S2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [x]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S2 TuneUp.UtilitiesSvc;AVG PC TuneUp Service;c:\program files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe;c:\program files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S3 fwlanusbn;FRITZ!WLAN N;c:\windows\system32\DRIVERS\fwlanusbn.sys;c:\windows\SYSNATIVE\DRIVERS\fwlanusbn.sys [x]
S3 GDFwSvc;G Data Personal Firewall;c:\program files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe;c:\program files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe [x]
S3 GDPkIcpt;GDPkIcpt;c:\windows\system32\drivers\PktIcpt.sys;c:\windows\SYSNATIVE\drivers\PktIcpt.sys [x]
S3 GDScan;G Data Scanner;c:\program files (x86)\Common Files\G Data\GDScan\GDScan.exe;c:\program files (x86)\Common Files\G Data\GDScan\GDScan.exe [x]
S3 iusb3hub;Intel(R) USB 3.0-Hubtreiber;c:\windows\system32\drivers\iusb3hub.sys;c:\windows\SYSNATIVE\drivers\iusb3hub.sys [x]
S3 iusb3xhc;Intel(R) USB 3.0 eXtensible-Hostcontrollertreiber;c:\windows\system32\drivers\iusb3xhc.sys;c:\windows\SYSNATIVE\drivers\iusb3xhc.sys [x]
S3 NvStreamKms;NvStreamKms;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [x]
S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad64v.sys;c:\windows\SYSNATIVE\drivers\nvvad64v.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftfslh.sys [x]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftplaylh.sys [x]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftredirlh.sys [x]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftvollh.sys [x]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [x]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesDriver64.sys;c:\program files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesDriver64.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2015-01-16 11:57	1087816	----a-w-	c:\program files (x86)\Google\Chrome\Application\39.0.2171.99\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2015-01-21 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-05-14 13:27]
.
2015-01-21 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-07-09 11:44]
.
2015-01-20 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-07-09 11:44]
.
2015-01-18 c:\windows\Tasks\Wise Registry Cleaner Schedule Task.job
- c:\program files (x86)\Wise\Wise Registry Cleaner\WiseRegCleaner.exe [2013-05-28 12:28]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2012-06-12 6548112]
"NvBackend"="c:\program files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe" [2014-12-13 2531472]
"ShadowPlay"="c:\windows\system32\nvspcap64.dll" [2014-12-13 2824504]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = about:blank
mStart Page = about:blank
mLocal Page = c:\windows\SysWOW64\blank.htm
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\my710sjh.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo DE
user_pref(extensions.BFE1C-E485-44AA-8F36-353751B41
FF - user.js: extensions.Softonic.vrsn - 1.8.21.14
FF - user.js: extensions.Softonic.vrsni - 1.8.21.14
FF - user.js: extensions.Softonic.vrsnTs - 1.8.21.1416:11
FF - user.js: extensions.Softonic.prtnrId - softonic
FF - user.js: extensions.Softonic.prdct - Softonic
FF - user.js: extensions.Softonic.aflt - OC
FF - user.js: extensions.Softonic.smplGrp - none
FF - user.js: extensions.Softonic.tlbrId - opencandy2013
FF - user.js: extensions.Softonic.instlRef - MOY00621
FF - user.js: extensions.Softonic.dfltLng - de
FF - user.js: extensions.Softonic.excTlbr - false
FF - user.js: extensions.Softonic.ffxUnstlRst - false
FF - user.js: extensions.Softonic.admin - false
FF - user.js: extensions.Softonic.autoRvrt - false
FF - user.js: extensions.Softonic.rvrt - false
FF - user.js: extensions.Softonic.hmpg - true
FF - user.js: extensions.Softonic.hmpgUrl - hxxp://search.softonic.com/MOY00621/tb_v1?SearchSource=13&cc=&mi=2c9ae4c0000000000000bc054306f36a
FF - user.js: extensions.Softonic.dfltSrch - true
FF - user.js: extensions.Softonic.srchPrvdr - Search the web (Softonic)
FF - user.js: extensions.Softonic.dnsErr - true
FF - user.js: extensions.Softonic.newTab - true
FF - user.js: extensions.Softonic.newTabUrl - hxxp://search.softonic.com/MOY00621/tb_v1/?SearchSource=15&cc=&mi=2c9ae4c0000000000000bc054306f36a
FF - user.js: extensions.mysearchdial.dnsErr - true
FF - user.js: extensions.mysearchdial_i.newTab - false
FF - user.js: extensions.mysearchdial.id - 10BF4873B070E4C0
FF - user.js: extensions.mysearchdial.instlDay - 16148
FF - user.js: extensions.mysearchdial.vrsn - 1.8.29.0
FF - user.js: extensions.mysearchdial.vrsni - 1.8.29.0
FF - user.js: extensions.mysearchdial_i.vrsnTs - 1.8.29.013:19:2
FF - user.js: extensions.mysearchdial.prtnrId - mysearchdial
FF - user.js: extensions.mysearchdial.prdct - mysearchdial
FF - user.js: extensions.mysearchdial.aflt - ir_14_12_ch
FF - user.js: extensions.mysearchdial_i.smplGrp - none
FF - user.js: extensions.mysearchdial.tlbrId - base
FF - user.js: extensions.mysearchdial.instlRef - 140305_f
FF - user.js: extensions.mysearchdial.dfltLng - 
FF - user.js: extensions.mysearchdial.appId - {CA5CAA63-B27C-4963-9BEC-CB16A36D56F8}
FF - user.js: extensions.mysearchdial.excTlbr - false
FF - user.js: extensions.mysearchdial_i.hmpg - true
FF - user.js: extensions.mysearchdial.cr - 1434241063
FF - user.js: extensions.mysearchdial.cd - 2XzuyEtN2Y1L1QzutCtD0B0FyEzzyBtA0BtDyBtD0EyE0CtDtN0D0Tzu0SzztDzytN1L2XzutCtFtCtFtCtFtCtN1L1CzutCyEtDtAtDyD1V1OtN1L1G1B1V1N2Y1L1Qzu2StAtCzy0ByBtDzztAtGyB0CyDtCtG0D0FyE0FtGtA0FyC0CtGtAtCyD0AtAyDyDzy0EtBtBtC2QtN1M1F1B2Z1V1N2Y1L1Qzu2StCzzyBzz0FtA0CtDtG0FyEtC0FtG0CyD0BzztGzy0AzztAtGtC0CtDyCtB0DyEyC0BtAyDyD2Q
FF - user.js: extensions.mysearchdial.AL - 2
FF - user.js: extensions.irmysearch.cd - 2XzuyEtN2Y1L1QzutCtD0B0FyEzzyBtA0BtDyBtD0EyE0CtDtN0D0Tzu0SzztDzytN1L2XzutCtFtCtFtCtFtCtN1L1CzutCyEtDtAtDyD1V1OtN1L1G1B1V1N2Y1L1Qzu2StAtCzy0ByBtDzztAtGyB0CyDtCtG0D0FyE0FtGtA0FyC0CtGtAtCyD0AtAyDyDzy0EtBtBtC2QtN1M1F1B2Z1V1N2Y1L1Qzu2StCzzyBzz0FtA0CtDtG0FyEtC0FtG0CyD0BzztGzy0AzztAtGtC0CtDyCtB0DyEyC0BtAyDyD2Q
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.
.
------- Dateityp-Verknüpfung -------
.
inifile="%SystemRoot%\system32\NOTEPAD.EXE" %1
txtfile="%SystemRoot%\system32\NOTEPAD.EXE" %1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
Toolbar-Locked - (no file)
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-526734976-3399402404-692726830-1001\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:5f,c4,c5,61,46,ce,14,5e,9b,7b,52,43,d7,43,d4,08,0c,00,16,a7,0f,07,92,
   0f,d6,4a,38,20,d3,21,41,77,2b,2d,0e,05,75,1b,b2,ce,d9,7f,5a,62,09,28,a0,02,\
"??"=hex:e2,06,90,c3,a9,ab,f7,ca,1c,f7,63,d7,3e,f2,89,5d
.
[HKEY_USERS\S-1-5-21-526734976-3399402404-692726830-1001\Software\SecuROM\License information*]
"datasecu"=hex:3d,7b,5b,23,09,c2,3d,74,b3,b1,3d,7e,35,32,ae,fd,57,18,4d,1b,a2,
   b3,58,ea,52,64,75,65,98,27,a6,8b,47,1f,cc,15,0a,a7,d8,1a,91,df,47,d9,33,3c,\
"rkeysecu"=hex:dd,bc,ad,1e,30,35,24,4f,1a,47,c7,1e,c5,3b,48,c4
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_16_0_0_257_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_16_0_0_257_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_16_0_0_257_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_16_0_0_257_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_257.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.16"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_257.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_257.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_257.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2015-01-21  16:53:47
ComboFix-quarantined-files.txt  2015-01-21 15:53
.
Vor Suchlauf: 12 Verzeichnis(se), 21.917.716.480 Bytes frei
Nach Suchlauf: 19 Verzeichnis(se), 23.445.028.864 Bytes frei
.
- - End Of File - - 1ECE655503755B8960C96293295F19B2
         

Ach so, mein G-Data Anti Virus System konnte ich nicht zu 100 % abschalten. Es hat ein wenig gemeckert.

Downloade Dir bitte Malwarebytes Anti-Malware

• Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
• Starte Malwarebytes' Anti-Malware (MBAM).
• Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
• Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
• Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
• Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
• Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
• Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte AdwCleaner auf deinen Desktop.

• Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
• Starte die AdwCleaner.exe mit einem Doppelklick.
• Stimme den Nutzungsbedingungen zu.
• Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
  • "Tracing" Schlüssel löschen
  • Winsock Einstellungen zurücksetzen
  • Proxy Einstellungen zurücksetzen
  • Internet Explorer Richtlinien zurücksetzen
  • Chrome Richtlinien zurücksetzen
  • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
• Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
• Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
• Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

• Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
• Drücke eine beliebige Taste, um das Tool zu starten.
• Je nach System kann der Scan eine Weile dauern.
• Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
• Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 21.01.2015
Suchlauf-Zeit: 23:27:21
Logdatei: mbam.txt
Administrator: Ja

Version: 2.00.4.1028
Malware Datenbank: v2015.01.21.11
Rootkit Datenbank: v2015.01.14.01
Lizenz: Testversion
Malware Schutz: Aktiviert
Bösartiger Webseiten Schutz: Aktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: sebastian

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 346630
Verstrichene Zeit: 4 Min, 7 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(Keine schädliche Elemente erkannt)

Module: 0
(Keine schädliche Elemente erkannt)

Registrierungsschlüssel: 0
(Keine schädliche Elemente erkannt)

Registrierungswerte: 0
(Keine schädliche Elemente erkannt)

Registrierungsdaten: 0
(Keine schädliche Elemente erkannt)

Ordner: 0
(Keine schädliche Elemente erkannt)

Dateien: 21
PUP.Optional.MySearch.A, C:\Users\sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\my710sjh.default\user.js, Gut: (), Schlecht: (user_pref("extensions.irmysearch.cd", "2XzuyEtN2Y1L1QzutCtD0B0FyEzzyBtA0BtDyBtD0EyE0CtDtN0D0Tzu0SzztDzytN1L2XzutCtFtCtFtCtFtCtN1L1CzutCyEtDtAtDyD1V1OtN1L1G1B1V1N2Y1L1Qzu2StAtCzy0ByBtDzztAtGyB0CyDtCtG0D0FyE0FtGtA0FyC0CtGtAtCyD0AtAyDyDzy0EtBtBtC2QtN1M1F1B2Z1V1N2Y1L1Qzu2StCzzyBzz0FtA0CtDtG0FyEtC0FtG0CyD0BzztGzy0AzztAtGtC0CtDyCtB0DyEyC0BtAyDyD2Q");), Ersetzt,[5eb1af4b583182b4abd5defcb64f7c84]
PUP.Optional.MySearchDial.A, C:\Users\sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\my710sjh.default\user.js, Gut: (), Schlecht: (user_pref("extensions.mysearchdial.dnsErr", true);), Ersetzt,[37d8807ab8d1999d8009cf0bac593fc1]
PUP.Optional.MySearchDial.A, C:\Users\sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\my710sjh.default\user.js, Gut: (), Schlecht: (ons.BFE1C-E485-44AA-8F36-353751B41
user_pref("extens), Ersetzt,[749bba40dbaea39394f599418f76916f]
PUP.Optional.MySearchDial.A, C:\Users\sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\my710sjh.default\user.js, Gut: (), Schlecht: (.BFE1C-E485-44AA-8F36-353751B41
user_pref("extensions.Softo), Ersetzt,[d03fb842dbae4beb0c7d6f6b8382ee12]
PUP.Optional.MySearchDial.A, C:\Users\sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\my710sjh.default\user.js, Gut: (), Schlecht: (E485-44AA-8F36-353751B41
user_pref("extensions.Softoni), Ersetzt,[63ac5f9bcabf3105d7b24595c83d966a]
PUP.Optional.MySearchDial.A, C:\Users\sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\my710sjh.default\user.js, Gut: (), Schlecht: (FE1C-E485-44AA-8F36-353751B41
user_pref("extensions.S), Ersetzt,[26e98c6ee0a9b97d4445b327b64f817f]
PUP.Optional.MySearchDial.A, C:\Users\sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\my710sjh.default\user.js, Gut: (), Schlecht: (BFE1C-E485-44AA-8F36-353751B41
user_pref("extensions.S), Ersetzt,[7b9446b4fe8bf34301888b4fd035c53b]
PUP.Optional.MySearchDial.A, C:\Users\sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\my710sjh.default\user.js, Gut: (), Schlecht: (FE1C-E485-44AA-8F36-353751B41
user_pref("extensions.Softonic.vrs), Ersetzt,[52bded0d7613f5417910ca10917413ed]
PUP.Optional.MySearchDial.A, C:\Users\sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\my710sjh.default\user.js, Gut: (), Schlecht: (44AA-8F36-353751B41
user_pref("extensions.Softonic.vrsn", "1), Ersetzt,[e827b1491079da5cf990aa30ec191de3]
PUP.Optional.MySearchDial.A, C:\Users\sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\my710sjh.default\user.js, Gut: (), Schlecht: (485-44AA-8F36-353751B41
user_pref("extensions.Softonic.vrs), Ersetzt,[040bda20becbf046a1e8a436da2bbc44]
PUP.Optional.MySearchDial.A, C:\Users\sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\my710sjh.default\user.js, Gut: (), Schlecht: (-E485-44AA-8F36-353751B41
user_pref("extensions.Softonic), Ersetzt,[818e35c5860375c1c3c620ba2dd8d828]
PUP.Optional.MySearchDial.A, C:\Users\sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\my710sjh.default\user.js, Gut: (), Schlecht: (1C-E485-44AA-8F36-353751B41
user_pref("extensions.Soft), Ersetzt,[de31c2387f0a3df9b7d21dbdd72ea957]
PUP.Optional.MySearchDial.A, C:\Users\sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\my710sjh.default\user.js, Gut: (), Schlecht: (FE1C-E485-44AA-8F36-353751B41
user_pref("extensions), Ersetzt,[997671899feab77fb7d2cd0daa5b669a]
PUP.Optional.MySearchDial.A, C:\Users\sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\my710sjh.default\user.js, Gut: (), Schlecht: (s.BFE1C-E485-44AA-8F36-353751B41
user_pref("extensions.So), Ersetzt,[ad6269915d2c22145e2bae2c60a5a45c]
PUP.Optional.MySearchDial.A, C:\Users\sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\my710sjh.default\user.js, Gut: (), Schlecht: (C-E485-44AA-8F36-353751B41
user_pref("extensions), Ersetzt,[719e50aa9aefdc5a3752a03a64a16f91]
PUP.Optional.MySearchDial.A, C:\Users\sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\my710sjh.default\user.js, Gut: (), Schlecht: (ions.BFE1C-E485-44AA-8F36-353751B41
user_pref("extensions.Softonic.vrsn", "1.8.21.14), Ersetzt,[9e714fabef9a51e54f3ad703db2ad030]
PUP.Optional.MySearchDial.A, C:\Users\sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\my710sjh.default\user.js, Gut: (), Schlecht: (
user_pref("extensions.Softonic.vrsn", "1.8.21.14");), Ersetzt,[24eb8f6ba8e1aa8c4a3f34a68f76cd33]
PUP.Optional.MySearchDial.A, C:\Users\sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\my710sjh.default\user.js, Gut: (), Schlecht: (s.BFE1C-E485-44AA-8F36-353751B41
user_pref("exten), Ersetzt,[719e7981c2c73cfa8cfd35a5fe0742be]
PUP.Optional.MySearchDial.A, C:\Users\sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\my710sjh.default\user.js, Gut: (), Schlecht: (ons.BFE1C-E485-44AA-8F36-353751B41
user_pref("extensi), Ersetzt,[55bac139305991a5a1e830aa1beafa06]
PUP.Optional.MySearchDial.A, C:\Users\sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\my710sjh.default\user.js, Gut: (), Schlecht: (BFE1C-E485-44AA-8F36-353751B41
user_pref("extensions.Softonic.vrsn", "1.8.21.14");
user_pref("extensions.Softonic.vrsni", "1.8.21.14");
user_pref("extensions.Softonic.vrsnTs", "1.8.21.1416:11:22");
user_pref("extensions.Softonic.prtnrId", "softonic");
user_pref("extensions.Softonic.prdct", "Softonic");
user_pref("extensions.Softonic.aflt", ), Ersetzt,[c64944b6236684b2f099f5e5db2aca36]
PUP.Optional.MySearchDial.A, C:\Users\sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\my710sjh.default\user.js, Gut: (), Schlecht: (, "Softonic");
user_pref("extensions.Softo), Ersetzt,[54bbb446c0c9fa3c88018c4e09fcd927]

Physische Sektoren: 0
(Keine schädliche Elemente erkannt)


(end)
         

# AdwCleaner v4.108 - Bericht erstellt am 21/01/2015 um 23:41:10
# Aktualisiert 17/01/2015 von Xplode
# Database : 2015-01-18.1 [Live]
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : sebastian - SEBASTIAN-PC
# Gestartet von : C:\Users\sebastian\Downloads\AdwCleaner_4.108.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\Babylon
Ordner Gelöscht : C:\ProgramData\Tarma Installer
Ordner Gelöscht : C:\ProgramData\Uniblue
Ordner Gelöscht : C:\Program Files (x86)\JustCloud
Ordner Gelöscht : C:\Users\sebastian\AppData\Local\SwvUpdater
Ordner Gelöscht : C:\Users\sebastian\AppData\Local\CrashRpt
Ordner Gelöscht : C:\Users\sebastian\AppData\LocalLow\Softonic
Ordner Gelöscht : C:\Users\sebastian\AppData\Roaming\BabSolution
Ordner Gelöscht : C:\Users\sebastian\AppData\Roaming\Babylon
Ordner Gelöscht : C:\Users\sebastian\AppData\Roaming\DataMgr
Ordner Gelöscht : C:\Users\sebastian\AppData\Roaming\DesktopIconForAmazon
Ordner Gelöscht : C:\Users\sebastian\AppData\Roaming\Intermediate
Ordner Gelöscht : C:\Users\sebastian\AppData\Roaming\pccustubinstaller
Ordner Gelöscht : C:\Users\sebastian\AppData\Roaming\SCheck
Ordner Gelöscht : C:\Users\sebastian\AppData\Roaming\Snz
Ordner Gelöscht : C:\Users\sebastian\AppData\Roaming\SSync
Datei Gelöscht : C:\windows\System32\roboot64.exe
Datei Gelöscht : C:\Users\sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\my710sjh.default\foxydeal.sqlite
Datei Gelöscht : C:\Users\sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\my710sjh.default\invalidprefs.js
Datei Gelöscht : C:\Users\sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\my710sjh.default\searchplugins\bingp.xml
Datei Gelöscht : C:\Users\sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\my710sjh.default\user.js

***** [ Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Wert Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [ssync]
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\BabylonHelper.EXE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\esrv.EXE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{6536801B-F50C-449B-9476-093DFD3789E3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{7ABBFE1C-E485-44AA-8F36-353751B4124D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{C292AD0A-C11F-479B-B8DB-743E72D283B0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FB684D26-01F4-4D9D-87CB-F486BEBA56DC}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{121EFDA4-E46E-4E8A-A61C-D08E5240A29D}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{37CCD3B4-715F-400C-9023-2EC5F815AAB0}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{37CCD3B4-715F-400C-9023-2EC5F815AAB0}
Schlüssel Gelöscht : HKCU\Software\httogroup
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\Protector
Schlüssel Gelöscht : HKLM\SOFTWARE\Uniblue

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17496


-\\ Mozilla Firefox v35.0 (x86 de)


-\\ Google Chrome v39.0.2171.99

[C:\Users\sebastian\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=ir_14_12_ch&cd=2XzuyEtN2Y1L1QzutCtD0B0FyEzzyBtA0BtDyBtD0EyE0CtDtN0D0Tzu0SzztDzytN1L2XzutCtFtCtFtCtFtCtN1L1CzutCyEtDtAtDyD1V1OtN1L1G1B1V1N2Y1L1Qzu2StAtCzy0ByBtDzztAtGyB0CyDtCtG0D0FyE0FtGtA0FyC0CtGtAtCyD0AtAyDyDzy0EtBtBtC2QtN1M1F1B2Z1V1N2Y1L1Qzu2StCzzyBzz0FtA0CtDtG0FyEtC0FtG0CyD0BzztGzy0AzztAtGtC0CtDyCtB0DyEyC0BtAyDyD2Q&cr=1434241063&ir=
[C:\Users\sebastian\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=ir_14_12_ch&cd=2XzuyEtN2Y1L1QzutCtD0B0FyEzzyBtA0BtDyBtD0EyE0CtDtN0D0Tzu0SzztDzytN1L2XzutCtFtCtFtCtFtCtN1L1CzutCyEtDtAtDyD1V1OtN1L1G1B1V1N2Y1L1Qzu2StAtCzy0ByBtDzztAtGyB0CyDtCtG0D0FyE0FtGtA0FyC0CtGtAtCyD0AtAyDyDzy0EtBtBtC2QtN1M1F1B2Z1V1N2Y1L1Qzu2StCzzyBzz0FtA0CtDtG0FyEtC0FtG0CyD0BzztGzy0AzztAtGtC0CtDyCtB0DyEyC0BtAyDyD2Q&cr=1434241063&ir=

*************************

AdwCleaner[R0].txt - [5072 octets] - [21/01/2015 23:37:56]
AdwCleaner[R1].txt - [5132 octets] - [21/01/2015 23:39:44]
AdwCleaner[S0].txt - [4599 octets] - [21/01/2015 23:41:10]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [4659 octets] ##########
         

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.1 (12.28.2014:1)
OS: Windows 7 Home Premium x64
Ran by sebastian on 21.01.2015 at 23:49:34,07
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL



~~~ Registry Keys



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\Users\sebastian\AppData\Roaming\getrighttogo"
Successfully deleted: [Folder] "C:\Users\sebastian\AppData\Roaming\zona"
Successfully deleted: [Folder] "C:\Program Files (x86)\zona"
Successfully deleted: [Empty Folder] C:\Users\sebastian\appdata\local\{4747C58C-28E2-4B03-888D-40604B18C0FA}



~~~ FireFox

Emptied folder: C:\Users\sebastian\AppData\Roaming\mozilla\firefox\profiles\my710sjh.default\minidumps [26 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 21.01.2015 at 23:52:51,68
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         

Danke dir für die Antwort, Gruß Sebastian.

ESET Online Scanner

• Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
• Lade und starte Eset Online Scanner
• Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
• Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
• Klicke auf Starten.
• Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Klicke am Ende des Suchlaufs auf Fertig stellen.
• Schließe das Fenster von ESET.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte SecurityCheck und:

• Speichere es auf dem Desktop.
• Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
• Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?