Windows 8: Ungewollte Help4U Benachrichtigungen

hankmoody25 · 11.04.2015, 18:02

Hallo.

ich glaube ich habe mir einen Virus eingefangen. Ständig kommt eine Meldung mit:

"Ist ihr PC zu langsam? Wählen sie 030......."

Rechts unten steht klein: "gestellt von help4u" (siehe Anhang)

Habe Avast drauf. Hbe auch mal nen help4u Virus gefunden und gelöscht, seitdem findet er ihn auch nicht mehr, aber da ist er offensichtlich noch.

Danke im Voraus für die Hilfe =)

LG

schrauber · 11.04.2015, 18:20

hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

hankmoody25 · 12.04.2015, 10:18

Danke für die rasche Antwort

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-04-2015
Ran by Dominik (administrator) on STUDIEN-PC on 12-04-2015 11:13:56
Running from C:\Users\Dominik\Downloads
Loaded Profiles: UpdatusUser & Dominik (Available profiles: UpdatusUser & Dominik)
Platform: Windows 8 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 10 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Qualcomm Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe
(Broadcom Corp.) C:\Program Files\Broadcom\MemoryCard\BrcmCardReader.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDService.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe
(Dritek System INC.) C:\Windows\RfBtnSvc64.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(FileProperties_CompanyName) C:\Program Files (x86)\help4u\help4u_notification_service.exe
(Atheros) C:\Program Files (x86)\Qualcomm Atheros\Ath_WlanAgent.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(Client Connect LTD) C:\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe
(Avast Software) C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\ng\ngservice.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerTray.exe
(Client Connect LTD) C:\Program Files (x86)\SearchProtect\SearchProtect\bin\cltmng.exe
(Client Connect LTD) C:\Program Files (x86)\SearchProtect\UI\bin\cltmngui.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Dolby Laboratories Inc.) C:\Dolby PCEE4\pcee4.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(CyberLink) C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Qualcomm Atheros) C:\Program Files (x86)\Bluetooth Suite\BtTray.exe
(Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
() C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe
() C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuBrowserIEAgent.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Windows\System32\CompatTel\wicainventory.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2012-06-11] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1212048 2012-06-07] (Realtek Semiconductor)
HKLM\...\Run: [BtPreLoad] => C:\Program Files (x86)\Bluetooth Suite\BtPreLoad.exe [64640 2012-08-10] ()
HKLM-x32\...\Run: [LManager] => [X]
HKLM-x32\...\Run: [Dolby Home Theater v4] => C:\Dolby PCEE4\pcee4.exe [508256 2012-04-23] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [193568 2014-11-28] (Geek Software GmbH)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5512912 2015-04-08] (Avast Software s.r.o.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKU\S-1-5-19\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-20\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-21-2931490297-3027747817-2233262723-1002\...\Policies\Explorer: [NoDriveTypeAutoRun] 0x95000000
HKU\S-1-5-21-2931490297-3027747817-2233262723-1002\...\MountPoints2: {d5ff15b9-4643-11e4-8204-208984c59d73} - "E:\iStudio.exe" 
HKU\S-1-5-18\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
AppInit_DLLs: C:\PROGRA~2\SEARCH~1\SEARCH~1\bin\VC64LO~1.DLL => C:\Program Files (x86)\SearchProtect\SearchProtect\bin\VC64Loader.dll [263952 2015-03-16] (Client Connect LTD)
AppInit_DLLs:  C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [247144 2012-10-11] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\PROGRA~2\SEARCH~1\SEARCH~1\bin\VC32LO~1.DLL => C:\Program Files (x86)\SearchProtect\SearchProtect\bin\VC32Loader.dll [223504 2015-03-16] (Client Connect LTD)
AppInit_DLLs-x32:  C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [203112 2012-10-11] (NVIDIA Corporation)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (Avast Software s.r.o.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:55348;https=127.0.0.1:55348
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://istart.webssearches.com/?type=hp&ts=1407674597&from=wld&uid=TOSHIBAXMQ01ABD050_92UIS64ISXX92UIS64IS
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://istart.webssearches.com/?type=hp&ts=1407674597&from=wld&uid=TOSHIBAXMQ01ABD050_92UIS64ISXX92UIS64IS
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://istart.webssearches.com/web/?type=ds&ts=1407674597&from=wld&uid=TOSHIBAXMQ01ABD050_92UIS64ISXX92UIS64IS&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://istart.webssearches.com/web/?type=ds&ts=1407674597&from=wld&uid=TOSHIBAXMQ01ABD050_92UIS64ISXX92UIS64IS&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://istart.webssearches.com/?type=hp&ts=1407674597&from=wld&uid=TOSHIBAXMQ01ABD050_92UIS64ISXX92UIS64IS
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://istart.webssearches.com/?type=hp&ts=1407674597&from=wld&uid=TOSHIBAXMQ01ABD050_92UIS64ISXX92UIS64IS
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1407674597&from=wld&uid=TOSHIBAXMQ01ABD050_92UIS64ISXX92UIS64IS&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1407674597&from=wld&uid=TOSHIBAXMQ01ABD050_92UIS64ISXX92UIS64IS&q={searchTerms}
HKU\S-1-5-21-2931490297-3027747817-2233262723-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://acer13.msn.com
HKU\S-1-5-21-2931490297-3027747817-2233262723-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer13.msn.com
HKU\S-1-5-21-2931490297-3027747817-2233262723-1002\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.trovi.com/?gd=&ctid=CT3322288&octid=EB_ORIGINAL_CTID&ISID=M2495563F-3D00-4261-99E6-D2683449ECDB&SearchSource=55&CUI=&UM=6&UP=SP25B173FF-6AF7-49AE-85F9-8455F8B53EA8&SSPV=
HKU\S-1-5-21-2931490297-3027747817-2233262723-1002\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://istart.webssearches.com/?type=hp&ts=1407674597&from=wld&uid=TOSHIBAXMQ01ABD050_92UIS64ISXX92UIS64IS
SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1407674597&from=wld&uid=TOSHIBAXMQ01ABD050_92UIS64ISXX92UIS64IS&q={searchTerms}
SearchScopes: HKLM -> {1CCA7B31-CA5A-4030-B735-2C968CC35CCE} URL = hxxp://url24.info/?id=9912a7456k8734&q={searchTerms}
SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1407674597&from=wld&uid=TOSHIBAXMQ01ABD050_92UIS64ISXX92UIS64IS&q={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1407674597&from=wld&uid=TOSHIBAXMQ01ABD050_92UIS64ISXX92UIS64IS&q={searchTerms}
SearchScopes: HKLM-x32 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1407674597&from=wld&uid=TOSHIBAXMQ01ABD050_92UIS64ISXX92UIS64IS&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2931490297-3027747817-2233262723-1002 -> DefaultScope {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://www.trovi.com/Results.aspx?gd=&ctid=CT3322288&octid=EB_ORIGINAL_CTID&ISID=M2495563F-3D00-4261-99E6-D2683449ECDB&SearchSource=58&CUI=&UM=6&UP=SP25B173FF-6AF7-49AE-85F9-8455F8B53EA8&q={searchTerms}&SSPV=
SearchScopes: HKU\S-1-5-21-2931490297-3027747817-2233262723-1002 -> {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://www.trovi.com/Results.aspx?gd=&ctid=CT3322288&octid=EB_ORIGINAL_CTID&ISID=M2495563F-3D00-4261-99E6-D2683449ECDB&SearchSource=58&CUI=&UM=6&UP=SP25B173FF-6AF7-49AE-85F9-8455F8B53EA8&q={searchTerms}&SSPV=
SearchScopes: HKU\S-1-5-21-2931490297-3027747817-2233262723-1002 -> {1CCA7B31-CA5A-4030-B735-2C968CC35CCE} URL = hxxp://url24.info/?id=9912a7456k8734&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2931490297-3027747817-2233262723-1002 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1407674597&from=wld&uid=TOSHIBAXMQ01ABD050_92UIS64ISXX92UIS64IS&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2931490297-3027747817-2233262723-1002 -> {76149113-4D33-46DD-A552-3BEA0A947DB6} URL = 
SearchScopes: HKU\S-1-5-21-2931490297-3027747817-2233262723-1002 -> {CE6B38BB-49B4-46BE-ADA7-E7BD583814CD} URL = https://de.search.yahoo.com/search?fr=mcafee&type=B011DE662D20140725&p={SearchTerms}
BHO: Radio Canyon -> {11111111-1111-1111-1111-110611081104} -> C:\Program Files (x86)\Radio Canyon\Radio Canyon-bho64.dll [2014-11-20] (Radio Canyon)
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-02-10] (Microsoft Corporation)
BHO: CIESpeechBHO Class -> {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} -> C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll [2012-08-10] (Qualcomm Atheros Commnucations)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2015-04-08] (Avast Software s.r.o.)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-03-03] (Google Inc.)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-02-10] (Microsoft Corporation)
BHO: DVDVideoSoft IE Extension -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll [2014-05-27] (DVDVideoSoft Ltd.)
BHO-x32: Radio Canyon -> {11111111-1111-1111-1111-110611081104} -> C:\Program Files (x86)\Radio Canyon\Radio Canyon-bho.dll [2014-11-20] (Radio Canyon)
BHO-x32: No Name -> {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} ->  No File
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-04-08] (Avast Software s.r.o.)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-03-03] (Google Inc.)
BHO-x32: DVDVideoSoft IE Extension -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll [2014-08-07] (DVDVideoSoft Ltd.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-03-03] (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-03-03] (Google Inc.)
Toolbar: HKU\S-1-5-21-2931490297-3027747817-2233262723-1002 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-03-03] (Google Inc.)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-02-03] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://istart.webssearches.com/?type=sc&ts=1407674597&from=wld&uid=TOSHIBAXMQ01ABD050_92UIS64ISXX92UIS64IS

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll [2014-01-12] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll [2014-01-12] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-06-07] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-06-07] (Intel Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2013-07-10] (Microsoft Corporation)
FF Plugin-x32: @staging.google.com/globalUpdate Update;version=10 -> C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll [2014-11-20] (globalUpdate)
FF Plugin-x32: @staging.google.com/globalUpdate Update;version=4 -> C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll [2014-11-20] (globalUpdate)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-08] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-08] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-02-05] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2015-04-08]
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
FF HKU\S-1-5-21-2931490297-3027747817-2233262723-1002\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff
FF Extension: Download videos and MP3s from YouTube - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-08-10]

Chrome: 
=======
CHR HomePage: Default -> hxxp://www.trovi.com/?gd=&ctid=CT3322288&octid=EB_ORIGINAL_CTID&ISID=M2495563F-3D00-4261-99E6-D2683449ECDB&SearchSource=55&CUI=&UM=6&UP=SP25B173FF-6AF7-49AE-85F9-8455F8B53EA8&SSPV=
CHR StartupUrls: Default -> "hxxp://www.trovi.com/?gd=&ctid=CT3322288&octid=EB_ORIGINAL_CTID&ISID=M2495563F-3D00-4261-99E6-D2683449ECDB&SearchSource=55&CUI=&UM=6&UP=SP25B173FF-6AF7-49AE-85F9-8455F8B53EA8&SSPV="
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}
CHR Profile: C:\Users\Dominik\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (YouTube) - C:\Users\Dominik\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-02-15]
CHR Extension: (Google Search) - C:\Users\Dominik\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-02-15]
CHR Extension: (Avast Online Security) - C:\Users\Dominik\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2015-04-08]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Dominik\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-04]
CHR Extension: (Google Wallet) - C:\Users\Dominik\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-21]
CHR Extension: (Gmail) - C:\Users\Dominik\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-02-15]
CHR HKU\S-1-5-21-2931490297-3027747817-2233262723-1002\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\DVDVideoSoftBrowserExtension.crx [2014-08-10]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-04-08]
CHR HKLM-x32\...\Chrome\Extension: [ocbnpbkmjpgbdcgiflkgkpnkinifpgpj] - C:\Users\Dominik\ChromeExtensions\ocbnpbkmjpgbdcgiflkgkpnkinifpgpj\amazon-icon-2.crx [2014-08-10]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [211584 2012-08-10] (Qualcomm Atheros Commnucations) [File not signed]
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [343336 2015-04-08] (Avast Software s.r.o.)
R3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [4030800 2015-04-08] (Avast Software)
R2 BrcmCardReader; C:\Program Files\Broadcom\MemoryCard\BrcmCardReader.exe [176640 2012-08-20] (Broadcom Corp.) [File not signed]
R2 CCDMonitorService; C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe [2435728 2012-08-23] (Acer Incorporated)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2714800 2015-02-10] (Microsoft Corporation)
R2 CltMngSvc; C:\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe [3505936 2015-01-28] (Client Connect LTD)
S3 DeviceFastLaneService; C:\Program Files\Acer\Acer Device Fast-lane\DeviceFastLaneSvc.exe [468624 2012-08-23] (Acer Incorporated)
R3 ePowerSvc; C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe [658576 2012-08-22] (Acer Incorporated)
R2 ETDService; C:\Program Files\Elantech\ETDService.exe [85904 2012-09-05] (ELAN Microelectronics Corp.)
S2 globalUpdate; C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe [68608 2014-11-20] (globalUpdate) [File not signed]
S3 globalUpdatem; C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe [68608 2014-11-20] (globalUpdate) [File not signed]
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-18] (Intel Corporation)
R2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [259136 2012-08-23] (NTI Corporation)
R2 RfButtonDriverService; C:\Windows\RfBtnSvc64.exe [93296 2012-12-25] (Dritek System INC.)
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe [2145080 2014-07-16] (TuneUp Software)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16024 2015-01-31] (Microsoft Corporation)
R2 ZAtheros Wlan Agent; C:\Program Files (x86)\Qualcomm Atheros\Ath_WlanAgent.exe [81536 2012-08-01] (Atheros) [File not signed]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29168 2015-04-08] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [88408 2015-04-08] (Avast Software s.r.o.)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-04-08] (Avast Software s.r.o.)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65736 2015-04-08] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1047320 2015-04-08] (Avast Software s.r.o.)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [442264 2015-04-08] (Avast Software s.r.o.)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [136752 2015-04-08] (Avast Software s.r.o.)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [271200 2015-04-08] ()
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2014-12-20] ()
S3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [5139968 2012-06-02] (Broadcom Corporation)
R3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [76952 2012-08-10] (Qualcomm Atheros)
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2014-12-20] ()
R3 Ps2Kb2Hid; C:\Windows\System32\drivers\aPs2Kb2Hid.sys [26736 2012-12-25] (Dritek System Inc.)
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesDriver64.sys [14112 2014-02-10] (TuneUp Software)
R2 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [273824 2015-04-08] (Avast Software)
R3 SPPD; \??\C:\Windows\system32\drivers\SPPD.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-12 11:13 - 2015-04-12 11:14 - 00024856 _____ () C:\Users\Dominik\Downloads\FRST.txt
2015-04-12 11:13 - 2015-04-12 11:14 - 00000000 ____D () C:\FRST
2015-04-12 11:13 - 2015-04-12 11:13 - 02095616 _____ (Farbar) C:\Users\Dominik\Downloads\FRST64.exe
2015-04-09 22:46 - 2015-04-11 16:50 - 00003486 _____ () C:\Windows\System32\Tasks\avaavxvyex
2015-04-09 22:46 - 2015-04-11 12:46 - 00000000 ____D () C:\Users\Dominik\AppData\Local\avaavxvyex
2015-04-09 21:58 - 2015-04-11 16:50 - 00000000 ____D () C:\Program Files (x86)\SearchProtect
2015-04-09 21:58 - 2015-04-09 21:59 - 00000000 ____D () C:\Users\Dominik\AppData\Local\SearchProtect
2015-04-08 22:31 - 2015-04-12 11:09 - 00004356 _____ () C:\Windows\PFRO.log
2015-04-08 21:33 - 2015-04-08 21:35 - 00000000 ____D () C:\Windows\SysWOW64\vbox
2015-04-08 21:33 - 2015-04-08 21:35 - 00000000 ____D () C:\Windows\system32\vbox
2015-04-08 21:33 - 2015-04-08 21:33 - 00000000 ____D () C:\Users\Dominik\AppData\Roaming\AVAST Software
2015-04-08 21:32 - 2015-04-08 21:32 - 00001926 _____ () C:\Users\Public\Desktop\Avast Free Antivirus.lnk
2015-04-08 21:32 - 2015-04-08 21:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2015-04-08 21:31 - 2015-04-12 11:11 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2015-04-08 21:31 - 2015-04-08 21:31 - 01047320 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswSnx.sys
2015-04-08 21:31 - 2015-04-08 21:31 - 00442264 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswSP.sys
2015-04-08 21:31 - 2015-04-08 21:31 - 00364472 _____ (Avast Software s.r.o.) C:\Windows\system32\aswBoot.exe
2015-04-08 21:31 - 2015-04-08 21:31 - 00271200 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2015-04-08 21:31 - 2015-04-08 21:31 - 00136752 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswStm.sys
2015-04-08 21:31 - 2015-04-08 21:31 - 00093528 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswRdr2.sys
2015-04-08 21:31 - 2015-04-08 21:31 - 00088408 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswMonFlt.sys
2015-04-08 21:31 - 2015-04-08 21:31 - 00065736 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2015-04-08 21:31 - 2015-04-08 21:31 - 00043112 _____ (Avast Software s.r.o.) C:\Windows\avastSS.scr
2015-04-08 21:31 - 2015-04-08 21:31 - 00029168 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2015-04-08 21:30 - 2015-04-08 21:30 - 00000000 ____D () C:\Program Files\AVAST Software
2015-04-08 21:27 - 2015-04-08 21:27 - 00000000 ____D () C:\Users\Dominik\Downloads\backups
2015-04-08 21:17 - 2015-04-08 21:17 - 00012680 _____ () C:\Users\Dominik\Desktop\hijackthis.log
2015-04-08 21:16 - 2015-04-08 21:16 - 00388608 _____ (Trend Micro Inc.) C:\Users\Dominik\Downloads\HiJackThis204 (1).exe
2015-04-08 21:04 - 2015-04-08 21:04 - 00442264 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\spgxhfjh.sys
2015-04-08 21:03 - 2015-04-08 21:29 - 00000000 ____D () C:\ProgramData\AVAST Software
2015-04-08 21:03 - 2015-04-08 21:03 - 00442264 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\ieztnrhr.sys
2015-04-08 21:00 - 2015-04-08 21:01 - 150062624 _____ (Avast Software s.r.o.) C:\Users\Dominik\Downloads\avast_free_antivirus_setup_10.2.2215.exe
2015-04-08 01:34 - 2015-04-09 16:52 - 00000657 _____ () C:\Users\Dominik\Desktop\Neues Textdokument.txt
2015-04-03 21:25 - 2015-04-11 21:25 - 00773049 _____ () C:\Windows\WindowsUpdate.log
2015-04-03 14:55 - 2015-04-12 11:10 - 00000004 _____ () C:\Windows\SysWOW64\029B560A371F4E00AB32838EBC01B9E7
2015-04-03 00:46 - 2015-04-12 11:09 - 00001316 _____ () C:\Windows\Tasks\help4u_notification_service.job
2015-04-03 00:46 - 2015-04-08 21:35 - 00000000 ____D () C:\Program Files (x86)\help4u
2015-04-03 00:46 - 2015-04-03 00:46 - 00004322 _____ () C:\Windows\System32\Tasks\help4u_notification_service
2015-03-26 20:52 - 2015-03-11 07:21 - 00677888 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-03-26 20:52 - 2015-03-11 07:20 - 00943104 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-03-26 20:52 - 2015-03-11 07:20 - 00760320 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-03-26 20:52 - 2015-03-11 07:20 - 00414208 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-03-26 20:52 - 2015-03-11 07:20 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-03-26 20:52 - 2015-03-11 07:20 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-03-26 20:52 - 2015-03-11 00:04 - 01107456 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-03-26 20:50 - 2015-03-04 09:26 - 00596480 _____ (Microsoft Corporation) C:\Windows\system32\AutoUpdate.exe
2015-03-26 20:50 - 2015-03-04 09:26 - 00467952 _____ (Microsoft Corporation) C:\Windows\system32\NotificationUI.exe
2015-03-26 20:50 - 2015-03-04 09:26 - 00011105 _____ () C:\Windows\system32\AutoconfigV2.cab
2015-03-26 20:50 - 2015-03-04 08:41 - 00695808 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll
2015-03-26 20:50 - 2015-03-04 08:41 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2015-03-26 20:50 - 2015-03-04 06:53 - 00568832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll
2015-03-26 20:50 - 2015-03-04 06:53 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2015-03-19 23:49 - 2015-03-29 22:05 - 00000000 ____D () C:\Users\Dominik\Desktop\Stefan
2015-03-19 23:48 - 2015-03-24 23:29 - 00003490 _____ () C:\Windows\System32\Tasks\avayvaxxvae
2015-03-17 18:16 - 2015-03-17 18:16 - 00000000 ____D () C:\Users\Dominik\AppData\Roaming\mp3DirectCut
2015-03-17 18:13 - 2015-03-17 18:13 - 00000000 ____D () C:\Program Files (x86)\mp3DirectCut
2015-03-17 18:11 - 2015-03-17 18:11 - 00308709 _____ () C:\Users\Dominik\Downloads\mp3DC220.exe
2015-03-16 12:25 - 2015-03-16 13:02 - 748863400 _____ () C:\Users\Dominik\Downloads\58eIMdFY.rar
2015-03-16 12:22 - 2015-03-16 12:22 - 00728552 _____ (Installer Internet ) C:\Users\Dominik\Downloads\installer_vlc_media_player_Spanish.exe
2015-03-16 01:05 - 2015-03-16 01:57 - 726878216 _____ () C:\Users\Dominik\Downloads\58knxJ7c.rar

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-12 11:10 - 2014-11-20 19:41 - 00000966 _____ () C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job
2015-04-12 11:10 - 2013-02-15 11:33 - 00001136 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-04-12 11:09 - 2014-11-20 19:42 - 00002454 _____ () C:\Windows\Tasks\9a59edf6-dba4-42e9-b4d9-3a4ddec8b58d-5_user.job
2015-04-12 11:09 - 2014-11-20 19:42 - 00002454 _____ () C:\Windows\Tasks\9a59edf6-dba4-42e9-b4d9-3a4ddec8b58d-5.job
2015-04-12 11:09 - 2014-11-20 19:41 - 00005526 _____ () C:\Windows\Tasks\9a59edf6-dba4-42e9-b4d9-3a4ddec8b58d-6.job
2015-04-12 11:09 - 2014-11-20 19:41 - 00005190 _____ () C:\Windows\Tasks\9a59edf6-dba4-42e9-b4d9-3a4ddec8b58d-7.job
2015-04-12 11:09 - 2014-11-20 19:41 - 00004848 _____ () C:\Windows\Tasks\9a59edf6-dba4-42e9-b4d9-3a4ddec8b58d-11.job
2015-04-12 11:09 - 2014-11-20 19:41 - 00004502 _____ () C:\Windows\Tasks\9a59edf6-dba4-42e9-b4d9-3a4ddec8b58d-4.job
2015-04-12 11:09 - 2014-11-20 19:41 - 00003120 _____ () C:\Windows\Tasks\9a59edf6-dba4-42e9-b4d9-3a4ddec8b58d-1.job
2015-04-12 11:09 - 2012-07-26 09:22 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-04-11 21:47 - 2012-07-26 07:26 - 00262144 ___SH () C:\Windows\system32\config\BBI
2015-04-11 21:27 - 2013-02-15 11:33 - 00001140 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-04-11 21:13 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\system32\sru
2015-04-11 18:46 - 2014-11-20 19:41 - 00000970 _____ () C:\Windows\Tasks\globalUpdateUpdateTaskMachineUA.job
2015-04-11 12:51 - 2013-02-18 11:19 - 00000000 ____D () C:\Users\Dominik\AppData\Local\CrashDumps
2015-04-11 11:51 - 2013-02-13 00:22 - 00000000 ____D () C:\Users\Dominik
2015-04-09 22:37 - 2014-08-10 14:43 - 00000000 ____D () C:\Program Files (x86)\SupTab
2015-04-09 21:58 - 2012-12-25 16:33 - 00753134 _____ () C:\Windows\system32\perfh007.dat
2015-04-09 21:58 - 2012-12-25 16:33 - 00155826 _____ () C:\Windows\system32\perfc007.dat
2015-04-09 21:58 - 2012-07-26 09:28 - 01745416 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-04-09 12:14 - 2014-11-20 19:41 - 00000000 ____D () C:\Program Files (x86)\Radio Canyon
2015-04-08 22:54 - 2013-02-14 06:55 - 00003600 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2931490297-3027747817-2233262723-1002
2015-04-08 21:35 - 2014-08-10 14:43 - 00000000 ____D () C:\ProgramData\IePluginServices
2015-04-08 21:17 - 2013-02-13 00:22 - 00000000 ____D () C:\Users\Dominik\AppData\Local\VirtualStore
2015-04-08 21:15 - 2015-02-25 18:38 - 00053890 _____ () C:\Windows\wininit.ini
2015-04-08 21:13 - 2012-11-02 05:33 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2015-04-08 21:13 - 2012-11-02 05:33 - 00000000 ____D () C:\ProgramData\WildTangent
2015-04-08 21:12 - 2013-02-15 11:33 - 00002179 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-04-08 21:12 - 2013-02-13 00:23 - 00001446 _____ () C:\Users\Dominik\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-04-08 21:08 - 2015-01-26 22:33 - 00000000 ____D () C:\Program Files (x86)\WIntEnhance
2015-04-08 21:08 - 2015-01-26 22:33 - 00000000 ____D () C:\Program Files (x86)\Wajam
2015-04-03 16:51 - 2014-04-28 16:35 - 00000000 ____D () C:\Users\Dominik\Desktop\Muay Thai
2015-04-03 16:21 - 2014-12-17 08:55 - 00000000 ____D () C:\Users\Dominik\Desktop\Bewerbungen
2015-03-30 12:46 - 2013-02-15 17:54 - 00000000 ____D () C:\Users\Dominik\AppData\Local\Deployment
2015-03-26 22:48 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\rescache
2015-03-26 22:46 - 2015-02-19 17:27 - 00005152 _____ () C:\Windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for Studien-PC-Dominik Studien-PC
2015-03-26 20:56 - 2014-12-13 10:36 - 00000000 ____D () C:\Windows\system32\appraiser
2015-03-26 20:56 - 2014-08-01 00:00 - 00000000 ___SD () C:\Windows\system32\CompatTel
2015-03-26 20:56 - 2012-07-26 09:59 - 00000000 ____D () C:\Windows\CbsTemp
2015-03-26 20:55 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\WinStore
2015-03-18 22:50 - 2013-02-15 17:50 - 00000000 ____D () C:\Program Files\Microsoft Office 15
2015-03-17 22:45 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\AUInstallAgent
2015-03-16 13:32 - 2014-12-29 12:29 - 00000000 ____D () C:\Users\Dominik\Desktop\Musik
2015-03-16 10:26 - 2015-03-11 12:03 - 00000000 ____D () C:\Users\Dominik\AppData\Local\avayvaxxvae
2015-03-13 23:34 - 2012-07-26 10:12 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2015-03-13 23:34 - 2012-07-26 10:12 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2015-03-13 23:34 - 2012-07-26 10:12 - 00000000 ____D () C:\Program Files\Windows Defender
2015-03-13 23:34 - 2012-07-26 10:12 - 00000000 ____D () C:\Program Files (x86)\Windows Defender

==================== Files in the root of some directories =======

2012-12-25 08:00 - 2012-12-25 08:00 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

Some content of TEMP:
====================
C:\Users\Dominik\AppData\Local\Temp\6fc0000a.exe
C:\Users\Dominik\AppData\Local\Temp\Setup.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-04-04 12:32

==================== End Of Log ============================

--- --- ---

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-04-2015
Ran by Dominik at 2015-04-12 11:15:12
Running from C:\Users\Dominik\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

 clear.fi SDK - Video 2 (x32 Version: 2.1.1925 - CyberLink Corp.) Hidden
 clear.fi SDK- Movie 2 (x32 Version: 2.1.2008 - CyberLink Corp.) Hidden
Acer Backup Manager (HKLM-x32\...\InstallShield_{9DDDF20E-9FD1-4434-A43E-E7889DBC9420}) (Version: 4.0.0.0059 - NTI Corporation)
Acer Device Fast-lane (HKLM\...\{3F62D2FD-13C1-49A2-8B5D-47623D9460D7}) (Version: 1.00.3007 - Acer Incorporated)
Acer Instant Update Service (HKLM\...\{8215A318-CC27-435E-B3EA-2E3443C8998C}) (Version: 1.00.3013 - Acer Incorporated)
Acer Power Management (HKLM\...\{91F52DE4-B789-42B0-9311-A349F10E5479}) (Version: 7.00.3006 - Acer Incorporated)
Acer Recovery Management (HKLM\...\{07F2005A-8CAC-4A4B-83A2-DA98A722CA61}) (Version: 6.00.3011 - Acer Incorporated)
AcerCloud (HKLM-x32\...\{A5AD0B17-F34D-49BE-A157-C8B3D52ACD13}) (Version: 2.01.3115 - Acer Incorporated)
AcerCloud Docs (HKLM-x32\...\{CA4FE8B0-298C-4E5D-A486-F33B126D6A0A}) (Version: 1.00.3201 - Acer Incorporated)
Adobe Flash Player 11 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 11.9.900.170 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 10.2.2215 - AVAST Software)
Backup Manager v4 (x32 Version: 4.0.0.0059 - NTI Corporation) Hidden
Broadcom Card Reader Driver Installer (HKLM\...\{F0A7DF2F-0BE0-470F-B137-D7A19F977189}) (Version: 15.4.7.1 - Broadcom Corporation)
CCleaner (HKLM\...\CCleaner) (Version: 3.27 - Piriform)
clear.fi Media (HKLM-x32\...\{E9AF1707-3F3A-49E2-8345-4F2D629D0876}) (Version: 2.01.3108 - Acer Incorporated)
clear.fi Photo (HKLM-x32\...\{B5AD89F2-03D3-4206-8487-018298007DD0}) (Version: 2.01.3108 - Acer Incorporated)
CyberLink MediaEspresso 6.5 (HKLM-x32\...\InstallShield_{E3739848-5329-48E3-8D28-5BBD6E8BE384}) (Version: 6.5.3103_44819 - CyberLink Corp.)
Dolby Home Theater v4 (HKLM-x32\...\{B26438B4-BF51-49C3-9567-7F14A5E40CB9}) (Version: 7.2.8000.13 - Dolby Laboratories Inc)
eBay Worldwide (HKLM-x32\...\{A694AF57-9891-4D62-824C-7E55A1361A14}) (Version: 2.3.0630 - OEM)
ETDWare PS/2-X64 11.6.9.001_WHQL (HKLM\...\Elantech) (Version: 11.6.9.001 - ELAN Microelectronic Corp.)
Free YouTube Download version 3.2.49.1111 (HKLM-x32\...\Free YouTube Download_is1) (Version: 3.2.49.1111 - DVDVideoSoft Ltd.)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 41.0.2272.118 - Google Inc.)
Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.6227.252 - Google Inc.)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
Identity Card (HKLM-x32\...\{3D9CB654-99AD-4301-89C6-0D12A790767C}) (Version: 2.00.3004 - Acer Incorporated)
InetStat (HKU\S-1-5-21-2931490297-3027747817-2233262723-1002\...\InetStat) (Version: 0.5b - InetStat) <==== ATTENTION!
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.2867 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.5.0.1207 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
Launch Manager (HKLM-x32\...\LManager) (Version: 7.0.5 - Acer Inc.)
Live Updater (HKLM-x32\...\{EE26E302-876A-48D9-9058-3129E5B99999}) (Version: 2.00.3004 - Acer Incorporated)
Microsoft Office Home and Student 2013 - de-de (HKLM\...\HomeStudentRetail - de-de) (Version: 15.0.4701.1002 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SkyDrive (HKU\S-1-5-21-2931490297-3027747817-2233262723-1002\...\SkyDriveSetup.exe) (Version: 17.0.2003.1112 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
MyWinLocker (Version: 4.0.14.35 - Egis Technology Inc.) Hidden
MyWinLocker 4 (x32 Version: 4.0.14.35 - Egis Technology Inc.) Hidden
MyWinLocker Suite (HKLM-x32\...\InstallShield_{17DF9714-60C9-43C9-A9C2-32BCAED44CBE}) (Version: 4.0.14.24 - Egis Technology Inc.)
MyWinLocker Suite (x32 Version: 4.0.14.24 - Egis Technology Inc.) Hidden
NTI Media Maker 9 (HKLM-x32\...\InstallShield_{D3D5C4E8-040F-4C6F-8105-41D43CF94F44}) (Version: 9.0.2.9008 - NTI Corporation)
NTI Media Maker 9 (x32 Version: 9.0.2.9008 - NTI Corporation) Hidden
NVIDIA Grafiktreiber 307.17 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 307.17 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.12.0613 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.12.0613 - NVIDIA Corporation)
NVIDIA Update 1.10.8 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.10.8 - NVIDIA Corporation)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4701.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4701.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4701.1002 - Microsoft Corporation) Hidden
Office Addin (HKLM-x32\...\{6D2BBE1D-E600-4695-BA37-0B0E605542CC}) (Version: 2.01.3200 - Acer)
PDF24 Creator 6.9.2 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)
Qualcomm Atheros Bluetooth Suite (64) (HKLM\...\{A84A4FB1-D703-48DB-89E0-68B6499D2801}) (Version: 8.0.0.206 - Ihr Firmenname)
Qualcomm Atheros WiFi Driver Installation (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 11.05 - Qualcomm Atheros)
Radio Canyon (HKLM-x32\...\Radio Canyon) (Version: 1.35.9.29 - Radio Canyon) <==== ATTENTION!
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6657 - Realtek Semiconductor Corp.)
Remote Desktop Access (VuuPC) (HKLM-x32\...\VOPackage) (Version: 1.0.0.0 - CMI Limited) <==== ATTENTION
Search Protect (HKLM-x32\...\SearchProtect) (Version: 2.22.0.160 - Client Connect LTD) <==== ATTENTION
Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)
Shredder (Version: 2.0.8.9 - Egis Technology Inc.) Hidden
Shredder (x32 Version: 2.0.8.9 - Egis Technology Inc.) Hidden
Spotify (HKLM-x32\...\Spotify) (Version: 0.8.4.99.ga249b5f1 - Spotify AB)
Tropico (HKLM-x32\...\{818FB39B-1A57-4F1B-A54D-391C33D6C586}) (Version:  - )
TuneUp Utilities 2014 (de-DE) (x32 Version: 14.0.1000.340 - TuneUp Software) Hidden
TuneUp Utilities 2014 (HKLM-x32\...\TuneUp Utilities) (Version: 14.0.1000.340 - TuneUp Software)
TuneUp Utilities 2014 (x32 Version: 14.0.1000.340 - TuneUp Software) Hidden
Visual Studio 2005 Tools for Office Second Edition Runtime (HKLM-x32\...\Microsoft Visual Studio 2005 Tools for Office Runtime) (Version:  - Microsoft Corporation)
Visual Studio Tools for the Office system 3.0 Runtime (HKLM-x32\...\Visual Studio Tools for the Office system 3.0 Runtime) (Version:  - Microsoft Corporation)
Visual Studio Tools for the Office system 3.0 Runtime Service Pack 1 (KB949258) (HKLM-x32\...\{8FB53850-246A-3507-8ADE-0060093FFEA6}.KB949258) (Version: 1 - Microsoft Corporation)
VLC media player 2.1.3 (HKLM-x32\...\VLC media player) (Version: 2.1.3 - VideoLAN)
WindowsMangerProtect20.0.0.502 (HKLM-x32\...\WindowsMangerProtect) (Version: 20.0.0.502 - WindowsProtect LIMITED) <==== ATTENTION
WinRAR 5.20 (32-Bit) (HKLM-x32\...\WinRAR archiver) (Version: 5.20.0 - win.rar GmbH)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-2931490297-3027747817-2233262723-1002_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Dominik\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2931490297-3027747817-2233262723-1002_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Dominik\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2931490297-3027747817-2233262723-1002_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32 -> C:\Users\Dominik\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2931490297-3027747817-2233262723-1002_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Dominik\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2931490297-3027747817-2233262723-1002_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Dominik\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\amd64\FileSyncApi64.dll (Microsoft Corporation)

==================== Restore Points  =========================

19-03-2015 16:37:43 Geplanter Prüfpunkt
26-03-2015 20:54:50 Windows Update
03-04-2015 15:55:11 Geplanter Prüfpunkt
08-04-2015 21:29:35 avast! antivirus system restore point

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2012-07-26 07:26 - 2012-07-26 07:26 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0855FA5D-DF0C-4B26-8B9E-DBA3D0101720} - System32\Tasks\Recovery Management\Notification => C:\Program Files\Acer\Acer Recovery Management\Notification\Notification.exe [2012-07-31] (Acer Incorporated)
Task: {0CA8AB11-20C7-4E48-94E6-C3801478A32F} - System32\Tasks\avaxvavya => C:\Users\Dominik\AppData\Local\avaxvavya\avaxvavya.exe [2015-01-28] () <==== ATTENTION
Task: {1139621C-8DFA-451C-9105-E048C358B44D} - System32\Tasks\help4u_notification_service => C:\Program Files (x86)\help4u\help4u_notification_service.exe [2015-04-03] (FileProperties_CompanyName)
Task: {1B0A2796-5AD5-4BAF-B05E-75AE68B68CD5} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 => C:\Program Files (x86)\TuneUp Utilities 2014\OneClick.exe [2014-07-16] (TuneUp Software)
Task: {1E3B7EB2-607A-4E12-AB89-087FB25386A9} - System32\Tasks\9a59edf6-dba4-42e9-b4d9-3a4ddec8b58d-7 => C:\Program Files (x86)\Radio Canyon\9a59edf6-dba4-42e9-b4d9-3a4ddec8b58d-7.exe <==== ATTENTION
Task: {21854FC0-B4AB-4957-AFFD-A2E18D9837AA} - System32\Tasks\Microsoft Office 15 Sync Maintenance for Studien-PC-Dominik Studien-PC => C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [2015-02-10] (Microsoft Corporation)
Task: {27949D9D-ABF9-436E-A568-6B88DBF87C2B} - System32\Tasks\DeviceDetector => C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe [2012-07-04] (CyberLink)
Task: {33F8BA16-2015-4E14-8612-8D4CF302606F} - System32\Tasks\9a59edf6-dba4-42e9-b4d9-3a4ddec8b58d-5_user => C:\Program Files (x86)\Radio Canyon\9a59edf6-dba4-42e9-b4d9-3a4ddec8b58d-5.exe <==== ATTENTION
Task: {3764ACD2-537D-4A2A-B876-701C956B9C2B} - System32\Tasks\ALU => C:\Program Files (x86)\Acer\Live Updater\updater.exe [2012-08-30] ()
Task: {3C46B0D9-64EE-407A-A035-BC3C93BC9955} - System32\Tasks\Power Management => C:\Program Files\Acer\Acer Power Management\ePowerTray.exe [2012-08-22] (Acer Incorporated)
Task: {3D3B3545-6C2A-4FA9-8619-71ABD39F5788} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-02-15] (Google Inc.)
Task: {4C812B30-E4E0-4BA1-A700-538F743ACCD1} - System32\Tasks\globalUpdateUpdateTaskMachineUA => C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe [2014-11-20] (globalUpdate) <==== ATTENTION
Task: {4D02C09C-7EC1-4366-89F4-A63219B60ED6} - System32\Tasks\iuBrowserIEAgent => C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuBrowserIEAgent.exe [2012-08-23] ()
Task: {4FADDBDE-04F9-416E-9430-15EDFA9B5B97} - System32\Tasks\avaavxvyex => C:\Users\Dominik\AppData\Local\avaavxvyex\avaavxvyex.exe [2015-03-16] () <==== ATTENTION
Task: {53FFA86F-637F-416C-921B-5CF07D441A0B} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2015-03-11] (Microsoft Corporation)
Task: {5B3191FA-7E0D-4B84-ABD8-AC73B2C829C9} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-02-15] (Google Inc.)
Task: {5C3BC2EF-AA9D-430C-B7FF-305E334829EB} - System32\Tasks\9a59edf6-dba4-42e9-b4d9-3a4ddec8b58d-4 => C:\Program Files (x86)\Radio Canyon\9a59edf6-dba4-42e9-b4d9-3a4ddec8b58d-4.exe <==== ATTENTION
Task: {5C9CDFA4-5781-44A2-B2F4-3D46261C6531} - System32\Tasks\9a59edf6-dba4-42e9-b4d9-3a4ddec8b58d-6 => C:\Program Files (x86)\Radio Canyon\9a59edf6-dba4-42e9-b4d9-3a4ddec8b58d-6.exe <==== ATTENTION
Task: {5F771809-24A5-4677-AA7F-35D968E17514} - System32\Tasks\avayvxvaxc => C:\Users\Dominik\AppData\Local\avayvxvaxc\avayvxvaxc.exe [2015-02-15] () <==== ATTENTION
Task: {69AC89AD-0274-4668-8047-BEEAA6D194B4} - System32\Tasks\PMMUpdate => C:\Program Files\EgisTec IPS\PMMUpdate.exe [2012-07-12] (Egis Technology Inc.)
Task: {77FAB995-E459-41BB-80E3-609022345B31} - System32\Tasks\9a59edf6-dba4-42e9-b4d9-3a4ddec8b58d-1 => C:\Program Files (x86)\Radio Canyon\Radio Canyon-codedownloader.exe <==== ATTENTION
Task: {78F7944A-CFE4-4C86-9FFD-1437702CA6AB} - System32\Tasks\avayvaxxvae => C:\Users\Dominik\AppData\Local\avayvaxxvae\avayvaxxvae.exe [2015-03-04] () <==== ATTENTION
Task: {82B33C67-F329-458D-B9FC-BD1FEDEC1E40} - System32\Tasks\iuEmailOutlookAgent => C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe [2012-08-23] ()
Task: {8D71B8DF-2A46-4C7B-90D9-CCFC5BFDBD95} - System32\Tasks\EgisUpdate => C:\Program Files\EgisTec IPS\EgisUpdate.exe [2012-07-12] (Egis Technology Inc.)
Task: {97C70124-91F3-4F53-A758-4ED6F2F25DD5} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-02-10] (Microsoft Corporation)
Task: {9F427398-F1B5-4156-ACCB-024B53466752} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2015-04-08] (Avast Software s.r.o.)
Task: {B04D421F-6C9B-4044-BEFE-26C33F56039C} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {B943FFEA-719E-41B3-BBA1-70566DD92E07} - System32\Tasks\avayvaxvaa => C:\Users\Dominik\AppData\Local\avayvaxvaa\avayvaxvaa.exe [2015-02-19] () <==== ATTENTION
Task: {BD8CE4CA-0568-43FB-97C1-5DD52EDA91DB} - System32\Tasks\globalUpdateUpdateTaskMachineCore => C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe [2014-11-20] (globalUpdate) <==== ATTENTION
Task: {D51F0A53-0EC3-4302-9997-857A086E3ECC} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-01-23] (Piriform Ltd)
Task: {DD061010-51A0-4E2C-82F3-6D41359E54DB} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-02-10] (Microsoft Corporation)
Task: {DDADEDBD-2B56-4634-9D9F-F4CED38F85BA} - System32\Tasks\ALUAgent => C:\Program Files (x86)\Acer\Live Updater\liveupdater_agent.exe [2012-06-22] ()
Task: {EA011470-39D0-4238-A744-D76ED910479E} - System32\Tasks\9a59edf6-dba4-42e9-b4d9-3a4ddec8b58d-11 => C:\Program Files (x86)\Radio Canyon\9a59edf6-dba4-42e9-b4d9-3a4ddec8b58d-11.exe <==== ATTENTION
Task: {EF5891E1-E944-4F7C-AB89-719273D13A56} - System32\Tasks\9a59edf6-dba4-42e9-b4d9-3a4ddec8b58d-5 => C:\Program Files (x86)\Radio Canyon\9a59edf6-dba4-42e9-b4d9-3a4ddec8b58d-5.exe <==== ATTENTION
Task: {F26E67BE-AF0B-4BEB-8B13-45638488F2D8} - System32\Tasks\avaxvyyvyf => C:\Users\Dominik\AppData\Local\avaxvyyvyf\avaxvyyvyf.exe [2015-02-02] () <==== ATTENTION
Task: C:\Windows\Tasks\9a59edf6-dba4-42e9-b4d9-3a4ddec8b58d-1.job => C:\Program Files (x86)\Radio Canyon\Radio Canyon-codedownloader.exe <==== ATTENTION
Task: C:\Windows\Tasks\9a59edf6-dba4-42e9-b4d9-3a4ddec8b58d-11.job => C:\Program Files (x86)\Radio Canyon\9a59edf6-dba4-42e9-b4d9-3a4ddec8b58d-11.exe <==== ATTENTION
Task: C:\Windows\Tasks\9a59edf6-dba4-42e9-b4d9-3a4ddec8b58d-4.job => C:\Program Files (x86)\Radio Canyon\9a59edf6-dba4-42e9-b4d9-3a4ddec8b58d-4.exe <==== ATTENTION
Task: C:\Windows\Tasks\9a59edf6-dba4-42e9-b4d9-3a4ddec8b58d-5.job => C:\Program Files (x86)\Radio Canyon\9a59edf6-dba4-42e9-b4d9-3a4ddec8b58d-5.exe <==== ATTENTION
Task: C:\Windows\Tasks\9a59edf6-dba4-42e9-b4d9-3a4ddec8b58d-5_user.job => C:\Program Files (x86)\Radio Canyon\9a59edf6-dba4-42e9-b4d9-3a4ddec8b58d-5.exe <==== ATTENTION
Task: C:\Windows\Tasks\9a59edf6-dba4-42e9-b4d9-3a4ddec8b58d-6.job => C:\Program Files (x86)\Radio Canyon\9a59edf6-dba4-42e9-b4d9-3a4ddec8b58d-6.exe <==== ATTENTION
Task: C:\Windows\Tasks\9a59edf6-dba4-42e9-b4d9-3a4ddec8b58d-7.job => C:\Program Files (x86)\Radio Canyon\9a59edf6-dba4-42e9-b4d9-3a4ddec8b58d-7.exe <==== ATTENTION
Task: C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job => C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe <==== ATTENTION
Task: C:\Windows\Tasks\globalUpdateUpdateTaskMachineUA.job => C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe <==== ATTENTION
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\help4u_notification_service.job => C:\Program Files (x86)\help4u\help4u_notification_service.exeâ/url='http:/cdn.selectbestopt.com/notf_sys/index.html' /crregname='help4u' /appid='73143' /srcid='2913' /bic='111487d4c25b3e3518cbe1ae3bbf6559' /verifier='7bcc0ff92b60f6af6575627c28e9c62b' /installerversion='1.50.3.10' /statsdomain='http:/stats.buildomserv.com/data.gif?' /errorsdomain='http:/stats.buildomserv.com/data.gif?' /monetizationdomain='http:/logs.buildomserv.com/monetization.gif

==================== Loaded Modules (whitelisted) ==============

2014-03-20 19:22 - 2014-05-20 09:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2014-07-16 10:24 - 2014-07-16 10:24 - 00699704 _____ () C:\Program Files (x86)\TuneUp Utilities 2014\avgrepliba.dll
2012-11-02 05:55 - 2012-10-23 20:37 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2012-08-10 19:28 - 2012-08-10 19:28 - 00384128 _____ () C:\Program Files (x86)\Bluetooth Suite\ContactsApi.dll
2012-08-10 19:23 - 2012-08-10 19:23 - 00020992 _____ () C:\Program Files (x86)\Bluetooth Suite\L10n\de-DE\BtTray.de-DE.dll
2012-08-23 00:04 - 2012-08-23 00:04 - 00025232 _____ () C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe
2012-08-23 00:04 - 2012-08-23 00:04 - 00044176 _____ () C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuBrowserIEAgent.exe
2015-04-08 21:31 - 2015-04-08 21:31 - 00104400 _____ () C:\Program Files\AVAST Software\Avast\log.dll
2015-04-08 21:31 - 2015-04-08 21:31 - 00081728 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
2015-04-11 12:39 - 2015-04-11 12:39 - 02925568 _____ () C:\Program Files\AVAST Software\Avast\defs\15041100\algo.dll
2015-04-12 11:11 - 2015-04-12 11:11 - 02925568 _____ () C:\Program Files\AVAST Software\Avast\defs\15041200\algo.dll
2012-08-23 08:26 - 2012-08-23 08:26 - 00465384 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\sqlite3.dll
2012-08-23 08:25 - 2012-08-23 08:25 - 00125504 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\MailConverter32.dll
2012-08-23 08:26 - 2012-08-23 08:26 - 00155712 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\VolumeSnapshot.dll
2012-08-23 08:25 - 2012-08-23 08:25 - 00118336 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\Online.dll
2012-08-23 08:25 - 2012-08-23 08:25 - 01081408 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\ACE.dll
2012-08-23 08:25 - 2012-08-23 08:25 - 00052288 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\OsSettingPort.dll
2012-08-23 08:26 - 2012-08-23 08:26 - 00727616 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\OutlookShadow.dll
2015-04-03 15:28 - 2015-03-30 23:07 - 01174856 _____ () C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.118\libglesv2.dll
2015-04-03 15:28 - 2015-03-30 23:07 - 00080200 _____ () C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.118\libegl.dll
2015-04-08 21:31 - 2015-04-08 21:31 - 40540672 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2015-04-03 15:28 - 2015-03-30 23:07 - 09279304 _____ () C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.118\pdf.dll
2015-04-03 15:28 - 2015-03-30 23:07 - 14974280 _____ () C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.118\PepperFlash\pepflashplayer.dll
2012-12-25 07:54 - 2012-06-25 19:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2931490297-3027747817-2233262723-1002\Control Panel\Desktop\\Wallpaper -> C:\Users\Dominik\Desktop\1938-why-so-serious-800x600.jpg
DNS Servers: 192.168.178.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== Accounts: =============================

Administrator (S-1-5-21-2931490297-3027747817-2233262723-500 - Administrator - Disabled)
Dominik (S-1-5-21-2931490297-3027747817-2233262723-1002 - Administrator - Enabled) => C:\Users\Dominik
Gast (S-1-5-21-2931490297-3027747817-2233262723-501 - Limited - Disabled)
UpdatusUser (S-1-5-21-2931490297-3027747817-2233262723-1001 - Limited - Enabled) => C:\Users\UpdatusUser

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (04/11/2015 00:51:38 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Notification.exe, Version: 6.0.3004.0, Zeitstempel: 0x50174098
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.2.9200.16864, Zeitstempel: 0x531d34d8
Ausnahmecode: 0xe0434352
Fehleroffset: 0x0000000000047b8c
ID des fehlerhaften Prozesses: 0x10b8
Startzeit der fehlerhaften Anwendung: 0xNotification.exe0
Pfad der fehlerhaften Anwendung: Notification.exe1
Pfad des fehlerhaften Moduls: Notification.exe2
Berichtskennung: Notification.exe3
Vollständiger Name des fehlerhaften Pakets: Notification.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Notification.exe5

Error: (04/11/2015 00:51:37 PM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Anwendung: Notification.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet.
Ausnahmeinformationen: System.ComponentModel.Win32Exception
Stapel:
   bei System.Diagnostics.NtProcessManager.GetModuleInfos(Int32, Boolean)
   bei System.Diagnostics.Process.get_MainModule()
   bei Notification.App.CheckResolution()
   bei Notification.App.Main(System.String[])

Error: (04/09/2015 05:13:47 PM) (Source: VSS) (EventID: 12294) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Aufrufen einer Routine auf dem Schattenkopieanbieter "{b5946137-7b9f-4925-af80-51abd60b20d5}" ist ein Fehler aufgetreten. Die Routine hat E_INVALIDARG zurückgegeben.
Routinedetails GetSnapshot({00000000-0000-0000-0000-000000000000},000000857663C220).


Vorgang:
   Eigenschaften der Schattenkopie abrufen

Kontext:
   Ausführungskontext: Coordinator

Error: (04/09/2015 00:26:49 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005

Error: (04/08/2015 09:37:01 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".


Details:
AddWin32ServiceFiles: Unable to back up image of service IePlugin Services since QueryServiceConfig API failed

System Error:
Das System kann die angegebene Datei nicht finden.
.

Error: (04/08/2015 09:37:01 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".


Details:
AddLegacyDriverFiles: Unable to back up image of binary nxgbwnlt.

System Error:
Das System kann die angegebene Datei nicht finden.
.

Error: (04/08/2015 09:36:07 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".


Details:
AddWin32ServiceFiles: Unable to back up image of service IePlugin Services since QueryServiceConfig API failed

System Error:
Das System kann die angegebene Datei nicht finden.
.

Error: (04/08/2015 09:36:07 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".


Details:
AddLegacyDriverFiles: Unable to back up image of binary nxgbwnlt.

System Error:
Das System kann die angegebene Datei nicht finden.
.

Error: (04/08/2015 09:30:15 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".


Details:
AddLegacyDriverFiles: Unable to back up image of binary nxgbwnlt.

System Error:
Das System kann die angegebene Datei nicht finden.
.

Error: (04/08/2015 09:06:16 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Notification.exe, Version: 6.0.3004.0, Zeitstempel: 0x50174098
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.2.9200.16864, Zeitstempel: 0x531d34d8
Ausnahmecode: 0xe0434352
Fehleroffset: 0x0000000000047b8c
ID des fehlerhaften Prozesses: 0xe58
Startzeit der fehlerhaften Anwendung: 0xNotification.exe0
Pfad der fehlerhaften Anwendung: Notification.exe1
Pfad des fehlerhaften Moduls: Notification.exe2
Berichtskennung: Notification.exe3
Vollständiger Name des fehlerhaften Pakets: Notification.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Notification.exe5


System errors:
=============
Error: (04/12/2015 11:09:17 AM) (Source: Microsoft-Windows-Kernel-General) (EventID: 6) (User: NT-AUTORITÄT)
Description: 0xc000014d0

Error: (04/11/2015 00:39:07 PM) (Source: Microsoft-Windows-Kernel-General) (EventID: 6) (User: NT-AUTORITÄT)
Description: 0xc000014d0

Error: (04/11/2015 11:52:01 AM) (Source: Service Control Manager) (EventID: 7043) (User: )
Description: Der Dienst Gruppenrichtlinienclient konnte nach dem Empfang eines Preshutdown-Steuerelements nicht richtig heruntergefahren werden.

Error: (04/10/2015 09:36:05 PM) (Source: Microsoft-Windows-Kernel-General) (EventID: 6) (User: NT-AUTORITÄT)
Description: 0xc000014d0

Error: (04/10/2015 09:37:15 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎10.‎04.‎2015 um 21:29:41 unerwartet heruntergefahren.

Error: (04/10/2015 00:04:20 AM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde nicht richtig gestartet.

Error: (04/09/2015 11:59:43 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Search Protect Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%129

Error: (04/09/2015 10:52:01 PM) (Source: Microsoft-Windows-Kernel-General) (EventID: 6) (User: NT-AUTORITÄT)
Description: 0xc000014d0

Error: (04/09/2015 09:50:22 PM) (Source: Microsoft-Windows-Kernel-General) (EventID: 6) (User: NT-AUTORITÄT)
Description: 0xc000014d0

Error: (04/09/2015 04:34:48 PM) (Source: Microsoft-Windows-Kernel-General) (EventID: 6) (User: NT-AUTORITÄT)
Description: 0xc000014d0


Microsoft Office Sessions:
=========================
Error: (04/11/2015 00:51:38 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Notification.exe6.0.3004.050174098KERNELBASE.dll6.2.9200.16864531d34d8e04343520000000000047b8c10b801d074457aef8975C:\Program Files\Acer\Acer Recovery Management\Notification\Notification.exeC:\Windows\system32\KERNELBASE.dllba4a99b9-e038-11e4-8381-9c2a701ad84c

Error: (04/11/2015 00:51:37 PM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Anwendung: Notification.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet.
Ausnahmeinformationen: System.ComponentModel.Win32Exception
Stapel:
   bei System.Diagnostics.NtProcessManager.GetModuleInfos(Int32, Boolean)
   bei System.Diagnostics.Process.get_MainModule()
   bei Notification.App.CheckResolution()
   bei Notification.App.Main(System.String[])

Error: (04/09/2015 05:13:47 PM) (Source: VSS) (EventID: 12294) (User: )
Description: {b5946137-7b9f-4925-af80-51abd60b20d5}GetSnapshot({00000000-0000-0000-0000-000000000000},000000857663C220)

Vorgang:
   Eigenschaften der Schattenkopie abrufen

Kontext:
   Ausführungskontext: Coordinator

Error: (04/09/2015 00:26:49 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005

Error: (04/08/2015 09:37:01 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: 
Details:
AddWin32ServiceFiles: Unable to back up image of service IePlugin Services since QueryServiceConfig API failed

System Error:
Das System kann die angegebene Datei nicht finden.

Error: (04/08/2015 09:37:01 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: 
Details:
AddLegacyDriverFiles: Unable to back up image of binary nxgbwnlt.

System Error:
Das System kann die angegebene Datei nicht finden.

Error: (04/08/2015 09:36:07 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: 
Details:
AddWin32ServiceFiles: Unable to back up image of service IePlugin Services since QueryServiceConfig API failed

System Error:
Das System kann die angegebene Datei nicht finden.

Error: (04/08/2015 09:36:07 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: 
Details:
AddLegacyDriverFiles: Unable to back up image of binary nxgbwnlt.

System Error:
Das System kann die angegebene Datei nicht finden.

Error: (04/08/2015 09:30:15 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: 
Details:
AddLegacyDriverFiles: Unable to back up image of binary nxgbwnlt.

System Error:
Das System kann die angegebene Datei nicht finden.

Error: (04/08/2015 09:06:16 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Notification.exe6.0.3004.050174098KERNELBASE.dll6.2.9200.16864531d34d8e04343520000000000047b8ce5801d0722f14c2e3ebC:\Program Files\Acer\Acer Recovery Management\Notification\Notification.exeC:\Windows\system32\KERNELBASE.dll543892eb-de22-11e4-837a-9c2a701ad84c


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i5-3230M CPU @ 2.60GHz
Percentage of memory in use: 50%
Total physical RAM: 3985.27 MB
Available physical RAM: 1974.86 MB
Total Pagefile: 5201.27 MB
Available Pagefile: 3052.43 MB
Total Virtual: 8192 MB
Available Virtual: 8191.77 MB

==================== Drives ================================

Drive c: (Acer) (Fixed) (Total:445.75 GB) (Free:383.84 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: CCEA0B91)

Partition: GPT Partition Type.

==================== End Of Log ============================

schrauber · 12.04.2015, 17:45

Lade Dir bitte von hier

Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.

Installiere und starte das Programm. (Bebilderte Anleitung zu Revo Uninstaller)
Klicke auf Optionen und wähle als Sprache Deutsch.
Suche im Uninstallerfeld nach den Programmen:

InetStat

Radio Canyon

Remote Desktop Access

Search Protect

WindowsMangerProtect20.0.0.502 (HKLM-x32\...\WindowsMangerProtect) (Version: 20.0.0.502 - WindowsProtect LIMITED) <==== ATTENTION
Wähle die Programme nacheinander aus und klicke jedes Mal auf Uninstall.
Wähle anschließend den Modus "Moderat" aus.
Reste löschen:
Klicke auf dann auf und dann auf .

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

hankmoody25 · 13.04.2015, 17:42

Vielen Dank!

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 13.04.2015
Suchlauf-Zeit: 15:38:06
Logdatei: mbam.txt
Administrator: Ja

Version: 2.01.4.1018
Malware Datenbank: v2015.04.13.05
Rootkit Datenbank: v2015.03.31.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 8
CPU: x64
Dateisystem: NTFS
Benutzer: Dominik

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 375354
Verstrichene Zeit: 17 Min, 23 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 3
PUP.Optional.CrossRider, C:\Program Files (x86)\help4u\help4u_notification_service.exe, 3116, Löschen bei Neustart, [03166309ccbe0e2887af90b3ac569c64]
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe, 3328, Löschen bei Neustart, [190086e6503ae155f41f37868879ff01]
PUP.Optional.SearchProtect.A, C:\Users\Dominik\AppData\Local\Temp\~nsu.tmp\Au_.exe, 4464, Löschen bei Neustart, [2dec1b51bcce53e39d76ebd203feca36]

Module: 1
PUP.Optional.SearchProtect.A, C:\Users\Dominik\AppData\Local\Temp\nssA3D8.tmp\SPtool.dll, Löschen bei Neustart, [7c9d83e9711942f4a66d1ca1e31e33cd], 

Registrierungsschlüssel: 47
PUP.Optional.SearchProtect.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\CltMngSvc, In Quarantäne, [190086e6503ae155f41f37868879ff01], 
PUP.Optional.SearchProtect.A, HKU\S-1-5-21-2931490297-3027747817-2233262723-1002\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}, In Quarantäne, [c5542d3fc2c8b581ffc214277e85b749], 
PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}, In Quarantäne, [2cedc6a6781253e3ed286cd4e61dda26], 
PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}, In Quarantäne, [2cedc6a6781253e3ed286cd4e61dda26], 
PUP.Optional.SearchProtect.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\SearchProtect, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.CrossRider.A, HKLM\SOFTWARE\INSTALLEDBROWSEREXTENSIONS\13641, In Quarantäne, [d346244842489c9a70eee12192727b85], 
PUP.Optional.RadioCanyon.A, HKLM\SOFTWARE\WOW6432NODE\Radio Canyon-nv, In Quarantäne, [61b82646ed9dae88be71df6af5102cd4], 
PUP.Optional.WPM.A, HKLM\SOFTWARE\WOW6432NODE\supWindowsMangerProtect, In Quarantäne, [c65372faccbeaf87b990e45f669f817f], 
PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\supWPM, In Quarantäne, [c05990dc5832d0665e7a8062c63d28d8], 
PUP.Optional.WebsSearches.A, HKLM\SOFTWARE\WOW6432NODE\webssearchesSoftware, In Quarantäne, [e831600c32584ee8cb78d82ac93bd62a], 
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\GLOBALUPDATE\UPDATE, In Quarantäne, [cd4cc7a59bef31051f2983672bd853ad], 
PUP.Optional.CrossRider.A, HKLM\SOFTWARE\WOW6432NODE\INSTALLEDBROWSEREXTENSIONS\13641, In Quarantäne, [a178501c107a043217470df56a9a24dc], 
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLAPLUGINS\@staging.google.com/globalUpdate Update;version=10, In Quarantäne, [d742b1bb47430333a43dec597491916f], 
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLAPLUGINS\@staging.google.com/globalUpdate Update;version=4, In Quarantäne, [6eabafbd6b1f290dfbe73b0abe47a759], 
PUP.Optional.SearchProtect.A, HKLM\SOFTWARE\WOW6432NODE\SEARCHPROTECT, In Quarantäne, [28f178f46921d561b27cdd113ac9966a], 
PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\SUPDP, In Quarantäne, [1306b3b953373afc57550ed410f3ea16], 
PUP.Optional.IEPluginServices.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\EVENTLOG\APPLICATION\IePluginServices, In Quarantäne, [94857defd5b567cf2949c414897acb35], 
PUP.Optional.WindowsMangerProtect.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\EVENTLOG\APPLICATION\WindowsMangerProtect, In Quarantäne, [4ccd98d44842270f185b419793709070], 
PUP.Optional.SearchProtect, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\SPPD, In Quarantäne, [c851ea8253370d292be1cf1926dddd23], 
PUP.Optional.WebSearches.A, HKU\S-1-5-21-2931490297-3027747817-2233262723-1002\SOFTWARE\SupHpUISoft, In Quarantäne, [5abf80ec682244f28cdb766e748f2dd3], 
PUP.Optional.CrossRider.A, HKU\S-1-5-21-2931490297-3027747817-2233262723-1002\SOFTWARE\APPDATALOW\SOFTWARE\Crossrider, In Quarantäne, [62b7a2ca94f6f145dd3f3bfdd92c38c8], 
PUP.Optional.RadioCanyon.A, HKU\S-1-5-21-2931490297-3027747817-2233262723-1002\SOFTWARE\APPDATALOW\SOFTWARE\Radio Canyon, In Quarantäne, [4dcc75f72961c175df5251f87b8a5ca4], 
PUP.Optional.GlobalUpdate.C, HKU\S-1-5-21-2931490297-3027747817-2233262723-1002\SOFTWARE\GLOBALUPDATE\UPDATE\PROXY, In Quarantäne, [bd5c0d5f1d6d280e0510af0fbe45e020], 
PUP.Optional.DVDVideoSoftTB.A, HKU\S-1-5-21-2931490297-3027747817-2233262723-1002\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\nikpibnbobmbdbheedjfogjlikpgpnhp, In Quarantäne, [110885e7ec9e0d29f990b42ac43f31cf], 
PUP.Optional.CrossRider.A, HKU\S-1-5-21-2931490297-3027747817-2233262723-1002\SOFTWARE\INSTALLEDBROWSEREXTENSIONS\13641, In Quarantäne, [be5bfe6ecdbde353c7651cc39370db25], 
PUP.Optional.GlobalUpdate.T, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\globalUpdate, In Quarantäne, [c8511755abdf2e0893c93a6408fbc040], 
PUP.Optional.GlobalUpdate.T, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\globalUpdatem, In Quarantäne, [c8511755abdf2e0893c93a6408fbc040], 
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\GOOGLEUPDATE.EXE, In Quarantäne, [c8511755abdf2e0893c93a6408fbc040], 
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\GOOGLEUPDATE.EXE, In Quarantäne, [c8511755abdf2e0893c93a6408fbc040], 
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{5645E0E7-FC12-43BF-A6E4-F9751942B298}, In Quarantäne, [c8511755abdf2e0893c93a6408fbc040], 
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\CLASSES\globalUpdate.OneClickCtrl.10, In Quarantäne, [c8511755abdf2e0893c93a6408fbc040], 
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\CLASSES\globalUpdate.OneClickCtrl.10, In Quarantäne, [c8511755abdf2e0893c93a6408fbc040], 
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\CLASSES\WOW6432NODE\globalUpdate.OneClickCtrl.10, In Quarantäne, [c8511755abdf2e0893c93a6408fbc040], 
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{5645E0E7-FC12-43BF-A6E4-F9751942B298}, In Quarantäne, [c8511755abdf2e0893c93a6408fbc040], 
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{5645E0E7-FC12-43BF-A6E4-F9751942B298}, In Quarantäne, [c8511755abdf2e0893c93a6408fbc040], 
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{5645E0E7-FC12-43BF-A6E4-F9751942B298}, In Quarantäne, [c8511755abdf2e0893c93a6408fbc040], 
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}, In Quarantäne, [c8511755abdf2e0893c93a6408fbc040], 
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\CLASSES\globalUpdate.Update3WebControl.4, In Quarantäne, [c8511755abdf2e0893c93a6408fbc040], 
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\CLASSES\globalUpdate.Update3WebControl.4, In Quarantäne, [c8511755abdf2e0893c93a6408fbc040], 
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\CLASSES\WOW6432NODE\globalUpdate.Update3WebControl.4, In Quarantäne, [c8511755abdf2e0893c93a6408fbc040], 
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}, In Quarantäne, [c8511755abdf2e0893c93a6408fbc040], 
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}, In Quarantäne, [c8511755abdf2e0893c93a6408fbc040], 
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}, In Quarantäne, [c8511755abdf2e0893c93a6408fbc040], 
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{CFC47BB5-5FB5-4AD0-8427-6AA04334A3FC}, In Quarantäne, [c8511755abdf2e0893c93a6408fbc040], 
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{CFC47BB5-5FB5-4AD0-8427-6AA04334A3FC}, In Quarantäne, [c8511755abdf2e0893c93a6408fbc040], 
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{E0ADB535-D7B5-4D8B-B15D-578BDD20D76A}, In Quarantäne, [c8511755abdf2e0893c93a6408fbc040], 
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{E0ADB535-D7B5-4D8B-B15D-578BDD20D76A}, In Quarantäne, [c8511755abdf2e0893c93a6408fbc040], 

Registrierungswerte: 9
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\GLOBALUPDATE\UPDATE|path, C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe, In Quarantäne, [cd4cc7a59bef31051f2983672bd853ad]
PUP.Optional.GlobalUpdate.C, HKLM\SOFTWARE\WOW6432NODE\GLOBALUPDATE\UPDATEDEV|AuCheckPeriodMs, 21600000, In Quarantäne, [51c8402cddadb482f686407d956e1ee2]
PUP.Optional.SearchProtect.A, HKLM\SOFTWARE\WOW6432NODE\SEARCHPROTECT|InstallDir, C:\PROGRA~2\SearchProtect, In Quarantäne, [28f178f46921d561b27cdd113ac9966a]
PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\SUPDP|dir, C:\Program Files (x86)\SupTab, In Quarantäne, [1306b3b953373afc57550ed410f3ea16]
PUP.Optional.SearchProtect, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\SPPD|ImagePath, \??\C:\Windows\system32\drivers\SPPD.sys, In Quarantäne, [c851ea8253370d292be1cf1926dddd23]
PUP.Optional.GlobalUpdate.C, HKU\S-1-5-21-2931490297-3027747817-2233262723-1002\SOFTWARE\GLOBALUPDATE\UPDATE\PROXY|source, auto, In Quarantäne, [bd5c0d5f1d6d280e0510af0fbe45e020]
PUP.Optional.Trovi.A, HKU\S-1-5-21-2931490297-3027747817-2233262723-1002\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}|URL, hxxp://www.trovi.com/Results.aspx?gd=&ctid=CT3322288&octid=EB_ORIGINAL_CTID&ISID=M2495563F-3D00-4261-99E6-D2683449ECDB&SearchSource=58&CUI=&UM=6&UP=SP25B173FF-6AF7-49AE-85F9-8455F8B53EA8&q={searchTerms}&SSPV=, In Quarantäne, [0e0b79f3fa90999d5ace203261a49b65]
PUP.Optional.Conduit.A, HKU\S-1-5-21-2931490297-3027747817-2233262723-1002\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}|SuggestionsURL_JSON, hxxp://suggest.seccint.com/CSuggestJson.ashx?prefix={searchTerms}, In Quarantäne, [e03924484347999d227ac4f9cf34f60a]
PUP.Optional.Trovi.A, HKU\S-1-5-21-2931490297-3027747817-2233262723-1002\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}|DisplayName, Trovi search, In Quarantäne, [e732d894345650e6db4dc78bc144c33d]

Registrierungsdaten: 16
PUP.Optional.SearchProtect.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS|AppInit_DLLs, C:\PROGRA~2\SEARCH~1\SEARCH~1\bin\VC64LO~1.DLL C:\Windows\system32\nvinitx.dll, Gut: (), Schlecht: (C:\PROGRA~2\SEARCH~1\SEARCH~1\bin\VC64LO~1.DLL),Ersetzt,[c7526804c0cac27433e045781ce551af]
PUP.Optional.SearchProtect.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS|AppInit_DLLs, C:\PROGRA~2\SEARCH~1\SEARCH~1\bin\VC32LO~1.DLL C:\Windows\SysWOW64\nvinit.dll, Gut: (), Schlecht: (C:\PROGRA~2\SEARCH~1\SEARCH~1\bin\VC32LO~1.DLL),Ersetzt,[47d2b3b95a3046f0d93a407dc0412ad6]
PUP.Optional.WebsSearches.A, HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND, C:\Program Files\Internet Explorer\iexplore.exe hxxp://istart.webssearches.com/?type=sc&ts=1407674597&from=wld&uid=TOSHIBAXMQ01ABD050_92UIS64ISXX92UIS64IS, Gut: (iexplore.exe), Schlecht: (C:\Program Files\Internet Explorer\iexplore.exe hxxp://istart.webssearches.com/?type=sc&ts=1407674597&from=wld&uid=TOSHIBAXMQ01ABD050_92UIS64ISXX92UIS64IS),Ersetzt,[6faa4f1d38521b1be9a06b8bff06bf41]
PUP.Optional.WebsSearches, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, hxxp://istart.webssearches.com/web/?type=ds&ts=1407674597&from=wld&uid=TOSHIBAXMQ01ABD050_92UIS64ISXX92UIS64IS&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://istart.webssearches.com/web/?type=ds&ts=1407674597&from=wld&uid=TOSHIBAXMQ01ABD050_92UIS64ISXX92UIS64IS&q={searchTerms}),Ersetzt,[a5740765c7c3989e2b4ef301e421d62a]
PUP.Optional.WebsSearches, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, hxxp://istart.webssearches.com/?type=hp&ts=1407674597&from=wld&uid=TOSHIBAXMQ01ABD050_92UIS64ISXX92UIS64IS, Gut: (www.google.com), Schlecht: (hxxp://istart.webssearches.com/?type=hp&ts=1407674597&from=wld&uid=TOSHIBAXMQ01ABD050_92UIS64ISXX92UIS64IS),Ersetzt,[02174527fc8e95a1f485ea0a4abb8e72]
PUP.Optional.WebsSearches, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://istart.webssearches.com/?type=hp&ts=1407674597&from=wld&uid=TOSHIBAXMQ01ABD050_92UIS64ISXX92UIS64IS, Gut: (www.google.com), Schlecht: (hxxp://istart.webssearches.com/?type=hp&ts=1407674597&from=wld&uid=TOSHIBAXMQ01ABD050_92UIS64ISXX92UIS64IS),Ersetzt,[07125f0d305ae84e9fda6490d4310bf5]
PUP.Optional.WebsSearches, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, hxxp://istart.webssearches.com/web/?type=ds&ts=1407674597&from=wld&uid=TOSHIBAXMQ01ABD050_92UIS64ISXX92UIS64IS&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://istart.webssearches.com/web/?type=ds&ts=1407674597&from=wld&uid=TOSHIBAXMQ01ABD050_92UIS64ISXX92UIS64IS&q={searchTerms}),Ersetzt,[4ecbdd8fd4b64de9403933c19b6a9f61]
PUP.Optional.Qone8, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Gut: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Schlecht: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),Ersetzt,[091092da0f7b37ff0a227c846b9b9070]
PUP.Optional.WebsSearches.A, HKLM\SOFTWARE\WOW6432NODE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND, C:\Program Files\Internet Explorer\iexplore.exe hxxp://istart.webssearches.com/?type=sc&ts=1407674597&from=wld&uid=TOSHIBAXMQ01ABD050_92UIS64ISXX92UIS64IS, Gut: (iexplore.exe), Schlecht: (C:\Program Files\Internet Explorer\iexplore.exe hxxp://istart.webssearches.com/?type=sc&ts=1407674597&from=wld&uid=TOSHIBAXMQ01ABD050_92UIS64ISXX92UIS64IS),Ersetzt,[61b83f2d305a0d293d4c21d5788db44c]
PUP.Optional.WebsSearches, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, hxxp://istart.webssearches.com/web/?type=ds&ts=1407674597&from=wld&uid=TOSHIBAXMQ01ABD050_92UIS64ISXX92UIS64IS&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://istart.webssearches.com/web/?type=ds&ts=1407674597&from=wld&uid=TOSHIBAXMQ01ABD050_92UIS64ISXX92UIS64IS&q={searchTerms}),Ersetzt,[6eab214b1e6c4cea9fdad024ae576d93]
PUP.Optional.WebsSearches, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, hxxp://istart.webssearches.com/?type=hp&ts=1407674597&from=wld&uid=TOSHIBAXMQ01ABD050_92UIS64ISXX92UIS64IS, Gut: (www.google.com), Schlecht: (hxxp://istart.webssearches.com/?type=hp&ts=1407674597&from=wld&uid=TOSHIBAXMQ01ABD050_92UIS64ISXX92UIS64IS),Ersetzt,[43d6ed7f29615fd78beea74d7293dd23]
PUP.Optional.WebsSearches, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://istart.webssearches.com/?type=hp&ts=1407674597&from=wld&uid=TOSHIBAXMQ01ABD050_92UIS64ISXX92UIS64IS, Gut: (www.google.com), Schlecht: (hxxp://istart.webssearches.com/?type=hp&ts=1407674597&from=wld&uid=TOSHIBAXMQ01ABD050_92UIS64ISXX92UIS64IS),Ersetzt,[ec2d6ffdc0ca3bfb6a0fd51feb1a5aa6]
PUP.Optional.WebsSearches, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, hxxp://istart.webssearches.com/web/?type=ds&ts=1407674597&from=wld&uid=TOSHIBAXMQ01ABD050_92UIS64ISXX92UIS64IS&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://istart.webssearches.com/web/?type=ds&ts=1407674597&from=wld&uid=TOSHIBAXMQ01ABD050_92UIS64ISXX92UIS64IS&q={searchTerms}),Ersetzt,[e138fc707812e551f98027cd55b08f71]
PUP.Optional.Qone8, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Gut: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Schlecht: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),Ersetzt,[de3b74f8e1a9f83ed25a6898a85eb24e]
PUP.Optional.Trovi.A, HKU\S-1-5-21-2931490297-3027747817-2233262723-1002\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://www.trovi.com/?gd=&ctid=CT3322288&octid=EB_ORIGINAL_CTID&ISID=M2495563F-3D00-4261-99E6-D2683449ECDB&SearchSource=55&CUI=&UM=6&UP=SP25B173FF-6AF7-49AE-85F9-8455F8B53EA8&SSPV=, Gut: (www.google.com), Schlecht: (hxxp://www.trovi.com/?gd=&ctid=CT3322288&octid=EB_ORIGINAL_CTID&ISID=M2495563F-3D00-4261-99E6-D2683449ECDB&SearchSource=55&CUI=&UM=6&UP=SP25B173FF-6AF7-49AE-85F9-8455F8B53EA8&SSPV=),Ersetzt,[d346a5c7276302347f8530c60ef7f907]
PUP.Optional.WebsSearches, HKU\S-1-5-21-2931490297-3027747817-2233262723-1002\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, hxxp://istart.webssearches.com/?type=hp&ts=1407674597&from=wld&uid=TOSHIBAXMQ01ABD050_92UIS64ISXX92UIS64IS, Gut: (www.google.com), Schlecht: (hxxp://istart.webssearches.com/?type=hp&ts=1407674597&from=wld&uid=TOSHIBAXMQ01ABD050_92UIS64ISXX92UIS64IS),Ersetzt,[a376adbf1b6ff3430f6bda1abc497888]

Ordner: 63
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main\bin, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main\rep, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect\bin, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect\rep, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\bin, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Consent, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\libs, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protection, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protectionDS, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\settings, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\uninstall, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\rep, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.Wajam.A, C:\Program Files (x86)\Wajam, In Quarantäne, [15040b614b3f4cea9395315819eaec14], 
PUP.Optional.IePluginServices.A, C:\ProgramData\IePluginServices, In Quarantäne, [14054c20a6e47fb77adfc1da7b88a759], 
PUP.Optional.IePluginServices.A, C:\ProgramData\IePluginServices\update, In Quarantäne, [14054c20a6e47fb77adfc1da7b88a759], 
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update, In Quarantäne, [c8511755abdf2e0893c93a6408fbc040], 
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0, In Quarantäne, [c8511755abdf2e0893c93a6408fbc040], 
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\Download, In Quarantäne, [c8511755abdf2e0893c93a6408fbc040], 
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\Download\{DF43BBA7-FA5E-49AA-85B8-CD01727E5373}, In Quarantäne, [c8511755abdf2e0893c93a6408fbc040], 
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\Download\{DF43BBA7-FA5E-49AA-85B8-CD01727E5373}\1.3.25.27, In Quarantäne, [c8511755abdf2e0893c93a6408fbc040], 
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\Install, In Quarantäne, [c8511755abdf2e0893c93a6408fbc040], 
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\Offline, In Quarantäne, [c8511755abdf2e0893c93a6408fbc040], 
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\Offline\{F6AC2BF3-5A88-44EC-8891-76D4142392DA}, In Quarantäne, [c8511755abdf2e0893c93a6408fbc040], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\skin, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\skin\image, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\en-US, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\es-419, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\es-ES, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-BE, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-CA, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-CH, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-FR, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-LU, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\it-CH, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\it-IT, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\pl, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\pt, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\pt-BR, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\ru, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\ru-MO, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\tr-TR, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\vi-VI, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\zh-CN, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\zh-TW, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.RadioCanyon.A, C:\Users\Dominik\AppData\LocalLow\Radio Canyon, In Quarantäne, [21f8d3994e3cab8b966a2c7ebc4729d7], 
PUP.Optional.Wajam.A, C:\Program Files (x86)\WIntEnhance, In Quarantäne, [47d2006c5337280ec5848c2a699a9967], 
PUP.Optional.SearchProtect.A, C:\Users\Dominik\AppData\Local\avaxvavya, In Quarantäne, [71a888e43852162047b6981fe51e4db3], 
PUP.Optional.SearchProtect.A, C:\Users\Dominik\AppData\Local\avaxvyyvyf, In Quarantäne, [39e05e0e0f7b1f17f7069225758e6d93], 
PUP.Optional.SearchProtect.A, C:\Users\Dominik\AppData\Local\avayvaxvaa, In Quarantäne, [d346cd9f701a4ceaac51b9fe6b98bc44], 
PUP.Optional.SearchProtect.A, C:\Users\Dominik\AppData\Local\avayvaxxvae, In Quarantäne, [d148303c5a30ba7c1edf7b3c21e29070], 
PUP.Optional.SearchProtect.A, C:\Users\Dominik\AppData\Local\avayvxvaxc, In Quarantäne, [c95067053555be7812ebbbfcc340659b], 
PUP.Optional.Help4U.A, C:\Program Files (x86)\help4u, Löschen bei Neustart, [fe1bde8e84064cea38f68f2de32045bb], 

Dateien: 289
PUP.Optional.CrossRider, C:\Program Files (x86)\help4u\help4u_notification_service.exe, Löschen bei Neustart, [03166309ccbe0e2887af90b3ac569c64], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe, In Quarantäne, [190086e6503ae155f41f37868879ff01], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect\bin\cltmng.exe, In Quarantäne, [f623511b5f2b22149b78d4e9a25fd927], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\bin\cltmngui.exe, In Quarantäne, [a772bdafa9e13303cb48f2cb867bf10f], 
PUP.Optional.SearchProtect.A, C:\Users\Dominik\AppData\Local\Temp\~nsu.tmp\Au_.exe, In Quarantäne, [2dec1b51bcce53e39d76ebd203feca36], 
PUP.Optional.SearchProtect.A, C:\Users\Dominik\AppData\Local\Temp\nssA3D8.tmp\SPtool.dll, In Quarantäne, [7c9d83e9711942f4a66d1ca1e31e33cd], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect\bin\VC64Loader.dll, In Quarantäne, [c7526804c0cac27433e045781ce551af], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect\bin\VC32Loader.dll, In Quarantäne, [47d2b3b95a3046f0d93a407dc0412ad6], 
PUP.Optional.CrossRider.A, C:\Users\Dominik\AppData\Roaming\RHEng\47DE6CDA0B8B467FB2A3DF22B66BAF3B\setup.exe, In Quarantäne, [8a8f303c62282016e1e79e5251b016ea], 
PUP.Optional.SearchProtect.A, C:\Users\Dominik\AppData\Roaming\RHEng\A8210BC2D6794F21A1572F6AEAFC5038\13443.exe, In Quarantäne, [0910a4c812788ea87f634e6320e158a8], 
PUP.Optional.RadioCanyon.A, C:\$Recycle.Bin\S-1-5-21-2931490297-3027747817-2233262723-1002\$R6CKN5M\Radio Canyon-bg.exe, In Quarantäne, [e5342d3feb9fe650cb2c8150dd24f20e], 
PUP.Optional.RadioCanyon.A, C:\$Recycle.Bin\S-1-5-21-2931490297-3027747817-2233262723-1002\$R6CKN5M\Radio Canyon-bho.dll, In Quarantäne, [7f9abdaf03871521ed0a379a27da20e0], 
PUP.Optional.RadioCanyon.A, C:\$Recycle.Bin\S-1-5-21-2931490297-3027747817-2233262723-1002\$R6CKN5M\Radio Canyon-bho64.dll, In Quarantäne, [f821d9931e6c5adc15e2f5dc0ff239c7], 
PUP.Optional.SearchProtect.A, C:\Users\Dominik\AppData\Local\Temp\Setup.exe, In Quarantäne, [2dec3f2d91f95fd737dcf5c837ca05fb], 
PUP.Optional.SearchProtect.A, C:\Users\Dominik\AppData\Local\Temp\nsoB5E8.tmp\SPtool.dll, In Quarantäne, [97821b510288cf67cc477647976ac23e], 
PUP.Optional.SearchProtect.A, C:\Windows\Temp\nsfFFA7.tmp\SPtool.dll, In Quarantäne, [49d0036983078caaac673f7ea45d56aa], 
PUP.Optional.SearchProtect.A, C:\Windows\Temp\nsg3370.tmp\SPtool.dll, In Quarantäne, [2fea81eb3159c472f3201ca11ae79a66], 
PUP.Optional.SearchProtect.A, C:\Windows\Temp\nsg9EAA.tmp\SPtool.dll, In Quarantäne, [e13828442c5e9e9848cbbb022bd60000], 
PUP.Optional.SearchProtect.A, C:\Windows\Temp\nsjBC59.tmp\SPtool.dll, In Quarantäne, [cb4e89e30e7cbd7956bd704d946d8e72], 
PUP.Optional.SearchProtect.A, C:\Windows\Temp\nsnEF3B.tmp\SPtool.dll, In Quarantäne, [7e9babc1f59575c1d93acdf01be6926e], 
PUP.Optional.SearchProtect.A, C:\Windows\Temp\nsp1A79.tmp\SPtool.dll, In Quarantäne, [eb2e9dcf96f43df96fa4e5d8d1308c74], 
PUP.Optional.SearchProtect.A, C:\Windows\Temp\nsq3B82.tmp\SPtool.dll, In Quarantäne, [ff1ac8a4276389ad41d23d80b64b55ab], 
PUP.Optional.SearchProtect.A, C:\Windows\Temp\nsq5184.tmp\SPtool.dll, In Quarantäne, [0316c8a42f5bd264888b2697ae53b24e], 
PUP.Optional.SearchProtect.A, C:\Windows\Temp\nsq986C.tmp\SPtool.dll, In Quarantäne, [2decf07cfb8f41f5c44f0cb145bcad53], 
PUP.Optional.SearchProtect.A, C:\Windows\Temp\nsr2507.tmp\SPtool.dll, In Quarantäne, [b960b1bb36544aeccc474f6e936ee917], 
PUP.Optional.SearchProtect.A, C:\Windows\Temp\nss5492.tmp\SPtool.dll, In Quarantäne, [ff1ab8b4bfcb270f858e4578c839867a], 
PUP.Optional.SearchProtect.A, C:\Windows\Temp\nsu33FA.tmp\SPtool.dll, In Quarantäne, [de3b2b411c6edb5b0f04754808f9c23e], 
PUP.Optional.SearchProtect.A, C:\Windows\Temp\nsuA092.tmp\SPtool.dll, In Quarantäne, [e237a8c47a1096a0b26184393cc549b7], 
PUP.Optional.SearchProtect.A, C:\Windows\Temp\nsuD70A.tmp\SPtool.dll, In Quarantäne, [021774f86e1cf44246cd417c18e95ba5], 
PUP.Optional.SearchProtect.A, C:\Windows\Temp\nsv751B.tmp\SPtool.dll, In Quarantäne, [b663b1bb9febe35339da605d5ca51fe1], 
PUP.Optional.SearchProtect.A, C:\Windows\Temp\nsx5EAF.tmp\SPtool.dll, In Quarantäne, [63b6ee7e6c1e77bf38db9b22b64b27d9], 
PUP.Optional.SearchProtect.A, C:\Windows\Temp\nsx8EA3.tmp\SPtool.dll, In Quarantäne, [6eabda92b4d6999d1bf802bbd031fd03], 
PUP.Optional.SearchProtect.A, C:\Windows\Temp\nsyF740.tmp\SPtool.dll, In Quarantäne, [0415a4c8ef9b10266ea513aa30d158a8], 
PUP.Optional.SearchProtect.A, C:\Windows\Temp\nsz4BF7.tmp\SPtool.dll, In Quarantäne, [2beea8c46f1b7eb89281b409f20f867a], 
PUP.Optional.SearchProtect.A, C:\Windows\Temp\nsa31DA.tmp\SPtool.dll, In Quarantäne, [b168a0ccf39795a17d96ffbe857cb14f], 
PUP.Optional.SearchProtect.A, C:\Windows\Temp\nsbB753.tmp\SPtool.dll, In Quarantäne, [e732026a90fa4aec36dd9e1ff50c4eb2], 
PUP.Optional.SearchProtect.A, C:\Windows\Temp\nse3E78.tmp\SPtool.dll, In Quarantäne, [a178e18b137772c41003ae0f07fa34cc], 
PUP.Optional.SearchProtect.A, C:\Windows\Temp\nse5544.tmp\SPtool.dll, In Quarantäne, [a27782ea1971fc3a38dbd4e968991fe1], 
PUP.Optional.SearchProtect.A, C:\Windows\Temp\nseB2DE.tmp\SPtool.dll, In Quarantäne, [9c7d115bfa9042f464af84397190ed13], 
PUP.Optional.SearchProtect.A, C:\Windows\Temp\nsf551F.tmp\SPtool.dll, In Quarantäne, [fa1f521a97f3d56124ef8d30738ea858], 
PUP.Optional.InstallCore.SID.A, C:\Users\Dominik\Downloads\installer_vlc_media_player_Spanish.exe, In Quarantäne, [c950e7853d4dce689531c4768c7ac63a], 
PUP.Optional.Conduit.A, C:\Users\Dominik\Downloads\Silverlight_TSV13O986.exe, In Quarantäne, [2dec214b4c3e54e2eea2b6c444bd2bd5], 
PUP.Optional.SearchProtect, C:\Users\Dominik\AppData\Local\avaavxvyex\avaavxvyex.exe, In Quarantäne, [44d5b7b5028880b6f54472aa7e84cd33], 
PUP.Optional.SearchProtect.A, C:\Users\Dominik\AppData\Local\avaavxvyex\pbqrmvbub, In Quarantäne, [52c7214b226879bd1102febf6d943dc3], 
PUP.Optional.SearchProtect, C:\Users\Dominik\AppData\Local\avaxvavya\avaxvavya.exe, In Quarantäne, [fc1de08ccbbf6ec8b98045d7758df40c], 
PUP.Optional.SearchProtect.A, C:\Users\Dominik\AppData\Local\avaxvavya\pbqrmvbub, In Quarantäne, [63b684e8206a68ceec27c1fc956cad53], 
PUP.Optional.SearchProtect, C:\Users\Dominik\AppData\Local\avaxvyyvyf\avaxvyyvyf.exe, In Quarantäne, [d34694d86921eb4bac8da577f60c847c], 
PUP.Optional.SearchProtect.A, C:\Users\Dominik\AppData\Local\avaxvyyvyf\pbqrmvbub, In Quarantäne, [45d417558703d0664ec5bd0011f01de3], 
PUP.Optional.SearchProtect, C:\Users\Dominik\AppData\Local\avayvaxvaa\avayvaxvaa.exe, In Quarantäne, [51c8a2ca5e2cd0663dfc5fbda65c8d73], 
PUP.Optional.SearchProtect.A, C:\Users\Dominik\AppData\Local\avayvaxvaa\pbqrmvbub, In Quarantäne, [c1589cd03e4ca88e58bb1ba2df22b050], 
PUP.Optional.SearchProtect, C:\Users\Dominik\AppData\Local\avayvaxxvae\avayvaxxvae.exe, In Quarantäne, [958474f8a8e2f640b089cb51da284cb4], 
PUP.Optional.SearchProtect.A, C:\Users\Dominik\AppData\Local\avayvaxxvae\pbqrmvbub, In Quarantäne, [67b22547deac4beb2be8a01d41c0827e], 
PUP.Optional.SearchProtect, C:\Users\Dominik\AppData\Local\avayvxvaxc\avayvxvaxc.exe, In Quarantäne, [0f0a71fb820841f5ba7f44d8ac56c739], 
PUP.Optional.SearchProtect.A, C:\Users\Dominik\AppData\Local\avayvxvaxc\pbqrmvbub, In Quarantäne, [8891e9837b0f81b53bd829949a675ba5], 
PUP.Optional.SearchProtect.A, C:\Windows\apppatch\apppatch64\VCLdr64.dll, In Quarantäne, [8594c0ac266486b0fc178b32010040c0], 
PUP.Optional.SearchProtect.A, C:\Windows\apppatch\apppatch64\VCLdr64.dll_1424354070162, In Quarantäne, [0b0ebab2a3e74de956bddbe2738e946c], 
PUP.Optional.SearchProtect.A, C:\Windows\apppatch\nbin\VC32Loader.dll, In Quarantäne, [e9303933b5d5b2841bf8bffe25dc9a66], 
PUP.Optional.Notification.A, C:\Windows\Tasks\help4u_notification_service.job, In Quarantäne, [9e7b511b8109d264446503b93ec535cb], 
PUP.Optional.Notification.A, C:\Windows\System32\Tasks\help4u_notification_service, In Quarantäne, [899053197e0c74c28e1c11ab29da857b], 
PUP.Optional.SearchProtect.A, C:\Windows\System32\Tasks\avaavxvyex, In Quarantäne, [5cbd8fddc2c85dd92e222b9b778cd52b], 
PUP.Optional.SearchProtect.A, C:\Windows\System32\Tasks\avaxvavya, In Quarantäne, [e633323ab8d22412143ca52104ff7090], 
PUP.Optional.SearchProtect.A, C:\Windows\System32\Tasks\avaxvyyvyf, In Quarantäne, [b168cca0bad07db95ff10fb7d42fd729], 
PUP.Optional.SearchProtect.A, C:\Windows\System32\Tasks\avayvaxvaa, In Quarantäne, [f920363690fa7cbaa9a7dee8847fbb45], 
PUP.Optional.SearchProtect.A, C:\Windows\System32\Tasks\avayvaxxvae, In Quarantäne, [6bae90dc2d5d66d05000a323e41f629e], 
PUP.Optional.SearchProtect.A, C:\Windows\System32\Tasks\avayvxvaxc, In Quarantäne, [f82133390a80b284321ed5f1af54f907], 
PUP.Optional.SelectNGo.A, C:\Users\Dominik\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_static.selectgo00.selectgo.net_0.localstorage, In Quarantäne, [948554181377ce684e82f1d90df6a45c], 
PUP.Optional.SelectNGo.A, C:\Users\Dominik\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_static.selectgo00.selectgo.net_0.localstorage-journal, In Quarantäne, [22f775f7b3d78ea8d5fba228956ede22], 
PUP.Optional.WebsSearches.A, C:\Users\Dominik\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_istart.webssearches.com_0.localstorage, In Quarantäne, [65b475f75b2fee48cd29597257ac649c], 
PUP.Optional.WebsSearches.A, C:\Users\Dominik\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_istart.webssearches.com_0.localstorage-journal, In Quarantäne, [41d879f38a0093a35b9b1dae0ff446ba], 
PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\9a59edf6-dba4-42e9-b4d9-3a4ddec8b58d-1, In Quarantäne, [33e6006ce9a1d165bb888862d52e926e], 
PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\9a59edf6-dba4-42e9-b4d9-3a4ddec8b58d-11, In Quarantäne, [22f7c0ac3a5051e596ad8b5fed1654ac], 
PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\9a59edf6-dba4-42e9-b4d9-3a4ddec8b58d-4, In Quarantäne, [ec2d1854f199b086e95ae604ca39c23e], 
PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\9a59edf6-dba4-42e9-b4d9-3a4ddec8b58d-5, In Quarantäne, [0613f7757c0ebe788eb58e5cab58d729], 
PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\9a59edf6-dba4-42e9-b4d9-3a4ddec8b58d-5_user, In Quarantäne, [36e33d2f12784ee8cf742dbd709316ea], 
PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\9a59edf6-dba4-42e9-b4d9-3a4ddec8b58d-6, In Quarantäne, [190008648307092d65de5a90a06307f9], 
PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\9a59edf6-dba4-42e9-b4d9-3a4ddec8b58d-7, In Quarantäne, [fb1e333918725bdb9ea57e6c14ef02fe], 
PUP.Optional.SelectNGo.A, C:\Users\Dominik\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_static.select-n-go00.select-n-go.com_0.localstorage, In Quarantäne, [9e7b2b4190fafe38402014e17093f30d], 
PUP.Optional.SelectNGo.A, C:\Users\Dominik\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_static.select-n-go00.select-n-go.com_0.localstorage-journal, In Quarantäne, [7f9a1c50107ad36361ff6392be45f40c], 
PUP.Optional.ShoppingGate.A, C:\Users\Dominik\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_inst.shoppingate.info_0.localstorage, In Quarantäne, [2ced5e0e95f5b482ac389562cb3807f9], 
PUP.Optional.ShoppingGate.A, C:\Users\Dominik\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_inst.shoppingate.info_0.localstorage-journal, In Quarantäne, [48d192da34565bdba440b93e08fbce32], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\EULA.txt, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\CRASH_REPORT_P3280_T4296_D2015_04_12_T11_28_06.txt, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main\bin\SPtool.dll, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main\bin\uninstall.exe, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main\bin\uninstall.pun, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main\rep\cfi.bin, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main\rep\edk.bin, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main\rep\pni.bin, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main\rep\SystemRepository.dat, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main\rep\trn.bin, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect\bin\RN32.dll, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect\bin\SPtool64.exe, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect\bin\VC32.dll, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect\bin\VC64.dll, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\settings.html, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\style.css, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Consent\consent.css, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Consent\consent.html, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Consent\consent.js, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Consent\defaults.js, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\bgUninstall.png, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\hez-def-grey.png, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\Apply-default.png, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\Apply-onclick.png, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\Apply-Rollover.png, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\bg-dia.png, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\bg-uninstall.png, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\bg-with-logo.png, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\bg.png, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\bgNotif.png, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\bgSettings.png, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\bgSettingsDS.png, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\btnBlue.png, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\btnClose.png, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\btnSilver.png, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\button-bg.png, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\checkbox.png, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\checkbox_checked.png, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\checkbox_def.png, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\close-win-def.png, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\close-win-over-click.png, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\gray-bg.png, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\hez-def.png, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\hez-selected.png, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\hez.png, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\icon-win.png, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\info-icon.png, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\menu-rollover.png, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\menu-selected.png, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\radio-button-def.png, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\radio-button-selected.png, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\radio-button.png, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\radio-button2.png, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\Settings-icon.png, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\SP_DialogBG.png, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\text-field.png, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\v.png, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\x.png, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\libs\defaults.js, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\libs\DialogAPI.js, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\libs\dialogUtils.js, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\libs\jquery.1.7.1.min.js, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\libs\json2.min.js, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\libs\main.js, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protection\defaults.js, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protection\protection.css, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protection\protection.html, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protection\protection.js, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protectionDS\defaults.js, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protectionDS\protectionDS.css, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protectionDS\protectionDS.html, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protectionDS\protectionDS.js, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\settings\defaults.js, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\settings\settings.css, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\settings\settings.html, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\settings\settings.js, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\uninstall\defaults.js, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\uninstall\uninstall.css, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\uninstall\uninstall.html, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\uninstall\uninstall.js, In Quarantäne, [bc5d0369761475c19862b07d9372c53b], 
PUP.Optional.CrossRider.T, C:\Windows\Tasks\9a59edf6-dba4-42e9-b4d9-3a4ddec8b58d-1.job, In Quarantäne, [011863097515c472fcd84300669f59a7], 
PUP.Optional.CrossRider.T, C:\Windows\Tasks\9a59edf6-dba4-42e9-b4d9-3a4ddec8b58d-11.job, In Quarantäne, [ef2ad399f7937db9557f72d136cf817f], 
PUP.Optional.CrossRider.T, C:\Windows\Tasks\9a59edf6-dba4-42e9-b4d9-3a4ddec8b58d-4.job, In Quarantäne, [0811274572185fd72aaa87bc0ef78b75], 
PUP.Optional.CrossRider.T, C:\Windows\Tasks\9a59edf6-dba4-42e9-b4d9-3a4ddec8b58d-5.job, In Quarantäne, [65b49bd165250e284292f84b55b0e41c], 
PUP.Optional.CrossRider.T, C:\Windows\Tasks\9a59edf6-dba4-42e9-b4d9-3a4ddec8b58d-5_user.job, In Quarantäne, [f62390dc8efc53e3f4e0241f58ad09f7], 
PUP.Optional.CrossRider.T, C:\Windows\Tasks\9a59edf6-dba4-42e9-b4d9-3a4ddec8b58d-6.job, In Quarantäne, [f62305679bef6bcb92429aa9a65f1ae6], 
PUP.Optional.CrossRider.T, C:\Windows\Tasks\9a59edf6-dba4-42e9-b4d9-3a4ddec8b58d-7.job, In Quarantäne, [64b572fad3b7e35301d3e063778efd03], 
PUP.Optional.GlobalUpdate.A, C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job, In Quarantäne, [ff1a54182961d3637370b98a83826799], 
PUP.Optional.GlobalUpdate.A, C:\Windows\System32\Tasks\globalUpdateUpdateTaskMachineCore, In Quarantäne, [b2678be193f7fc3ad60efc47bd487d83], 
PUP.Optional.GlobalUpdate.A, C:\Windows\Tasks\globalUpdateUpdateTaskMachineUA.job, In Quarantäne, [df3ab2baacdee15585604102966f6898], 
PUP.Optional.GlobalUpdate.A, C:\Windows\System32\Tasks\globalUpdateUpdateTaskMachineUA, In Quarantäne, [0910f27adeacd26408decf7419ecde22], 
PUP.Optional.SearchProtect, C:\Windows\apppatch\Custom\Custom64\{cf2797aa-b7ec-e311-8ed9-005056c00008}.sdb, In Quarantäne, [de3b521ac4c6f541fa0077cfbd48d729], 
PUP.Optional.IePluginServices.A, C:\ProgramData\IePluginServices\update\conf, In Quarantäne, [14054c20a6e47fb77adfc1da7b88a759], 
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe, In Quarantäne, [c8511755abdf2e0893c93a6408fbc040], 
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\GoogleCrashHandler.exe, In Quarantäne, [c8511755abdf2e0893c93a6408fbc040], 
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\GoogleUpdate.exe, In Quarantäne, [c8511755abdf2e0893c93a6408fbc040], 
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\GoogleUpdateBroker.exe, In Quarantäne, [c8511755abdf2e0893c93a6408fbc040], 
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\GoogleUpdateHelper.msi, In Quarantäne, [c8511755abdf2e0893c93a6408fbc040], 
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\GoogleUpdateOnDemand.exe, In Quarantäne, [c8511755abdf2e0893c93a6408fbc040], 
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\goopdate.dll, In Quarantäne, [c8511755abdf2e0893c93a6408fbc040], 
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\goopdateres_en.dll, In Quarantäne, [c8511755abdf2e0893c93a6408fbc040], 
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll, In Quarantäne, [c8511755abdf2e0893c93a6408fbc040], 
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\psmachine.dll, In Quarantäne, [c8511755abdf2e0893c93a6408fbc040], 
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\psuser.dll, In Quarantäne, [c8511755abdf2e0893c93a6408fbc040], 
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\Download\{DF43BBA7-FA5E-49AA-85B8-CD01727E5373}\1.3.25.27\setup.exe, In Quarantäne, [c8511755abdf2e0893c93a6408fbc040], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\ient.json, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\msvcp110.dll, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\msvcr110.dll, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\uninstall.exe, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\skin\bk_shadow.png, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\skin\btn.png, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\skin\close.png, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\skin\main.xml, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\skin\main.xml.bak, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\skin\image\ck_box.png, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\skin\image\ck_check.png, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\skin\image\radio_bk.png, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\skin\image\radio_check.png, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\data.html, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\indexIE.html, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\indexIE8.html, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\main.css, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\ver.txt, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\google_trends.png, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\icon128.png, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\icon16.png, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\icon48.png, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\loading.gif, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\logo32.ico, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\common.js, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\ga.js, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\jquery-1.11.0.min.js, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\jquery.autocomplete.js, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\js.js, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\library.js, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\xagainit.js, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\en-US\messages.json, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\es-419\messages.json, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\es-ES\messages.json, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-BE\messages.json, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-CA\messages.json, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-CH\messages.json, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-FR\messages.json, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-LU\messages.json, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\it-CH\messages.json, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\it-IT\messages.json, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\pl\messages.json, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\pt\messages.json, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\pt-BR\messages.json, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\ru\messages.json, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\ru-MO\messages.json, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\tr-TR\messages.json, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\vi-VI\messages.json, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\zh-CN\messages.json, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\zh-TW\messages.json, In Quarantäne, [d742521a8901d85e418bced227dc9c64], 
PUP.Optional.RadioCanyon.A, C:\Users\Dominik\AppData\LocalLow\Radio Canyon\DTFProxyToServerSect_b71c6c330e74701318a6f0adb73eaa5ae0060804_p5056.dat, In Quarantäne, [21f8d3994e3cab8b966a2c7ebc4729d7], 
PUP.Optional.RadioCanyon.A, C:\Users\Dominik\AppData\LocalLow\Radio Canyon\DTFProxyToServerSect_b71c6c330e74701318a6f0adb73eaa5ae0060804_p2864.dat, In Quarantäne, [21f8d3994e3cab8b966a2c7ebc4729d7], 
PUP.Optional.RadioCanyon.A, C:\Users\Dominik\AppData\LocalLow\Radio Canyon\DTFProxyToServerSect_b71c6c330e74701318a6f0adb73eaa5ae0060804_p3684.dat, In Quarantäne, [21f8d3994e3cab8b966a2c7ebc4729d7], 
PUP.Optional.RadioCanyon.A, C:\Users\Dominik\AppData\LocalLow\Radio Canyon\DTFProxyToServerSect_b71c6c330e74701318a6f0adb73eaa5ae0060804_p3760.dat, In Quarantäne, [21f8d3994e3cab8b966a2c7ebc4729d7], 
PUP.Optional.RadioCanyon.A, C:\Users\Dominik\AppData\LocalLow\Radio Canyon\DTFProxyToServerSect_b71c6c330e74701318a6f0adb73eaa5ae0060804_p44.dat, In Quarantäne, [21f8d3994e3cab8b966a2c7ebc4729d7], 
PUP.Optional.RadioCanyon.A, C:\Users\Dominik\AppData\LocalLow\Radio Canyon\DTFProxyToServerSect_b71c6c330e74701318a6f0adb73eaa5ae0060804_p4652.dat, In Quarantäne, [21f8d3994e3cab8b966a2c7ebc4729d7], 
PUP.Optional.RadioCanyon.A, C:\Users\Dominik\AppData\LocalLow\Radio Canyon\DTFProxyToServerSect_b71c6c330e74701318a6f0adb73eaa5ae0060804_p4660.dat, In Quarantäne, [21f8d3994e3cab8b966a2c7ebc4729d7], 
PUP.Optional.RadioCanyon.A, C:\Users\Dominik\AppData\LocalLow\Radio Canyon\DTFProxyToServerSect_b71c6c330e74701318a6f0adb73eaa5ae0060804_p5216.dat, In Quarantäne, [21f8d3994e3cab8b966a2c7ebc4729d7], 
PUP.Optional.RadioCanyon.A, C:\Users\Dominik\AppData\LocalLow\Radio Canyon\DTFProxyToServerSect_b71c6c330e74701318a6f0adb73eaa5ae0060804_p5236.dat, In Quarantäne, [21f8d3994e3cab8b966a2c7ebc4729d7], 
PUP.Optional.RadioCanyon.A, C:\Users\Dominik\AppData\LocalLow\Radio Canyon\DTFProxyToServerSect_b71c6c330e74701318a6f0adb73eaa5ae0060804_p6624.dat, In Quarantäne, [21f8d3994e3cab8b966a2c7ebc4729d7], 
PUP.Optional.RadioCanyon.A, C:\Users\Dominik\AppData\LocalLow\Radio Canyon\DTFProxyToServerSect_b71c6c330e74701318a6f0adb73eaa5ae0060804_p7480.dat, In Quarantäne, [21f8d3994e3cab8b966a2c7ebc4729d7], 
PUP.Optional.RadioCanyon.A, C:\Users\Dominik\AppData\LocalLow\Radio Canyon\DTFProxyToServerSect_b71c6c330e74701318a6f0adb73eaa5ae0060804_p8464.dat, In Quarantäne, [21f8d3994e3cab8b966a2c7ebc4729d7], 
PUP.Optional.RadioCanyon.A, C:\Users\Dominik\AppData\LocalLow\Radio Canyon\DTFProxyToServerSect_b71c6c330e74701318a6f0adb73eaa5ae0060804_p904.dat, In Quarantäne, [21f8d3994e3cab8b966a2c7ebc4729d7], 
PUP.Optional.SearchProtect.A, C:\Users\Dominik\AppData\Local\avaxvavya\bahvxfk, In Quarantäne, [71a888e43852162047b6981fe51e4db3], 
PUP.Optional.SearchProtect.A, C:\Users\Dominik\AppData\Local\avaxvavya\mkfvxfk, In Quarantäne, [71a888e43852162047b6981fe51e4db3], 
PUP.Optional.SearchProtect.A, C:\Users\Dominik\AppData\Local\avaxvavya\pvpqbjobmlpfqlovvawq, In Quarantäne, [71a888e43852162047b6981fe51e4db3], 
PUP.Optional.SearchProtect.A, C:\Users\Dominik\AppData\Local\avaxvavya\qokvxfk, In Quarantäne, [71a888e43852162047b6981fe51e4db3], 
PUP.Optional.SearchProtect.A, C:\Users\Dominik\AppData\Local\avaxvavya\rfobmlpfqlovvawq, In Quarantäne, [71a888e43852162047b6981fe51e4db3], 
PUP.Optional.SearchProtect.A, C:\Users\Dominik\AppData\Local\avaxvavya\rpboobmlpfqlovvawq, In Quarantäne, [71a888e43852162047b6981fe51e4db3], 
PUP.Optional.SearchProtect.A, C:\Users\Dominik\AppData\Local\avaxvavya\stb.dat, In Quarantäne, [71a888e43852162047b6981fe51e4db3], 
PUP.Optional.SearchProtect.A, C:\Users\Dominik\AppData\Local\avaxvavya\ycfvxfk, In Quarantäne, [71a888e43852162047b6981fe51e4db3], 
PUP.Optional.SearchProtect.A, C:\Users\Dominik\AppData\Local\avaxvyyvyf\bahvxfk, In Quarantäne, [39e05e0e0f7b1f17f7069225758e6d93], 
PUP.Optional.SearchProtect.A, C:\Users\Dominik\AppData\Local\avaxvyyvyf\mkfvxfk, In Quarantäne, [39e05e0e0f7b1f17f7069225758e6d93], 
PUP.Optional.SearchProtect.A, C:\Users\Dominik\AppData\Local\avaxvyyvyf\pvpqbjobmlpfqlovvawq, In Quarantäne, [39e05e0e0f7b1f17f7069225758e6d93], 
PUP.Optional.SearchProtect.A, C:\Users\Dominik\AppData\Local\avaxvyyvyf\qokvxfk, In Quarantäne, [39e05e0e0f7b1f17f7069225758e6d93], 
PUP.Optional.SearchProtect.A, C:\Users\Dominik\AppData\Local\avaxvyyvyf\rfobmlpfqlovvawq, In Quarantäne, [39e05e0e0f7b1f17f7069225758e6d93], 
PUP.Optional.SearchProtect.A, C:\Users\Dominik\AppData\Local\avaxvyyvyf\rpboobmlpfqlovvawq, In Quarantäne, [39e05e0e0f7b1f17f7069225758e6d93], 
PUP.Optional.SearchProtect.A, C:\Users\Dominik\AppData\Local\avaxvyyvyf\stb.dat, In Quarantäne, [39e05e0e0f7b1f17f7069225758e6d93], 
PUP.Optional.SearchProtect.A, C:\Users\Dominik\AppData\Local\avaxvyyvyf\ycfvxfk, In Quarantäne, [39e05e0e0f7b1f17f7069225758e6d93], 
PUP.Optional.SearchProtect.A, C:\Users\Dominik\AppData\Local\avayvaxvaa\bahvxfk, In Quarantäne, [d346cd9f701a4ceaac51b9fe6b98bc44], 
PUP.Optional.SearchProtect.A, C:\Users\Dominik\AppData\Local\avayvaxvaa\mkfvxfk, In Quarantäne, [d346cd9f701a4ceaac51b9fe6b98bc44], 
PUP.Optional.SearchProtect.A, C:\Users\Dominik\AppData\Local\avayvaxvaa\pvpqbjobmlpfqlovvawq, In Quarantäne, [d346cd9f701a4ceaac51b9fe6b98bc44], 
PUP.Optional.SearchProtect.A, C:\Users\Dominik\AppData\Local\avayvaxvaa\qokvxfk, In Quarantäne, [d346cd9f701a4ceaac51b9fe6b98bc44], 
PUP.Optional.SearchProtect.A, C:\Users\Dominik\AppData\Local\avayvaxvaa\rfobmlpfqlovvawq, In Quarantäne, [d346cd9f701a4ceaac51b9fe6b98bc44], 
PUP.Optional.SearchProtect.A, C:\Users\Dominik\AppData\Local\avayvaxvaa\rpboobmlpfqlovvawq, In Quarantäne, [d346cd9f701a4ceaac51b9fe6b98bc44], 
PUP.Optional.SearchProtect.A, C:\Users\Dominik\AppData\Local\avayvaxvaa\stb.dat, In Quarantäne, [d346cd9f701a4ceaac51b9fe6b98bc44], 
PUP.Optional.SearchProtect.A, C:\Users\Dominik\AppData\Local\avayvaxvaa\ycfvxfk, In Quarantäne, [d346cd9f701a4ceaac51b9fe6b98bc44], 
PUP.Optional.SearchProtect.A, C:\Users\Dominik\AppData\Local\avayvaxxvae\bahvxfk, In Quarantäne, [d148303c5a30ba7c1edf7b3c21e29070], 
PUP.Optional.SearchProtect.A, C:\Users\Dominik\AppData\Local\avayvaxxvae\mkfvxfk, In Quarantäne, [d148303c5a30ba7c1edf7b3c21e29070], 
PUP.Optional.SearchProtect.A, C:\Users\Dominik\AppData\Local\avayvaxxvae\pvpqbjobmlpfqlovvawq, In Quarantäne, [d148303c5a30ba7c1edf7b3c21e29070], 
PUP.Optional.SearchProtect.A, C:\Users\Dominik\AppData\Local\avayvaxxvae\qokvxfk, In Quarantäne, [d148303c5a30ba7c1edf7b3c21e29070], 
PUP.Optional.SearchProtect.A, C:\Users\Dominik\AppData\Local\avayvaxxvae\rfobmlpfqlovvawq, In Quarantäne, [d148303c5a30ba7c1edf7b3c21e29070], 
PUP.Optional.SearchProtect.A, C:\Users\Dominik\AppData\Local\avayvaxxvae\rpboobmlpfqlovvawq, In Quarantäne, [d148303c5a30ba7c1edf7b3c21e29070], 
PUP.Optional.SearchProtect.A, C:\Users\Dominik\AppData\Local\avayvaxxvae\stb.dat, In Quarantäne, [d148303c5a30ba7c1edf7b3c21e29070], 
PUP.Optional.SearchProtect.A, C:\Users\Dominik\AppData\Local\avayvaxxvae\ycfvxfk, In Quarantäne, [d148303c5a30ba7c1edf7b3c21e29070], 
PUP.Optional.SearchProtect.A, C:\Users\Dominik\AppData\Local\avayvxvaxc\bahvxfk, In Quarantäne, [c95067053555be7812ebbbfcc340659b], 
PUP.Optional.SearchProtect.A, C:\Users\Dominik\AppData\Local\avayvxvaxc\mkfvxfk, In Quarantäne, [c95067053555be7812ebbbfcc340659b], 
PUP.Optional.SearchProtect.A, C:\Users\Dominik\AppData\Local\avayvxvaxc\pvpqbjobmlpfqlovvawq, In Quarantäne, [c95067053555be7812ebbbfcc340659b], 
PUP.Optional.SearchProtect.A, C:\Users\Dominik\AppData\Local\avayvxvaxc\qokvxfk, In Quarantäne, [c95067053555be7812ebbbfcc340659b], 
PUP.Optional.SearchProtect.A, C:\Users\Dominik\AppData\Local\avayvxvaxc\rfobmlpfqlovvawq, In Quarantäne, [c95067053555be7812ebbbfcc340659b], 
PUP.Optional.SearchProtect.A, C:\Users\Dominik\AppData\Local\avayvxvaxc\rpboobmlpfqlovvawq, In Quarantäne, [c95067053555be7812ebbbfcc340659b], 
PUP.Optional.SearchProtect.A, C:\Users\Dominik\AppData\Local\avayvxvaxc\stb.dat, In Quarantäne, [c95067053555be7812ebbbfcc340659b], 
PUP.Optional.SearchProtect.A, C:\Users\Dominik\AppData\Local\avayvxvaxc\ycfvxfk, In Quarantäne, [c95067053555be7812ebbbfcc340659b], 
PUP.Optional.Trovi.A, C:\Users\Dominik\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences, Gut: (), Schlecht: (   "homepage": "hxxp://www.trovi.com/?gd=&ctid=CT3322288&octid=EB_ORIGINAL_CTID&ISID=M2495563F-3D00-4261-99E6-D2683449ECDB&SearchSource=55&CUI=&UM=6&UP=SP25B173FF-6AF7-49AE-85F9-8455F8B53EA8&SSPV=",), Ersetzt,[f72245275d2d84b2899b66d922e49769]

Physische Sektoren: 0
(Keine schädliche Elemente gefunden)


(end)

Code:

ATTFilter

# AdwCleaner v4.201 - Bericht erstellt 13/04/2015 um 18:17:09
# Aktualisiert 08/04/2015 von Xplode
# Datenbank : 2015-04-08.1 [Server]
# Betriebssystem : Windows 8  (x64)
# Benutzername : Dominik - STUDIEN-PC
# Gestarted von : C:\Users\Dominik\Downloads\AdwCleaner_4.201.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\Program Files (x86)\globalUpdate
Ordner Gelöscht : C:\Windows\SysWOW64\config\systemprofile\AppData\Local\SearchProtect
Ordner Gelöscht : C:\Users\Dominik\AppData\Local\globalUpdate
Ordner Gelöscht : C:\Users\Dominik\AppData\Roaming\RHEng
Datei Gelöscht : C:\END
Datei Gelöscht : C:\Users\Public\Desktop\eBay.lnk

***** [ Geplante Tasks ] *****

Task Gelöscht : avayvaxvaa
Task Gelöscht : avayvaxxvae

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdate.OneClickProcessLauncherMachine
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdate.OneClickProcessLauncherMachine.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoCreateAsync
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoCreateAsync.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreClass
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreClass.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreMachineClass
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreMachineClass.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CredentialDialogMachine
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CredentialDialogMachine.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachine
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachine.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachineFallback
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachineFallback.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassSvc
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassSvc.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.ProcessLauncher
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.ProcessLauncher.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3COMClassService
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3COMClassService.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachine
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachine.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachineFallback
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachineFallback.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebSvc
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebSvc.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protector_dll.protectorbho
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protector_dll.protectorbho.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{3278F5CF-48F3-4253-A6BB-004CE84AF492}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{577975B8-C40E-43E6-B0DE-4C6B44088B52}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{02A96331-0CA6-40E2-A87D-C224601985EB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3278F5CF-48F3-4253-A6BB-004CE84AF492}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3B5702BA-7F4C-4D1A-B026-1E9A01D43978}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{577975B8-C40E-43E6-B0DE-4C6B44088B52}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{5E89ACE9-E16B-499A-87B4-0DBF742404C1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{69F256DF-BA98-45E9-86EA-FC3CFECF9D30}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{6E87FC94-9866-49B9-8E93-5736D6DE3DD7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{7E49F793-B3CD-4BF7-8419-B34B8BD30E61}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{834469E3-CA2B-4F21-A5CA-4F6F4DBCDE87}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{8529FAA3-5BFD-43C1-AB35-B53C4B96C6E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{ADBC39BE-3D20-4333-8D99-E91EB1B62474}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E06CA7F5-BA34-4FF6-8D24-B1BDC594D91F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F6421EE5-A5BE-4D31-81D5-C16B7BF48E4C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FD8E81D0-F5FE-4CB1-9AEA-1E163D2BAB78}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5E89ACE9-E16B-499A-87B4-0DBF742404C1}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{1CCA7B31-CA5A-4030-B735-2C968CC35CCE}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{1CCA7B31-CA5A-4030-B735-2C968CC35CCE}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Schlüssel Gelöscht : HKCU\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\GlobalUpdate
Schlüssel Gelöscht : HKCU\Software\InstalledBrowserExtensions
Schlüssel Gelöscht : HKLM\SOFTWARE\GlobalUpdate
Schlüssel Gelöscht : HKLM\SOFTWARE\InstalledBrowserExtensions
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\InstalledBrowserExtensions
Daten Gelöscht : HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyServer] - hxxp=127.0.0.1:55348;hxxps=127.0.0.1:55348
Daten Gelöscht : HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyEnable] - 1
Daten Gelöscht : HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - <-loopback>
Daten Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - <-loopback>

***** [ Internetbrowser ] *****

-\\ Internet Explorer v10.0.9200.17267


-\\ Google Chrome v41.0.2272.118

[C:\Users\Dominik\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] - Gelöscht [Extension] : booedmolknjekdopkepjjeckmjkdpfgl
[C:\Users\Dominik\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] - Gelöscht [Extension] : flpcjncodpafbgdpnkljologafpionhb
[C:\Users\Dominik\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] - Gelöscht [Startup_URLs] : hxxp://www.trovi.com/?gd=&ctid=CT3322288&octid=EB_ORIGINAL_CTID&ISID=M2495563F-3D00-4261-99E6-D2683449ECDB&SearchSource=55&CUI=&UM=6&UP=SP25B173FF-6AF7-49AE-85F9-8455F8B53EA8&SSPV=
[C:\Users\Dominik\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] - Gelöscht [Default_Search_Provider_Data] : 

*************************

AdwCleaner[R0].txt - [23707 Bytes] - [13/04/2015 18:15:53]
AdwCleaner[S0].txt - [7934 Bytes] - [13/04/2015 18:17:09]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [7993  Bytes] ##########

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.5.4 (04.13.2015:1)
OS: Windows 8 x64
Ran by Dominik on 13.04.2015 at 18:32:40,96
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files

Successfully deleted: [File] C:\Windows\wininit.ini



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 13.04.2015 at 18:37:06,06
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-04-2015
Ran by Dominik (administrator) on STUDIEN-PC on 13-04-2015 18:39:54
Running from C:\Users\Dominik\Downloads
Loaded Profiles: Dominik (Available profiles: UpdatusUser & Dominik)
Platform: Windows 8 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 10 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe
(Avast Software) C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\ng\ngservice.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(Dritek System INC.) C:\Windows\RfBtnSvc64.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2012-06-11] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1212048 2012-06-07] (Realtek Semiconductor)
HKLM\...\Run: [BtPreLoad] => C:\Program Files (x86)\Bluetooth Suite\BtPreLoad.exe [64640 2012-08-10] ()
HKLM-x32\...\Run: [LManager] => [X]
HKLM-x32\...\Run: [Dolby Home Theater v4] => C:\Dolby PCEE4\pcee4.exe [508256 2012-04-23] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [193568 2014-11-28] (Geek Software GmbH)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5512912 2015-04-08] (Avast Software s.r.o.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKU\S-1-5-19\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-20\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-21-2931490297-3027747817-2233262723-1002\...\Policies\Explorer: [NoDriveTypeAutoRun] 0x95000000
HKU\S-1-5-21-2931490297-3027747817-2233262723-1002\...\MountPoints2: {d5ff15b9-4643-11e4-8204-208984c59d73} - "E:\iStudio.exe" 
HKU\S-1-5-18\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [247144 2012-10-11] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [203112 2012-10-11] (NVIDIA Corporation)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (Avast Software s.r.o.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:55348;https=127.0.0.1:55348
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-2931490297-3027747817-2233262723-1002 -> {76149113-4D33-46DD-A552-3BEA0A947DB6} URL = 
SearchScopes: HKU\S-1-5-21-2931490297-3027747817-2233262723-1002 -> {CE6B38BB-49B4-46BE-ADA7-E7BD583814CD} URL = https://de.search.yahoo.com/search?fr=mcafee&type=B011DE662D20140725&p={SearchTerms}
BHO: Radio Canyon -> {11111111-1111-1111-1111-110611081104} -> C:\Program Files (x86)\Radio Canyon\Radio Canyon-bho64.dll No File
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-02-10] (Microsoft Corporation)
BHO: CIESpeechBHO Class -> {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} -> C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll [2012-08-10] (Qualcomm Atheros Commnucations)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2015-04-08] (Avast Software s.r.o.)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-03-03] (Google Inc.)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-02-10] (Microsoft Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-04-08] (Avast Software s.r.o.)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-03-03] (Google Inc.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-03-03] (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-03-03] (Google Inc.)
Toolbar: HKU\S-1-5-21-2931490297-3027747817-2233262723-1002 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-03-03] (Google Inc.)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-02-03] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
StartMenuInternet: IEXPLORE.EXE - iexplore.exe

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll [2014-01-12] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll [2014-01-12] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-06-07] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-06-07] (Intel Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2013-07-10] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-08] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-08] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-02-05] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2015-04-08]
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
FF HKU\S-1-5-21-2931490297-3027747817-2233262723-1002\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff
FF Extension: Download videos and MP3s from YouTube - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-08-10]

Chrome: 
=======
CHR Profile: C:\Users\Dominik\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Avast Online Security) - C:\Users\Dominik\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2015-04-08]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Dominik\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-04]
CHR Extension: (Google Wallet) - C:\Users\Dominik\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-21]
CHR Extension: (Amazon) - C:\Users\Dominik\AppData\Local\Google\Chrome\User Data\Default\Extensions\ocbnpbkmjpgbdcgiflkgkpnkinifpgpj [2015-04-13]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-04-08]
CHR HKLM-x32\...\Chrome\Extension: [ocbnpbkmjpgbdcgiflkgkpnkinifpgpj] - C:\Users\Dominik\ChromeExtensions\ocbnpbkmjpgbdcgiflkgkpnkinifpgpj\amazon-icon-2.crx [2014-08-10]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [211584 2012-08-10] (Qualcomm Atheros Commnucations) [File not signed]
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [343336 2015-04-08] (Avast Software s.r.o.)
R3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [4030800 2015-04-08] (Avast Software)
S2 BrcmCardReader; C:\Program Files\Broadcom\MemoryCard\BrcmCardReader.exe [176640 2012-08-20] (Broadcom Corp.) [File not signed]
S2 CCDMonitorService; C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe [2435728 2012-08-23] (Acer Incorporated)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2714800 2015-02-10] (Microsoft Corporation)
S3 DeviceFastLaneService; C:\Program Files\Acer\Acer Device Fast-lane\DeviceFastLaneSvc.exe [468624 2012-08-23] (Acer Incorporated)
S3 ePowerSvc; C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe [658576 2012-08-22] (Acer Incorporated)
S2 ETDService; C:\Program Files\Elantech\ETDService.exe [85904 2012-09-05] (ELAN Microelectronics Corp.)
S2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-18] (Intel Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-03-17] (Malwarebytes Corporation)
S2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [259136 2012-08-23] (NTI Corporation)
R2 RfButtonDriverService; C:\Windows\RfBtnSvc64.exe [93296 2012-12-25] (Dritek System INC.)
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe [2145080 2014-07-16] (TuneUp Software)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16024 2015-01-31] (Microsoft Corporation)
S2 ZAtheros Wlan Agent; C:\Program Files (x86)\Qualcomm Atheros\Ath_WlanAgent.exe [81536 2012-08-01] (Atheros) [File not signed]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29168 2015-04-08] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [88408 2015-04-08] (Avast Software s.r.o.)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-04-08] (Avast Software s.r.o.)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65736 2015-04-08] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1047320 2015-04-08] (Avast Software s.r.o.)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [442264 2015-04-08] (Avast Software s.r.o.)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [136752 2015-04-08] (Avast Software s.r.o.)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [271200 2015-04-08] ()
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2014-12-20] ()
S3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [5139968 2012-06-02] (Broadcom Corporation)
R3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [76952 2012-08-10] (Qualcomm Atheros)
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2014-12-20] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-03-17] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2015-03-17] (Malwarebytes Corporation)
R3 Ps2Kb2Hid; C:\Windows\System32\drivers\aPs2Kb2Hid.sys [26736 2012-12-25] (Dritek System Inc.)
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesDriver64.sys [14112 2014-02-10] (TuneUp Software)
R2 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [273824 2015-04-08] (Avast Software)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-13 18:39 - 2015-04-13 18:39 - 00000000 ____D () C:\Users\Dominik\Downloads\FRST-OlderVersion
2015-04-13 18:37 - 2015-04-13 18:37 - 00000669 _____ () C:\Users\Dominik\Desktop\JRT.txt
2015-04-13 18:32 - 2015-04-13 18:32 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-STUDIEN-PC-Windows-8-(64-bit).dat
2015-04-13 18:32 - 2015-04-13 18:32 - 00000000 ____D () C:\RegBackup
2015-04-13 18:21 - 2015-04-13 18:21 - 02687136 _____ (Thisisu) C:\Users\Dominik\Downloads\JRT.exe
2015-04-13 18:20 - 2015-04-13 18:20 - 00008093 _____ () C:\Users\Dominik\Desktop\adw.txt
2015-04-13 18:15 - 2015-04-13 18:17 - 00000000 ____D () C:\AdwCleaner
2015-04-13 18:15 - 2015-04-13 18:15 - 02217984 _____ () C:\Users\Dominik\Downloads\AdwCleaner_4.201.exe
2015-04-13 18:14 - 2015-04-13 18:14 - 00067947 _____ () C:\Users\Dominik\Desktop\mbam.txt
2015-04-13 15:37 - 2015-04-13 18:14 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-04-13 15:37 - 2015-04-13 15:37 - 21540440 _____ (Malwarebytes Corporation ) C:\Users\Dominik\Downloads\mbam-setup-2.1.4.1018.exe
2015-04-13 15:37 - 2015-04-13 15:37 - 00001070 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-04-13 15:37 - 2015-04-13 15:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-04-13 15:37 - 2015-04-13 15:37 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-04-13 15:37 - 2015-04-13 15:37 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-04-13 15:37 - 2015-03-17 06:15 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-04-13 15:37 - 2015-03-17 06:15 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-04-13 15:37 - 2015-03-17 06:15 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-04-13 15:17 - 2015-04-13 15:17 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Dominik\Downloads\revosetup95.exe
2015-04-13 15:17 - 2015-04-13 15:17 - 00001232 _____ () C:\Users\Dominik\Desktop\Revo Uninstaller.lnk
2015-04-13 15:17 - 2015-04-13 15:17 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2015-04-12 11:15 - 2015-04-12 11:16 - 00035791 _____ () C:\Users\Dominik\Downloads\Addition.txt
2015-04-12 11:13 - 2015-04-13 18:39 - 02096640 _____ (Farbar) C:\Users\Dominik\Downloads\FRST64.exe
2015-04-12 11:13 - 2015-04-13 18:39 - 00015769 _____ () C:\Users\Dominik\Downloads\FRST.txt
2015-04-12 11:13 - 2015-04-13 18:39 - 00000000 ____D () C:\FRST
2015-04-08 22:31 - 2015-04-13 18:17 - 00004710 _____ () C:\Windows\PFRO.log
2015-04-08 21:33 - 2015-04-08 21:35 - 00000000 ____D () C:\Windows\SysWOW64\vbox
2015-04-08 21:33 - 2015-04-08 21:35 - 00000000 ____D () C:\Windows\system32\vbox
2015-04-08 21:33 - 2015-04-08 21:33 - 00000000 ____D () C:\Users\Dominik\AppData\Roaming\AVAST Software
2015-04-08 21:32 - 2015-04-08 21:32 - 00001926 _____ () C:\Users\Public\Desktop\Avast Free Antivirus.lnk
2015-04-08 21:32 - 2015-04-08 21:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2015-04-08 21:31 - 2015-04-12 11:11 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2015-04-08 21:31 - 2015-04-08 21:31 - 01047320 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswSnx.sys
2015-04-08 21:31 - 2015-04-08 21:31 - 00442264 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswSP.sys
2015-04-08 21:31 - 2015-04-08 21:31 - 00364472 _____ (Avast Software s.r.o.) C:\Windows\system32\aswBoot.exe
2015-04-08 21:31 - 2015-04-08 21:31 - 00271200 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2015-04-08 21:31 - 2015-04-08 21:31 - 00136752 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswStm.sys
2015-04-08 21:31 - 2015-04-08 21:31 - 00093528 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswRdr2.sys
2015-04-08 21:31 - 2015-04-08 21:31 - 00088408 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswMonFlt.sys
2015-04-08 21:31 - 2015-04-08 21:31 - 00065736 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2015-04-08 21:31 - 2015-04-08 21:31 - 00043112 _____ (Avast Software s.r.o.) C:\Windows\avastSS.scr
2015-04-08 21:31 - 2015-04-08 21:31 - 00029168 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2015-04-08 21:30 - 2015-04-08 21:30 - 00000000 ____D () C:\Program Files\AVAST Software
2015-04-08 21:27 - 2015-04-08 21:27 - 00000000 ____D () C:\Users\Dominik\Downloads\backups
2015-04-08 21:17 - 2015-04-08 21:17 - 00012680 _____ () C:\Users\Dominik\Desktop\hijackthis.log
2015-04-08 21:16 - 2015-04-08 21:16 - 00388608 _____ (Trend Micro Inc.) C:\Users\Dominik\Downloads\HiJackThis204 (1).exe
2015-04-08 21:04 - 2015-04-08 21:04 - 00442264 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\spgxhfjh.sys
2015-04-08 21:03 - 2015-04-08 21:29 - 00000000 ____D () C:\ProgramData\AVAST Software
2015-04-08 21:03 - 2015-04-08 21:03 - 00442264 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\ieztnrhr.sys
2015-04-08 21:00 - 2015-04-08 21:01 - 150062624 _____ (Avast Software s.r.o.) C:\Users\Dominik\Downloads\avast_free_antivirus_setup_10.2.2215.exe
2015-04-08 01:34 - 2015-04-09 16:52 - 00000657 _____ () C:\Users\Dominik\Desktop\Neues Textdokument.txt
2015-04-03 21:25 - 2015-04-13 18:31 - 00999340 _____ () C:\Windows\WindowsUpdate.log
2015-04-03 14:55 - 2015-04-12 19:31 - 00000004 _____ () C:\Windows\SysWOW64\029B560A371F4E00AB32838EBC01B9E7
2015-03-26 20:52 - 2015-03-11 07:21 - 00677888 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-03-26 20:52 - 2015-03-11 07:20 - 00943104 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-03-26 20:52 - 2015-03-11 07:20 - 00760320 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-03-26 20:52 - 2015-03-11 07:20 - 00414208 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-03-26 20:52 - 2015-03-11 07:20 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-03-26 20:52 - 2015-03-11 07:20 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-03-26 20:52 - 2015-03-11 00:04 - 01107456 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-03-26 20:50 - 2015-03-04 09:26 - 00596480 _____ (Microsoft Corporation) C:\Windows\system32\AutoUpdate.exe
2015-03-26 20:50 - 2015-03-04 09:26 - 00467952 _____ (Microsoft Corporation) C:\Windows\system32\NotificationUI.exe
2015-03-26 20:50 - 2015-03-04 09:26 - 00011105 _____ () C:\Windows\system32\AutoconfigV2.cab
2015-03-26 20:50 - 2015-03-04 08:41 - 00695808 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll
2015-03-26 20:50 - 2015-03-04 08:41 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2015-03-26 20:50 - 2015-03-04 06:53 - 00568832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll
2015-03-26 20:50 - 2015-03-04 06:53 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2015-03-19 23:49 - 2015-03-29 22:05 - 00000000 ____D () C:\Users\Dominik\Desktop\Stefan
2015-03-17 18:16 - 2015-03-17 18:16 - 00000000 ____D () C:\Users\Dominik\AppData\Roaming\mp3DirectCut
2015-03-17 18:13 - 2015-03-17 18:13 - 00000000 ____D () C:\Program Files (x86)\mp3DirectCut
2015-03-17 18:11 - 2015-03-17 18:11 - 00308709 _____ () C:\Users\Dominik\Downloads\mp3DC220.exe
2015-03-16 12:25 - 2015-03-16 13:02 - 748863400 _____ () C:\Users\Dominik\Downloads\58eIMdFY.rar
2015-03-16 01:05 - 2015-03-16 01:57 - 726878216 _____ () C:\Users\Dominik\Downloads\58knxJ7c.rar

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-13 18:38 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\system32\sru
2015-04-13 18:27 - 2013-02-15 11:33 - 00001140 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-04-13 18:18 - 2013-02-15 11:33 - 00001136 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-04-13 18:18 - 2012-07-26 09:22 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-04-13 16:03 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\Registration
2015-04-13 16:03 - 2012-07-26 07:26 - 00262144 ___SH () C:\Windows\system32\config\BBI
2015-04-12 13:18 - 2013-02-18 11:19 - 00000000 ____D () C:\Users\Dominik\AppData\Local\CrashDumps
2015-04-11 11:51 - 2013-02-13 00:22 - 00000000 ____D () C:\Users\Dominik
2015-04-09 21:58 - 2012-12-25 16:33 - 00753134 _____ () C:\Windows\system32\perfh007.dat
2015-04-09 21:58 - 2012-12-25 16:33 - 00155826 _____ () C:\Windows\system32\perfc007.dat
2015-04-09 21:58 - 2012-07-26 09:28 - 01745416 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-04-08 22:54 - 2013-02-14 06:55 - 00003600 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2931490297-3027747817-2233262723-1002
2015-04-08 21:17 - 2013-02-13 00:22 - 00000000 ____D () C:\Users\Dominik\AppData\Local\VirtualStore
2015-04-08 21:13 - 2012-11-02 05:33 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2015-04-08 21:13 - 2012-11-02 05:33 - 00000000 ____D () C:\ProgramData\WildTangent
2015-04-08 21:12 - 2013-02-15 11:33 - 00002179 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-04-08 21:12 - 2013-02-13 00:23 - 00001446 _____ () C:\Users\Dominik\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-04-03 16:51 - 2014-04-28 16:35 - 00000000 ____D () C:\Users\Dominik\Desktop\Muay Thai
2015-04-03 16:21 - 2014-12-17 08:55 - 00000000 ____D () C:\Users\Dominik\Desktop\Bewerbungen
2015-03-30 12:46 - 2013-02-15 17:54 - 00000000 ____D () C:\Users\Dominik\AppData\Local\Deployment
2015-03-26 22:48 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\rescache
2015-03-26 22:46 - 2015-02-19 17:27 - 00005152 _____ () C:\Windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for Studien-PC-Dominik Studien-PC
2015-03-26 20:56 - 2014-12-13 10:36 - 00000000 ____D () C:\Windows\system32\appraiser
2015-03-26 20:56 - 2014-08-01 00:00 - 00000000 ___SD () C:\Windows\system32\CompatTel
2015-03-26 20:56 - 2012-07-26 09:59 - 00000000 ____D () C:\Windows\CbsTemp
2015-03-26 20:55 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\WinStore
2015-03-18 22:50 - 2013-02-15 17:50 - 00000000 ____D () C:\Program Files\Microsoft Office 15
2015-03-17 22:45 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\AUInstallAgent
2015-03-16 13:32 - 2014-12-29 12:29 - 00000000 ____D () C:\Users\Dominik\Desktop\Musik

==================== Files in the root of some directories =======

2012-12-25 08:00 - 2012-12-25 08:00 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

Some content of TEMP:
====================
C:\Users\Dominik\AppData\Local\Temp\6fc0000a.exe
C:\Users\Dominik\AppData\Local\Temp\Quarantine.exe
C:\Users\Dominik\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-04-13 08:39

==================== End Of Log ============================

--- --- ---

schrauber · 14.04.2015, 07:06

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

hankmoody25 · 18.04.2015, 11:21

Momentan ist alles gut...viiiielen Dank schonmal

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=95836d81c2f0964ba0e919c28c326a24
# engine=23432
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-04-17 01:05:59
# local_time=2015-04-17 03:05:59 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.2.9200 NT 
# compatibility_mode_1='avast! Antivirus'
# compatibility_mode=783 16777213 71 91 754468 754606 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 405029 6595855 0 0
# scanned=219129
# found=8
# cleaned=0
# scan_time=4514
sh=17C73945ED34781B45F628C9F315115131929BB4 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.F evtl. unerwünschte Anwendung" ac=I fn="C:\$Recycle.Bin\S-1-5-21-2931490297-3027747817-2233262723-1002\$R6CKN5M\9a59edf6-dba4-42e9-b4d9-3a4ddec8b58d.crx"
sh=08E08BF3F2C2A72457B27318A4E035FFB77907C7 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.F evtl. unerwünschte Anwendung" ac=I fn="C:\$Recycle.Bin\S-1-5-21-2931490297-3027747817-2233262723-1002\$R6CKN5M\9a59edf6-dba4-42e9-b4d9-3a4ddec8b58d.xpi"
sh=7B342410FDF1F0B65E0AE695CC866CF6E9DF6354 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.F evtl. unerwünschte Anwendung" ac=I fn="C:\$Recycle.Bin\S-1-5-21-2931490297-3027747817-2233262723-1002\$R6CKN5M\fd572dc8-5388-43cc-a4fa-c0fa74dd713c.crx"
sh=72EA88EBFB02962D4D05F1DFED4A712E833960A4 ft=1 fh=127e47e0eb45761a vn="Variante von Win32/Toolbar.CrossRider.AW evtl. unerwünschte Anwendung" ac=I fn="C:\$Recycle.Bin\S-1-5-21-2931490297-3027747817-2233262723-1002\$R6CKN5M\Uninstall.exe"
sh=0A42CDC8CD6BBD2758D1DAAA7D9880E214694004 ft=1 fh=6c331dd5e4d7b503 vn="Variante von Win32/DownloadGuide.D evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Dominik\Downloads\microsoft-silverlight.exe"
sh=8F1C2B612863828FD0D02F8F2F08873BD600C2B3 ft=1 fh=a448cc7744d3e6a9 vn="Variante von Win32/AdWare.iBryte.AR Anwendung" ac=I fn="C:\Users\Dominik\Downloads\Setup.exe"
sh=A118917FF63FB88003E2E40529752331B1B80117 ft=1 fh=07a2481b1bd04f8f vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Dominik\Downloads\VLC media player 64 Bit - CHIP-Installer.exe"
sh=AF4CAA075362E539F6F7A21E35A6547C30FBED34 ft=1 fh=3f3f0b1d94717ae2 vn="Variante von Win32/Toolbar.CrossRider.BA evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Dominik\Downloads\backups\backup-20150408-212700-714.dll"

Code:

ATTFilter

 Results of screen317's Security Check version 1.00  
   x64 (UAC is enabled)  
 Internet Explorer 10 Out of date! 
``````````````Antivirus/Firewall Check:`````````````` 
Windows Defender   
avast! Antivirus   
 Antivirus up to date!   
`````````Anti-malware/Other Utilities Check:````````` 
 TuneUp Utilities 2014   
 TuneUp Utilities 2014 (de-DE)  
 TuneUp Utilities 2014   
  Adobe Flash Player 	11.9.900.170 Flash Player out of Date!  
 Adobe Reader XI  
 Google Chrome (41.0.2272.118) 
 Google Chrome (42.0.2311.90) 
````````Process Check: objlist.exe by Laurent````````  
 AVAST Software Avast AvastSvc.exe  
 AVAST Software Avast ng vbox\AvastVBoxSVC.exe 
 AVAST Software Avast ng ngservice.exe 
 AVAST Software Avast AvastUI.exe  
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  % 
````````````````````End of Log``````````````````````

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 18-04-2015 01
Ran by Dominik (administrator) on STUDIEN-PC on 18-04-2015 12:17:59
Running from C:\Users\Dominik\Downloads
Loaded Profiles: UpdatusUser & Dominik (Available profiles: UpdatusUser & Dominik)
Platform: Windows 8 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 10 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Qualcomm Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe
(Broadcom Corp.) C:\Program Files\Broadcom\MemoryCard\BrcmCardReader.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDService.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe
(Dritek System INC.) C:\Windows\RfBtnSvc64.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe
(Atheros) C:\Program Files (x86)\Qualcomm Atheros\Ath_WlanAgent.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Avast Software) C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\ng\ngservice.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Dolby Laboratories Inc.) C:\Dolby PCEE4\pcee4.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerTray.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe
(CyberLink) C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe
(Qualcomm Atheros) C:\Program Files (x86)\Bluetooth Suite\BtTray.exe
(Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
() C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe
() C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuBrowserIEAgent.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Egis Technology Inc.) C:\Program Files\EgisTec IPS\PmmUpdate.exe
(Egis Technology Inc.) C:\Program Files\EgisTec IPS\EgisUpdate.exe
(Microsoft Corporation) C:\Windows\SysWOW64\WWAHost.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
() C:\Users\Dominik\Downloads\SecurityCheck.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2012-06-11] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1212048 2012-06-07] (Realtek Semiconductor)
HKLM\...\Run: [BtPreLoad] => C:\Program Files (x86)\Bluetooth Suite\BtPreLoad.exe [64640 2012-08-10] ()
HKLM-x32\...\Run: [LManager] => [X]
HKLM-x32\...\Run: [Dolby Home Theater v4] => C:\Dolby PCEE4\pcee4.exe [508256 2012-04-23] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [193568 2014-11-28] (Geek Software GmbH)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5512912 2015-04-08] (Avast Software s.r.o.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKU\S-1-5-19\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-20\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-21-2931490297-3027747817-2233262723-1002\...\Policies\Explorer: [NoDriveTypeAutoRun] 0x95000000
HKU\S-1-5-21-2931490297-3027747817-2233262723-1002\...\MountPoints2: {d5ff15b9-4643-11e4-8204-208984c59d73} - "E:\iStudio.exe" 
HKU\S-1-5-18\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [247144 2012-10-11] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [203112 2012-10-11] (NVIDIA Corporation)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (Avast Software s.r.o.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:55348;https=127.0.0.1:55348
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKU\S-1-5-21-2931490297-3027747817-2233262723-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://acer13.msn.com
HKU\S-1-5-21-2931490297-3027747817-2233262723-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer13.msn.com
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-2931490297-3027747817-2233262723-1002 -> {76149113-4D33-46DD-A552-3BEA0A947DB6} URL = 
SearchScopes: HKU\S-1-5-21-2931490297-3027747817-2233262723-1002 -> {CE6B38BB-49B4-46BE-ADA7-E7BD583814CD} URL = https://de.search.yahoo.com/search?fr=mcafee&type=B011DE662D20140725&p={SearchTerms}
BHO: Radio Canyon -> {11111111-1111-1111-1111-110611081104} -> C:\Program Files (x86)\Radio Canyon\Radio Canyon-bho64.dll No File
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-02-10] (Microsoft Corporation)
BHO: CIESpeechBHO Class -> {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} -> C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll [2012-08-10] (Qualcomm Atheros Commnucations)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2015-04-08] (Avast Software s.r.o.)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-03-03] (Google Inc.)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-02-10] (Microsoft Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-04-08] (Avast Software s.r.o.)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-03-03] (Google Inc.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-03-03] (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-03-03] (Google Inc.)
Toolbar: HKU\S-1-5-21-2931490297-3027747817-2233262723-1002 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-03-03] (Google Inc.)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-02-03] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
StartMenuInternet: IEXPLORE.EXE - iexplore.exe

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll [2014-01-12] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll [2014-01-12] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-06-07] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-06-07] (Intel Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2013-07-10] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-08] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-08] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-02-05] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: No Name - C:\Program Files\AVAST Software\Avast\WebRep\FF [2015-04-08]
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
FF HKU\S-1-5-21-2931490297-3027747817-2233262723-1002\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff
FF Extension: No Name - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-08-10]

Chrome: 
=======
CHR Profile: C:\Users\Dominik\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Avast SafePrice) - C:\Users\Dominik\AppData\Local\Google\Chrome\User Data\Default\Extensions\eofcbnmajmjmplflapaojjnihcjkigck [2015-04-13]
CHR Extension: (Bookmark Manager) - C:\Users\Dominik\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik [2015-04-16]
CHR Extension: (Avast Online Security) - C:\Users\Dominik\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2015-04-08]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Dominik\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-04]
CHR Extension: (Google Wallet) - C:\Users\Dominik\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-21]
CHR Extension: (Amazon) - C:\Users\Dominik\AppData\Local\Google\Chrome\User Data\Default\Extensions\ocbnpbkmjpgbdcgiflkgkpnkinifpgpj [2015-04-13]
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChromeSp.crx [2015-04-08]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-04-08]
CHR HKLM-x32\...\Chrome\Extension: [ocbnpbkmjpgbdcgiflkgkpnkinifpgpj] - C:\Users\Dominik\ChromeExtensions\ocbnpbkmjpgbdcgiflkgkpnkinifpgpj\amazon-icon-2.crx [2014-08-10]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [211584 2012-08-10] (Qualcomm Atheros Commnucations) [File not signed]
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [343336 2015-04-08] (Avast Software s.r.o.)
R3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [4030800 2015-04-08] (Avast Software)
R2 BrcmCardReader; C:\Program Files\Broadcom\MemoryCard\BrcmCardReader.exe [176640 2012-08-20] (Broadcom Corp.) [File not signed]
R2 CCDMonitorService; C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe [2435728 2012-08-23] (Acer Incorporated)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2714800 2015-02-10] (Microsoft Corporation)
S3 DeviceFastLaneService; C:\Program Files\Acer\Acer Device Fast-lane\DeviceFastLaneSvc.exe [468624 2012-08-23] (Acer Incorporated)
R3 ePowerSvc; C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe [658576 2012-08-22] (Acer Incorporated)
R2 ETDService; C:\Program Files\Elantech\ETDService.exe [85904 2012-09-05] (ELAN Microelectronics Corp.)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-18] (Intel Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-03-17] (Malwarebytes Corporation)
R2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [259136 2012-08-23] (NTI Corporation)
R2 RfButtonDriverService; C:\Windows\RfBtnSvc64.exe [93296 2012-12-25] (Dritek System INC.)
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe [2145080 2014-07-16] (TuneUp Software)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16024 2015-01-31] (Microsoft Corporation)
R2 ZAtheros Wlan Agent; C:\Program Files (x86)\Qualcomm Atheros\Ath_WlanAgent.exe [81536 2012-08-01] (Atheros) [File not signed]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29168 2015-04-08] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [88408 2015-04-08] (Avast Software s.r.o.)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-04-08] (Avast Software s.r.o.)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65736 2015-04-08] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1047320 2015-04-08] (Avast Software s.r.o.)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [442264 2015-04-08] (Avast Software s.r.o.)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [136752 2015-04-08] (Avast Software s.r.o.)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [271200 2015-04-08] ()
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2014-12-20] ()
S3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [5139968 2012-06-02] (Broadcom Corporation)
R3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [76952 2012-08-10] (Qualcomm Atheros)
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2014-12-20] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-03-17] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2015-03-17] (Malwarebytes Corporation)
R3 Ps2Kb2Hid; C:\Windows\System32\drivers\aPs2Kb2Hid.sys [26736 2012-12-25] (Dritek System Inc.)
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesDriver64.sys [14112 2014-02-10] (TuneUp Software)
R2 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [273824 2015-04-08] (Avast Software)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-18 12:16 - 2015-04-18 12:16 - 00852616 _____ () C:\Users\Dominik\Downloads\SecurityCheck.exe
2015-04-17 13:48 - 2015-04-17 13:48 - 00000000 ____D () C:\Program Files (x86)\ESET
2015-04-17 13:47 - 2015-04-17 13:47 - 02347384 _____ (ESET) C:\Users\Dominik\Downloads\esetsmartinstaller_deu.exe
2015-04-16 13:40 - 2015-03-23 07:19 - 00726528 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-04-16 13:40 - 2015-03-23 07:17 - 00957440 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-04-16 13:40 - 2015-03-23 07:17 - 00769024 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-04-16 13:40 - 2015-03-23 07:17 - 00419328 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-04-16 13:40 - 2015-03-23 07:17 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-04-16 13:40 - 2015-03-23 07:17 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-04-16 13:40 - 2015-03-23 00:04 - 01111552 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-04-16 13:39 - 2015-03-17 09:00 - 06971712 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-04-16 13:39 - 2015-03-17 08:52 - 01822696 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-04-16 13:39 - 2015-03-17 06:45 - 01409496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-04-16 13:39 - 2015-03-14 10:07 - 01120256 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll
2015-04-16 13:39 - 2015-03-14 08:33 - 00891904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msctf.dll
2015-04-16 13:39 - 2015-03-04 09:29 - 00361280 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\clfs.sys
2015-04-16 13:39 - 2015-03-04 08:39 - 00074752 _____ (Microsoft Corporation) C:\Windows\system32\clfsw32.dll
2015-04-16 13:39 - 2015-03-04 06:52 - 00057856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\clfsw32.dll
2015-04-16 13:39 - 2015-02-24 09:58 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\http.sys
2015-04-16 13:38 - 2015-03-10 07:28 - 02237952 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-04-16 13:38 - 2015-03-10 07:28 - 01409024 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-04-16 13:38 - 2015-03-10 07:28 - 00600576 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-04-16 13:38 - 2015-03-10 07:27 - 19292672 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-04-16 13:38 - 2015-03-10 07:27 - 15409152 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-04-16 13:38 - 2015-03-10 07:27 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-04-16 13:38 - 2015-03-10 07:27 - 00949760 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2015-04-16 13:38 - 2015-03-10 07:27 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-04-16 13:38 - 2015-03-10 07:27 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-04-16 13:38 - 2015-03-10 05:49 - 14373376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-04-16 13:38 - 2015-03-10 05:49 - 02864640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-04-16 13:38 - 2015-03-10 05:49 - 01763328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-04-16 13:38 - 2015-03-10 05:49 - 01181696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-04-16 13:38 - 2015-03-10 05:49 - 00737280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2015-04-16 13:38 - 2015-03-10 05:49 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-04-16 13:38 - 2015-03-10 05:49 - 00523776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-04-16 13:38 - 2015-03-10 05:49 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-04-16 13:38 - 2015-03-10 05:48 - 13767680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-04-13 18:40 - 2015-04-13 18:40 - 00027984 _____ () C:\Users\Dominik\Desktop\FRST.txt
2015-04-13 18:39 - 2015-04-18 12:17 - 00000000 ____D () C:\Users\Dominik\Downloads\FRST-OlderVersion
2015-04-13 18:37 - 2015-04-13 18:37 - 00000669 _____ () C:\Users\Dominik\Desktop\JRT.txt
2015-04-13 18:32 - 2015-04-13 18:32 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-STUDIEN-PC-Windows-8-(64-bit).dat
2015-04-13 18:32 - 2015-04-13 18:32 - 00000000 ____D () C:\RegBackup
2015-04-13 18:21 - 2015-04-13 18:21 - 02687136 _____ (Thisisu) C:\Users\Dominik\Downloads\JRT.exe
2015-04-13 18:20 - 2015-04-13 18:20 - 00008093 _____ () C:\Users\Dominik\Desktop\adw.txt
2015-04-13 18:15 - 2015-04-13 18:17 - 00000000 ____D () C:\AdwCleaner
2015-04-13 18:15 - 2015-04-13 18:15 - 02217984 _____ () C:\Users\Dominik\Downloads\AdwCleaner_4.201.exe
2015-04-13 18:14 - 2015-04-13 18:14 - 00067947 _____ () C:\Users\Dominik\Desktop\mbam.txt
2015-04-13 15:37 - 2015-04-13 18:14 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-04-13 15:37 - 2015-04-13 15:37 - 21540440 _____ (Malwarebytes Corporation ) C:\Users\Dominik\Downloads\mbam-setup-2.1.4.1018.exe
2015-04-13 15:37 - 2015-04-13 15:37 - 00001070 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-04-13 15:37 - 2015-04-13 15:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-04-13 15:37 - 2015-04-13 15:37 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-04-13 15:37 - 2015-04-13 15:37 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-04-13 15:37 - 2015-03-17 06:15 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-04-13 15:37 - 2015-03-17 06:15 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-04-13 15:37 - 2015-03-17 06:15 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-04-13 15:17 - 2015-04-13 15:17 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Dominik\Downloads\revosetup95.exe
2015-04-13 15:17 - 2015-04-13 15:17 - 00001232 _____ () C:\Users\Dominik\Desktop\Revo Uninstaller.lnk
2015-04-13 15:17 - 2015-04-13 15:17 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2015-04-12 11:15 - 2015-04-12 11:16 - 00035791 _____ () C:\Users\Dominik\Downloads\Addition.txt
2015-04-12 11:13 - 2015-04-18 12:18 - 00000000 ____D () C:\FRST
2015-04-12 11:13 - 2015-04-18 12:17 - 02098176 _____ (Farbar) C:\Users\Dominik\Downloads\FRST64.exe
2015-04-12 11:13 - 2015-04-18 12:17 - 00019210 _____ () C:\Users\Dominik\Downloads\FRST.txt
2015-04-08 22:31 - 2015-04-13 18:17 - 00004710 _____ () C:\Windows\PFRO.log
2015-04-08 21:33 - 2015-04-08 21:35 - 00000000 ____D () C:\Windows\SysWOW64\vbox
2015-04-08 21:33 - 2015-04-08 21:35 - 00000000 ____D () C:\Windows\system32\vbox
2015-04-08 21:33 - 2015-04-08 21:33 - 00000000 ____D () C:\Users\Dominik\AppData\Roaming\AVAST Software
2015-04-08 21:32 - 2015-04-08 21:32 - 00001926 _____ () C:\Users\Public\Desktop\Avast Free Antivirus.lnk
2015-04-08 21:32 - 2015-04-08 21:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2015-04-08 21:31 - 2015-04-16 19:20 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2015-04-08 21:31 - 2015-04-08 21:31 - 01047320 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswSnx.sys
2015-04-08 21:31 - 2015-04-08 21:31 - 00442264 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswSP.sys
2015-04-08 21:31 - 2015-04-08 21:31 - 00364472 _____ (Avast Software s.r.o.) C:\Windows\system32\aswBoot.exe
2015-04-08 21:31 - 2015-04-08 21:31 - 00271200 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2015-04-08 21:31 - 2015-04-08 21:31 - 00136752 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswStm.sys
2015-04-08 21:31 - 2015-04-08 21:31 - 00093528 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswRdr2.sys
2015-04-08 21:31 - 2015-04-08 21:31 - 00088408 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswMonFlt.sys
2015-04-08 21:31 - 2015-04-08 21:31 - 00065736 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2015-04-08 21:31 - 2015-04-08 21:31 - 00043112 _____ (Avast Software s.r.o.) C:\Windows\avastSS.scr
2015-04-08 21:31 - 2015-04-08 21:31 - 00029168 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2015-04-08 21:30 - 2015-04-08 21:30 - 00000000 ____D () C:\Program Files\AVAST Software
2015-04-08 21:27 - 2015-04-08 21:27 - 00000000 ____D () C:\Users\Dominik\Downloads\backups
2015-04-08 21:17 - 2015-04-08 21:17 - 00012680 _____ () C:\Users\Dominik\Desktop\hijackthis.log
2015-04-08 21:16 - 2015-04-08 21:16 - 00388608 _____ (Trend Micro Inc.) C:\Users\Dominik\Downloads\HiJackThis204 (1).exe
2015-04-08 21:04 - 2015-04-08 21:04 - 00442264 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\spgxhfjh.sys
2015-04-08 21:03 - 2015-04-08 21:29 - 00000000 ____D () C:\ProgramData\AVAST Software
2015-04-08 21:03 - 2015-04-08 21:03 - 00442264 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\ieztnrhr.sys
2015-04-08 21:00 - 2015-04-08 21:01 - 150062624 _____ (Avast Software s.r.o.) C:\Users\Dominik\Downloads\avast_free_antivirus_setup_10.2.2215.exe
2015-04-08 01:34 - 2015-04-09 16:52 - 00000657 _____ () C:\Users\Dominik\Desktop\Neues Textdokument.txt
2015-04-03 21:25 - 2015-04-17 17:16 - 01435193 _____ () C:\Windows\WindowsUpdate.log
2015-04-03 14:55 - 2015-04-12 19:31 - 00000004 _____ () C:\Windows\SysWOW64\029B560A371F4E00AB32838EBC01B9E7
2015-03-26 20:50 - 2015-03-04 09:26 - 00596480 _____ (Microsoft Corporation) C:\Windows\system32\AutoUpdate.exe
2015-03-26 20:50 - 2015-03-04 09:26 - 00467952 _____ (Microsoft Corporation) C:\Windows\system32\NotificationUI.exe
2015-03-26 20:50 - 2015-03-04 09:26 - 00011105 _____ () C:\Windows\system32\AutoconfigV2.cab
2015-03-26 20:50 - 2015-03-04 08:41 - 00695808 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll
2015-03-26 20:50 - 2015-03-04 08:41 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2015-03-26 20:50 - 2015-03-04 06:53 - 00568832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll
2015-03-26 20:50 - 2015-03-04 06:53 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2015-03-19 23:49 - 2015-03-29 22:05 - 00000000 ____D () C:\Users\Dominik\Desktop\Stefan

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-18 12:11 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\system32\sru
2015-04-18 01:27 - 2013-02-15 11:33 - 00001140 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-04-18 01:16 - 2013-02-15 11:33 - 00001136 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-04-18 01:15 - 2012-07-26 09:22 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-04-17 15:21 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\rescache
2015-04-17 08:29 - 2012-07-26 07:26 - 00262144 ___SH () C:\Windows\system32\config\BBI
2015-04-16 23:28 - 2014-12-13 10:36 - 00000000 ____D () C:\Windows\system32\appraiser
2015-04-16 23:28 - 2014-08-01 00:00 - 00000000 ___SD () C:\Windows\system32\CompatTel
2015-04-16 19:50 - 2012-07-26 09:59 - 00000000 ____D () C:\Windows\CbsTemp
2015-04-16 19:49 - 2013-11-10 23:50 - 00000000 ____D () C:\Windows\system32\MRT
2015-04-16 19:46 - 2013-02-17 22:32 - 128913832 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-04-16 11:02 - 2012-12-25 16:33 - 00753134 _____ () C:\Windows\system32\perfh007.dat
2015-04-16 11:02 - 2012-12-25 16:33 - 00155826 _____ () C:\Windows\system32\perfc007.dat
2015-04-16 11:02 - 2012-07-26 09:28 - 01745416 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-04-15 21:28 - 2013-02-15 11:33 - 00002139 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-04-14 00:07 - 2014-07-25 23:36 - 00791520 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-04-14 00:07 - 2014-07-25 23:36 - 00177632 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-04-13 16:03 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\Registration
2015-04-12 13:18 - 2013-02-18 11:19 - 00000000 ____D () C:\Users\Dominik\AppData\Local\CrashDumps
2015-04-11 11:51 - 2013-02-13 00:22 - 00000000 ____D () C:\Users\Dominik
2015-04-08 22:54 - 2013-02-14 06:55 - 00003600 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2931490297-3027747817-2233262723-1002
2015-04-08 21:17 - 2013-02-13 00:22 - 00000000 ____D () C:\Users\Dominik\AppData\Local\VirtualStore
2015-04-08 21:13 - 2012-11-02 05:33 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2015-04-08 21:13 - 2012-11-02 05:33 - 00000000 ____D () C:\ProgramData\WildTangent
2015-04-08 21:12 - 2013-02-13 00:23 - 00001446 _____ () C:\Users\Dominik\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-04-03 16:51 - 2014-04-28 16:35 - 00000000 ____D () C:\Users\Dominik\Desktop\Muay Thai
2015-04-03 16:21 - 2014-12-17 08:55 - 00000000 ____D () C:\Users\Dominik\Desktop\Bewerbungen
2015-03-30 12:46 - 2013-02-15 17:54 - 00000000 ____D () C:\Users\Dominik\AppData\Local\Deployment
2015-03-26 20:55 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\WinStore

==================== Files in the root of some directories =======

2012-12-25 08:00 - 2012-12-25 08:00 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

Some content of TEMP:
====================
C:\Users\Dominik\AppData\Local\Temp\6fc0000a.exe
C:\Users\Dominik\AppData\Local\Temp\Quarantine.exe
C:\Users\Dominik\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-04-14 11:38

==================== End Of Log ============================

--- --- ---

schrauber · 18.04.2015, 22:57

Flash Player und WIndows updaten.

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

C:\$Recycle.Bin

C:\Users\Dominik\Downloads\microsoft-silverlight.exe

C:\Users\Dominik\Downloads\Setup.exe

C:\Users\Dominik\Downloads\VLC media player 64 Bit - CHIP-Installer.exe

C:\Users\Dominik\Downloads\backups\backup-20150408-212700-714.dll
RemoveProxy:
Emptytemp:

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Frisches FRST log bitte.

hankmoody25 · 25.04.2015, 11:10

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 23-04-2015 02
Ran by Dominik at 2015-04-24 17:46:28 Run:1
Running from C:\Users\Dominik\Downloads
Loaded Profiles: UpdatusUser & Dominik (Available profiles: UpdatusUser & Dominik)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
C:\$Recycle.Bin

C:\Users\Dominik\Downloads\microsoft-silverlight.exe

C:\Users\Dominik\Downloads\Setup.exe

C:\Users\Dominik\Downloads\VLC media player 64 Bit - CHIP-Installer.exe

C:\Users\Dominik\Downloads\backups\backup-20150408-212700-714.dll
RemoveProxy:
Emptytemp:
         
*****************

C:\$Recycle.Bin => Moved successfully.
C:\Users\Dominik\Downloads\microsoft-silverlight.exe => Moved successfully.
C:\Users\Dominik\Downloads\Setup.exe => Moved successfully.
C:\Users\Dominik\Downloads\VLC media player 64 Bit - CHIP-Installer.exe => Moved successfully.
C:\Users\Dominik\Downloads\backups\backup-20150408-212700-714.dll => Moved successfully.

========= RemoveProxy: =========

HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable => value deleted successfully.
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => value deleted successfully.
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value deleted successfully.
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value deleted successfully.
HKU\S-1-5-21-2931490297-3027747817-2233262723-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value deleted successfully.
HKU\S-1-5-21-2931490297-3027747817-2233262723-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value deleted successfully.
HKU\S-1-5-21-2931490297-3027747817-2233262723-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value deleted successfully.
HKU\S-1-5-21-2931490297-3027747817-2233262723-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value deleted successfully.


========= End of RemoveProxy: =========

EmptyTemp: => Removed 549.4 MB temporary data.


The system needed a reboot. 

==== End of Fixlog 17:46:45 ====

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 23-04-2015 02
Ran by Dominik (administrator) on STUDIEN-PC on 25-04-2015 12:08:56
Running from C:\Users\Dominik\Downloads
Loaded Profiles: UpdatusUser & Dominik (Available profiles: UpdatusUser & Dominik)
Platform: Windows 8 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 10 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Qualcomm Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe
(Broadcom Corp.) C:\Program Files\Broadcom\MemoryCard\BrcmCardReader.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDService.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe
(Dritek System INC.) C:\Windows\RfBtnSvc64.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(Atheros) C:\Program Files (x86)\Qualcomm Atheros\Ath_WlanAgent.exe
(Avast Software) C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\ng\ngservice.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerTray.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Dolby Laboratories Inc.) C:\Dolby PCEE4\pcee4.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe
(CyberLink) C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe
(Qualcomm Atheros) C:\Program Files (x86)\Bluetooth Suite\BtTray.exe
(Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
() C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe
() C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuBrowserIEAgent.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Egis Technology Inc.) C:\Program Files\EgisTec IPS\PmmUpdate.exe
(Egis Technology Inc.) C:\Program Files\EgisTec IPS\EgisUpdate.exe
(Microsoft Corporation) C:\Windows\SysWOW64\WWAHost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\WWAHost.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\wsqmcons.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\CompatTel\wicainventory.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2012-06-11] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1212048 2012-06-07] (Realtek Semiconductor)
HKLM\...\Run: [BtPreLoad] => C:\Program Files (x86)\Bluetooth Suite\BtPreLoad.exe [64640 2012-08-10] ()
HKLM-x32\...\Run: [LManager] => [X]
HKLM-x32\...\Run: [Dolby Home Theater v4] => C:\Dolby PCEE4\pcee4.exe [508256 2012-04-23] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [193568 2014-11-28] (Geek Software GmbH)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5512912 2015-04-08] (Avast Software s.r.o.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKU\S-1-5-19\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-20\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-21-2931490297-3027747817-2233262723-1002\...\Policies\Explorer: [NoDriveTypeAutoRun] 0x95000000
HKU\S-1-5-21-2931490297-3027747817-2233262723-1002\...\MountPoints2: {d5ff15b9-4643-11e4-8204-208984c59d73} - "E:\iStudio.exe" 
HKU\S-1-5-18\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [247144 2012-10-11] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [203112 2012-10-11] (NVIDIA Corporation)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2015-04-08] (Avast Software s.r.o.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKU\S-1-5-21-2931490297-3027747817-2233262723-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://acer13.msn.com
HKU\S-1-5-21-2931490297-3027747817-2233262723-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer13.msn.com
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-2931490297-3027747817-2233262723-1002 -> {76149113-4D33-46DD-A552-3BEA0A947DB6} URL = 
SearchScopes: HKU\S-1-5-21-2931490297-3027747817-2233262723-1002 -> {CE6B38BB-49B4-46BE-ADA7-E7BD583814CD} URL = https://de.search.yahoo.com/search?fr=mcafee&type=B011DE662D20140725&p={SearchTerms}
BHO: No Name -> {11111111-1111-1111-1111-110611081104} ->  No File
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-02-10] (Microsoft Corporation)
BHO: CIESpeechBHO Class -> {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} -> C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll [2012-08-10] (Qualcomm Atheros Commnucations)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2015-04-08] (Avast Software s.r.o.)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-03-03] (Google Inc.)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-02-10] (Microsoft Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-04-08] (Avast Software s.r.o.)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-03-03] (Google Inc.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-03-03] (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-03-03] (Google Inc.)
Toolbar: HKU\S-1-5-21-2931490297-3027747817-2233262723-1002 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-03-03] (Google Inc.)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-02-03] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
StartMenuInternet: IEXPLORE.EXE - iexplore.exe

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll [2014-01-12] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll [2014-01-12] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-06-07] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-06-07] (Intel Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2013-07-10] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-08] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-08] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-02-05] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2015-04-08]
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
FF HKU\S-1-5-21-2931490297-3027747817-2233262723-1002\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff
FF Extension: Download videos and MP3s from YouTube - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-08-10]

Chrome: 
=======
CHR Profile: C:\Users\Dominik\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Avast SafePrice) - C:\Users\Dominik\AppData\Local\Google\Chrome\User Data\Default\Extensions\eofcbnmajmjmplflapaojjnihcjkigck [2015-04-13]
CHR Extension: (Bookmark Manager) - C:\Users\Dominik\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik [2015-04-16]
CHR Extension: (Avast Online Security) - C:\Users\Dominik\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2015-04-08]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Dominik\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-04]
CHR Extension: (Google Wallet) - C:\Users\Dominik\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-21]
CHR Extension: (Amazon) - C:\Users\Dominik\AppData\Local\Google\Chrome\User Data\Default\Extensions\ocbnpbkmjpgbdcgiflkgkpnkinifpgpj [2015-04-13]
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChromeSp.crx [2015-04-08]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-04-08]
CHR HKLM-x32\...\Chrome\Extension: [ocbnpbkmjpgbdcgiflkgkpnkinifpgpj] - C:\Users\Dominik\ChromeExtensions\ocbnpbkmjpgbdcgiflkgkpnkinifpgpj\amazon-icon-2.crx [2014-08-10]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [211584 2012-08-10] (Qualcomm Atheros Commnucations) [File not signed]
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [343336 2015-04-08] (Avast Software s.r.o.)
R3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [4030800 2015-04-08] (Avast Software)
R2 BrcmCardReader; C:\Program Files\Broadcom\MemoryCard\BrcmCardReader.exe [176640 2012-08-20] (Broadcom Corp.) [File not signed]
R2 CCDMonitorService; C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe [2435728 2012-08-23] (Acer Incorporated)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2714800 2015-02-10] (Microsoft Corporation)
S3 DeviceFastLaneService; C:\Program Files\Acer\Acer Device Fast-lane\DeviceFastLaneSvc.exe [468624 2012-08-23] (Acer Incorporated)
R3 ePowerSvc; C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe [658576 2012-08-22] (Acer Incorporated)
R2 ETDService; C:\Program Files\Elantech\ETDService.exe [85904 2012-09-05] (ELAN Microelectronics Corp.)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-18] (Intel Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-03-17] (Malwarebytes Corporation)
R2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [259136 2012-08-23] (NTI Corporation)
R2 RfButtonDriverService; C:\Windows\RfBtnSvc64.exe [93296 2012-12-25] (Dritek System INC.)
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe [2145080 2014-07-16] (TuneUp Software)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16024 2015-01-31] (Microsoft Corporation)
R2 ZAtheros Wlan Agent; C:\Program Files (x86)\Qualcomm Atheros\Ath_WlanAgent.exe [81536 2012-08-01] (Atheros) [File not signed]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29168 2015-04-08] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [88408 2015-04-08] (Avast Software s.r.o.)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-04-08] (Avast Software s.r.o.)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65736 2015-04-08] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1047320 2015-04-08] (Avast Software s.r.o.)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [442264 2015-04-08] (Avast Software s.r.o.)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [136752 2015-04-08] (Avast Software s.r.o.)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [271200 2015-04-08] ()
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2014-12-20] ()
S3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [5139968 2012-06-02] (Broadcom Corporation)
R3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [76952 2012-08-10] (Qualcomm Atheros)
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2014-12-20] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-03-17] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2015-03-17] (Malwarebytes Corporation)
R3 Ps2Kb2Hid; C:\Windows\System32\drivers\aPs2Kb2Hid.sys [26736 2012-12-25] (Dritek System Inc.)
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesDriver64.sys [14112 2014-02-10] (TuneUp Software)
R2 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [273824 2015-04-08] (Avast Software)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-25 12:06 - 2015-04-25 12:06 - 00003286 _____ () C:\Windows\System32\Tasks\avastBCLRestartS-1-5-21-2931490297-3027747817-2233262723-1002
2015-04-24 17:48 - 2015-04-24 17:48 - 00000670 _____ () C:\Windows\PFRO.log
2015-04-20 15:00 - 2015-04-23 11:19 - 00123857 _____ () C:\Windows\WindowsUpdate.log
2015-04-18 12:16 - 2015-04-18 12:16 - 00852616 _____ () C:\Users\Dominik\Downloads\SecurityCheck.exe
2015-04-17 13:47 - 2015-04-17 13:47 - 02347384 _____ (ESET) C:\Users\Dominik\Downloads\esetsmartinstaller_deu.exe
2015-04-16 13:40 - 2015-03-23 07:19 - 00726528 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-04-16 13:40 - 2015-03-23 07:17 - 00957440 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-04-16 13:40 - 2015-03-23 07:17 - 00769024 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-04-16 13:40 - 2015-03-23 07:17 - 00419328 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-04-16 13:40 - 2015-03-23 07:17 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-04-16 13:40 - 2015-03-23 07:17 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-04-16 13:40 - 2015-03-23 00:04 - 01111552 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-04-16 13:39 - 2015-03-17 09:00 - 06971712 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-04-16 13:39 - 2015-03-17 08:52 - 01822696 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-04-16 13:39 - 2015-03-17 06:45 - 01409496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-04-16 13:39 - 2015-03-14 10:07 - 01120256 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll
2015-04-16 13:39 - 2015-03-14 08:33 - 00891904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msctf.dll
2015-04-16 13:39 - 2015-03-04 09:29 - 00361280 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\clfs.sys
2015-04-16 13:39 - 2015-03-04 08:39 - 00074752 _____ (Microsoft Corporation) C:\Windows\system32\clfsw32.dll
2015-04-16 13:39 - 2015-03-04 06:52 - 00057856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\clfsw32.dll
2015-04-16 13:39 - 2015-02-24 09:58 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\http.sys
2015-04-16 13:38 - 2015-03-10 07:28 - 02237952 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-04-16 13:38 - 2015-03-10 07:28 - 01409024 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-04-16 13:38 - 2015-03-10 07:28 - 00600576 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-04-16 13:38 - 2015-03-10 07:27 - 19292672 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-04-16 13:38 - 2015-03-10 07:27 - 15409152 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-04-16 13:38 - 2015-03-10 07:27 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-04-16 13:38 - 2015-03-10 07:27 - 00949760 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2015-04-16 13:38 - 2015-03-10 07:27 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-04-16 13:38 - 2015-03-10 07:27 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-04-16 13:38 - 2015-03-10 05:49 - 14373376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-04-16 13:38 - 2015-03-10 05:49 - 02864640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-04-16 13:38 - 2015-03-10 05:49 - 01763328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-04-16 13:38 - 2015-03-10 05:49 - 01181696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-04-16 13:38 - 2015-03-10 05:49 - 00737280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2015-04-16 13:38 - 2015-03-10 05:49 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-04-16 13:38 - 2015-03-10 05:49 - 00523776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-04-16 13:38 - 2015-03-10 05:49 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-04-16 13:38 - 2015-03-10 05:48 - 13767680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-04-13 18:40 - 2015-04-13 18:40 - 00027984 _____ () C:\Users\Dominik\Desktop\FRST.txt
2015-04-13 18:39 - 2015-04-24 17:46 - 00000000 ____D () C:\Users\Dominik\Downloads\FRST-OlderVersion
2015-04-13 18:37 - 2015-04-13 18:37 - 00000669 _____ () C:\Users\Dominik\Desktop\JRT.txt
2015-04-13 18:32 - 2015-04-13 18:32 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-STUDIEN-PC-Windows-8-(64-bit).dat
2015-04-13 18:32 - 2015-04-13 18:32 - 00000000 ____D () C:\RegBackup
2015-04-13 18:21 - 2015-04-13 18:21 - 02687136 _____ (Thisisu) C:\Users\Dominik\Downloads\JRT.exe
2015-04-13 18:20 - 2015-04-13 18:20 - 00008093 _____ () C:\Users\Dominik\Desktop\adw.txt
2015-04-13 18:15 - 2015-04-13 18:17 - 00000000 ____D () C:\AdwCleaner
2015-04-13 18:15 - 2015-04-13 18:15 - 02217984 _____ () C:\Users\Dominik\Downloads\AdwCleaner_4.201.exe
2015-04-13 18:14 - 2015-04-13 18:14 - 00067947 _____ () C:\Users\Dominik\Desktop\mbam.txt
2015-04-13 15:37 - 2015-04-13 18:14 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-04-13 15:37 - 2015-04-13 15:37 - 21540440 _____ (Malwarebytes Corporation ) C:\Users\Dominik\Downloads\mbam-setup-2.1.4.1018.exe
2015-04-13 15:37 - 2015-04-13 15:37 - 00001070 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-04-13 15:37 - 2015-04-13 15:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-04-13 15:37 - 2015-04-13 15:37 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-04-13 15:37 - 2015-04-13 15:37 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-04-13 15:37 - 2015-03-17 06:15 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-04-13 15:37 - 2015-03-17 06:15 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-04-13 15:37 - 2015-03-17 06:15 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-04-13 15:17 - 2015-04-13 15:17 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Dominik\Downloads\revosetup95.exe
2015-04-13 15:17 - 2015-04-13 15:17 - 00001232 _____ () C:\Users\Dominik\Desktop\Revo Uninstaller.lnk
2015-04-13 15:17 - 2015-04-13 15:17 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2015-04-12 11:15 - 2015-04-12 11:16 - 00035791 _____ () C:\Users\Dominik\Downloads\Addition.txt
2015-04-12 11:13 - 2015-04-25 12:08 - 00019195 _____ () C:\Users\Dominik\Downloads\FRST.txt
2015-04-12 11:13 - 2015-04-25 12:08 - 00000000 ____D () C:\FRST
2015-04-12 11:13 - 2015-04-24 17:46 - 02099712 _____ (Farbar) C:\Users\Dominik\Downloads\FRST64.exe
2015-04-08 21:33 - 2015-04-08 21:35 - 00000000 ____D () C:\Windows\SysWOW64\vbox
2015-04-08 21:33 - 2015-04-08 21:35 - 00000000 ____D () C:\Windows\system32\vbox
2015-04-08 21:33 - 2015-04-08 21:33 - 00000000 ____D () C:\Users\Dominik\AppData\Roaming\AVAST Software
2015-04-08 21:32 - 2015-04-08 21:32 - 00001926 _____ () C:\Users\Public\Desktop\Avast Free Antivirus.lnk
2015-04-08 21:32 - 2015-04-08 21:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2015-04-08 21:31 - 2015-04-24 17:49 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2015-04-08 21:31 - 2015-04-08 21:31 - 01047320 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswSnx.sys
2015-04-08 21:31 - 2015-04-08 21:31 - 00442264 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswSP.sys
2015-04-08 21:31 - 2015-04-08 21:31 - 00364472 _____ (Avast Software s.r.o.) C:\Windows\system32\aswBoot.exe
2015-04-08 21:31 - 2015-04-08 21:31 - 00271200 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2015-04-08 21:31 - 2015-04-08 21:31 - 00136752 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswStm.sys
2015-04-08 21:31 - 2015-04-08 21:31 - 00093528 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswRdr2.sys
2015-04-08 21:31 - 2015-04-08 21:31 - 00088408 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswMonFlt.sys
2015-04-08 21:31 - 2015-04-08 21:31 - 00065736 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2015-04-08 21:31 - 2015-04-08 21:31 - 00043112 _____ (Avast Software s.r.o.) C:\Windows\avastSS.scr
2015-04-08 21:31 - 2015-04-08 21:31 - 00029168 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2015-04-08 21:30 - 2015-04-08 21:30 - 00000000 ____D () C:\Program Files\AVAST Software
2015-04-08 21:27 - 2015-04-24 17:46 - 00000000 ____D () C:\Users\Dominik\Downloads\backups
2015-04-08 21:17 - 2015-04-08 21:17 - 00012680 _____ () C:\Users\Dominik\Desktop\hijackthis.log
2015-04-08 21:16 - 2015-04-08 21:16 - 00388608 _____ (Trend Micro Inc.) C:\Users\Dominik\Downloads\HiJackThis204 (1).exe
2015-04-08 21:04 - 2015-04-08 21:04 - 00442264 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\spgxhfjh.sys
2015-04-08 21:03 - 2015-04-08 21:29 - 00000000 ____D () C:\ProgramData\AVAST Software
2015-04-08 21:03 - 2015-04-08 21:03 - 00442264 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\ieztnrhr.sys
2015-04-08 21:00 - 2015-04-08 21:01 - 150062624 _____ (Avast Software s.r.o.) C:\Users\Dominik\Downloads\avast_free_antivirus_setup_10.2.2215.exe
2015-04-08 01:34 - 2015-04-09 16:52 - 00000657 _____ () C:\Users\Dominik\Desktop\Neues Textdokument.txt
2015-04-03 14:55 - 2015-04-12 19:31 - 00000004 _____ () C:\Windows\SysWOW64\029B560A371F4E00AB32838EBC01B9E7
2015-03-26 20:50 - 2015-03-04 09:26 - 00596480 _____ (Microsoft Corporation) C:\Windows\system32\AutoUpdate.exe
2015-03-26 20:50 - 2015-03-04 09:26 - 00467952 _____ (Microsoft Corporation) C:\Windows\system32\NotificationUI.exe
2015-03-26 20:50 - 2015-03-04 09:26 - 00011105 _____ () C:\Windows\system32\AutoconfigV2.cab
2015-03-26 20:50 - 2015-03-04 08:41 - 00695808 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll
2015-03-26 20:50 - 2015-03-04 08:41 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2015-03-26 20:50 - 2015-03-04 06:53 - 00568832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll
2015-03-26 20:50 - 2015-03-04 06:53 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-25 12:07 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\system32\sru
2015-04-24 17:49 - 2013-02-15 11:33 - 00001136 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-04-24 17:48 - 2012-07-26 09:22 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-04-24 17:48 - 2012-07-26 07:26 - 00262144 ___SH () C:\Windows\system32\config\BBI
2015-04-24 00:27 - 2013-02-15 11:33 - 00001140 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-04-23 16:26 - 2014-12-29 12:29 - 00000000 ____D () C:\Users\Dominik\Desktop\Musik
2015-04-23 15:35 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\AppCompat
2015-04-21 13:40 - 2012-12-25 16:33 - 00753134 _____ () C:\Windows\system32\perfh007.dat
2015-04-21 13:40 - 2012-12-25 16:33 - 00155826 _____ () C:\Windows\system32\perfc007.dat
2015-04-21 13:40 - 2012-07-26 09:28 - 01745416 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-04-20 09:27 - 2013-02-18 11:19 - 00000000 ____D () C:\Users\Dominik\AppData\Local\CrashDumps
2015-04-17 15:21 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\rescache
2015-04-16 23:28 - 2014-12-13 10:36 - 00000000 ____D () C:\Windows\system32\appraiser
2015-04-16 23:28 - 2014-08-01 00:00 - 00000000 ___SD () C:\Windows\system32\CompatTel
2015-04-16 19:50 - 2012-07-26 09:59 - 00000000 ____D () C:\Windows\CbsTemp
2015-04-16 19:49 - 2013-11-10 23:50 - 00000000 ____D () C:\Windows\system32\MRT
2015-04-16 19:46 - 2013-02-17 22:32 - 128913832 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-04-15 21:28 - 2013-02-15 11:33 - 00002139 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-04-14 00:07 - 2014-07-25 23:36 - 00791520 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-04-14 00:07 - 2014-07-25 23:36 - 00177632 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-04-13 16:03 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\Registration
2015-04-11 11:51 - 2013-02-13 00:22 - 00000000 ____D () C:\Users\Dominik
2015-04-08 22:54 - 2013-02-14 06:55 - 00003600 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2931490297-3027747817-2233262723-1002
2015-04-08 21:17 - 2013-02-13 00:22 - 00000000 ____D () C:\Users\Dominik\AppData\Local\VirtualStore
2015-04-08 21:13 - 2012-11-02 05:33 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2015-04-08 21:13 - 2012-11-02 05:33 - 00000000 ____D () C:\ProgramData\WildTangent
2015-04-08 21:12 - 2013-02-13 00:23 - 00001446 _____ () C:\Users\Dominik\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-04-03 16:51 - 2014-04-28 16:35 - 00000000 ____D () C:\Users\Dominik\Desktop\Muay Thai
2015-04-03 16:21 - 2014-12-17 08:55 - 00000000 ____D () C:\Users\Dominik\Desktop\Bewerbungen
2015-03-30 12:46 - 2013-02-15 17:54 - 00000000 ____D () C:\Users\Dominik\AppData\Local\Deployment
2015-03-29 22:05 - 2015-03-19 23:49 - 00000000 ____D () C:\Users\Dominik\Desktop\Stefan
2015-03-26 20:55 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\WinStore

==================== Files in the root of some directories =======

2012-12-25 08:00 - 2012-12-25 08:00 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-04-23 10:58

==================== End Of Log ============================

--- --- ---

schrauber · 25.04.2015, 19:30

Noch Probleme?

25.04.2015, 19:30	#10
schrauber /// the machine /// TB-Ausbilder	Windows 8: Ungewollte Help4U Benachrichtigungen Noch Probleme? __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

Windows 8: Ungewollte Help4U Benachrichtigungen

Plagegeister aller Art und deren Bekämpfung: Windows 8: Ungewollte Help4U Benachrichtigungen