[Win7] Browser-Redirects zu fake "Java Update"

bowiewowie · 14.04.2014, 21:29

Hallo zusammen,

ich habe dasselbe Problem wie in diesem Thread:

http://www.trojaner-board.de/150103-...n-updates.html

das heißt wenn ich im Internet surfe legt sich irgendwann ein Layer über mein Bild mit der Meldung ich solle ein (fake) Java Update ausführen. Zum Glück hab ich erst gegooglet und nichts geöffnet.

Hier meine Logfiles, zu jedem Scan noch ein kurzes Detail. Bevor ich die Standardprozedur im "Hilfesuchthread" gestartet habe, habe ich vorab mit Eset und ComboFix gescannt.

Hier meine Logs:

1.Eset - hat 4 infizierte Dateien gefunden

Code:

ATTFilter

C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\_Setupx.dll	a variant of Win32/Adware.Yontoo.B application
C:\Users\All Users\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\_Setupx.dll	a variant of Win32/Adware.Yontoo.B application
C:\Users\BBQPitBoyz\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00044e	HTML/ScrInject.B.Gen virus
C:\Users\BBQPitBoyz\AppData\Local\Mozilla\Firefox\Profiles\t4p4ixn4.default\Cache\E\92\C0EDBd01	HTML/ScrInject.B.Gen virus

2.ComboFix - hat mir kurz nach Scanstart den Fehler ""pev.3xe" funktioniert nicht mehr" gebracht. Wenn ich mehrmals auf "Programm beenden" geklickt habe hat er weiter gescannt.Ich weiß nicht ob die Logfile brauchbar ist.

Code:

ATTFilter

ComboFix 14-04-12.01 - BBQPitBoyz 14.04.2014  20:30:31.1.4 - x64
Microsoft Windows 7 Professional   6.1.7601.1.1252.49.1031.18.8132.5621 [GMT 2:00]
ausgeführt von:: c:\users\BBQPitBoyz\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
SP: Spybot - Search and Destroy *Disabled/Updated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\BBQPitBoyz\Default.SFX
c:\users\BBQPitBoyz\Default64.SFX
c:\users\BBQPitBoyz\WinCon.SFX
c:\users\BBQPitBoyz\WinCon64.SFX
c:\users\BBQPitBoyz\Zip.SFX
c:\users\BBQPitBoyz\Zip64.SFX
.
.
(((((((((((((((((((((((   Dateien erstellt von 2014-03-14 bis 2014-04-14  ))))))))))))))))))))))))))))))
.
.
2014-04-14 18:33 . 2014-04-14 18:33	--------	d-----w-	c:\users\Default\AppData\Local\temp
2014-04-13 18:07 . 2014-04-13 18:07	96168	----a-w-	c:\windows\SysWow64\WindowsAccessBridge-32.dll
2014-04-13 17:57 . 2014-04-13 17:59	--------	d-----w-	c:\programdata\IePluginService
2014-04-13 17:57 . 2014-04-13 17:57	--------	d-----w-	c:\program files (x86)\SupTab
2014-04-13 17:57 . 2014-04-13 17:57	--------	d-----w-	c:\users\BBQPitBoyz\AppData\Roaming\SupTab
2014-04-13 17:57 . 2014-04-13 17:57	--------	d-----w-	c:\programdata\WPM
2014-04-13 17:57 . 2014-04-13 17:57	--------	d-----w-	c:\users\BBQPitBoyz\AppData\Roaming\sweet-page
2014-04-13 17:57 . 2014-04-13 17:57	--------	d-----w-	c:\program files (x86)\BrowseMark
2014-04-13 17:41 . 2014-04-13 17:41	--------	d-----w-	c:\program files (x86)\Common Files\Java
2014-04-13 12:37 . 2014-04-13 12:37	--------	d-----w-	c:\users\BBQPitBoyz\AppData\Roaming\Krautscape
2014-04-12 07:17 . 2014-03-07 04:43	10521840	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{8EE775F2-D5C9-4147-8B18-828F3C493F39}\mpengine.dll
2014-04-11 21:53 . 2014-04-11 21:53	--------	d-sh--w-	c:\users\BBQPitBoyz\AppData\Local\EmieUserList
2014-04-11 21:53 . 2014-04-11 21:53	--------	d-sh--w-	c:\users\BBQPitBoyz\AppData\Local\EmieSiteList
2014-04-10 04:18 . 2014-02-04 02:35	190912	----a-w-	c:\windows\system32\drivers\storport.sys
2014-04-08 15:59 . 2014-04-08 15:59	--------	d-----w-	c:\users\BBQPitBoyz\AppData\Roaming\AVAST Software
2014-04-08 04:59 . 2014-04-13 17:38	312728	----a-w-	c:\windows\system32\javaws.exe
2014-04-08 04:59 . 2014-04-13 17:38	111000	----a-w-	c:\windows\system32\WindowsAccessBridge-64.dll
2014-04-08 04:59 . 2014-04-13 17:38	191384	----a-w-	c:\windows\system32\javaw.exe
2014-04-08 04:59 . 2014-04-13 17:37	190872	----a-w-	c:\windows\system32\java.exe
2014-04-08 04:59 . 2014-04-13 18:06	--------	d-----w-	c:\program files\Java
2014-04-08 04:46 . 2014-04-08 04:46	84816	----a-w-	c:\windows\system32\drivers\aswStm.sys
2014-04-08 04:46 . 2014-04-08 04:46	43152	----a-w-	c:\windows\avastSS.scr
2014-03-28 20:20 . 2014-04-14 15:52	--------	d-----r-	c:\users\BBQPitBoyz\Dropbox
2014-03-28 20:19 . 2014-04-14 15:52	--------	d-----w-	c:\users\BBQPitBoyz\AppData\Roaming\Dropbox
2014-03-22 21:20 . 2014-03-22 21:20	--------	d-----w-	c:\users\BBQPitBoyz\AppData\Local\AlbumArtDownloader
2014-03-22 21:20 . 2014-03-22 21:20	--------	d-----w-	c:\program files\AlbumArtDownloader
2014-03-22 07:56 . 2014-03-22 07:56	--------	d-----w-	c:\users\BBQPitBoyz\AppData\Local\Skype
2014-03-22 07:56 . 2014-03-22 07:56	--------	d-----w-	c:\program files (x86)\Common Files\Skype
2014-03-22 07:56 . 2014-03-22 07:56	--------	d-----r-	c:\program files (x86)\Skype
2014-03-21 20:20 . 2014-03-21 20:21	--------	d-----w-	c:\users\BBQPitBoyz\AppData\Local\Arma 3
2014-03-21 20:20 . 2014-03-21 20:20	--------	d-----w-	c:\programdata\Bohemia Interactive
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-04-13 15:51 . 2013-04-18 21:47	214392	----a-w-	c:\windows\SysWow64\PnkBstrB.exe
2014-04-13 15:42 . 2013-04-18 21:47	214392	----a-w-	c:\windows\SysWow64\PnkBstrB.ex0
2014-04-12 07:35 . 2013-04-17 15:36	70832	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-04-12 07:35 . 2013-04-17 15:36	692400	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2014-04-10 04:28 . 2013-11-09 20:51	90655440	----a-w-	c:\windows\system32\MRT.exe
2014-04-08 04:46 . 2013-04-17 15:09	93568	----a-w-	c:\windows\system32\drivers\aswRdr2.sys
2014-04-08 04:46 . 2013-04-17 15:09	79184	----a-w-	c:\windows\system32\drivers\aswMonFlt.sys
2014-04-08 04:46 . 2013-04-17 15:09	65776	----a-w-	c:\windows\system32\drivers\aswRvrt.sys
2014-04-08 04:46 . 2013-04-17 15:09	423240	----a-w-	c:\windows\system32\drivers\aswSP.sys
2014-04-08 04:46 . 2013-04-17 15:09	334648	----a-w-	c:\windows\system32\aswBoot.exe
2014-04-08 04:46 . 2013-04-17 15:09	208928	----a-w-	c:\windows\system32\drivers\aswVmm.sys
2014-04-08 04:46 . 2013-04-17 15:09	1039096	----a-w-	c:\windows\system32\drivers\aswSnx.sys
2014-03-04 09:17 . 2014-04-10 04:18	44032	----a-w-	c:\windows\apppatch\acwow64.dll
2014-02-07 01:23 . 2014-03-13 19:50	3156480	----a-w-	c:\windows\system32\win32k.sys
2014-02-04 02:32 . 2014-03-13 19:48	1424384	----a-w-	c:\windows\system32\WindowsCodecs.dll
2014-02-04 02:32 . 2014-03-13 19:48	624128	----a-w-	c:\windows\system32\qedit.dll
2014-02-04 02:04 . 2014-03-13 19:48	1230336	----a-w-	c:\windows\SysWow64\WindowsCodecs.dll
2014-02-04 02:04 . 2014-03-13 19:48	509440	----a-w-	c:\windows\SysWow64\qedit.dll
2014-01-29 02:32 . 2014-03-13 19:50	484864	----a-w-	c:\windows\system32\wer.dll
2014-01-29 02:06 . 2014-03-13 19:50	381440	----a-w-	c:\windows\SysWow64\wer.dll
2014-01-28 02:32 . 2014-03-13 19:50	228864	----a-w-	c:\windows\system32\wwansvc.dll
2014-01-22 07:52 . 2014-01-22 07:52	206080	----a-w-	c:\windows\system32\drivers\ssudmdm.sys
2014-01-22 07:52 . 2014-01-22 07:52	108800	----a-w-	c:\windows\system32\drivers\ssudbus.sys
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}]
2014-04-11 02:07	513648	----a-w-	c:\program files (x86)\SupTab\SupTab.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{bff3225c-247b-41b3-8ec7-0724c8618e03}]
2014-03-11 18:25	249632	----a-w-	c:\program files (x86)\BrowseMark\BrowseMarkBHO.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro1 (ErrorConflict)]
@="{8BA85C75-763B-4103-94EB-9470F12FE0F7}"
[HKEY_CLASSES_ROOT\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7}]
2014-03-12 18:13	1728216	----a-w-	c:\progra~2\MICROS~1\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro2 (SyncInProgress)]
@="{CD55129A-B1A1-438E-A425-CEBC7DC684EE}"
[HKEY_CLASSES_ROOT\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE}]
2014-03-12 18:13	1728216	----a-w-	c:\progra~2\MICROS~1\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro3 (InSync)]
@="{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}"
[HKEY_CLASSES_ROOT\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}]
2014-03-12 18:13	1728216	----a-w-	c:\progra~2\MICROS~1\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09	131248	----a-w-	c:\users\BBQPitBoyz\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09	131248	----a-w-	c:\users\BBQPitBoyz\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09	131248	----a-w-	c:\users\BBQPitBoyz\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2013-03-14 3672640]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
"Screenpresso"="c:\users\BBQPitBoyz\AppData\Local\Learnpulse\Screenpresso\Screenpresso.exe" [2014-03-12 10256912]
"puush"="c:\program files (x86)\puush\puush.exe" [2014-01-08 567880]
"GoogleChromeAutoLaunch_EF836093D41F1E88A6425FE21F6CFE69"="c:\users\BBQPitBoyz\AppData\Local\Google\Chrome\Application\chrome.exe" [2014-04-02 841032]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2014-02-10 20922016]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe" [2012-09-12 56128]
"ControlCenter3"="c:\program files (x86)\Brother\ControlCenter3\brctrcen.exe" [2008-12-24 114688]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe" [2013-11-07 766208]
"PDFPrint"="c:\program files (x86)\PDF24\pdf24.exe" [2013-10-28 185896]
"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2014-04-08 3854640]
.
c:\users\BBQPitBoyz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Core Temp.exe [2013-3-1 763856]
CoreTemp.ini [2013-12-9 1237]
Dropbox.lnk - c:\users\BBQPitBoyz\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2014-3-28 32667896]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
"AppInit_DLLs"=c:\progra~2\SupTab\SearchProtect32.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute	REG_MULTI_SZ   	autocheck autochk *\0sdnclean64.exe
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 IAStorDataMgrSvc;Intel(R) Rapid Storage-Technologie;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
R2 IePluginService;IePlugin Service;c:\programdata\IePluginService\PluginService.exe;c:\programdata\IePluginService\PluginService.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R2 Wpm;Wpm Service;c:\programdata\WPM\wprotectmanager.exe;c:\programdata\WPM\wprotectmanager.exe [x]
R3 AsrCDDrv;AsrCDDrv;c:\windows\SysWOW64\Drivers\AsrCDDrv.sys;c:\windows\SysWOW64\Drivers\AsrCDDrv.sys [x]
R3 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys;c:\windows\SYSNATIVE\drivers\aswStm.sys [x]
R3 CGVPNCliSrvc;CyberGhost VPN Client;c:\program files\CyberGhost VPN\CGVPNCliService.exe;c:\program files\CyberGhost VPN\CGVPNCliService.exe [x]
R3 cpuz136;cpuz136;c:\windows\TEMP\cpuz136\cpuz136_x64.sys;c:\windows\TEMP\cpuz136\cpuz136_x64.sys [x]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 Futuremark SystemInfo Service;Futuremark SystemInfo Service;c:\program files (x86)\Futuremark\Futuremark SystemInfo\FMSISvc.exe;c:\program files (x86)\Futuremark\Futuremark SystemInfo\FMSISvc.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\drivers\nusb3hub.sys;c:\windows\SYSNATIVE\drivers\nusb3hub.sys [x]
R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\drivers\nusb3xhc.sys;c:\windows\SYSNATIVE\drivers\nusb3xhc.sys [x]
R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 ssudmdm;SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 vtcdrv;VTC Driver v5.0.0.3;c:\windows\system32\DRIVERS\vtcdrv.sys;c:\windows\SYSNATIVE\DRIVERS\vtcdrv.sys [x]
S0 aswRvrt;avast! Revert; [x]
S0 aswVmm;avast! VM Monitor; [x]
S0 iaStorA;iaStorA;c:\windows\system32\DRIVERS\iaStorA.sys;c:\windows\SYSNATIVE\DRIVERS\iaStorA.sys [x]
S0 iaStorF;iaStorF;c:\windows\system32\DRIVERS\iaStorF.sys;c:\windows\SYSNATIVE\DRIVERS\iaStorF.sys [x]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys;c:\windows\SYSNATIVE\drivers\aswSnx.sys [x]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys;c:\windows\SYSNATIVE\drivers\aswSP.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]
S2 HiPatchService;Hi-Rez Studios Authenticate and Update Service;s:\gamez\Tribes Ascend\HiPatchService.exe;s:\gamez\Tribes Ascend\HiPatchService.exe [x]
S3 ALSysIO;ALSysIO;c:\users\BBQPIT~1\AppData\Local\Temp\ALSysIO64.sys;c:\users\BBQPIT~1\AppData\Local\Temp\ALSysIO64.sys [x]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]
S3 MBfilt;MBfilt;c:\windows\system32\drivers\MBfilt64.sys;c:\windows\SYSNATIVE\drivers\MBfilt64.sys [x]
S3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys;c:\windows\SYSNATIVE\DRIVERS\point64.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2014-04-14 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-07-15 07:35]
.
2014-04-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-04-22 19:50]
.
2014-04-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-04-22 19:50]
.
2014-04-14 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2923481869-3162173556-2377066677-1000Core.job
- c:\users\BBQPitBoyz\AppData\Local\Google\Update\GoogleUpdate.exe [2013-09-19 10:00]
.
2014-04-14 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2923481869-3162173556-2377066677-1000UA.job
- c:\users\BBQPitBoyz\AppData\Local\Google\Update\GoogleUpdate.exe [2013-09-19 10:00]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro1 (ErrorConflict)]
@="{8BA85C75-763B-4103-94EB-9470F12FE0F7}"
[HKEY_CLASSES_ROOT\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7}]
2014-03-12 18:10	2333400	----a-w-	c:\progra~1\MICROS~3\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro2 (SyncInProgress)]
@="{CD55129A-B1A1-438E-A425-CEBC7DC684EE}"
[HKEY_CLASSES_ROOT\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE}]
2014-03-12 18:10	2333400	----a-w-	c:\progra~1\MICROS~3\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro3 (InSync)]
@="{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}"
[HKEY_CLASSES_ROOT\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}]
2014-03-12 18:10	2333400	----a-w-	c:\progra~1\MICROS~3\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2014-04-08 04:46	290888	----a-w-	c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09	164016	----a-w-	c:\users\BBQPitBoyz\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09	164016	----a-w-	c:\users\BBQPitBoyz\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09	164016	----a-w-	c:\users\BBQPitBoyz\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09	164016	----a-w-	c:\users\BBQPitBoyz\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2012-07-13 12936848]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2011-08-01 2417032]
"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2010-07-21 2306448]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\progra~2\SupTab\SearchProtect64.dll
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.sweet-page.com/?type=hp&ts=1397411834&from=cor&uid=SamsungXSSDX840XSeries_S14CNEAD305402K
mDefault_Search_URL = hxxp://www.sweet-page.com/web/?type=ds&ts=1397411834&from=cor&uid=SamsungXSSDX840XSeries_S14CNEAD305402K&q={searchTerms}
mDefault_Page_URL = hxxp://www.sweet-page.com/?type=hp&ts=1397411834&from=cor&uid=SamsungXSSDX840XSeries_S14CNEAD305402K
mStart Page = hxxp://www.sweet-page.com/?type=hp&ts=1397411834&from=cor&uid=SamsungXSSDX840XSeries_S14CNEAD305402K
mLocal Page = c:\windows\SysWOW64\blank.htm
mSearch Page = hxxp://www.sweet-page.com/web/?type=ds&ts=1397411834&from=cor&uid=SamsungXSSDX840XSeries_S14CNEAD305402K&q={searchTerms}
IE: An OneNote s&enden - c:\progra~1\MICROS~3\Office15\ONBttnIE.dll/105
IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MICROS~3\Office15\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.0.1
Filter: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - c:\program files (x86)\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL
FF - ProfilePath - c:\users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.sweet-page.com/?type=hppp&ts=1397451764&from=cor&uid=SamsungXSSDX840XSeries_S14CNEAD305402K
FF - prefs.js: network.proxy.type - 0
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
AddRemove-5513-1208-7298-9440 - c:\program files (x86)\JDownloader\JDUninstall.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-2923481869-3162173556-2377066677-1000\Software\SecuROM\License information*]
"datasecu"=hex:e3,83,e3,5f,20,73,ee,15,e7,fc,88,07,22,06,87,56,d8,9d,d4,db,1b,
   8b,92,8d,66,66,18,65,24,42,13,02,4f,27,c1,f8,75,05,e9,f1,29,27,83,5d,59,1d,\
"rkeysecu"=hex:5b,b5,24,50,93,e4,52,d9,04,b2,c6,1f,89,5e,58,ee
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-04-14  20:34:59
ComboFix-quarantined-files.txt  2014-04-14 18:34
.
Vor Suchlauf: 15 Verzeichnis(se), 53.475.594.240 Bytes frei
Nach Suchlauf: 19 Verzeichnis(se), 53.930.696.704 Bytes frei
.
- - End Of File - - 3AB1BC0149380908CCA79CCA5AD6CD3B
A36C5E4F47E84449FF07ED3517B43A31

3.Defogger - hat mir hier keine Fehlermeldung gebracht, dennoch gab er mir nur die "defogger_disable" zum abspeichern.

Code:

ATTFilter

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 21:50 on 14/04/2014 (BBQPitBoyz)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-

4.FRST64 - ohne Probleme

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 14-04-2014
Ran by BBQPitBoyz (administrator) on BBQPITBOYZ-PC on 14-04-2014 21:51:32
Running from C:\Users\BBQPitBoyz\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Hi-Rez Studios) S:\GaMeZ\Tribes Ascend\HiPatchService.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Microsoft Corporation) C:\Program Files\Microsoft IntelliPoint\ipoint.exe
(Microsoft Corporation) C:\Program Files\Microsoft IntelliType Pro\itype.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
() C:\Program Files (x86)\puush\puush.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.23.9\GoogleCrashHandler.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.23.9\GoogleCrashHandler64.exe
(Disc Soft Ltd) C:\Program Files (x86)\DAEMON Tools Lite\DTShellHlp.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_182.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_182.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12936848 2012-07-13] (Realtek Semiconductor)
HKLM\...\Run: [IntelliPoint] => C:\Program Files\Microsoft IntelliPoint\ipoint.exe [2417032 2011-08-01] (Microsoft Corporation)
HKLM\...\Run: [itype] => C:\Program Files\Microsoft IntelliType Pro\itype.exe [2306448 2010-07-21] (Microsoft Corporation)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [285240 2012-09-01] (Intel Corporation)
HKLM-x32\...\Run: [ControlCenter3] => C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-11-07] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [185896 2013-10-28] (Geek Software GmbH)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [3854640 2014-04-08] (AVAST Software)
HKU\S-1-5-21-2923481869-3162173556-2377066677-1000\...\Run: [Sidebar] => C:\Program Files\Windows Sidebar\sidebar.exe [1475584 2010-11-21] (Microsoft Corporation)
HKU\S-1-5-21-2923481869-3162173556-2377066677-1000\...\Run: [Screenpresso] => C:\Users\BBQPitBoyz\AppData\Local\Learnpulse\Screenpresso\Screenpresso.exe [10256912 2014-03-12] (Learnpulse)
HKU\S-1-5-21-2923481869-3162173556-2377066677-1000\...\Run: [puush] => C:\Program Files (x86)\puush\puush.exe [567880 2014-01-08] ()
HKU\S-1-5-21-2923481869-3162173556-2377066677-1000\...\Run: [GoogleChromeAutoLaunch_EF836093D41F1E88A6425FE21F6CFE69] => C:\Users\BBQPitBoyz\AppData\Local\Google\Chrome\Application\chrome.exe [841032 2014-04-02] (Google Inc.)
HKU\S-1-5-21-2923481869-3162173556-2377066677-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [20922016 2014-02-10] (Skype Technologies S.A.)
AppInit_DLLs: C:\PROGRA~2\SupTab\SearchProtect64.dll => C:\Program Files (x86)\SupTab\SearchProtect64.dll [102512 2014-04-02] (Skytech Co., Ltd.)
AppInit_DLLs-x32: C:\PROGRA~2\SupTab\SearchProtect32.dll => C:\Program Files (x86)\SupTab\SearchProtect32.dll [91248 2014-04-02] (Skytech Co., Ltd.)
Startup: C:\Users\BBQPitBoyz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Core Temp.exe ()
Startup: C:\Users\BBQPitBoyz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CoreTemp.ini ()

==================== Internet (Whitelisted) ====================

ProxyServer: :0
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.sweet-page.com/?type=hp&ts=1397411834&from=cor&uid=SamsungXSSDX840XSeries_S14CNEAD305402K
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.sweet-page.com/?type=hp&ts=1397411834&from=cor&uid=SamsungXSSDX840XSeries_S14CNEAD305402K
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.sweet-page.com/web/?type=ds&ts=1397411834&from=cor&uid=SamsungXSSDX840XSeries_S14CNEAD305402K&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.sweet-page.com/?type=hp&ts=1397411834&from=cor&uid=SamsungXSSDX840XSeries_S14CNEAD305402K
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.sweet-page.com/?type=hp&ts=1397411834&from=cor&uid=SamsungXSSDX840XSeries_S14CNEAD305402K
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.sweet-page.com/web/?type=ds&ts=1397411834&from=cor&uid=SamsungXSSDX840XSeries_S14CNEAD305402K&q={searchTerms}
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.sweet-page.com/web/?type=ds&ts=1397411834&from=cor&uid=SamsungXSSDX840XSeries_S14CNEAD305402K&q={searchTerms}
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=ironmsd04&cd=2XzuyEtN2Y1L1Qzu0B0CyD0F0FyEzz0ByBzz0AzyzzyD0AzztN0D0Tzu0SyEyBtAtN1L2XzutBtFtBtFtCtFyDtCyDtN1L1Czu1L1C1F1G1H1B1QtDyE&cr=1744334573&ir=
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.sweet-page.com/web/?type=ds&ts=1397411834&from=cor&uid=SamsungXSSDX840XSeries_S14CNEAD305402K&q={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.sweet-page.com/web/?type=ds&ts=1397411834&from=cor&uid=SamsungXSSDX840XSeries_S14CNEAD305402K&q={searchTerms}
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=ironmsd04&cd=2XzuyEtN2Y1L1Qzu0B0CyD0F0FyEzz0ByBzz0AzyzzyD0AzztN0D0Tzu0SyEyBtAtN1L2XzutBtFtBtFtCtFyDtCyDtN1L1Czu1L1C1F1G1H1B1QtDyE&cr=1744334573&ir=
SearchScopes: HKLM-x32 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.sweet-page.com/web/?type=ds&ts=1397411834&from=cor&uid=SamsungXSSDX840XSeries_S14CNEAD305402K&q={searchTerms}
SearchScopes: HKCU - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://search.conduit.com/Results.aspx?ctid=CT3314932&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=2&UP=SP197F600C-D7D3-4C8D-B08A-1D88BCB624D9&q={searchTerms}
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=ironmsd04&cd=2XzuyEtN2Y1L1Qzu0B0CyD0F0FyEzz0ByBzz0AzyzzyD0AzztN0D0Tzu0SyEyBtAtN1L2XzutBtFtBtFtCtFyDtCyDtN1L1Czu1L1C1F1G1H1B1QtDyE&cr=1744334573&ir=
SearchScopes: HKCU - {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL = 
BHO: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre8\bin\ssv.dll (Oracle Corporation)
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre8\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO-x32: IETabPage Class - {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} - C:\Program Files (x86)\SupTab\SupTab.dll (Thinknice Co. Limited)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: BrowseMark - {bff3225c-247b-41b3-8ec7-0724c8618e03} - C:\Program Files (x86)\BrowseMark\BrowseMarkbho.dll (BrowseMark)
BHO-x32: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  No File
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL (Microsoft Corporation)
Handler: saphtmlp - {D1F8BD1E-7967-11D2-B43A-006094B9EADB} -  No File
Handler: sapr3 - {D1F8BD1E-7967-11D2-B43A-006094B9EADB} -  No File
Handler-x32: saphtmlp - {D1F8BD1E-7967-11D2-B43A-006094B9EADB} - s:\programme\sapgui\saphtmlp.dll (SAP, Walldorf)
Handler-x32: sapr3 - {D1F8BD1E-7967-11D2-B43A-006094B9EADB} - s:\programme\sapgui\saphtmlp.dll (SAP, Walldorf)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default
FF NewTab: chrome://quick_start/content/index.html
FF Homepage: hxxp://www.sweet-page.com/?type=hppp&ts=1397451764&from=cor&uid=SamsungXSSDX840XSeries_S14CNEAD305402K
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_182.dll ()
FF Plugin: @java.com/DTPlugin,version=11.0.2 - C:\Program Files\Java\jre8\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.0.2 - C:\Program Files\Java\jre8\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MICROS~3\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.6 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_182.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1210150.dll (Adobe Systems, Inc.)
FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=2.1.4 - C:\Program Files (x86)\Battlelog Web Plugins\2.1.4\npesnlaunch.dll No File
FF Plugin-x32: @esn/npbattlelog,version=2.3.1 - C:\Program Files (x86)\Battlelog Web Plugins\2.3.1\npbattlelog.dll (EA Digital Illusions CE AB)
FF Plugin-x32: @esn/npbattlelog,version=2.3.2 - C:\Program Files (x86)\Battlelog Web Plugins\2.3.2\npbattlelog.dll (EA Digital Illusions CE AB)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 - C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @stonetrip.com/ShiVaWebPlayer,version=1.8.0.0 - C:\Users\BBQPitBoyz\AppData\Roaming\..\LocalLow\StoneTrip\Web Player\npShiVa3D.dll (StoneTrip)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\BBQPitBoyz\AppData\Local\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\BBQPitBoyz\AppData\Local\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\BBQPitBoyz\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\searchplugins\11-suche.xml
FF SearchPlugin: C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\searchplugins\BrowserProtect.xml
FF SearchPlugin: C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\searchplugins\claro.xml
FF SearchPlugin: C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\searchplugins\lastminute.xml
FF SearchPlugin: C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\searchplugins\webde-suche.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\sweet-page.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Flash Video Downloader - Full HD Download - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\artur.dubovoy@gmail.com [2014-03-09]
FF Extension: German Dictionary - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\de-DE@dictionaries.addons.mozilla.org [2013-08-08]
FF Extension: United States English Spellchecker - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\en-US@dictionaries.addons.mozilla.org [2013-08-08]
FF Extension: Quick Start - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\quick_start@gmail.com [2014-04-14]
FF Extension: No Name - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\staged [2013-09-03]
FF Extension: YouTube Unblocker - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\youtubeunblocker@unblocker.yt [2014-03-14]
FF Extension: WOT - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2013-11-27]
FF Extension: Snip-Me - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\addon@snip-me.de.xpi [2013-04-17]
FF Extension: Add to Amazon Wish List Button - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\amznUWL2@amazon.com.xpi [2013-04-17]
FF Extension: BrowseMark - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\firefox@browsemark.net.xpi [2014-03-11]
FF Extension: Ghostery - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\firefox@ghostery.com.xpi [2013-08-03]
FF Extension: FastestFox - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\smarterwiki@wikiatic.com.xpi [2013-04-17]
FF Extension: Free Hide IP - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\support@free-hideip.com.xpi [2013-05-14]
FF Extension: GMX MailCheck - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\toolbar@gmx.net.xpi [2013-08-15]
FF Extension: YouTube to MP3 - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\youtube2mp3@mondayx.de.xpi [2013-04-17]
FF Extension: {0aa6a016-77fb-4f7b-8db0-f0d8b886339c} - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\{0aa6a016-77fb-4f7b-8db0-f0d8b886339c}.xpi [2013-10-31]
FF Extension: Flagfox - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b}.xpi [2014-03-08]
FF Extension: Unity Web Player Updater Pro - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\{177ad903-e11c-4952-89ac-e019391e0360}.xpi [2013-11-06]
FF Extension: Stylish - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8}.xpi [2013-11-16]
FF Extension: Multirow Bookmarks Toolbar Plus - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\{4c7097f7-08f2-4ef2-9b9f-f95fa4cbb064}.xpi [2013-04-17]
FF Extension: NoScript - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2013-04-17]
FF Extension: ReloadEvery - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\{888d99e7-e8b5-46a3-851e-1ec45da1e644}.xpi [2013-04-17]
FF Extension: Gutscheinaffe - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\{9220f99f-5b7d-4a4d-97ca-209991796400}.xpi [2013-09-03]
FF Extension: StumbleUpon - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\{AE93811A-5C9A-4d34-8462-F7B864FC4696}.xpi [2013-04-17]
FF Extension: SoundCloud Downloader - Technowise - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\{c8d3bc80-0810-4d21-a2c2-be5f2b2832ac}.xpi [2013-10-28]
FF Extension: Adblock Plus - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-02-27]
FF Extension: Multirow Bookmarks Toolbar - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\{FBF6D7FB-F305-4445-BB3D-FEF66579A033}.xpi [2013-04-17]
FF Extension: Adblock Edge - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\{fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi [2013-07-22]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2013-04-17]
FF HKLM-x32\...\Firefox\Extensions: [quick_start@gmail.com] - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\extensions\quick_start@gmail.com
FF Extension: Quick Start - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\extensions\quick_start@gmail.com [2014-04-14]

Chrome: 
=======
CHR HomePage: hxxp://www.sweet-page.com/?type=hp&ts=1397411834&from=cor&uid=SamsungXSSDX840XSeries_S14CNEAD305402K
CHR DefaultSearchKeyword: sweet-page
CHR DefaultSearchProvider: sweet-page
CHR DefaultSearchURL: hxxp://www.sweet-page.com/web/?type=ds&ts=1397411834&from=cor&uid=SamsungXSSDX840XSeries_S14CNEAD305402K&q={searchTerms}
CHR Extension: (Google Wallet) - C:\Users\BBQPitBoyz\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-19]
CHR Extension: (MySearchDial) - C:\Users\BBQPitBoyz\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff [2014-02-01]
CHR HKLM\...\Chrome\Extension: [pflphaooapbgpeakohlggbpidpppgdff] - C:\Users\BBQPIT~1\AppData\Local\mysearchdial.crx [2013-04-18]
CHR HKCU\...\Chrome\Extension: [pflphaooapbgpeakohlggbpidpppgdff] - C:\Users\BBQPIT~1\AppData\Local\mysearchdial.crx [2013-04-18]
CHR HKLM-x32\...\Chrome\Extension: [pflphaooapbgpeakohlggbpidpppgdff] - C:\Users\BBQPIT~1\AppData\Local\mysearchdial.crx [2013-04-18]

==================== Services (Whitelisted) =================

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-04-08] (AVAST Software)
S3 CGVPNCliSrvc; C:\Program Files\CyberGhost VPN\CGVPNCliService.exe [2438696 2012-04-26] (mobile concepts GmbH)
R2 HiPatchService; S:\GaMeZ\Tribes Ascend\HiPatchService.exe [9216 2013-12-13] (Hi-Rez Studios)
S2 IePluginService; C:\ProgramData\IePluginService\PluginService.exe [705136 2014-04-11] (Cherished Technololgy LIMITED)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-10-31] ()
S2 Wpm; C:\ProgramData\WPM\wprotectmanager.exe [566272 2014-04-13] (Cherished Technololgy LIMITED)

==================== Drivers (Whitelisted) ====================

R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-04-08] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-04-08] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-04-08] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1039096 2014-04-08] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423240 2014-04-08] (AVAST Software)
R3 aswStm; C:\Windows\system32\drivers\aswStm.sys [84816 2014-04-08] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [208928 2014-04-08] ()
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2013-04-17] (DT Soft Ltd)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28216 2012-09-01] (Intel Corporation)
S3 vtcdrv; C:\Windows\System32\DRIVERS\vtcdrv.sys [25088 2010-05-17] (Windows (R) Win 7 DDK provider)
R3 ALSysIO; \??\C:\Users\BBQPIT~1\AppData\Local\Temp\ALSysIO64.sys [X]
S3 AsrCDDrv; \??\C:\Windows\SysWOW64\Drivers\AsrCDDrv.sys [X]
U3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 cpuz136; \??\C:\Windows\TEMP\cpuz136\cpuz136_x64.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-04-14 21:51 - 2014-04-14 21:51 - 00025502 _____ () C:\Users\BBQPitBoyz\Desktop\FRST.txt
2014-04-14 21:51 - 2014-04-14 21:51 - 00000000 ____D () C:\FRST
2014-04-14 21:50 - 2014-04-14 21:50 - 02054144 _____ (Farbar) C:\Users\BBQPitBoyz\Desktop\FRST64.exe
2014-04-14 21:48 - 2014-04-14 21:50 - 00000482 _____ () C:\Users\BBQPitBoyz\Desktop\defogger_disable.log
2014-04-14 21:48 - 2014-04-14 21:48 - 00050477 _____ () C:\Users\BBQPitBoyz\Desktop\Defogger.exe
2014-04-14 21:48 - 2014-04-14 21:48 - 00000168 _____ () C:\Users\BBQPitBoyz\defogger_reenable
2014-04-14 21:46 - 2014-04-14 21:46 - 00000724 _____ () C:\Users\BBQPitBoyz\Desktop\eset.txt
2014-04-14 21:43 - 2014-04-14 21:43 - 00027309 _____ () C:\Users\BBQPitBoyz\Desktop\combofix.txt
2014-04-14 20:38 - 2014-04-14 20:38 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-04-14 20:34 - 2014-04-14 20:34 - 00027309 _____ () C:\ComboFix.txt
2014-04-14 20:22 - 2014-04-14 20:22 - 00000085 _____ () C:\Windows\wininit.ini
2014-04-14 20:22 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-04-14 20:22 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-04-14 20:22 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-04-14 20:22 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-04-14 20:22 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-04-14 20:22 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-04-14 20:22 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-04-14 20:22 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-04-14 20:18 - 2014-04-14 20:35 - 00000000 ____D () C:\Qoobox
2014-04-14 20:18 - 2014-04-14 20:34 - 00000000 ____D () C:\Windows\erdnt
2014-04-14 20:14 - 2014-04-14 20:18 - 05194807 ____R (Swearware) C:\Users\BBQPitBoyz\Desktop\ComboFix.exe
2014-04-13 20:07 - 2014-04-13 20:07 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-04-13 20:07 - 2014-04-13 20:07 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-04-13 20:07 - 2014-04-13 20:07 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-04-13 20:07 - 2014-04-13 20:07 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-04-13 19:57 - 2014-04-13 19:59 - 00000000 ____D () C:\ProgramData\IePluginService
2014-04-13 19:57 - 2014-04-13 19:57 - 00000000 ____D () C:\Users\BBQPitBoyz\AppData\Roaming\sweet-page
2014-04-13 19:57 - 2014-04-13 19:57 - 00000000 ____D () C:\Users\BBQPitBoyz\AppData\Roaming\SupTab
2014-04-13 19:57 - 2014-04-13 19:57 - 00000000 ____D () C:\ProgramData\WPM
2014-04-13 19:57 - 2014-04-13 19:57 - 00000000 ____D () C:\Program Files (x86)\SupTab
2014-04-13 19:57 - 2014-04-13 19:57 - 00000000 ____D () C:\Program Files (x86)\BrowseMark
2014-04-13 14:37 - 2014-04-13 14:37 - 00000000 ____D () C:\Users\BBQPitBoyz\AppData\Roaming\Krautscape
2014-04-11 23:53 - 2014-04-11 23:53 - 00000000 __SHD () C:\Users\BBQPitBoyz\AppData\Local\EmieUserList
2014-04-11 23:53 - 2014-04-11 23:53 - 00000000 __SHD () C:\Users\BBQPitBoyz\AppData\Local\EmieSiteList
2014-04-11 07:22 - 2014-03-06 12:21 - 23549440 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-11 07:22 - 2014-03-06 11:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-11 07:22 - 2014-03-06 11:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-04-11 07:22 - 2014-03-06 11:19 - 17387008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-11 07:22 - 2014-03-06 10:59 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-04-11 07:22 - 2014-03-06 10:57 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-04-11 07:22 - 2014-03-06 10:57 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-04-11 07:22 - 2014-03-06 10:53 - 02767360 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-04-11 07:22 - 2014-03-06 10:40 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-04-11 07:22 - 2014-03-06 10:39 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-04-11 07:22 - 2014-03-06 10:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-11 07:22 - 2014-03-06 10:32 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-04-11 07:22 - 2014-03-06 10:29 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-04-11 07:22 - 2014-03-06 10:29 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-04-11 07:22 - 2014-03-06 10:28 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-04-11 07:22 - 2014-03-06 10:15 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-04-11 07:22 - 2014-03-06 10:11 - 05784064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-04-11 07:22 - 2014-03-06 10:09 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-04-11 07:22 - 2014-03-06 10:03 - 00586240 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-04-11 07:22 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-04-11 07:22 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-04-11 07:22 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-04-11 07:22 - 2014-03-06 09:56 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-04-11 07:22 - 2014-03-06 09:48 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-04-11 07:22 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-04-11 07:22 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-04-11 07:22 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-04-11 07:22 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-04-11 07:22 - 2014-03-06 09:42 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-04-11 07:22 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-04-11 07:22 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-04-11 07:22 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-04-11 07:22 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-04-11 07:22 - 2014-03-06 09:21 - 00628736 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-04-11 07:22 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-04-11 07:22 - 2014-03-06 09:11 - 02043904 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-04-11 07:22 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-04-11 07:22 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-04-11 07:22 - 2014-03-06 08:53 - 13551104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-04-11 07:22 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-04-11 07:22 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-04-11 07:22 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-04-11 07:22 - 2014-03-06 08:22 - 02260480 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-04-11 07:22 - 2014-03-06 07:58 - 01400832 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-04-11 07:22 - 2014-03-06 07:50 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-04-11 07:22 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-04-11 07:22 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-04-11 07:22 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-04-10 06:18 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-04-10 06:18 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2014-04-10 06:18 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2014-04-10 06:18 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2014-04-10 06:18 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2014-04-10 06:18 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2014-04-10 06:18 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-04-10 06:18 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2014-04-10 06:18 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2014-04-10 06:18 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2014-04-10 06:18 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2014-04-10 06:18 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2014-04-10 06:18 - 2014-02-04 04:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2014-04-10 06:18 - 2014-02-04 04:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2014-04-10 06:18 - 2014-02-04 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll
2014-04-10 06:18 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll
2014-04-10 06:18 - 2014-01-24 04:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2014-04-08 17:59 - 2014-04-08 17:59 - 00000000 ____D () C:\Users\BBQPitBoyz\AppData\Roaming\AVAST Software
2014-04-08 06:59 - 2014-04-13 20:06 - 00000000 ____D () C:\Program Files\Java
2014-04-08 06:59 - 2014-04-13 19:38 - 00312728 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-04-08 06:59 - 2014-04-13 19:38 - 00191384 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-04-08 06:59 - 2014-04-13 19:38 - 00111000 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2014-04-08 06:59 - 2014-04-13 19:37 - 00190872 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-04-08 06:46 - 2014-04-08 06:46 - 00084816 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2014-04-08 06:46 - 2014-04-08 06:46 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-03-30 16:57 - 2014-03-30 16:58 - 00000000 ____D () C:\Users\BBQPitBoyz\Desktop\Goat.Simulator-DOGE
2014-03-29 09:53 - 2014-03-29 09:53 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-03-28 22:20 - 2014-04-14 17:52 - 00000000 ___RD () C:\Users\BBQPitBoyz\Dropbox
2014-03-28 22:19 - 2014-04-14 20:35 - 00000000 ____D () C:\Users\BBQPitBoyz\AppData\Roaming\Dropbox
2014-03-27 07:50 - 2014-03-27 01:39 - 14358210 _____ () C:\Users\BBQPitBoyz\Desktop\ArnoldHandbLogistik2008.rar
2014-03-22 23:20 - 2014-03-22 23:20 - 00000000 ____D () C:\Users\BBQPitBoyz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Album Art Downloader
2014-03-22 23:20 - 2014-03-22 23:20 - 00000000 ____D () C:\Users\BBQPitBoyz\AppData\Local\AlbumArtDownloader
2014-03-22 23:20 - 2014-03-22 23:20 - 00000000 ____D () C:\Program Files\AlbumArtDownloader
2014-03-22 09:56 - 2014-03-22 09:56 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-03-22 09:56 - 2014-03-22 09:56 - 00000000 ____D () C:\Users\BBQPitBoyz\AppData\Local\Skype
2014-03-21 22:20 - 2014-03-21 22:21 - 00000000 ____D () C:\Users\BBQPitBoyz\AppData\Local\Arma 3
2014-03-21 22:20 - 2014-03-21 22:20 - 00000000 ____D () C:\Users\BBQPitBoyz\Documents\Arma 3
2014-03-21 22:20 - 2014-03-21 22:20 - 00000000 ____D () C:\ProgramData\Bohemia Interactive
2014-03-15 19:23 - 2013-10-17 17:50 - 00000000 ____D () C:\Users\BBQPitBoyz\Desktop\Fuelio Pro v3.0.4

==================== One Month Modified Files and Folders =======

2014-04-14 21:51 - 2014-04-14 21:51 - 00025502 _____ () C:\Users\BBQPitBoyz\Desktop\FRST.txt
2014-04-14 21:51 - 2014-04-14 21:51 - 00000000 ____D () C:\FRST
2014-04-14 21:50 - 2014-04-14 21:50 - 02054144 _____ (Farbar) C:\Users\BBQPitBoyz\Desktop\FRST64.exe
2014-04-14 21:50 - 2014-04-14 21:48 - 00000482 _____ () C:\Users\BBQPitBoyz\Desktop\defogger_disable.log
2014-04-14 21:48 - 2014-04-14 21:48 - 00050477 _____ () C:\Users\BBQPitBoyz\Desktop\Defogger.exe
2014-04-14 21:48 - 2014-04-14 21:48 - 00000168 _____ () C:\Users\BBQPitBoyz\defogger_reenable
2014-04-14 21:48 - 2013-04-17 16:09 - 00000000 ____D () C:\Users\BBQPitBoyz
2014-04-14 21:46 - 2014-04-14 21:46 - 00000724 _____ () C:\Users\BBQPitBoyz\Desktop\eset.txt
2014-04-14 21:43 - 2014-04-14 21:43 - 00027309 _____ () C:\Users\BBQPitBoyz\Desktop\combofix.txt
2014-04-14 21:43 - 2013-04-22 21:50 - 00001118 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-04-14 21:27 - 2013-04-17 21:41 - 00000000 ____D () C:\Users\BBQPitBoyz\AppData\Roaming\Skype
2014-04-14 21:15 - 2013-04-17 17:36 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-04-14 21:13 - 2013-09-19 12:00 - 00001140 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2923481869-3162173556-2377066677-1000UA.job
2014-04-14 21:04 - 2013-04-17 16:10 - 01267762 _____ () C:\Windows\WindowsUpdate.log
2014-04-14 20:38 - 2014-04-14 20:38 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-04-14 20:35 - 2014-04-14 20:18 - 00000000 ____D () C:\Qoobox
2014-04-14 20:35 - 2014-03-28 22:19 - 00000000 ____D () C:\Users\BBQPitBoyz\AppData\Roaming\Dropbox
2014-04-14 20:35 - 2013-04-17 16:09 - 00000000 ___RD () C:\Users\BBQPitBoyz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-04-14 20:35 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default
2014-04-14 20:34 - 2014-04-14 20:34 - 00027309 _____ () C:\ComboFix.txt
2014-04-14 20:34 - 2014-04-14 20:18 - 00000000 ____D () C:\Windows\erdnt
2014-04-14 20:33 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-04-14 20:22 - 2014-04-14 20:22 - 00000085 _____ () C:\Windows\wininit.ini
2014-04-14 20:22 - 2013-06-20 16:59 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-04-14 20:18 - 2014-04-14 20:14 - 05194807 ____R (Swearware) C:\Users\BBQPitBoyz\Desktop\ComboFix.exe
2014-04-14 18:13 - 2013-09-19 12:00 - 00001088 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2923481869-3162173556-2377066677-1000Core.job
2014-04-14 17:57 - 2013-04-18 08:04 - 00710518 _____ () C:\Windows\system32\perfh007.dat
2014-04-14 17:57 - 2013-04-18 08:04 - 00154482 _____ () C:\Windows\system32\perfc007.dat
2014-04-14 17:57 - 2009-07-14 07:13 - 01653072 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-14 17:57 - 2009-07-14 06:45 - 00025872 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-14 17:57 - 2009-07-14 06:45 - 00025872 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-14 17:52 - 2014-03-28 22:20 - 00000000 ___RD () C:\Users\BBQPitBoyz\Dropbox
2014-04-14 17:52 - 2013-04-22 21:50 - 00001114 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-04-14 17:52 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-14 17:52 - 2009-07-14 06:51 - 00100768 _____ () C:\Windows\setupact.log
2014-04-13 22:04 - 2013-04-18 22:16 - 00000000 ____D () C:\ProgramData\Origin
2014-04-13 20:07 - 2014-04-13 20:07 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-04-13 20:07 - 2014-04-13 20:07 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-04-13 20:07 - 2014-04-13 20:07 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-04-13 20:07 - 2014-04-13 20:07 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-04-13 20:07 - 2013-09-14 14:00 - 00000000 ____D () C:\ProgramData\Oracle
2014-04-13 20:07 - 2013-07-02 07:49 - 00000000 ____D () C:\Program Files (x86)\Java
2014-04-13 20:06 - 2014-04-08 06:59 - 00000000 ____D () C:\Program Files\Java
2014-04-13 19:59 - 2014-04-13 19:57 - 00000000 ____D () C:\ProgramData\IePluginService
2014-04-13 19:57 - 2014-04-13 19:57 - 00000000 ____D () C:\Users\BBQPitBoyz\AppData\Roaming\sweet-page
2014-04-13 19:57 - 2014-04-13 19:57 - 00000000 ____D () C:\Users\BBQPitBoyz\AppData\Roaming\SupTab
2014-04-13 19:57 - 2014-04-13 19:57 - 00000000 ____D () C:\ProgramData\WPM
2014-04-13 19:57 - 2014-04-13 19:57 - 00000000 ____D () C:\Program Files (x86)\SupTab
2014-04-13 19:57 - 2014-04-13 19:57 - 00000000 ____D () C:\Program Files (x86)\BrowseMark
2014-04-13 19:38 - 2014-04-08 06:59 - 00312728 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-04-13 19:38 - 2014-04-08 06:59 - 00191384 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-04-13 19:38 - 2014-04-08 06:59 - 00111000 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2014-04-13 19:37 - 2014-04-08 06:59 - 00190872 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-04-13 17:51 - 2013-04-18 23:47 - 00214392 _____ () C:\Windows\SysWOW64\PnkBstrB.exe
2014-04-13 17:42 - 2013-04-18 23:47 - 00214392 _____ () C:\Windows\SysWOW64\PnkBstrB.ex0
2014-04-13 14:37 - 2014-04-13 14:37 - 00000000 ____D () C:\Users\BBQPitBoyz\AppData\Roaming\Krautscape
2014-04-13 01:33 - 2013-04-18 10:03 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-04-12 09:35 - 2013-04-18 10:11 - 00000000 ____D () C:\Users\BBQPitBoyz\AppData\Local\Adobe
2014-04-12 09:35 - 2013-04-17 17:36 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-04-12 09:35 - 2013-04-17 17:36 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-04-12 09:35 - 2013-04-17 17:36 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-04-11 23:53 - 2014-04-11 23:53 - 00000000 __SHD () C:\Users\BBQPitBoyz\AppData\Local\EmieUserList
2014-04-11 23:53 - 2014-04-11 23:53 - 00000000 __SHD () C:\Users\BBQPitBoyz\AppData\Local\EmieSiteList
2014-04-11 09:36 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-04-11 08:10 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-04-10 19:05 - 2013-05-05 01:11 - 00000000 ____D () C:\Users\BBQPitBoyz\Documents\Benutzerdefinierte Office-Vorlagen
2014-04-10 17:36 - 2013-04-17 17:09 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-04-10 17:35 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-04-10 06:29 - 2013-11-09 22:51 - 00000000 ____D () C:\Windows\system32\MRT
2014-04-10 06:28 - 2013-11-09 22:51 - 90655440 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-04-08 17:59 - 2014-04-08 17:59 - 00000000 ____D () C:\Users\BBQPitBoyz\AppData\Roaming\AVAST Software
2014-04-08 17:58 - 2010-11-21 05:47 - 00356626 _____ () C:\Windows\PFRO.log
2014-04-08 06:46 - 2014-04-08 06:46 - 00084816 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2014-04-08 06:46 - 2014-04-08 06:46 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-04-08 06:46 - 2013-04-17 17:09 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2014-04-08 06:46 - 2013-04-17 17:09 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2014-04-08 06:46 - 2013-04-17 17:09 - 00334648 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-04-08 06:46 - 2013-04-17 17:09 - 00208928 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2014-04-08 06:46 - 2013-04-17 17:09 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2014-04-08 06:46 - 2013-04-17 17:09 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-04-08 06:46 - 2013-04-17 17:09 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2014-04-08 06:46 - 2013-04-17 17:09 - 00000000 _____ () C:\Windows\SysWOW64\config.nt
2014-04-08 06:46 - 2013-04-17 17:06 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-04-06 22:52 - 2013-05-19 18:36 - 00000000 ____D () C:\Users\BBQPitBoyz\AppData\Roaming\vlc
2014-04-04 20:59 - 2013-10-28 13:28 - 00000000 ____D () C:\Users\BBQPitBoyz\Desktop\MANUTOPMUSIK
2014-04-03 19:59 - 2014-02-28 14:10 - 00000000 ____D () C:\Users\BBQPitBoyz\Desktop\eBooks NEED MOBI
2014-04-01 17:36 - 2013-04-21 22:07 - 00000000 ____D () C:\Program Files (x86)\Battlelog Web Plugins
2014-03-31 06:56 - 2013-04-17 17:05 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-03-30 18:08 - 2013-09-19 12:00 - 00004120 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2923481869-3162173556-2377066677-1000UA
2014-03-30 18:08 - 2013-09-19 12:00 - 00003724 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2923481869-3162173556-2377066677-1000Core
2014-03-30 16:59 - 2013-04-17 19:58 - 00000000 ____D () C:\Users\BBQPitBoyz\Documents\My Games
2014-03-30 16:58 - 2014-03-30 16:57 - 00000000 ____D () C:\Users\BBQPitBoyz\Desktop\Goat.Simulator-DOGE
2014-03-29 09:53 - 2014-03-29 09:53 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-03-28 22:18 - 2013-06-04 11:14 - 00000000 ____D () C:\Users\BBQPitBoyz\Documents\Outlook-Dateien
2014-03-28 12:38 - 2013-04-22 21:50 - 00004114 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-03-28 12:38 - 2013-04-22 21:50 - 00003862 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-03-27 01:39 - 2014-03-27 07:50 - 14358210 _____ () C:\Users\BBQPitBoyz\Desktop\ArnoldHandbLogistik2008.rar
2014-03-22 23:20 - 2014-03-22 23:20 - 00000000 ____D () C:\Users\BBQPitBoyz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Album Art Downloader
2014-03-22 23:20 - 2014-03-22 23:20 - 00000000 ____D () C:\Users\BBQPitBoyz\AppData\Local\AlbumArtDownloader
2014-03-22 23:20 - 2014-03-22 23:20 - 00000000 ____D () C:\Program Files\AlbumArtDownloader
2014-03-22 09:56 - 2014-03-22 09:56 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-03-22 09:56 - 2014-03-22 09:56 - 00000000 ____D () C:\Users\BBQPitBoyz\AppData\Local\Skype
2014-03-22 09:56 - 2013-04-17 21:41 - 00000000 ____D () C:\ProgramData\Skype
2014-03-21 22:21 - 2014-03-21 22:20 - 00000000 ____D () C:\Users\BBQPitBoyz\AppData\Local\Arma 3
2014-03-21 22:20 - 2014-03-21 22:20 - 00000000 ____D () C:\Users\BBQPitBoyz\Documents\Arma 3
2014-03-21 22:20 - 2014-03-21 22:20 - 00000000 ____D () C:\ProgramData\Bohemia Interactive

Files to move or delete:
====================
C:\Users\BBQPitBoyz\Rar.exe
C:\Users\BBQPitBoyz\RarExt.dll
C:\Users\BBQPitBoyz\RarExt32.dll
C:\Users\BBQPitBoyz\rarnew.dat
C:\Users\BBQPitBoyz\Uninstall.exe
C:\Users\BBQPitBoyz\UnRAR.exe
C:\Users\BBQPitBoyz\WinRAR.exe
C:\Users\BBQPitBoyz\zipnew.dat


Some content of TEMP:
====================
C:\Users\BBQPitBoyz\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpctokh2.dll


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-04-09 15:51

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

--- --- ---

--- --- ---

ADDITION - im Anhang, da für Thread zu groß

5.Gmer - ohne Probleme, logfile im Anhang da zu groß für den Thread

Mein Avast-Virenprogramm, Spybot Search&Destroy sowie HijackThis haben alle NICHTS angezeigt.

Bitte um Hilfe. DANKE

schrauber · 15.04.2014, 09:25

Hi,

Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen.
Ich kann auf Arbeit keine Anhänge öffnen, danke.

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

bowiewowie · 15.04.2014, 13:08

Hallo schrauber, sorry, hier die restlichen Logs:

zu

4.FRST 64

ADDITION

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 14-04-2014
Ran by BBQPitBoyz at 2014-04-14 21:51:47
Running from C:\Users\BBQPitBoyz\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Disabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Flash Player 11 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 11.7.700.224 - Adobe Systems Incorporated)
Adobe Flash Player 13 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 13.0.0.182 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.06) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.06 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.0 (HKLM-x32\...\{58597FDC-CDF0-4760-A57C-250DF09F4A21}) (Version: 12.0.2.122 - Adobe Systems, Inc)
Adobe Shockwave Player 12.1 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.1.0.150 - Adobe Systems, Inc.)
Album Art Downloader XUI 1.01 (HKLM-x32\...\Album Art Downloader XUI) (Version: 1.01 - hxxp://sourceforge.net/projects/album-art)
Allgemeine Runtime Files (x86) (HKLM\...\{1F6D1DB5-82B5-41A4-85A2-0A382C142A35}_is1) (Version: 1.0.3.6 - Sereby Corporation)
AMD Accelerated Video Transcoding (Version: 13.20.100.31107 - Advanced Micro Devices, Inc.) Hidden
AMD APP SDK Runtime (Version: 10.0.1016.4 - Advanced Micro Devices Inc.) Hidden
AMD Catalyst Control Center (x32 Version: 2013.1107.1129.20543 - Ihr Firmenname) Hidden
AMD Catalyst Install Manager (HKLM\...\{4ED88849-15C4-39B7-4238-24FEE1F82E9F}) (Version: 8.0.915.0 - Advanced Micro Devices, Inc.)
AMD Drag and Drop Transcoding (Version: 2.00.0000 - Advanced Micro Devices, Inc.) Hidden
AMD Media Foundation Decoders (Version: 1.0.81107.1147 - Advanced Micro Devices, Inc.) Hidden
AMD Wireless Display v3.0 (Version: 1.0.0.14 - Advanced Micro Devices, Inc.) Hidden
Arma 3 Complete (HKLM-x32\...\QXJtYTM=_is1) (Version: 1 - )
Assassin's Creed IV Black Flag Version 1.0 (HKLM-x32\...\Assassin's Creed IV Black Flag_is1) (Version: 1.0 - Ubisoft)
avast! Free Antivirus (HKLM-x32\...\avast) (Version: 9.0.2016 - Avast Software)
Battlefield 3™ (HKLM-x32\...\{76285C16-411A-488A-BCE3-C83CB933D8CF}) (Version: 1.6.0.0 - Electronic Arts)
Battlefield 4™ (HKLM-x32\...\{ABADE36E-EC37-413B-8179-B432AD3FACE7}) (Version: 1.2.0.0 - Electronic Arts)
Battlefield: Bad Company™ 2 (HKLM-x32\...\{3AC8457C-0385-4BEA-A959-E095F05D6D67}) (Version: 1.0.1.0 - Electronic Arts)
Battlelog Web Plugins (HKLM-x32\...\Battlelog Web Plugins) (Version: 2.3.2 - EA Digital Illusions CE AB)
Brother MFL-Pro Suite DCP-585CW (HKLM-x32\...\{48D082B9-18F6-4426-AFAC-8B6A3E7021B1}) (Version: 1.0.1.0 - Brother Industries, Ltd.)
BrowseMark (HKLM\...\BrowseMark) (Version: 2014.03.11.182504 - BrowseMark)
Bulletstorm (HKLM-x32\...\GFWL_{45410935-3E72-472B-8C35-AB1000008200}) (Version: 1.0.0000.130 - EA)
Bulletstorm (x32 Version: 1.0.0000.130 - EA) Hidden
BulletStorm (x32 Version: 1.0.0001.130 - EA) Hidden
Burnout(TM) Paradise The Ultimate Box (HKLM-x32\...\{9A996B6A-846E-4A89-B9C4-17546B7BE49F}) (Version: 1.1.0.0 - Electronic Arts)
Call of Duty Ghosts (HKLM-x32\...\Call of Duty Ghosts_is1) (Version: Call of Duty Ghosts - )
Call of Juarez Gunslinger (c) Ubisoft version 1 (HKLM-x32\...\Q2FsbG9mSnVhcmV6R3Vuc2xpbmdlcg==_is1) (Version: 1 - )
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2013.1107.1129.20543 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2013.1107.1129.20543 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2013.1107.1129.20543 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (x32 Version: 2013.1107.1128.20543 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (x32 Version: 2013.1107.1128.20543 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2013.1107.1128.20543 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (x32 Version: 2013.1107.1128.20543 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (x32 Version: 2013.1107.1128.20543 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2013.1107.1128.20543 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (x32 Version: 2013.1107.1128.20543 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2013.1107.1128.20543 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2013.1107.1128.20543 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (x32 Version: 2013.1107.1128.20543 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (x32 Version: 2013.1107.1128.20543 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2013.1107.1128.20543 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2013.1107.1128.20543 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (x32 Version: 2013.1107.1128.20543 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (x32 Version: 2013.1107.1128.20543 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (x32 Version: 2013.1107.1128.20543 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2013.1107.1128.20543 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (x32 Version: 2013.1107.1128.20543 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2013.1107.1128.20543 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (x32 Version: 2013.1107.1128.20543 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (x32 Version: 2013.1107.1128.20543 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (x32 Version: 2013.1107.1128.20543 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2013.1107.1129.20543 - Advanced Micro Devices, Inc.) Hidden
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.2.4291 - CDBurnerXP)
Crysis® 2 (HKLM-x32\...\{6033673D-2530-4587-8AD0-EB059FC263F9}) (Version: 1.9.0.0 - Electronic Arts)
Crysis®3 (HKLM-x32\...\{4198AE83-A3C6-4C41-85C8-EC63E990696E}) (Version: 1.1.0.0 - Electronic Arts)
CyberGhost VPN (HKLM\...\CyberGhost VPN_is1) (Version:  - CyberGhost S.R.L.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.47.1.0333 - Disc Soft Ltd)
DCS World (HKLM\...\DCS World_is1) (Version: 1.2.6.20768 - )
Definition Update for Microsoft Office 2013 (KB2760587) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{F68634D8-574F-42B2-B6D0-9B447EA9581E}) (Version:  - Microsoft)
Driver Genius (HKLM-x32\...\Driver Genius_is1) (Version: 12.0 - Driver-Soft Inc.)
Drucken in PDF Annotator (novaPDF OEM 7.7 printer) (HKLM\...\Drucken in PDF Annotator_is1) (Version:  - Softland)
Earth Screensaver HD  (HKLM-x32\...\Earth Screensaver HD) (Version: Earth Screensaver HD - Stonetrip)
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version:  - )
ESN Sonar (HKLM-x32\...\ESN Sonar-0.70.4) (Version: 0.70.4 - ESN Social Software AB)
F1 2013 German (HKLM-x32\...\RjEyMDEz_is1) (Version: 1 - )
Far Cry 3 (HKLM-x32\...\{3E7F5A51-7657-43D6-A9B3-C3A21473834B}_is1) (Version: 1.01 - RAF)
Far Cry 3 Blood Dragon (HKLM-x32\...\{A071F478-73E0-4143-AE55-4DD6BABD74F5}) (Version: 1.00 - Ubisoft)
Free Audio Converter version 5.0.30.1022 (HKLM-x32\...\Free Audio Converter_is1) (Version: 5.0.30.1022 - DVDVideoSoft Ltd.)
Free Video to DVD Converter version 5.0.22.128 (HKLM-x32\...\Free Video to DVD Converter_is1) (Version: 5.0.22.128 - DVDVideoSoft Ltd.)
Futuremark SystemInfo (HKLM-x32\...\{BEE64C14-BEF1-4610-8A68-A16EAA47B882}) (Version: 4.15.0 - Futuremark Corporation)
Geeks3D.com FurMark 1.10.6 (HKLM-x32\...\{2397CAD4-2263-4CD0-96BE-E43A980B9C9A}_is1) (Version:  - Geeks3D.com)
Goat Simulator (HKLM-x32\...\R29hdFNpbXVsYXRvcg==_is1) (Version: 1 - )
Google Chrome (HKCU\...\Google Chrome) (Version: 34.0.1847.116 - Google Inc.)
Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.23.9 - Google Inc.) Hidden
Hawken (HKCU\...\Hawken) (Version:  - Meteor Entertainment)
Hi-Rez Studios Authenticate and Update Service (HKLM-x32\...\{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF1FC}) (Version: 3.0.0.0 - Hi-Rez Studios)
How to Survive (HKLM-x32\...\How to Survive_is1) (Version:  - )
ImgBurn (HKLM-x32\...\ImgBurn) (Version: 2.5.8.0 - LIGHTNING UK!)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1008 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.6.0.1030 - Intel Corporation)
Java 7 Update 51 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417051FF}) (Version: 7.0.510 - Oracle)
Java 7 Update 51 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217051FF}) (Version: 7.0.510 - Oracle)
Java 8 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418000FF}) (Version: 8.0.0 - Oracle Corporation)
Java Auto Updater (x32 Version: 2.8.00.132 - Oracle, Inc.) Hidden
JDownloader 0.9 (HKLM-x32\...\5513-1208-7298-9440) (Version: 0.9 - AppWork GmbH)
Junk Mail filter update (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
KMSnano 22 (HKLM\...\KMSnano 22_is1) (Version: KMSnano 22 - )
Krautscape (HKLM-x32\...\Krautscape_is1) (Version:  - )
Mafia II (HKLM-x32\...\Mafia II_is1) (Version:  - )
Metro: Last Light (c) Deep Silver version 1 (HKLM-x32\...\TWV0cm9MYXN0TGlnaHQ=_is1) (Version: 1 - )
Microsoft .NET Framework 1.1 (HKLM-x32\...\Microsoft .NET Framework 1.1  (1033)) (Version:  - )
Microsoft .NET Framework 1.1 (x32 Version: 1.1.4322 - Microsoft) Hidden
Microsoft .NET Framework 1.1 Security Update (KB2698023) (HKLM-x32\...\M2698023) (Version:  - )
Microsoft .NET Framework 1.1 Security Update (KB2742597) (HKLM-x32\...\M2742597) (Version:  - )
Microsoft .NET Framework 1.1 Security Update (KB979906) (HKLM-x32\...\M979906) (Version:  - )
Microsoft .NET Framework 1.1 SP1 (HKLM\...\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}) (Version:  - )
Microsoft .NET Framework 1.1 SP1 (HKLM\...\Microsoft .NET Framework 1.1  (1033)) (Version:  - )
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Access MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft DCF MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Excel MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Games for Windows - LIVE (HKLM-x32\...\{F97E3841-CA9D-4964-9D64-26066241D26F}) (Version: 3.3.24.0 - Microsoft Corporation)
Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{8FB1B528-E260-451E-9B55-E9152F94B80B}) (Version: 3.2.3.0 - Microsoft Corporation)
Microsoft Groove MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft InfoPath MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft IntelliPoint 8.2 (HKLM\...\Microsoft IntelliPoint 8.2) (Version: 8.20.468.0 - Microsoft Corporation)
Microsoft IntelliPoint 8.2 (Version: 8.20.468.0 - Microsoft Corporation) Hidden
Microsoft IntelliType Pro 8.0 (HKLM\...\{98C8DF59-BE5F-4EC2-9B12-FD2A54928EDB}) (Version: 8.0.225.0 - Microsoft)
Microsoft Lync MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Office 32-bit Components 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Office Korrekturhilfen 2013 - Deutsch (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Office OSM MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Office OSM UX MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUS) (Version: 15.0.4420.1017 - Microsoft Corporation)
Microsoft Office Professional Plus 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2013 - English (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2013 - Italiano (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Office Shared 32-bit MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft OneNote MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Outlook MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft PowerPoint MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Publisher MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft redistributable runtime DLLs VS2005 SP1(x86) (HKLM-x32\...\{CEC7A786-A9C8-4EF7-BB59-6518E3B3C878}) (Version: 8.0.50727.4053 - SAP)
Microsoft redistributable runtime DLLs VS2008 SP1(x86) (HKLM-x32\...\{A47A9101-6EB5-4314-BDA1-297880FBB908}) (Version: 9.0 - SAP AG)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{cbf90bef-21fb-400b-935a-5900785071dd}) (Version: 8.0.61187 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{3aca4f87-8f71-4d1a-bcbe-8c07d3967784}) (Version: 8.0.61186 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.7523 (HKLM-x32\...\{7CBA9009-7EA4-338B-893D-9607CD829ADF}) (Version: 9.0.30729.7523 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{307a22b8-8353-4c5e-b67b-2404c5734558}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.50727 (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.50727 (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual J# 2.0 Redistributable Package - SE (x64) (HKLM\...\Microsoft Visual J# 2.0 Redistributable Package - SE (x64)) (Version:  - Microsoft Corporation)
Microsoft Visual J# 2.0 Redistributable Package - SE (x64) (Version: 2.0.50728 - Microsoft Corporation) Hidden
Microsoft Word MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
MozBackup 1.5.1 (HKLM-x32\...\MozBackup) (Version:  - Pavel Cvrcek)
Mozilla Firefox 28.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 28.0 (x86 de)) (Version: 28.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 28.0 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT110 (x32 Version: 16.4.1108.0727 - Microsoft) Hidden
MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MuseScore 1.3 (HKLM-x32\...\MuseScore) (Version: 1.3.0 - Werner Schweer and Others)
My Game Long Name (HKLM\...\UDK-bd600ed4-c117-4469-98e5-249cf91a42ad) (Version:  - Epic Games, Inc.)
Nightly 24.0a1 (x64 en-US) (HKLM\...\Nightly 24.0a1 (x64 en-US)) (Version: 24.0a1 - Mozilla)
NVIDIA PhysX (HKLM-x32\...\{8B922CF8-8A6C-41CE-A858-F1755D7F5D29}) (Version: 9.12.1031 - NVIDIA Corporation)
Origin (HKLM-x32\...\Origin) (Version: 9.1.15.109 - Electronic Arts, Inc.)
Outils de vérification linguistique 2013 de Microsoft Office*- Français (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Outlast (HKLM-x32\...\T3V0bGFzdA==_is1) (Version: 1 - )
PDF Annotator 4.0.0.411 (HKLM-x32\...\PDFAnnotator_is1) (Version: 4.0.0.411 - GRAHL software design)
PDF24 Creator 6.0.1 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)
Photo Common (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
PhotoScape (HKLM-x32\...\PhotoScape) (Version:  - )
PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.993 - Even Balance, Inc.)
puush (HKLM-x32\...\{C3592426-531E-4110-911D-BFECE2CE284B}) (Version: 1.0.0.0 - Dean Herbert)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6690 - Realtek Semiconductor Corp.)
S3D Web Player (HKLM\...\S3D Web Player) (Version: 1.8.0.1 - Stonetrip)
Saints Row IV (HKLM-x32\...\U2FpbnRzUm93SVY=_is1) (Version: 1 - )
Samsung Magician (HKLM-x32\...\{29AE3F9F-7158-4ca7-B1ED-28A73ECDB215}_is1) (Version: 4.0.1 - Samsung Electronics)
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.27.0 - SAMSUNG Electronics Co., Ltd.)
SAP GUI for Windows 7.20 (HKLM-x32\...\SAPGUI710) (Version: 7.20 Compilation 3 - SAP)
Screenpresso (HKCU\...\Screenpresso) (Version: 1.5.0.0 - Learnpulse)
Skype™ 6.14 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.14.104 - Skype Technologies S.A.)
Southpark Stick of Truth (HKLM-x32\...\U291dGhwYXJrU3RpY2tvZlRydXRo_is1) (Version: 1 - )
Steam (HKLM-x32\...\Steam) (Version:  - Valve Corporation)
supra DateSet (HKLM-x32\...\{AB8FF586-A9CC-4A9C-8A20-631F98A5FC5B}) (Version: 1.0.1.0 - SUPRA Foto-Elektronik-Vertriebs-GmbH)
Sweet Page (HKLM-x32\...\sweet-page uninstaller) (Version:  - sweet-page) <==== ATTENTION
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
System Requirements Lab Detection (HKLM-x32\...\{A407FC22-36BF-4C82-A516-59D94BC505A9}) (Version: 1.0.5.0 - Husdawg, LLC)
Titanfall™ (HKLM-x32\...\{347EE0C3-0690-48F6-A231-53853C2A80D6}) (Version: 1.0.0.3 - Electronic Arts)
Tom Clancy's Splinter Cell® Blacklist™ (HKLM-x32\...\{A6356F2F-D3E1-4D83-9AA2-72871DD0C298}) (Version: 1.01 - Ubisoft)
Tribes Ascend (HKLM-x32\...\{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF010}) (Version: 1.0.1268.1 - Hi-Rez Studios)
Unity Web Player (HKCU\...\UnityWebPlayer) (Version:  - Unity Technologies ApS)
Update for Microsoft Access 2013 (KB2768008) 64-Bit Edition (HKLM\...\{90150000-0015-0407-1000-0000000FF1CE}_Office15.PROPLUS_{47F15B72-AB15-4B81-BDB8-28B204596EB7}) (Version:  - Microsoft)
Update for Microsoft Access 2013 (KB2827233) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{614E655F-A0ED-435A-8E0C-A81EE4BA7BC7}) (Version:  - Microsoft)
Update for Microsoft Excel 2013 (KB2752087) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{A2275591-C3AA-4A6C-A696-F958B6C65B3E}) (Version:  - Microsoft)
Update for Microsoft Excel 2013 (KB2752087) 64-Bit Edition (HKLM\...\{90150000-0016-0407-1000-0000000FF1CE}_Office15.PROPLUS_{A2275591-C3AA-4A6C-A696-F958B6C65B3E}) (Version:  - Microsoft)
Update for Microsoft Excel 2013 (KB2752087) 64-Bit Edition (HKLM\...\{90150000-0018-0407-1000-0000000FF1CE}_Office15.PROPLUS_{A2275591-C3AA-4A6C-A696-F958B6C65B3E}) (Version:  - Microsoft)
Update for Microsoft Excel 2013 (KB2752087) 64-Bit Edition (HKLM\...\{90150000-001B-0407-1000-0000000FF1CE}_Office15.PROPLUS_{A2275591-C3AA-4A6C-A696-F958B6C65B3E}) (Version:  - Microsoft)
Update for Microsoft Excel 2013 (KB2752087) 64-Bit Edition (HKLM\...\{90150000-00C1-0407-1000-0000000FF1CE}_Office15.PROPLUS_{A2275591-C3AA-4A6C-A696-F958B6C65B3E}) (Version:  - Microsoft)
Update for Microsoft InfoPath 2013 (KB2837648) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{5E759A69-FA72-4B3C-BE2F-D1194764D31E}) (Version:  - Microsoft)
Update for Microsoft Lync 2013 (KB2817678) 64-Bit Edition (HKLM\...\{90150000-012B-0407-1000-0000000FF1CE}_Office15.PROPLUS_{237834D6-FA98-44E1-8739-ABD56DDADC59}) (Version:  - Microsoft)
Update for Microsoft Lync 2013 (KB2863908) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{259F7CA1-7A87-4E60-85A9-0A55E60FF254}) (Version:  - Microsoft)
Update for Microsoft Lync 2013 (KB2863908) 64-Bit Edition (HKLM\...\{90150000-00C1-0000-1000-0000000FF1CE}_Office15.PROPLUS_{259F7CA1-7A87-4E60-85A9-0A55E60FF254}) (Version:  - Microsoft)
Update for Microsoft Lync 2013 (KB2863908) 64-Bit Edition (HKLM\...\{90150000-012B-0407-1000-0000000FF1CE}_Office15.PROPLUS_{8D84B988-2A7A-4DB6-A7A5-08DA7B3DE9EE}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2726954) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{43EB1F58-DAA0-4F61-A4EE-C5651F85A047}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2726954) 64-Bit Edition (HKLM\...\{90150000-00C1-0000-1000-0000000FF1CE}_Office15.PROPLUS_{43EB1F58-DAA0-4F61-A4EE-C5651F85A047}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2726996) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{76CACE05-7A19-4EAC-87D7-5BFF63AF7CDF}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2726996) 64-Bit Edition (HKLM\...\{90150000-00C1-0000-1000-0000000FF1CE}_Office15.PROPLUS_{76CACE05-7A19-4EAC-87D7-5BFF63AF7CDF}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2726996) 64-Bit Edition (HKLM\...\{90150000-00C1-0407-1000-0000000FF1CE}_Office15.PROPLUS_{79469196-F138-4CF0-8681-F1889D53B56B}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2738038) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{FEFF9FF6-FF61-455E-A8CC-3A1311A657AD}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2760224) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{3FF4EA9F-3505-4726-A974-6593A968FFCC}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2760242) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{9406D70B-2D9C-4613-A75A-F35B66BA8AFA}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2760267) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{CA390537-AA88-450F-A240-5FB4648A124A}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2760344) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{EF77B4A6-DFEC-4010-A87D-9B6BF87FABEC}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2760539) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{C8D57F4A-0824-4043-89E7-3C6280B67A47}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2760544) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{62857CDD-2985-4939-91BA-19ED0B0031A5}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2760553) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{AC4470FB-8011-4F16-B5D4-E0A34DE10C87}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2760610) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{D8B3D175-48B8-413F-8484-4D81E744B51C}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2760610) 64-Bit Edition (HKLM\...\{90150000-006E-0407-1000-0000000FF1CE}_Office15.PROPLUS_{526C9E5A-A734-4DC0-B829-ED1CDE793C6B}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2768012) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{0814662C-FD28-4DE0-ACE5-EE50D1D6C8FB}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2768016) 64-Bit Edition (HKLM\...\{90150000-006E-0407-1000-0000000FF1CE}_Office15.PROPLUS_{30C13416-B124-46AB-9E44-96CEFFA893F9}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2817314) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{C809B1D6-BD31-4496-BCFE-4567E0854F5F}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2817316) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{4FD8F672-3206-469C-B9F0-D6E72F7ACAB2}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2817316) 64-Bit Edition (HKLM\...\{90150000-0016-0407-1000-0000000FF1CE}_Office15.PROPLUS_{1A789784-5825-4B26-BB57-71FF7D3484CB}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2817316) 64-Bit Edition (HKLM\...\{90150000-0016-0407-1000-0000000FF1CE}_Office15.PROPLUS_{856D47BC-036C-4692-8702-D6CCA8F428D0}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2817490) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{CA0554C4-62FE-4F66-BC87-1EE1EAC675EF}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2817490) 64-Bit Edition (HKLM\...\{90150000-00C1-0000-1000-0000000FF1CE}_Office15.PROPLUS_{CA0554C4-62FE-4F66-BC87-1EE1EAC675EF}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2817626) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{F33ABF6A-3007-47E8-8E38-506A18E54641}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2817636) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{D97AACA3-9AEA-43FF-8CBA-93BED0443FC2}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2817636) 64-Bit Edition (HKLM\...\{90150000-006E-0407-1000-0000000FF1CE}_Office15.PROPLUS_{D97AACA3-9AEA-43FF-8CBA-93BED0443FC2}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2817636) 64-Bit Edition (HKLM\...\{90150000-00C1-0000-1000-0000000FF1CE}_Office15.PROPLUS_{D97AACA3-9AEA-43FF-8CBA-93BED0443FC2}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2825631) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{A54917FC-2C84-40F2-9525-7549BE08DE40}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2825631) 64-Bit Edition (HKLM\...\{90150000-006E-0407-1000-0000000FF1CE}_Office15.PROPLUS_{A54917FC-2C84-40F2-9525-7549BE08DE40}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2825631) 64-Bit Edition (HKLM\...\{90150000-00C1-0000-1000-0000000FF1CE}_Office15.PROPLUS_{A54917FC-2C84-40F2-9525-7549BE08DE40}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2826004) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{B38036CB-BAF6-41D4-8810-FD016453ABB9}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2827225) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{2A286156-257B-4528-9DB5-B4D4D53211BC}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2827227) 64-Bit Edition (HKLM\...\{90150000-001F-0407-1000-0000000FF1CE}_Office15.PROPLUS_{B5E3E636-7913-4775-BC9B-E4B56F4ED73B}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2827227) 64-Bit Edition (HKLM\...\{90150000-001F-0409-1000-0000000FF1CE}_Office15.PROPLUS_{92833C80-DC88-4A22-8630-407F810EF57B}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2827227) 64-Bit Edition (HKLM\...\{90150000-001F-040C-1000-0000000FF1CE}_Office15.PROPLUS_{602346D6-8E2F-4B0E-820A-CD62AC5B0DC9}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2827227) 64-Bit Edition (HKLM\...\{90150000-001F-0410-1000-0000000FF1CE}_Office15.PROPLUS_{869B93B9-E75A-44DE-8AC5-A030A7A21FDD}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2827230) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{F2187E8D-C68A-4655-8551-1932878A5581}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2827239) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{9353CD85-4B19-45C4-8DBA-1391926351F6}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2827239) 64-Bit Edition (HKLM\...\{90150000-00C1-0000-1000-0000000FF1CE}_Office15.PROPLUS_{9353CD85-4B19-45C4-8DBA-1391926351F6}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2827272) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{50F6EF67-B93C-4B7A-A2EB-E179E3436C69}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2827272) 64-Bit Edition (HKLM\...\{90150000-0016-0407-1000-0000000FF1CE}_Office15.PROPLUS_{50F6EF67-B93C-4B7A-A2EB-E179E3436C69}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2827272) 64-Bit Edition (HKLM\...\{90150000-0090-0407-1000-0000000FF1CE}_Office15.PROPLUS_{50F6EF67-B93C-4B7A-A2EB-E179E3436C69}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2863825) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{327EABFD-EDD3-44E7-AB47-7592DF33B719}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2863843) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{290D80DE-03AB-47EC-9402-108AF4CE4F66}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2863844) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{50F31E04-D56A-4159-BF36-CF3CE27DB30C}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2863860) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{6D170CB5-8D22-4D1B-A811-B899FE588946}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2863860) 64-Bit Edition (HKLM\...\{90150000-00C1-0000-1000-0000000FF1CE}_Office15.PROPLUS_{6D170CB5-8D22-4D1B-A811-B899FE588946}) (Version:  - Microsoft)
Update for Microsoft OneDrive for Business (KB2863864) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{AFB7E303-C8CA-4A08-AD3F-44A562B3C809}) (Version:  - Microsoft)
Update for Microsoft OneDrive for Business (KB2863864) 64-Bit Edition (HKLM\...\{90150000-00BA-0407-1000-0000000FF1CE}_Office15.PROPLUS_{AFB7E303-C8CA-4A08-AD3F-44A562B3C809}) (Version:  - Microsoft)
Update for Microsoft OneDrive for Business (KB2863864) 64-Bit Edition (HKLM\...\{90150000-00C1-0000-1000-0000000FF1CE}_Office15.PROPLUS_{AFB7E303-C8CA-4A08-AD3F-44A562B3C809}) (Version:  - Microsoft)
Update for Microsoft OneDrive for Business (KB2863864) 64-Bit Edition (HKLM\...\{90150000-00C1-0407-1000-0000000FF1CE}_Office15.PROPLUS_{AFB7E303-C8CA-4A08-AD3F-44A562B3C809}) (Version:  - Microsoft)
Update for Microsoft OneNote 2013 (KB2817628) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{9367C385-2EF9-4BE3-8351-7D2AB0798A57}) (Version:  - Microsoft)
Update for Microsoft OneNote 2013 (KB2817628) 64-Bit Edition (HKLM\...\{90150000-00A1-0407-1000-0000000FF1CE}_Office15.PROPLUS_{9367C385-2EF9-4BE3-8351-7D2AB0798A57}) (Version:  - Microsoft)
Update for Microsoft OneNote 2013 (KB2817628) 64-Bit Edition (HKLM\...\{90150000-00C1-0000-1000-0000000FF1CE}_Office15.PROPLUS_{9367C385-2EF9-4BE3-8351-7D2AB0798A57}) (Version:  - Microsoft)
Update for Microsoft Outlook 2013 (KB2863911) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{DF3798F3-F45C-44DA-83B7-229A9EBC9654}) (Version:  - Microsoft)
Update for Microsoft Outlook 2013 (KB2863911) 64-Bit Edition (HKLM\...\{90150000-001A-0407-1000-0000000FF1CE}_Office15.PROPLUS_{DAEE93F9-D258-45E4-AFD3-12AC5ED04693}) (Version:  - Microsoft)
Update for Microsoft PowerPoint 2013 (KB2837627) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{FE06DACB-AE2C-4DB7-B95D-97A320E59F45}) (Version:  - Microsoft)
Update for Microsoft PowerPoint 2013 (KB2837627) 64-Bit Edition (HKLM\...\{90150000-0018-0407-1000-0000000FF1CE}_Office15.PROPLUS_{FE06DACB-AE2C-4DB7-B95D-97A320E59F45}) (Version:  - Microsoft)
Update for Microsoft Project 2013 (KB2727085) 64-Bit Edition (HKLM\...\{90150000-00C1-0000-1000-0000000FF1CE}_Office15.PROPLUS_{BBD4F4CE-65D4-4CEB-AE19-E5296A57AA6C}) (Version:  - Microsoft)
Update for Microsoft Publisher 2013 (KB2837635) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{2837C624-A972-43CF-BCE5-0AE2EFED72E3}) (Version:  - Microsoft)
Update for Microsoft Publisher 2013 (KB2837635) 64-Bit Edition (HKLM\...\{90150000-0019-0407-1000-0000000FF1CE}_Office15.PROPLUS_{E9172003-60C1-447B-9569-7AA9FADE26B0}) (Version:  - Microsoft)
Update for Microsoft Visio 2013 (KB2817306) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{F16E7B82-23FE-4054-AB73-EAE53965251C}) (Version:  - Microsoft)
Update for Microsoft Visio Viewer 2013 (KB2817301) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{8E5CD68A-CDF8-4930-88DF-B7778B1871A9}) (Version:  - Microsoft)
Update for Microsoft Visio Viewer 2013 (KB2817301) 64-Bit Edition (HKLM\...\{90150000-006E-0407-1000-0000000FF1CE}_Office15.PROPLUS_{8E5CD68A-CDF8-4930-88DF-B7778B1871A9}) (Version:  - Microsoft)
Update for Microsoft Word 2013 (KB2863909) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{F9FAC8C0-20D9-4DC7-9A56-13B02BD4B724}) (Version:  - Microsoft)
Uplay (HKLM-x32\...\Uplay) (Version: 3.0 - Ubisoft)
VLC media player 2.0.6 (HKLM\...\VLC media player) (Version: 2.0.6 - VideoLAN)
Windows Live Communications Platform (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3508.0205 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4311.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows-Treiberpaket - Telechips Inc (vtcdrv) USB  (11/16/2011 5.0.0.3) (HKLM\...\E40BDFFBFD93EBFF5EF93A21BDA9030934851531) (Version: 11/16/2011 5.0.0.3 - Telechips Inc)
WinRAR 4.20 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
WISO Bewerbung 2008 (HKLM-x32\...\{FD065B02-AE17-4496-8C0F-FFD3A9FD9460}) (Version: 6.1.0.56 - Buhl Data Service GmbH)
WPM18.8.0.212 (HKLM-x32\...\WPM) (Version: 18.8.0.212 - Cherished Technololgy LIMITED) <==== ATTENTION
X Rebirth GERMAN (HKLM-x32\...\WFJlYmlydGg=_is1) (Version: 1 - )

==================== Restore Points  =========================

10-04-2014 04:27:03 Windows Update
11-04-2014 05:22:04 Windows Update
12-04-2014 23:33:25 Windows Update
13-04-2014 17:37:51 Installed Java 8 (64-bit)
13-04-2014 18:05:41 Removed Java 7 Update 51 (64-bit)
13-04-2014 18:06:00 Installed Java 7 Update 51 (64-bit)
13-04-2014 18:06:57 Removed Java 7 Update 51
13-04-2014 18:07:15 Installed Java 7 Update 51

==================== Hosts content: ==========================

2009-07-14 04:34 - 2014-04-14 20:33 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {3A7ACCF9-03C1-475A-BCF0-197D4BE37931} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2012-10-01] (Microsoft Corporation)
Task: {3C03012A-FEB7-4C18-84C2-40BACBBB8C8D} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-04-12] (Adobe Systems Incorporated)
Task: {4CF4B361-5A68-45BB-9C85-E5ABB4BBFE38} - System32\Tasks\Core Temp Autostart BBQPitBoyz => C:\Users\BBQPitBoyz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Core Temp.exe [2013-03-01] ()
Task: {55ED6B5B-DE23-4D37-86EE-26BBE741B020} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2923481869-3162173556-2377066677-1000Core => C:\Users\BBQPitBoyz\AppData\Local\Google\Update\GoogleUpdate.exe [2013-09-19] (Google Inc.)
Task: {5FDD68E6-76EF-4ECF-BFB6-C0C70644CD6A} - System32\Tasks\Trigger KMS Activation => C:\Program Files\KMSnano\TriggerKMS.exe [2013-01-26] ()
Task: {7DE8A8BA-031C-4C02-A38B-E2D5B680596C} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-04-22] (Google Inc.)
Task: {8CF96C80-3E7E-4462-BE4F-EB488CA3180F} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-04-08] (AVAST Software)
Task: {DA635A6D-1429-4CFF-B06D-146B1CBA3E27} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2012-10-01] (Microsoft Corporation)
Task: {DEAC6E09-A2BD-43A8-8023-E66F1CBA4C42} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2923481869-3162173556-2377066677-1000UA => C:\Users\BBQPitBoyz\AppData\Local\Google\Update\GoogleUpdate.exe [2013-09-19] (Google Inc.)
Task: {DFF78C5C-127E-4F94-B292-0ED105353DFE} - System32\Tasks\Microsoft_Hardware_Launch_IType_exe => C:\Program Files\Microsoft IntelliType Pro\IType.exe [2010-07-21] (Microsoft Corporation)
Task: {E1D8D457-B5C5-4497-9292-4A26DCA2709A} - System32\Tasks\Microsoft_Hardware_Launch_IPoint_exe => C:\Program Files\Microsoft IntelliPoint\IPoint.exe [2011-08-01] (Microsoft Corporation)
Task: {F39AA8B8-448A-43CB-9F62-DD365C54F43F} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-04-22] (Google Inc.)
Task: {F4FF0292-7AD0-4149-82A8-5C8B51E45076} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2012-10-01] (Microsoft Corporation)
Task: {FC80EABB-E2F0-4E7B-BC29-2F13285F04C1} - System32\Tasks\Asrsetup => D:\ASRSetup.exe
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2923481869-3162173556-2377066677-1000Core.job => C:\Users\BBQPitBoyz\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2923481869-3162173556-2377066677-1000UA.job => C:\Users\BBQPitBoyz\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2013-04-17 19:17 - 2013-04-17 19:17 - 00006144 _____ () C:\Users\BBQPitBoyz\AppData\Local\Microsoft\Windows Sidebar\Gadgets\CoreTempGadget.gadget\CoreTempReader.dll
2013-04-17 19:17 - 2013-04-17 19:17 - 00008704 _____ () C:\Users\BBQPitBoyz\AppData\Local\Microsoft\Windows Sidebar\Gadgets\CoreTempGadget.gadget\GetCoreTempInfoNET.dll
2013-04-17 19:17 - 2013-04-17 19:17 - 00007680 _____ () C:\Users\BBQPitBoyz\AppData\Local\Microsoft\Windows Sidebar\Gadgets\CoreTempGadget.gadget\SystemInfo.dll
2012-01-10 15:41 - 2014-01-08 20:43 - 00567880 _____ () C:\Program Files (x86)\puush\puush.exe
2013-04-18 23:47 - 2013-10-31 02:51 - 00076888 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2014-04-14 17:52 - 2014-04-14 17:52 - 02210304 _____ () C:\Program Files\AVAST Software\Avast\defs\14041400\algo.dll
2013-04-17 17:22 - 2009-02-27 16:38 - 00139264 ____R () C:\Program Files (x86)\Brother\BrUtilities\BrLogAPI.dll
2014-04-08 06:46 - 2014-04-08 06:46 - 19336120 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2014-03-29 09:53 - 2014-03-29 09:53 - 03642480 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2014-04-12 09:35 - 2014-04-12 09:35 - 16351920 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_182.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== Disabled items from MSCONFIG ==============

MSCONFIG\startupfolder: C:^Users^BBQPitBoyz^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Samsung Magician.lnk => C:\Windows\pss\Samsung Magician.lnk.Startup
MSCONFIG\startupreg: BrMfcWnd => C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
MSCONFIG\startupreg: Google Update => "C:\Users\BBQPitBoyz\AppData\Local\Google\Update\GoogleUpdate.exe" /c
MSCONFIG\startupreg: GoogleChromeAutoLaunch_EF836093D41F1E88A6425FE21F6CFE69 => "C:\Users\BBQPitBoyz\AppData\Local\Google\Chrome\Application\chrome.exe" --no-startup-window
MSCONFIG\startupreg: Lync => "C:\Program Files\Microsoft Office\Office15\lync.exe" /fromrunkey
MSCONFIG\startupreg: PDFPrint => C:\Program Files (x86)\PDF24\pdf24.exe

==================== Faulty Device Manager Devices =============

Name: USB (Universal Serial Bus)-Controller
Description: USB (Universal Serial Bus)-Controller
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (04/14/2014 09:48:06 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (04/14/2014 08:34:00 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: pev.3XE, Version: 0.0.0.0, Zeitstempel: 0x4e06cfe8
Name des fehlerhaften Moduls: SHLWAPI.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x4ce7b9e2
Ausnahmecode: 0xc0000005
Fehleroffset: 0x7594f69b
ID des fehlerhaften Prozesses: 0x1560
Startzeit der fehlerhaften Anwendung: 0xpev.3XE0
Pfad der fehlerhaften Anwendung: pev.3XE1
Pfad des fehlerhaften Moduls: pev.3XE2
Berichtskennung: pev.3XE3

Error: (04/14/2014 08:33:39 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: pev.3XE, Version: 0.0.0.0, Zeitstempel: 0x4e06cfe8
Name des fehlerhaften Moduls: SHLWAPI.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x4ce7b9e2
Ausnahmecode: 0xc0000005
Fehleroffset: 0x7594f69b
ID des fehlerhaften Prozesses: 0x15e0
Startzeit der fehlerhaften Anwendung: 0xpev.3XE0
Pfad der fehlerhaften Anwendung: pev.3XE1
Pfad des fehlerhaften Moduls: pev.3XE2
Berichtskennung: pev.3XE3

Error: (04/14/2014 08:33:30 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: pev.3XE, Version: 0.0.0.0, Zeitstempel: 0x4e06cfe8
Name des fehlerhaften Moduls: SHLWAPI.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x4ce7b9e2
Ausnahmecode: 0xc0000005
Fehleroffset: 0x759345e3
ID des fehlerhaften Prozesses: 0x13f4
Startzeit der fehlerhaften Anwendung: 0xpev.3XE0
Pfad der fehlerhaften Anwendung: pev.3XE1
Pfad des fehlerhaften Moduls: pev.3XE2
Berichtskennung: pev.3XE3

Error: (04/14/2014 08:33:23 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: pev.3XE, Version: 0.0.0.0, Zeitstempel: 0x4e06cfe8
Name des fehlerhaften Moduls: SHLWAPI.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x4ce7b9e2
Ausnahmecode: 0xc0000005
Fehleroffset: 0x7592ca35
ID des fehlerhaften Prozesses: 0x1694
Startzeit der fehlerhaften Anwendung: 0xpev.3XE0
Pfad der fehlerhaften Anwendung: pev.3XE1
Pfad des fehlerhaften Moduls: pev.3XE2
Berichtskennung: pev.3XE3

Error: (04/14/2014 08:33:22 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: pev.3XE, Version: 0.0.0.0, Zeitstempel: 0x4e06cfe8
Name des fehlerhaften Moduls: SHLWAPI.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x4ce7b9e2
Ausnahmecode: 0xc0000005
Fehleroffset: 0x7592ca35
ID des fehlerhaften Prozesses: 0x13fc
Startzeit der fehlerhaften Anwendung: 0xpev.3XE0
Pfad der fehlerhaften Anwendung: pev.3XE1
Pfad des fehlerhaften Moduls: pev.3XE2
Berichtskennung: pev.3XE3

Error: (04/14/2014 08:33:11 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: pev.3XE, Version: 0.0.0.0, Zeitstempel: 0x4e06cfe8
Name des fehlerhaften Moduls: SHLWAPI.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x4ce7b9e2
Ausnahmecode: 0xc0000005
Fehleroffset: 0x759345bf
ID des fehlerhaften Prozesses: 0x1644
Startzeit der fehlerhaften Anwendung: 0xpev.3XE0
Pfad der fehlerhaften Anwendung: pev.3XE1
Pfad des fehlerhaften Moduls: pev.3XE2
Berichtskennung: pev.3XE3

Error: (04/14/2014 08:33:09 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: pev.3XE, Version: 0.0.0.0, Zeitstempel: 0x4e06cfe8
Name des fehlerhaften Moduls: SHLWAPI.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x4ce7b9e2
Ausnahmecode: 0xc0000005
Fehleroffset: 0x759345bf
ID des fehlerhaften Prozesses: 0x1234
Startzeit der fehlerhaften Anwendung: 0xpev.3XE0
Pfad der fehlerhaften Anwendung: pev.3XE1
Pfad des fehlerhaften Moduls: pev.3XE2
Berichtskennung: pev.3XE3

Error: (04/14/2014 08:33:04 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: pev.3XE, Version: 0.0.0.0, Zeitstempel: 0x4e06cfe8
Name des fehlerhaften Moduls: SHLWAPI.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x4ce7b9e2
Ausnahmecode: 0xc0000005
Fehleroffset: 0x759345e3
ID des fehlerhaften Prozesses: 0x17bc
Startzeit der fehlerhaften Anwendung: 0xpev.3XE0
Pfad der fehlerhaften Anwendung: pev.3XE1
Pfad des fehlerhaften Moduls: pev.3XE2
Berichtskennung: pev.3XE3

Error: (04/14/2014 08:32:47 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: pev.3XE, Version: 0.0.0.0, Zeitstempel: 0x4e06cfe8
Name des fehlerhaften Moduls: SHLWAPI.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x4ce7b9e2
Ausnahmecode: 0xc0000005
Fehleroffset: 0x7594f69b
ID des fehlerhaften Prozesses: 0x1ac8
Startzeit der fehlerhaften Anwendung: 0xpev.3XE0
Pfad der fehlerhaften Anwendung: pev.3XE1
Pfad des fehlerhaften Moduls: pev.3XE2
Berichtskennung: pev.3XE3


System errors:
=============
Error: (04/14/2014 08:35:10 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%-2140993535

Error: (04/14/2014 08:35:10 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler beendet: 
%%-2140993535

Error: (04/14/2014 08:35:10 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%-2140993535

Error: (04/14/2014 08:35:10 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler beendet: 
%%-2140993535

Error: (04/14/2014 08:35:10 PM) (Source: PNRPSvc) (User: )
Description: 0x80630801

Error: (04/14/2014 08:35:10 PM) (Source: PNRPSvc) (User: )
Description: 0x80630801

Error: (04/14/2014 08:34:16 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler beendet: 
%%-2140993535

Error: (04/14/2014 08:34:16 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%-2140993535

Error: (04/14/2014 08:34:16 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler beendet: 
%%-2140993535

Error: (04/14/2014 08:34:16 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%-2140993535


Microsoft Office Sessions:
=========================
Error: (04/14/2014 09:48:06 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestS:\DoWnLoAdSS\esetsmartinstaller_enu.exe

Error: (04/14/2014 08:34:00 PM) (Source: Application Error)(User: )
Description: pev.3XE0.0.0.04e06cfe8SHLWAPI.dll_unloaded0.0.0.04ce7b9e2c00000057594f69b156001cf58101ab2b2c3C:\ComboFix\pev.3XESHLWAPI.dll587e6e06-c403-11e3-ac8d-bc5ff48b78a9

Error: (04/14/2014 08:33:39 PM) (Source: Application Error)(User: )
Description: pev.3XE0.0.0.04e06cfe8SHLWAPI.dll_unloaded0.0.0.04ce7b9e2c00000057594f69b15e001cf58100db75452C:\ComboFix\pev.3XESHLWAPI.dll4b830f96-c403-11e3-ac8d-bc5ff48b78a9

Error: (04/14/2014 08:33:30 PM) (Source: Application Error)(User: )
Description: pev.3XE0.0.0.04e06cfe8SHLWAPI.dll_unloaded0.0.0.04ce7b9e2c0000005759345e313f401cf5810088dea99C:\ComboFix\pev.3XESHLWAPI.dll4659a5dc-c403-11e3-ac8d-bc5ff48b78a9

Error: (04/14/2014 08:33:23 PM) (Source: Application Error)(User: )
Description: pev.3XE0.0.0.04e06cfe8SHLWAPI.dll_unloaded0.0.0.04ce7b9e2c00000057592ca35169401cf5810047eca9aC:\ComboFix\pev.3XESHLWAPI.dll425cd55f-c403-11e3-ac8d-bc5ff48b78a9

Error: (04/14/2014 08:33:22 PM) (Source: Application Error)(User: )
Description: pev.3XE0.0.0.04e06cfe8SHLWAPI.dll_unloaded0.0.0.04ce7b9e2c00000057592ca3513fc01cf581003cdca0aC:\ComboFix\pev.3XESHLWAPI.dll419f9fcd-c403-11e3-ac8d-bc5ff48b78a9

Error: (04/14/2014 08:33:11 PM) (Source: Application Error)(User: )
Description: pev.3XE0.0.0.04e06cfe8SHLWAPI.dll_unloaded0.0.0.04ce7b9e2c0000005759345bf164401cf580ffd657793C:\ComboFix\pev.3XESHLWAPI.dll3b3d67d7-c403-11e3-ac8d-bc5ff48b78a9

Error: (04/14/2014 08:33:09 PM) (Source: Application Error)(User: )
Description: pev.3XE0.0.0.04e06cfe8SHLWAPI.dll_unloaded0.0.0.04ce7b9e2c0000005759345bf123401cf580ffb7714e6C:\ComboFix\pev.3XESHLWAPI.dll39d3c596-c403-11e3-ac8d-bc5ff48b78a9

Error: (04/14/2014 08:33:04 PM) (Source: Application Error)(User: )
Description: pev.3XE0.0.0.04e06cfe8SHLWAPI.dll_unloaded0.0.0.04ce7b9e2c0000005759345e317bc01cf580ff8d01087C:\ComboFix\pev.3XESHLWAPI.dll369a452a-c403-11e3-ac8d-bc5ff48b78a9

Error: (04/14/2014 08:32:47 PM) (Source: Application Error)(User: )
Description: pev.3XE0.0.0.04e06cfe8SHLWAPI.dll_unloaded0.0.0.04ce7b9e2c00000057594f69b1ac801cf580feecb0efcC:\ComboFix\pev.3XESHLWAPI.dll2c96ca3f-c403-11e3-ac8d-bc5ff48b78a9


CodeIntegrity Errors:
===================================
  Date: 2014-04-14 20:33:33.497
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-04-14 20:33:33.457
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info =========================== 

Percentage of memory in use: 37%
Total physical RAM: 8132.01 MB
Available physical RAM: 5069.13 MB
Total Pagefile: 16262.2 MB
Available Pagefile: 13026.66 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:111.69 GB) (Free:48.53 GB) NTFS
Drive j: (KINGSTON) (Removable) (Total:14.64 GB) (Free:12.07 GB) NTFS
Drive s: (SeagateBarracuda) (Fixed) (Total:1863.01 GB) (Free:993.62 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 112 GB) (Disk ID: A44346E1)

Partition: GPT Partition Type.

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: 78F8190E)
Partition 1: (Not Active) - (Size=-198626508800) - (Type=07 NTFS)

========================================================
Disk: 6 (MBR Code: Windows XP) (Size: 15 GB) (Disk ID: C3072E18)

Partition: GPT Partition Type.

==================== End Of Log ============================

zu

5. GMER

Code:

ATTFilter

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-04-14 21:57:45
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-1 Samsung_SSD_840_Series rev.DXT07B0Q 111,79GB
Running: Gmer-19357.exe; Driver: C:\Users\BBQPIT~1\AppData\Local\Temp\agtdafob.sys


---- Kernel code sections - GMER 2.1 ----

INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528                                                                                                                                                                      fffff800031fd000 63 bytes [00, 00, 00, 00, 00, 00, 00, ...]
INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 592                                                                                                                                                                      fffff800031fd040 6 bytes [7D, 03, 00, 00, 00, 00]

---- User code sections - GMER 2.1 ----

.text     C:\Windows\system32\wininit.exe[596] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                              000000007781ef8d 1 byte [62]
.text     C:\Windows\system32\services.exe[656] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                             000000007781ef8d 1 byte [62]
.text     C:\Windows\system32\lsass.exe[680] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                                000000007781ef8d 1 byte [62]
.text     C:\Windows\system32\winlogon.exe[756] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                             000000007781ef8d 1 byte [62]
.text     C:\Windows\system32\svchost.exe[832] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                              000000007781ef8d 1 byte [62]
.text     C:\Windows\system32\svchost.exe[936] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                              000000007781ef8d 1 byte [62]
.text     C:\Windows\system32\atiesrxx.exe[1008] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                            000000007781ef8d 1 byte [62]
.text     C:\Windows\System32\svchost.exe[316] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                              000000007781ef8d 1 byte [62]
.text     C:\Windows\System32\svchost.exe[488] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                              000000007781ef8d 1 byte [62]
.text     C:\Windows\system32\svchost.exe[388] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                              000000007781ef8d 1 byte [62]
.text     C:\Windows\system32\svchost.exe[812] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                              000000007781ef8d 1 byte [62]
.text     C:\Windows\system32\svchost.exe[1144] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                             000000007781ef8d 1 byte [62]
.text     C:\Windows\system32\svchost.exe[1280] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                             000000007781ef8d 1 byte [62]
.text     C:\Windows\system32\atieclxx.exe[1352] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                            000000007781ef8d 1 byte [62]
.text     C:\Windows\system32\Dwm.exe[1584] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                                 000000007781ef8d 1 byte [62]
.text     C:\Windows\System32\spoolsv.exe[1896] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                             000000007781ef8d 1 byte [62]
.text     C:\Windows\system32\taskhost.exe[1996] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                            000000007781ef8d 1 byte [62]
.text     C:\Windows\system32\svchost.exe[2004] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                             000000007781ef8d 1 byte [62]
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1468] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                                                                00000000763fa2fd 1 byte [62]
.text     S:\GaMeZ\Tribes Ascend\HiPatchService.exe[2108] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189                                                                                                                                   000000007781ef8d 1 byte [62]
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2116] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                             000000007781ef8d 1 byte [62]
.text     C:\Program Files\Microsoft IntelliPoint\ipoint.exe[2140] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                          000000007781ef8d 1 byte [62]
.text     C:\Program Files\Windows Sidebar\sidebar.exe[2244] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                000000007781ef8d 1 byte [62]
.text     C:\Program Files (x86)\Skype\Phone\Skype.exe[2432] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                                                                                00000000763fa2fd 1 byte [62]
.text     C:\Program Files (x86)\Skype\Phone\Skype.exe[2432] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                              0000000075c91465 2 bytes [C9, 75]
.text     C:\Program Files (x86)\Skype\Phone\Skype.exe[2432] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                             0000000075c914bb 2 bytes [C9, 75]
.text     ...                                                                                                                                                                                                                                     * 2
.text     C:\Windows\SysWOW64\PnkBstrA.exe[2884] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                                                                                            00000000763fa2fd 1 byte [62]
.text     C:\Windows\SysWOW64\PnkBstrA.exe[2884] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 322                                                                                                                                                 0000000075471a22 2 bytes [47, 75]
.text     C:\Windows\SysWOW64\PnkBstrA.exe[2884] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 496                                                                                                                                                 0000000075471ad0 2 bytes [47, 75]
.text     C:\Windows\SysWOW64\PnkBstrA.exe[2884] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 552                                                                                                                                                 0000000075471b08 2 bytes [47, 75]
.text     C:\Windows\SysWOW64\PnkBstrA.exe[2884] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 730                                                                                                                                                 0000000075471bba 2 bytes [47, 75]
.text     C:\Windows\SysWOW64\PnkBstrA.exe[2884] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 762                                                                                                                                                 0000000075471bda 2 bytes [47, 75]
.text     C:\Windows\SysWOW64\PnkBstrA.exe[2884] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                                          0000000075c91465 2 bytes [C9, 75]
.text     C:\Windows\SysWOW64\PnkBstrA.exe[2884] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                                         0000000075c914bb 2 bytes [C9, 75]
.text     ...                                                                                                                                                                                                                                     * 2
.text     C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[2688] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                                                                  00000000763fa2fd 1 byte [62]
.text     C:\Program Files (x86)\PDF24\pdf24.exe[3208] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                                                                                      00000000763fa2fd 1 byte [62]
.text     C:\Program Files\AVAST Software\Avast\AvastUI.exe[3256] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter                                                                                                                    00000000763d8791 8 bytes [31, C0, C2, 04, 00, 90, 90, ...]
.text     C:\Program Files\AVAST Software\Avast\AvastUI.exe[3256] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                                                                           00000000763fa2fd 1 byte [62]
.text     C:\Program Files\AVAST Software\Avast\AvastUI.exe[3256] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                         0000000075c91465 2 bytes [C9, 75]
.text     C:\Program Files\AVAST Software\Avast\AvastUI.exe[3256] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                        0000000075c914bb 2 bytes [C9, 75]
.text     ...                                                                                                                                                                                                                                     * 2
.text     C:\Program Files (x86)\DAEMON Tools Lite\DTShellHlp.exe[2448] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                                                                     00000000763fa2fd 1 byte [62]
.text     C:\Windows\system32\svchost.exe[4112] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                             000000007781ef8d 1 byte [62]
.text     C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[4160] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                     000000007781ef8d 1 byte [62]
.text     C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[4360] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                    000000007781ef8d 1 byte [62]
.text     C:\Windows\system32\svchost.exe[5204] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                             000000007781ef8d 1 byte [62]
.text     C:\Windows\system32\svchost.exe[5748] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                             000000007781ef8d 1 byte [62]
.text     C:\Windows\System32\WUDFHost.exe[5908] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                            000000007781ef8d 1 byte [62]
.text     C:\Program Files\Windows Media Player\wmpnetwk.exe[5968] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                          000000007781ef8d 1 byte [62]
.text     C:\Windows\System32\svchost.exe[6104] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                             000000007781ef8d 1 byte [62]
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[6860] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112                                                                                               00000000763fa2fd 1 byte [62]
.text     C:\Windows\explorer.exe[1416] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                                     000000007781ef8d 1 byte [62]
.text     C:\Users\BBQPitBoyz\Desktop\Gmer-19357.exe[2424] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                                                                                  00000000763fa2fd 1 byte [62]
---- Processes - GMER 2.1 ----

Library   C:\Users\BBQPitBoyz\AppData\Local\Microsoft\Windows Sidebar\Gadgets\CoreTempGadget.gadget\CoreTempReader.dll (*** suspicious ***) @ C:\Program Files\Windows Sidebar\sidebar.exe [2244](2013-04-17 17:17:52)                            00000000741b0000
Library   C:\Users\BBQPitBoyz\AppData\Local\Microsoft\Windows Sidebar\Gadgets\CoreTempGadget.gadget\GetCoreTempInfoNET.dll (*** suspicious ***) @ C:\Program Files\Windows Sidebar\sidebar.exe [2244](2013-04-17 17:17:52)                        0000000074180000
Library   C:\Users\BBQPitBoyz\AppData\Local\Microsoft\Windows Sidebar\Gadgets\CoreTempGadget.gadget\SystemInfo.dll (*** suspicious ***) @ C:\Program Files\Windows Sidebar\sidebar.exe [2244](2013-04-17 17:17:52)                                0000000074100000
Library   C:\Users\BBQPitBoyz\AppData\Local\Microsoft\Windows Sidebar\Gadgets\GPUObserver37.gadget\GPUStatusReader.dll (*** suspicious ***) @ C:\Program Files\Windows Sidebar\sidebar.exe [2244] (GPUStatusReader/Orbmu2k)(2013-04-20 17:02:25)  0000000071700000

---- EOF - GMER 2.1 ----

Jetzt müsste alles komplett sein. Danke schonmal.

schrauber · 16.04.2014, 10:15

hi,

Revo Uninstaller - Download - Filepony
Damit alles deinstallieren was Du in der Additional.txt findest mit dem Zusatz <== ATTENTION

Mit Revo auch Moderat die Reste entfernen lassen.

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

bowiewowie · 16.04.2014, 17:23

Hallo Schrauber, ich habe 2 Programme mit Revo entfernt und danach Combofix drüberlaufen lassen. Allerdings ist dieses fake "plugin"-Layer immer noch vorhanden.

Noch ne Idee?

Hier die Combofix Logfile:

Code:

ATTFilter

ComboFix 14-04-12.01 - BBQPitBoyz 16.04.2014  18:09:25.2.4 - x64
Microsoft Windows 7 Professional   6.1.7601.1.1252.49.1031.18.8132.6094 [GMT 2:00]
ausgeführt von:: c:\users\BBQPitBoyz\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((   Dateien erstellt von 2014-03-16 bis 2014-04-16  ))))))))))))))))))))))))))))))
.
.
2014-04-16 16:11 . 2014-04-16 16:11	--------	d-----w-	c:\users\Default\AppData\Local\temp
2014-04-16 16:02 . 2014-04-16 16:02	--------	d-----w-	c:\program files (x86)\VS Revo Group
2014-04-15 12:00 . 2014-03-07 04:43	10521840	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{CC104631-EF71-454E-9177-195DA7AE6307}\mpengine.dll
2014-04-15 05:32 . 2014-04-15 05:32	--------	d-----w-	c:\program files\Microsoft.NET
2014-04-14 19:58 . 2014-04-14 19:58	--------	d-----w-	c:\users\BBQPitBoyz\AppData\Local\ElevatedDiagnostics
2014-04-14 19:51 . 2014-04-14 19:51	--------	d-----w-	C:\FRST
2014-04-14 18:38 . 2014-04-14 18:38	--------	d-----w-	c:\program files (x86)\ESET
2014-04-13 18:07 . 2014-04-13 18:07	96168	----a-w-	c:\windows\SysWow64\WindowsAccessBridge-32.dll
2014-04-13 17:57 . 2014-04-13 17:59	--------	d-----w-	c:\programdata\IePluginService
2014-04-13 17:57 . 2014-04-13 17:57	--------	d-----w-	c:\program files (x86)\SupTab
2014-04-13 17:57 . 2014-04-13 17:57	--------	d-----w-	c:\users\BBQPitBoyz\AppData\Roaming\SupTab
2014-04-13 17:57 . 2014-04-15 19:37	--------	d-----w-	c:\programdata\WPM
2014-04-13 17:57 . 2014-04-13 17:57	--------	d-----w-	c:\program files (x86)\BrowseMark
2014-04-13 17:41 . 2014-04-13 17:41	--------	d-----w-	c:\program files (x86)\Common Files\Java
2014-04-13 12:37 . 2014-04-13 12:37	--------	d-----w-	c:\users\BBQPitBoyz\AppData\Roaming\Krautscape
2014-04-11 21:53 . 2014-04-11 21:53	--------	d-sh--w-	c:\users\BBQPitBoyz\AppData\Local\EmieUserList
2014-04-11 21:53 . 2014-04-11 21:53	--------	d-sh--w-	c:\users\BBQPitBoyz\AppData\Local\EmieSiteList
2014-04-10 04:18 . 2014-02-04 02:35	190912	----a-w-	c:\windows\system32\drivers\storport.sys
2014-04-08 15:59 . 2014-04-08 15:59	--------	d-----w-	c:\users\BBQPitBoyz\AppData\Roaming\AVAST Software
2014-04-08 04:59 . 2014-04-13 17:38	312728	----a-w-	c:\windows\system32\javaws.exe
2014-04-08 04:59 . 2014-04-13 17:38	111000	----a-w-	c:\windows\system32\WindowsAccessBridge-64.dll
2014-04-08 04:59 . 2014-04-13 17:38	191384	----a-w-	c:\windows\system32\javaw.exe
2014-04-08 04:59 . 2014-04-13 17:37	190872	----a-w-	c:\windows\system32\java.exe
2014-04-08 04:59 . 2014-04-13 18:06	--------	d-----w-	c:\program files\Java
2014-04-08 04:46 . 2014-04-08 04:46	84816	----a-w-	c:\windows\system32\drivers\aswStm.sys
2014-04-08 04:46 . 2014-04-08 04:46	43152	----a-w-	c:\windows\avastSS.scr
2014-03-28 20:20 . 2014-04-14 15:52	--------	d-----r-	c:\users\BBQPitBoyz\Dropbox
2014-03-22 21:20 . 2014-03-22 21:20	--------	d-----w-	c:\users\BBQPitBoyz\AppData\Local\AlbumArtDownloader
2014-03-22 21:20 . 2014-03-22 21:20	--------	d-----w-	c:\program files\AlbumArtDownloader
2014-03-22 07:56 . 2014-03-22 07:56	--------	d-----w-	c:\users\BBQPitBoyz\AppData\Local\Skype
2014-03-22 07:56 . 2014-03-22 07:56	--------	d-----w-	c:\program files (x86)\Common Files\Skype
2014-03-22 07:56 . 2014-03-22 07:56	--------	d-----r-	c:\program files (x86)\Skype
2014-03-21 20:20 . 2014-03-21 20:21	--------	d-----w-	c:\users\BBQPitBoyz\AppData\Local\Arma 3
2014-03-21 20:20 . 2014-03-21 20:20	--------	d-----w-	c:\programdata\Bohemia Interactive
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-04-13 15:51 . 2013-04-18 21:47	214392	----a-w-	c:\windows\SysWow64\PnkBstrB.exe
2014-04-13 15:42 . 2013-04-18 21:47	214392	----a-w-	c:\windows\SysWow64\PnkBstrB.ex0
2014-04-12 07:35 . 2013-04-17 15:36	70832	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-04-12 07:35 . 2013-04-17 15:36	692400	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2014-04-10 04:28 . 2013-11-09 20:51	90655440	----a-w-	c:\windows\system32\MRT.exe
2014-04-08 04:46 . 2013-04-17 15:09	93568	----a-w-	c:\windows\system32\drivers\aswRdr2.sys
2014-04-08 04:46 . 2013-04-17 15:09	79184	----a-w-	c:\windows\system32\drivers\aswMonFlt.sys
2014-04-08 04:46 . 2013-04-17 15:09	65776	----a-w-	c:\windows\system32\drivers\aswRvrt.sys
2014-04-08 04:46 . 2013-04-17 15:09	423240	----a-w-	c:\windows\system32\drivers\aswSP.sys
2014-04-08 04:46 . 2013-04-17 15:09	334648	----a-w-	c:\windows\system32\aswBoot.exe
2014-04-08 04:46 . 2013-04-17 15:09	208928	----a-w-	c:\windows\system32\drivers\aswVmm.sys
2014-04-08 04:46 . 2013-04-17 15:09	1039096	----a-w-	c:\windows\system32\drivers\aswSnx.sys
2014-03-04 09:17 . 2014-04-10 04:18	44032	----a-w-	c:\windows\apppatch\acwow64.dll
2014-02-07 01:23 . 2014-03-13 19:50	3156480	----a-w-	c:\windows\system32\win32k.sys
2014-02-04 02:32 . 2014-03-13 19:48	1424384	----a-w-	c:\windows\system32\WindowsCodecs.dll
2014-02-04 02:32 . 2014-03-13 19:48	624128	----a-w-	c:\windows\system32\qedit.dll
2014-02-04 02:04 . 2014-03-13 19:48	1230336	----a-w-	c:\windows\SysWow64\WindowsCodecs.dll
2014-02-04 02:04 . 2014-03-13 19:48	509440	----a-w-	c:\windows\SysWow64\qedit.dll
2014-01-29 02:32 . 2014-03-13 19:50	484864	----a-w-	c:\windows\system32\wer.dll
2014-01-29 02:06 . 2014-03-13 19:50	381440	----a-w-	c:\windows\SysWow64\wer.dll
2014-01-28 02:32 . 2014-03-13 19:50	228864	----a-w-	c:\windows\system32\wwansvc.dll
2014-01-24 16:13 . 2014-01-24 16:13	37008	----a-w-	c:\windows\system32\FM20DEU.DLL
2014-01-23 14:05 . 2014-01-23 14:05	1683112	----a-w-	c:\windows\system32\FM20.DLL
2014-01-22 07:52 . 2014-01-22 07:52	206080	----a-w-	c:\windows\system32\drivers\ssudmdm.sys
2014-01-22 07:52 . 2014-01-22 07:52	108800	----a-w-	c:\windows\system32\drivers\ssudbus.sys
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}]
2014-04-11 02:07	513648	----a-w-	c:\program files (x86)\SupTab\SupTab.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{bff3225c-247b-41b3-8ec7-0724c8618e03}]
2014-03-11 18:25	249632	----a-w-	c:\program files (x86)\BrowseMark\BrowseMarkBHO.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro1 (ErrorConflict)]
@="{8BA85C75-763B-4103-94EB-9470F12FE0F7}"
[HKEY_CLASSES_ROOT\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7}]
2014-03-12 18:13	1728216	----a-w-	c:\progra~2\MICROS~1\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro2 (SyncInProgress)]
@="{CD55129A-B1A1-438E-A425-CEBC7DC684EE}"
[HKEY_CLASSES_ROOT\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE}]
2014-03-12 18:13	1728216	----a-w-	c:\progra~2\MICROS~1\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro3 (InSync)]
@="{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}"
[HKEY_CLASSES_ROOT\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}]
2014-03-12 18:13	1728216	----a-w-	c:\progra~2\MICROS~1\Office15\GROOVEEX.DLL
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
"Screenpresso"="c:\users\BBQPitBoyz\AppData\Local\Learnpulse\Screenpresso\Screenpresso.exe" [2014-03-12 10256912]
"puush"="c:\program files (x86)\puush\puush.exe" [2014-01-08 567880]
"GoogleChromeAutoLaunch_EF836093D41F1E88A6425FE21F6CFE69"="c:\users\BBQPitBoyz\AppData\Local\Google\Chrome\Application\chrome.exe" [2014-04-02 841032]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2014-02-10 20922016]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe" [2012-09-12 56128]
"ControlCenter3"="c:\program files (x86)\Brother\ControlCenter3\brctrcen.exe" [2008-12-24 114688]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe" [2013-11-07 766208]
"PDFPrint"="c:\program files (x86)\PDF24\pdf24.exe" [2013-10-28 185896]
"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2014-04-08 3854640]
.
c:\users\BBQPitBoyz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Core Temp.exe [2013-3-1 763856]
CoreTemp.ini [2013-12-9 1237]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
"AppInit_DLLs"=c:\progra~2\SupTab\SearchProtect32.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute	REG_MULTI_SZ   	autocheck autochk *\0sdnclean64.exe
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 IAStorDataMgrSvc;Intel(R) Rapid Storage-Technologie;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
R2 IePluginService;IePlugin Service;c:\programdata\IePluginService\PluginService.exe;c:\programdata\IePluginService\PluginService.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 AsrCDDrv;AsrCDDrv;c:\windows\SysWOW64\Drivers\AsrCDDrv.sys;c:\windows\SysWOW64\Drivers\AsrCDDrv.sys [x]
R3 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys;c:\windows\SYSNATIVE\drivers\aswStm.sys [x]
R3 CGVPNCliSrvc;CyberGhost VPN Client;c:\program files\CyberGhost VPN\CGVPNCliService.exe;c:\program files\CyberGhost VPN\CGVPNCliService.exe [x]
R3 cpuz136;cpuz136;c:\windows\TEMP\cpuz136\cpuz136_x64.sys;c:\windows\TEMP\cpuz136\cpuz136_x64.sys [x]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 Futuremark SystemInfo Service;Futuremark SystemInfo Service;c:\program files (x86)\Futuremark\Futuremark SystemInfo\FMSISvc.exe;c:\program files (x86)\Futuremark\Futuremark SystemInfo\FMSISvc.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\drivers\nusb3hub.sys;c:\windows\SYSNATIVE\drivers\nusb3hub.sys [x]
R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\drivers\nusb3xhc.sys;c:\windows\SYSNATIVE\drivers\nusb3xhc.sys [x]
R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 ssudmdm;SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 vtcdrv;VTC Driver v5.0.0.3;c:\windows\system32\DRIVERS\vtcdrv.sys;c:\windows\SYSNATIVE\DRIVERS\vtcdrv.sys [x]
S0 aswRvrt;avast! Revert; [x]
S0 aswVmm;avast! VM Monitor; [x]
S0 iaStorA;iaStorA;c:\windows\system32\DRIVERS\iaStorA.sys;c:\windows\SYSNATIVE\DRIVERS\iaStorA.sys [x]
S0 iaStorF;iaStorF;c:\windows\system32\DRIVERS\iaStorF.sys;c:\windows\SYSNATIVE\DRIVERS\iaStorF.sys [x]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys;c:\windows\SYSNATIVE\drivers\aswSnx.sys [x]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys;c:\windows\SYSNATIVE\drivers\aswSP.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]
S2 HiPatchService;Hi-Rez Studios Authenticate and Update Service;s:\gamez\Tribes Ascend\HiPatchService.exe;s:\gamez\Tribes Ascend\HiPatchService.exe [x]
S3 ALSysIO;ALSysIO;c:\users\BBQPIT~1\AppData\Local\Temp\ALSysIO64.sys;c:\users\BBQPIT~1\AppData\Local\Temp\ALSysIO64.sys [x]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]
S3 MBfilt;MBfilt;c:\windows\system32\drivers\MBfilt64.sys;c:\windows\SYSNATIVE\drivers\MBfilt64.sys [x]
S3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys;c:\windows\SYSNATIVE\DRIVERS\point64.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2014-04-16 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-07-15 07:35]
.
2014-04-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-04-22 19:50]
.
2014-04-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-04-22 19:50]
.
2014-04-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2923481869-3162173556-2377066677-1000Core.job
- c:\users\BBQPitBoyz\AppData\Local\Google\Update\GoogleUpdate.exe [2013-09-19 10:00]
.
2014-04-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2923481869-3162173556-2377066677-1000UA.job
- c:\users\BBQPitBoyz\AppData\Local\Google\Update\GoogleUpdate.exe [2013-09-19 10:00]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro1 (ErrorConflict)]
@="{8BA85C75-763B-4103-94EB-9470F12FE0F7}"
[HKEY_CLASSES_ROOT\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7}]
2014-03-12 18:10	2333400	----a-w-	c:\progra~1\MICROS~3\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro2 (SyncInProgress)]
@="{CD55129A-B1A1-438E-A425-CEBC7DC684EE}"
[HKEY_CLASSES_ROOT\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE}]
2014-03-12 18:10	2333400	----a-w-	c:\progra~1\MICROS~3\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro3 (InSync)]
@="{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}"
[HKEY_CLASSES_ROOT\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}]
2014-03-12 18:10	2333400	----a-w-	c:\progra~1\MICROS~3\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2014-04-08 04:46	290888	----a-w-	c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2012-07-13 12936848]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2011-08-01 2417032]
"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2010-07-21 2306448]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\progra~2\SupTab\SearchProtect64.dll
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = about:blank
mDefault_Search_URL = hxxp://www.sweet-page.com/web/?type=ds&ts=1397411834&from=cor&uid=SamsungXSSDX840XSeries_S14CNEAD305402K&q={searchTerms}
mDefault_Page_URL = about:blank
mStart Page = about:blank
mLocal Page = c:\windows\SysWOW64\blank.htm
mSearch Page = hxxp://www.sweet-page.com/web/?type=ds&ts=1397411834&from=cor&uid=SamsungXSSDX840XSeries_S14CNEAD305402K&q={searchTerms}
IE: An OneNote s&enden - c:\progra~1\MICROS~3\Office15\ONBttnIE.dll/105
IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MICROS~3\Office15\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.0.1
Filter: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - c:\program files (x86)\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL
FF - ProfilePath - c:\users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\
FF - prefs.js: network.proxy.type - 0
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-2923481869-3162173556-2377066677-1000\Software\SecuROM\License information*]
"datasecu"=hex:e3,83,e3,5f,20,73,ee,15,e7,fc,88,07,22,06,87,56,d8,9d,d4,db,1b,
   8b,92,8d,66,66,18,65,24,42,13,02,4f,27,c1,f8,75,05,e9,f1,29,27,83,5d,59,1d,\
"rkeysecu"=hex:5b,b5,24,50,93,e4,52,d9,04,b2,c6,1f,89,5e,58,ee
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-04-16  18:12:59
ComboFix-quarantined-files.txt  2014-04-16 16:12
ComboFix2.txt  2014-04-14 18:34
.
Vor Suchlauf: 19 Verzeichnis(se), 53.101.535.232 Bytes frei
Nach Suchlauf: 20 Verzeichnis(se), 52.925.231.104 Bytes frei
.
- - End Of File - - 29E5F610F74E9BA7E1F9FB05305847A4
A36C5E4F47E84449FF07ED3517B43A31

schrauber · 17.04.2014, 10:15

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

bowiewowie · 17.04.2014, 15:32

ok, hier 4 Logs, bei Malwarebytes hat er ordentlich zugelangt:

1.MALEWAREBYTES

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 17.04.2014
Suchlauf-Zeit: 16:10:29
Logdatei: MBAM1.txt
Administrator: Ja

Version: 2.00.1.1004
Malware Datenbank: v2014.04.17.04
Rootkit Datenbank: v2014.03.27.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Chameleon: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: BBQPitBoyz

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 260336
Verstrichene Zeit: 7 Min, 40 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Aktiviert
Shuriken: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registrierungsschlüssel: 11
PUP.Optional.BrowseMark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{bff3225c-247b-41b3-8ec7-0724c8618e03}, In Quarantäne, [06fa946cb050c13f76a8b8b844be7a86], 
PUP.Optional.BrowseMark.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{42574a0b-361e-4a87-8637-101cf9460c17}, In Quarantäne, [06fa946cb050c13f76a8b8b844be7a86], 
PUP.Optional.BrowseMark.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{329F2EC4-9BCC-434E-939C-A52E3922B04A}, In Quarantäne, [06fa946cb050c13f76a8b8b844be7a86], 
PUP.Optional.BrowseMark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{329F2EC4-9BCC-434E-939C-A52E3922B04A}, In Quarantäne, [06fa946cb050c13f76a8b8b844be7a86], 
PUP.Optional.BrowseMark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{42574a0b-361e-4a87-8637-101cf9460c17}, In Quarantäne, [06fa946cb050c13f76a8b8b844be7a86], 
PUP.Optional.BrowseMark.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{BFF3225C-247B-41B3-8EC7-0724C8618E03}, In Quarantäne, [06fa946cb050c13f76a8b8b844be7a86], 
PUP.Optional.BrowseMark.A, HKU\S-1-5-21-2923481869-3162173556-2377066677-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{BFF3225C-247B-41B3-8EC7-0724C8618E03}, In Quarantäne, [06fa946cb050c13f76a8b8b844be7a86], 
PUP.Optional.BrowseMark.A, HKU\S-1-5-21-2923481869-3162173556-2377066677-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{BFF3225C-247B-41B3-8EC7-0724C8618E03}, In Quarantäne, [06fa946cb050c13f76a8b8b844be7a86], 
PUP.Optional.BrowseMark.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\BrowseMark, In Quarantäne, [06fa946cb050c13f76a8b8b844be7a86], 
PUP.Optional.BrowseMark.A, HKLM\SOFTWARE\WOW6432NODE\BrowseMark, In Quarantäne, [0bf5857b966ad72934eca2ce05fd09f7], 
PUP.Optional.BrowseMark.A, HKU\S-1-5-21-2923481869-3162173556-2377066677-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\BrowseMark, In Quarantäne, [926e7d832fd107f93de29ad6bf43dd23], 

Registrierungswerte: 0
(No malicious items detected)

Registrierungsdaten: 1
PUP.Optional.Qone8, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Gut: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Schlecht: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),Ersetzt,[43bd28d8837d57a96a6147df6d970cf4]

Ordner: 1
PUP.Optional.BrowseMark.A, C:\Program Files (x86)\BrowseMark, In Quarantäne, [06fa946cb050c13f76a8b8b844be7a86], 

Dateien: 5
PUP.Optional.BrowseMark.A, C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\extensions\firefox@browsemark.net.xpi, In Quarantäne, [4cb4e91760a08080ef2daec27a88d32d], 
PUP.Optional.BrowseMark.A, C:\Program Files (x86)\BrowseMark\BrowseMark.ico, In Quarantäne, [06fa946cb050c13f76a8b8b844be7a86], 
PUP.Optional.BrowseMark.A, C:\Program Files (x86)\BrowseMark\BrowseMarkBHO.dll, In Quarantäne, [06fa946cb050c13f76a8b8b844be7a86], 
PUP.Optional.BrowseMark.A, C:\Program Files (x86)\BrowseMark\BrowseMarkUninstall.exe, In Quarantäne, [06fa946cb050c13f76a8b8b844be7a86], 
Trojan.Agent, C:\Users\BBQPitBoyz\WinRAR.exe, In Quarantäne, [f30dc53b0df309f7e234363f7c865ca4], 

Physische Sektoren: 0
(No malicious items detected)


(end)

2.ADW CLEANER

Code:

ATTFilter

# AdwCleaner v3.023 - Bericht erstellt am 17/04/2014 um 16:17:14
# Aktualisiert 01/04/2014 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzername : BBQPitBoyz - BBQPITBOYZ-PC
# Gestartet von : C:\Users\BBQPitBoyz\Desktop\AdwCleaner.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****


***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17041


-\\ Mozilla Firefox v28.0 (de)

[ Datei : C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\prefs.js ]


-\\ Google Chrome v

[ Datei : C:\Users\BBQPitBoyz\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [14368 octets] - [16/04/2014 18:28:40]
AdwCleaner[R1].txt - [1063 octets] - [17/04/2014 16:15:21]
AdwCleaner[R2].txt - [1124 octets] - [17/04/2014 16:16:40]
AdwCleaner[S0].txt - [13483 octets] - [16/04/2014 18:29:25]
AdwCleaner[S1].txt - [1046 octets] - [17/04/2014 16:17:14]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [1106 octets] ##########

3.Junkware REMOVAL TOOL

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Professional x64
Ran by BBQPitBoyz on 17.04.2014 at 16:20:00,11
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs
Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\\DisplayName
Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\\URL



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-2923481869-3162173556-2377066677-1000\Software\sweetim



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\drivergenius"
Successfully deleted: [Folder] "C:\Program Files (x86)\drivergenius"
Successfully deleted: [Folder] "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\driver genius"



~~~ FireFox

Successfully deleted: [Folder] C:\Users\BBQPitBoyz\AppData\Roaming\mozilla\firefox\profiles\t4p4ixn4.default\extensions\staged
Emptied folder: C:\Users\BBQPitBoyz\AppData\Roaming\mozilla\firefox\profiles\t4p4ixn4.default\minidumps [68 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 17.04.2014 at 16:24:39,04
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

4. Neues FRST - diesmal nur 1 txt

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 17-04-2014
Ran by BBQPitBoyz (administrator) on BBQPITBOYZ-PC on 17-04-2014 16:26:43
Running from C:\Users\BBQPitBoyz\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Microsoft Corporation) C:\Program Files\Microsoft IntelliPoint\ipoint.exe
(Microsoft Corporation) C:\Program Files\Microsoft IntelliType Pro\itype.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Learnpulse) C:\Users\BBQPitBoyz\AppData\Local\Learnpulse\Screenpresso\Screenpresso.exe
() C:\Program Files (x86)\puush\puush.exe
(Hi-Rez Studios) S:\GaMeZ\Tribes Ascend\HiPatchService.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
() C:\Users\BBQPitBoyz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Core Temp.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.23.9\GoogleCrashHandler.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.23.9\GoogleCrashHandler64.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Disc Soft Ltd) C:\Program Files (x86)\DAEMON Tools Lite\DTShellHlp.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12936848 2012-07-13] (Realtek Semiconductor)
HKLM\...\Run: [IntelliPoint] => C:\Program Files\Microsoft IntelliPoint\ipoint.exe [2417032 2011-08-01] (Microsoft Corporation)
HKLM\...\Run: [itype] => C:\Program Files\Microsoft IntelliType Pro\itype.exe [2306448 2010-07-21] (Microsoft Corporation)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [285240 2012-09-01] (Intel Corporation)
HKLM-x32\...\Run: [ControlCenter3] => C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-11-07] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [185896 2013-10-28] (Geek Software GmbH)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [3854640 2014-04-08] (AVAST Software)
HKU\S-1-5-21-2923481869-3162173556-2377066677-1000\...\Run: [Screenpresso] => C:\Users\BBQPitBoyz\AppData\Local\Learnpulse\Screenpresso\Screenpresso.exe [10256912 2014-03-12] (Learnpulse)
HKU\S-1-5-21-2923481869-3162173556-2377066677-1000\...\Run: [puush] => C:\Program Files (x86)\puush\puush.exe [567880 2014-01-08] ()
HKU\S-1-5-21-2923481869-3162173556-2377066677-1000\...\Run: [GoogleChromeAutoLaunch_EF836093D41F1E88A6425FE21F6CFE69] => C:\Users\BBQPitBoyz\AppData\Local\Google\Chrome\Application\chrome.exe [841032 2014-04-02] (Google Inc.)
HKU\S-1-5-21-2923481869-3162173556-2377066677-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [20922016 2014-02-10] (Skype Technologies S.A.)
AppInit_DLLs: C:\PROGRA~2\SupTab\SearchProtect64.dll => C:\PROGRA~2\SupTab\SearchProtect64.dll File Not Found
Startup: C:\Users\BBQPitBoyz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Core Temp.exe ()
Startup: C:\Users\BBQPitBoyz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CoreTemp.ini ()

==================== Internet (Whitelisted) ====================

ProxyServer: :0
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=ironmsd04&cd=2XzuyEtN2Y1L1Qzu0B0CyD0F0FyEzz0ByBzz0AzyzzyD0AzztN0D0Tzu0SyEyBtAtN1L2XzutBtFtBtFtCtFyDtCyDtN1L1Czu1L1C1F1G1H1B1QtDyE&cr=1744334573&ir=
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=ironmsd04&cd=2XzuyEtN2Y1L1Qzu0B0CyD0F0FyEzz0ByBzz0AzyzzyD0AzztN0D0Tzu0SyEyBtAtN1L2XzutBtFtBtFtCtFyDtCyDtN1L1Czu1L1C1F1G1H1B1QtDyE&cr=1744334573&ir=
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search
BHO: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre8\bin\ssv.dll (Oracle Corporation)
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre8\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  No File
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL (Microsoft Corporation)
Handler: saphtmlp - {D1F8BD1E-7967-11D2-B43A-006094B9EADB} -  No File
Handler: sapr3 - {D1F8BD1E-7967-11D2-B43A-006094B9EADB} -  No File
Handler-x32: saphtmlp - {D1F8BD1E-7967-11D2-B43A-006094B9EADB} - s:\programme\sapgui\saphtmlp.dll (SAP, Walldorf)
Handler-x32: sapr3 - {D1F8BD1E-7967-11D2-B43A-006094B9EADB} - s:\programme\sapgui\saphtmlp.dll (SAP, Walldorf)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default
FF Homepage: gmx.de|youtube.de/subscriptions|mydealz.de
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_182.dll ()
FF Plugin: @java.com/DTPlugin,version=11.0.2 - C:\Program Files\Java\jre8\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.0.2 - C:\Program Files\Java\jre8\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MICROS~3\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.6 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_182.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1210150.dll (Adobe Systems, Inc.)
FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=2.1.4 - C:\Program Files (x86)\Battlelog Web Plugins\2.1.4\npesnlaunch.dll No File
FF Plugin-x32: @esn/npbattlelog,version=2.3.1 - C:\Program Files (x86)\Battlelog Web Plugins\2.3.1\npbattlelog.dll (EA Digital Illusions CE AB)
FF Plugin-x32: @esn/npbattlelog,version=2.3.2 - C:\Program Files (x86)\Battlelog Web Plugins\2.3.2\npbattlelog.dll (EA Digital Illusions CE AB)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 - C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @stonetrip.com/ShiVaWebPlayer,version=1.8.0.0 - C:\Users\BBQPitBoyz\AppData\Roaming\..\LocalLow\StoneTrip\Web Player\npShiVa3D.dll (StoneTrip)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\BBQPitBoyz\AppData\Local\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\BBQPitBoyz\AppData\Local\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\BBQPitBoyz\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Flash Video Downloader - Full HD Download - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\artur.dubovoy@gmail.com [2014-03-09]
FF Extension: German Dictionary - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\de-DE@dictionaries.addons.mozilla.org [2013-08-08]
FF Extension: United States English Spellchecker - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\en-US@dictionaries.addons.mozilla.org [2013-08-08]
FF Extension: YouTube Unblocker - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\youtubeunblocker@unblocker.yt [2014-03-14]
FF Extension: WOT - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2013-11-27]
FF Extension: Snip-Me - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\addon@snip-me.de.xpi [2013-04-17]
FF Extension: Add to Amazon Wish List Button - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\amznUWL2@amazon.com.xpi [2013-04-17]
FF Extension: Ghostery - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\firefox@ghostery.com.xpi [2013-08-03]
FF Extension: FastestFox - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\smarterwiki@wikiatic.com.xpi [2013-04-17]
FF Extension: Free Hide IP - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\support@free-hideip.com.xpi [2013-05-14]
FF Extension: GMX MailCheck - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\toolbar@gmx.net.xpi [2013-08-15]
FF Extension: YouTube to MP3 - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\youtube2mp3@mondayx.de.xpi [2013-04-17]
FF Extension: {0aa6a016-77fb-4f7b-8db0-f0d8b886339c} - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\{0aa6a016-77fb-4f7b-8db0-f0d8b886339c}.xpi [2013-10-31]
FF Extension: Flagfox - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b}.xpi [2014-03-08]
FF Extension: Unity Web Player Updater Pro - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\{177ad903-e11c-4952-89ac-e019391e0360}.xpi [2013-11-06]
FF Extension: Stylish - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8}.xpi [2013-11-16]
FF Extension: Multirow Bookmarks Toolbar Plus - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\{4c7097f7-08f2-4ef2-9b9f-f95fa4cbb064}.xpi [2013-04-17]
FF Extension: NoScript - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2013-04-17]
FF Extension: ReloadEvery - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\{888d99e7-e8b5-46a3-851e-1ec45da1e644}.xpi [2013-04-17]
FF Extension: Gutscheinaffe - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\{9220f99f-5b7d-4a4d-97ca-209991796400}.xpi [2013-09-03]
FF Extension: StumbleUpon - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\{AE93811A-5C9A-4d34-8462-F7B864FC4696}.xpi [2013-04-17]
FF Extension: SoundCloud Downloader - Technowise - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\{c8d3bc80-0810-4d21-a2c2-be5f2b2832ac}.xpi [2013-10-28]
FF Extension: Adblock Plus - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-02-27]
FF Extension: Multirow Bookmarks Toolbar - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\{FBF6D7FB-F305-4445-BB3D-FEF66579A033}.xpi [2013-04-17]
FF Extension: Adblock Edge - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\{fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi [2013-07-22]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2013-04-17]

Chrome: 
=======
CHR StartupUrls: "hxxp://www.sweet-page.com/?type=hp&ts=1397411834&from=cor&uid=SamsungXSSDX840XSeries_S14CNEAD305402K"
CHR Extension: (Google Wallet) - C:\Users\BBQPitBoyz\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-19]

==================== Services (Whitelisted) =================

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-04-08] (AVAST Software)
S3 CGVPNCliSrvc; C:\Program Files\CyberGhost VPN\CGVPNCliService.exe [2438696 2012-04-26] (mobile concepts GmbH)
R2 HiPatchService; S:\GaMeZ\Tribes Ascend\HiPatchService.exe [9216 2013-12-13] (Hi-Rez Studios)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-10-31] ()

==================== Drivers (Whitelisted) ====================

R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-04-08] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-04-08] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-04-08] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1039096 2014-04-08] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423240 2014-04-08] (AVAST Software)
S3 aswStm; C:\Windows\system32\drivers\aswStm.sys [84816 2014-04-08] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [208928 2014-04-08] ()
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2013-04-17] (DT Soft Ltd)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28216 2012-09-01] (Intel Corporation)
S3 vtcdrv; C:\Windows\System32\DRIVERS\vtcdrv.sys [25088 2010-05-17] (Windows (R) Win 7 DDK provider)
R3 ALSysIO; \??\C:\Users\BBQPIT~1\AppData\Local\Temp\ALSysIO64.sys [X]
S3 AsrCDDrv; \??\C:\Windows\SysWOW64\Drivers\AsrCDDrv.sys [X]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 cpuz136; \??\C:\Windows\TEMP\cpuz136\cpuz136_x64.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-04-17 16:26 - 2014-04-17 16:26 - 00019944 _____ () C:\Users\BBQPitBoyz\Desktop\FRST.txt
2014-04-17 16:25 - 2014-04-17 16:25 - 00000000 ____D () C:\Users\BBQPitBoyz\Desktop\FRST-OlderVersion
2014-04-17 16:24 - 2014-04-17 16:24 - 00001763 _____ () C:\Users\BBQPitBoyz\Desktop\JRT.txt
2014-04-17 16:19 - 2014-04-17 16:19 - 00000000 ____D () C:\Windows\ERUNT
2014-04-17 16:19 - 2014-04-17 16:18 - 01016261 _____ (Thisisu) C:\Users\BBQPitBoyz\Desktop\JRT.exe
2014-04-17 16:18 - 2014-04-17 16:18 - 00001186 _____ () C:\Users\BBQPitBoyz\Desktop\AdwCleaner[S1].txt
2014-04-17 16:13 - 2014-04-17 16:13 - 00004105 _____ () C:\Users\BBQPitBoyz\Desktop\MBAM1.txt
2014-04-17 16:00 - 2014-04-17 16:12 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-17 16:00 - 2014-04-17 16:00 - 00001106 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-04-17 16:00 - 2014-04-17 16:00 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-17 16:00 - 2014-04-17 16:00 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-04-17 16:00 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-17 16:00 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-17 16:00 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-04-17 15:59 - 2014-04-17 15:59 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\BBQPitBoyz\Desktop\mbam-setup-2.0.1.1004.exe
2014-04-16 18:31 - 2014-04-16 18:28 - 01426178 _____ () C:\Users\BBQPitBoyz\Desktop\AdwCleaner.exe
2014-04-16 18:31 - 2014-04-14 20:38 - 02347384 _____ (ESET) C:\Users\BBQPitBoyz\Desktop\esetsmartinstaller_enu.exe
2014-04-16 18:28 - 2014-04-17 16:17 - 00000000 ____D () C:\AdwCleaner
2014-04-16 18:24 - 2013-12-03 20:01 - 00279656 _____ (Alexander Roshal) C:\Users\BBQPitBoyz\WinCon64.SFX
2014-04-16 18:24 - 2013-12-03 20:01 - 00252022 _____ () C:\Users\BBQPitBoyz\Default64.SFX
2014-04-16 18:24 - 2013-12-03 20:01 - 00239720 _____ (Alexander Roshal) C:\Users\BBQPitBoyz\WinCon.SFX
2014-04-16 18:24 - 2013-12-03 20:01 - 00198656 _____ () C:\Users\BBQPitBoyz\Default.SFX
2014-04-16 18:24 - 2013-12-03 20:01 - 00174198 _____ () C:\Users\BBQPitBoyz\Zip64.SFX
2014-04-16 18:24 - 2013-12-03 20:01 - 00142848 _____ () C:\Users\BBQPitBoyz\Zip.SFX
2014-04-16 18:13 - 2014-04-16 18:13 - 00024056 _____ () C:\Users\BBQPitBoyz\Desktop\combofix2.txt
2014-04-16 18:12 - 2014-04-16 18:12 - 00024056 _____ () C:\ComboFix.txt
2014-04-16 18:02 - 2014-04-16 18:02 - 00001268 _____ () C:\Users\BBQPitBoyz\Desktop\Revo Uninstaller.lnk
2014-04-16 18:02 - 2014-04-16 18:02 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-04-14 21:57 - 2014-04-14 21:57 - 00017055 _____ () C:\Users\BBQPitBoyz\Desktop\Gmer.txt
2014-04-14 21:53 - 2014-04-14 21:53 - 00380416 _____ () C:\Users\BBQPitBoyz\Desktop\Gmer-19357.exe
2014-04-14 21:51 - 2014-04-17 16:26 - 00000000 ____D () C:\FRST
2014-04-14 21:50 - 2014-04-17 16:25 - 02158592 _____ (Farbar) C:\Users\BBQPitBoyz\Desktop\FRST64.exe
2014-04-14 21:48 - 2014-04-14 21:50 - 00000482 _____ () C:\Users\BBQPitBoyz\Desktop\defogger_disable.log
2014-04-14 21:48 - 2014-04-14 21:48 - 00050477 _____ () C:\Users\BBQPitBoyz\Desktop\Defogger.exe
2014-04-14 21:48 - 2014-04-14 21:48 - 00000168 _____ () C:\Users\BBQPitBoyz\defogger_reenable
2014-04-14 21:46 - 2014-04-14 21:46 - 00000724 _____ () C:\Users\BBQPitBoyz\Desktop\eset.txt
2014-04-14 21:43 - 2014-04-14 21:43 - 00027309 _____ () C:\Users\BBQPitBoyz\Desktop\combofix.txt
2014-04-14 20:38 - 2014-04-14 20:38 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-04-14 20:22 - 2014-04-14 20:22 - 00000085 _____ () C:\Windows\wininit.ini
2014-04-14 20:22 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-04-14 20:22 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-04-14 20:22 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-04-14 20:22 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-04-14 20:22 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-04-14 20:22 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-04-14 20:22 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-04-14 20:22 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-04-14 20:18 - 2014-04-16 18:13 - 00000000 ____D () C:\Qoobox
2014-04-14 20:18 - 2014-04-14 20:34 - 00000000 ____D () C:\Windows\erdnt
2014-04-14 20:14 - 2014-04-14 20:18 - 05194807 ____R (Swearware) C:\Users\BBQPitBoyz\Desktop\ComboFix.exe
2014-04-13 20:07 - 2014-04-13 20:07 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-04-13 20:07 - 2014-04-13 20:07 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-04-13 20:07 - 2014-04-13 20:07 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-04-13 20:07 - 2014-04-13 20:07 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-04-13 14:37 - 2014-04-13 14:37 - 00000000 ____D () C:\Users\BBQPitBoyz\AppData\Roaming\Krautscape
2014-04-11 23:53 - 2014-04-11 23:53 - 00000000 __SHD () C:\Users\BBQPitBoyz\AppData\Local\EmieUserList
2014-04-11 23:53 - 2014-04-11 23:53 - 00000000 __SHD () C:\Users\BBQPitBoyz\AppData\Local\EmieSiteList
2014-04-11 07:22 - 2014-03-06 12:21 - 23549440 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-11 07:22 - 2014-03-06 11:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-11 07:22 - 2014-03-06 11:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-04-11 07:22 - 2014-03-06 11:19 - 17387008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-11 07:22 - 2014-03-06 10:59 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-04-11 07:22 - 2014-03-06 10:57 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-04-11 07:22 - 2014-03-06 10:57 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-04-11 07:22 - 2014-03-06 10:53 - 02767360 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-04-11 07:22 - 2014-03-06 10:40 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-04-11 07:22 - 2014-03-06 10:39 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-04-11 07:22 - 2014-03-06 10:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-11 07:22 - 2014-03-06 10:32 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-04-11 07:22 - 2014-03-06 10:29 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-04-11 07:22 - 2014-03-06 10:29 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-04-11 07:22 - 2014-03-06 10:28 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-04-11 07:22 - 2014-03-06 10:15 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-04-11 07:22 - 2014-03-06 10:11 - 05784064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-04-11 07:22 - 2014-03-06 10:09 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-04-11 07:22 - 2014-03-06 10:03 - 00586240 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-04-11 07:22 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-04-11 07:22 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-04-11 07:22 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-04-11 07:22 - 2014-03-06 09:56 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-04-11 07:22 - 2014-03-06 09:48 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-04-11 07:22 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-04-11 07:22 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-04-11 07:22 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-04-11 07:22 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-04-11 07:22 - 2014-03-06 09:42 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-04-11 07:22 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-04-11 07:22 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-04-11 07:22 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-04-11 07:22 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-04-11 07:22 - 2014-03-06 09:21 - 00628736 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-04-11 07:22 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-04-11 07:22 - 2014-03-06 09:11 - 02043904 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-04-11 07:22 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-04-11 07:22 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-04-11 07:22 - 2014-03-06 08:53 - 13551104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-04-11 07:22 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-04-11 07:22 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-04-11 07:22 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-04-11 07:22 - 2014-03-06 08:22 - 02260480 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-04-11 07:22 - 2014-03-06 07:58 - 01400832 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-04-11 07:22 - 2014-03-06 07:50 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-04-11 07:22 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-04-11 07:22 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-04-11 07:22 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-04-10 06:18 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-04-10 06:18 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2014-04-10 06:18 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2014-04-10 06:18 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2014-04-10 06:18 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2014-04-10 06:18 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2014-04-10 06:18 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-04-10 06:18 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2014-04-10 06:18 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2014-04-10 06:18 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2014-04-10 06:18 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2014-04-10 06:18 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2014-04-10 06:18 - 2014-02-04 04:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2014-04-10 06:18 - 2014-02-04 04:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2014-04-10 06:18 - 2014-02-04 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll
2014-04-10 06:18 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll
2014-04-10 06:18 - 2014-01-24 04:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2014-04-08 17:59 - 2014-04-08 17:59 - 00000000 ____D () C:\Users\BBQPitBoyz\AppData\Roaming\AVAST Software
2014-04-08 06:59 - 2014-04-13 20:06 - 00000000 ____D () C:\Program Files\Java
2014-04-08 06:59 - 2014-04-13 19:38 - 00312728 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-04-08 06:59 - 2014-04-13 19:38 - 00191384 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-04-08 06:59 - 2014-04-13 19:38 - 00111000 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2014-04-08 06:59 - 2014-04-13 19:37 - 00190872 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-04-08 06:46 - 2014-04-08 06:46 - 00084816 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2014-04-08 06:46 - 2014-04-08 06:46 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-03-30 16:57 - 2014-03-30 16:58 - 00000000 ____D () C:\Users\BBQPitBoyz\Desktop\Goat.Simulator-DOGE
2014-03-29 09:53 - 2014-03-29 09:53 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-03-28 22:20 - 2014-04-14 17:52 - 00000000 ___RD () C:\Users\BBQPitBoyz\Dropbox
2014-03-27 07:50 - 2014-03-27 01:39 - 14358210 _____ () C:\Users\BBQPitBoyz\Desktop\ArnoldHandbLogistik2008.rar
2014-03-22 23:20 - 2014-03-22 23:20 - 00000000 ____D () C:\Users\BBQPitBoyz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Album Art Downloader
2014-03-22 23:20 - 2014-03-22 23:20 - 00000000 ____D () C:\Users\BBQPitBoyz\AppData\Local\AlbumArtDownloader
2014-03-22 23:20 - 2014-03-22 23:20 - 00000000 ____D () C:\Program Files\AlbumArtDownloader
2014-03-22 09:56 - 2014-03-22 09:56 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-03-22 09:56 - 2014-03-22 09:56 - 00000000 ____D () C:\Users\BBQPitBoyz\AppData\Local\Skype
2014-03-21 22:20 - 2014-03-21 22:21 - 00000000 ____D () C:\Users\BBQPitBoyz\AppData\Local\Arma 3
2014-03-21 22:20 - 2014-03-21 22:20 - 00000000 ____D () C:\Users\BBQPitBoyz\Documents\Arma 3
2014-03-21 22:20 - 2014-03-21 22:20 - 00000000 ____D () C:\ProgramData\Bohemia Interactive

==================== One Month Modified Files and Folders =======

2014-04-17 16:26 - 2014-04-17 16:26 - 00019944 _____ () C:\Users\BBQPitBoyz\Desktop\FRST.txt
2014-04-17 16:26 - 2014-04-14 21:51 - 00000000 ____D () C:\FRST
2014-04-17 16:25 - 2014-04-17 16:25 - 00000000 ____D () C:\Users\BBQPitBoyz\Desktop\FRST-OlderVersion
2014-04-17 16:25 - 2014-04-14 21:50 - 02158592 _____ (Farbar) C:\Users\BBQPitBoyz\Desktop\FRST64.exe
2014-04-17 16:24 - 2014-04-17 16:24 - 00001763 _____ () C:\Users\BBQPitBoyz\Desktop\JRT.txt
2014-04-17 16:23 - 2013-04-18 08:04 - 00710518 _____ () C:\Windows\system32\perfh007.dat
2014-04-17 16:23 - 2013-04-18 08:04 - 00154482 _____ () C:\Windows\system32\perfc007.dat
2014-04-17 16:23 - 2009-07-14 07:13 - 01653072 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-17 16:22 - 2009-07-14 06:45 - 00025872 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-17 16:22 - 2009-07-14 06:45 - 00025872 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-17 16:20 - 2013-04-17 21:41 - 00000000 ____D () C:\Users\BBQPitBoyz\AppData\Roaming\Skype
2014-04-17 16:19 - 2014-04-17 16:19 - 00000000 ____D () C:\Windows\ERUNT
2014-04-17 16:18 - 2014-04-17 16:19 - 01016261 _____ (Thisisu) C:\Users\BBQPitBoyz\Desktop\JRT.exe
2014-04-17 16:18 - 2014-04-17 16:18 - 00001186 _____ () C:\Users\BBQPitBoyz\Desktop\AdwCleaner[S1].txt
2014-04-17 16:17 - 2014-04-16 18:28 - 00000000 ____D () C:\AdwCleaner
2014-04-17 16:17 - 2013-04-22 21:50 - 00001114 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-04-17 16:17 - 2013-04-17 16:10 - 01508936 _____ () C:\Windows\WindowsUpdate.log
2014-04-17 16:17 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-17 16:17 - 2009-07-14 06:51 - 00101384 _____ () C:\Windows\setupact.log
2014-04-17 16:15 - 2013-04-17 17:36 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-04-17 16:13 - 2014-04-17 16:13 - 00004105 _____ () C:\Users\BBQPitBoyz\Desktop\MBAM1.txt
2014-04-17 16:13 - 2013-09-19 12:00 - 00001140 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2923481869-3162173556-2377066677-1000UA.job
2014-04-17 16:12 - 2014-04-17 16:00 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-17 16:11 - 2010-11-21 05:47 - 00369852 _____ () C:\Windows\PFRO.log
2014-04-17 16:10 - 2013-04-17 16:09 - 00000000 ____D () C:\Users\BBQPitBoyz
2014-04-17 16:00 - 2014-04-17 16:00 - 00001106 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-04-17 16:00 - 2014-04-17 16:00 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-17 16:00 - 2014-04-17 16:00 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-04-17 15:59 - 2014-04-17 15:59 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\BBQPitBoyz\Desktop\mbam-setup-2.0.1.1004.exe
2014-04-17 15:43 - 2013-04-22 21:50 - 00001118 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-04-17 15:26 - 2013-05-05 01:11 - 00000000 ____D () C:\Users\BBQPitBoyz\Documents\Benutzerdefinierte Office-Vorlagen
2014-04-16 18:28 - 2014-04-16 18:31 - 01426178 _____ () C:\Users\BBQPitBoyz\Desktop\AdwCleaner.exe
2014-04-16 18:24 - 2013-04-17 19:08 - 00000000 ____D () C:\Users\BBQPitBoyz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-04-16 18:24 - 2013-04-17 17:36 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-04-16 18:24 - 2013-04-17 17:36 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-04-16 18:24 - 2013-04-17 17:36 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-04-16 18:13 - 2014-04-16 18:13 - 00024056 _____ () C:\Users\BBQPitBoyz\Desktop\combofix2.txt
2014-04-16 18:13 - 2014-04-14 20:18 - 00000000 ____D () C:\Qoobox
2014-04-16 18:13 - 2013-09-19 12:00 - 00001088 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2923481869-3162173556-2377066677-1000Core.job
2014-04-16 18:12 - 2014-04-16 18:12 - 00024056 _____ () C:\ComboFix.txt
2014-04-16 18:11 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-04-16 18:02 - 2014-04-16 18:02 - 00001268 _____ () C:\Users\BBQPitBoyz\Desktop\Revo Uninstaller.lnk
2014-04-16 18:02 - 2014-04-16 18:02 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-04-15 17:00 - 2013-11-22 23:20 - 00000000 ____D () C:\Users\BBQPitBoyz\Desktop\Fitness
2014-04-15 13:56 - 2013-04-17 16:17 - 00113136 _____ () C:\Users\BBQPitBoyz\AppData\Local\GDIPFONTCACHEV1.DAT
2014-04-15 13:56 - 2009-07-14 06:45 - 00448360 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-04-15 07:33 - 2013-04-18 10:03 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-04-15 07:33 - 2009-07-14 05:20 - 00000000 ____D () C:\Program Files\Common Files\System
2014-04-15 07:33 - 2009-07-14 04:34 - 00000478 _____ () C:\Windows\win.ini
2014-04-15 07:32 - 2009-07-14 05:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2014-04-14 22:03 - 2013-06-20 16:59 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-04-14 21:58 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-04-14 21:57 - 2014-04-14 21:57 - 00017055 _____ () C:\Users\BBQPitBoyz\Desktop\Gmer.txt
2014-04-14 21:53 - 2014-04-14 21:53 - 00380416 _____ () C:\Users\BBQPitBoyz\Desktop\Gmer-19357.exe
2014-04-14 21:50 - 2014-04-14 21:48 - 00000482 _____ () C:\Users\BBQPitBoyz\Desktop\defogger_disable.log
2014-04-14 21:48 - 2014-04-14 21:48 - 00050477 _____ () C:\Users\BBQPitBoyz\Desktop\Defogger.exe
2014-04-14 21:48 - 2014-04-14 21:48 - 00000168 _____ () C:\Users\BBQPitBoyz\defogger_reenable
2014-04-14 21:46 - 2014-04-14 21:46 - 00000724 _____ () C:\Users\BBQPitBoyz\Desktop\eset.txt
2014-04-14 21:43 - 2014-04-14 21:43 - 00027309 _____ () C:\Users\BBQPitBoyz\Desktop\combofix.txt
2014-04-14 20:38 - 2014-04-16 18:31 - 02347384 _____ (ESET) C:\Users\BBQPitBoyz\Desktop\esetsmartinstaller_enu.exe
2014-04-14 20:38 - 2014-04-14 20:38 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-04-14 20:35 - 2013-04-17 16:09 - 00000000 ___RD () C:\Users\BBQPitBoyz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-04-14 20:35 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default
2014-04-14 20:34 - 2014-04-14 20:18 - 00000000 ____D () C:\Windows\erdnt
2014-04-14 20:22 - 2014-04-14 20:22 - 00000085 _____ () C:\Windows\wininit.ini
2014-04-14 20:18 - 2014-04-14 20:14 - 05194807 ____R (Swearware) C:\Users\BBQPitBoyz\Desktop\ComboFix.exe
2014-04-14 17:52 - 2014-03-28 22:20 - 00000000 ___RD () C:\Users\BBQPitBoyz\Dropbox
2014-04-13 22:04 - 2013-04-18 22:16 - 00000000 ____D () C:\ProgramData\Origin
2014-04-13 20:07 - 2014-04-13 20:07 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-04-13 20:07 - 2014-04-13 20:07 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-04-13 20:07 - 2014-04-13 20:07 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-04-13 20:07 - 2014-04-13 20:07 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-04-13 20:07 - 2013-09-14 14:00 - 00000000 ____D () C:\ProgramData\Oracle
2014-04-13 20:07 - 2013-07-02 07:49 - 00000000 ____D () C:\Program Files (x86)\Java
2014-04-13 20:06 - 2014-04-08 06:59 - 00000000 ____D () C:\Program Files\Java
2014-04-13 19:38 - 2014-04-08 06:59 - 00312728 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-04-13 19:38 - 2014-04-08 06:59 - 00191384 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-04-13 19:38 - 2014-04-08 06:59 - 00111000 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2014-04-13 19:37 - 2014-04-08 06:59 - 00190872 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-04-13 17:51 - 2013-04-18 23:47 - 00214392 _____ () C:\Windows\SysWOW64\PnkBstrB.exe
2014-04-13 17:42 - 2013-04-18 23:47 - 00214392 _____ () C:\Windows\SysWOW64\PnkBstrB.ex0
2014-04-13 14:37 - 2014-04-13 14:37 - 00000000 ____D () C:\Users\BBQPitBoyz\AppData\Roaming\Krautscape
2014-04-12 09:35 - 2013-04-18 10:11 - 00000000 ____D () C:\Users\BBQPitBoyz\AppData\Local\Adobe
2014-04-11 23:53 - 2014-04-11 23:53 - 00000000 __SHD () C:\Users\BBQPitBoyz\AppData\Local\EmieUserList
2014-04-11 23:53 - 2014-04-11 23:53 - 00000000 __SHD () C:\Users\BBQPitBoyz\AppData\Local\EmieSiteList
2014-04-11 09:36 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-04-11 08:10 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-04-10 17:36 - 2013-04-17 17:09 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-04-10 17:35 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-04-10 06:29 - 2013-11-09 22:51 - 00000000 ____D () C:\Windows\system32\MRT
2014-04-10 06:28 - 2013-11-09 22:51 - 90655440 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-04-08 17:59 - 2014-04-08 17:59 - 00000000 ____D () C:\Users\BBQPitBoyz\AppData\Roaming\AVAST Software
2014-04-08 06:46 - 2014-04-08 06:46 - 00084816 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2014-04-08 06:46 - 2014-04-08 06:46 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-04-08 06:46 - 2013-04-17 17:09 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2014-04-08 06:46 - 2013-04-17 17:09 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2014-04-08 06:46 - 2013-04-17 17:09 - 00334648 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-04-08 06:46 - 2013-04-17 17:09 - 00208928 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2014-04-08 06:46 - 2013-04-17 17:09 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2014-04-08 06:46 - 2013-04-17 17:09 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-04-08 06:46 - 2013-04-17 17:09 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2014-04-08 06:46 - 2013-04-17 17:09 - 00000000 _____ () C:\Windows\SysWOW64\config.nt
2014-04-08 06:46 - 2013-04-17 17:06 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-04-06 22:52 - 2013-05-19 18:36 - 00000000 ____D () C:\Users\BBQPitBoyz\AppData\Roaming\vlc
2014-04-04 20:59 - 2013-10-28 13:28 - 00000000 ____D () C:\Users\BBQPitBoyz\Desktop\MANUTOPMUSIK
2014-04-03 19:59 - 2014-02-28 14:10 - 00000000 ____D () C:\Users\BBQPitBoyz\Desktop\eBooks NEED MOBI
2014-04-03 09:51 - 2014-04-17 16:00 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-03 09:51 - 2014-04-17 16:00 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-03 09:50 - 2014-04-17 16:00 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-04-01 17:36 - 2013-04-21 22:07 - 00000000 ____D () C:\Program Files (x86)\Battlelog Web Plugins
2014-03-31 06:56 - 2013-04-17 17:05 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-03-30 18:08 - 2013-09-19 12:00 - 00004120 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2923481869-3162173556-2377066677-1000UA
2014-03-30 18:08 - 2013-09-19 12:00 - 00003724 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2923481869-3162173556-2377066677-1000Core
2014-03-30 16:59 - 2013-04-17 19:58 - 00000000 ____D () C:\Users\BBQPitBoyz\Documents\My Games
2014-03-30 16:58 - 2014-03-30 16:57 - 00000000 ____D () C:\Users\BBQPitBoyz\Desktop\Goat.Simulator-DOGE
2014-03-29 09:53 - 2014-03-29 09:53 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-03-28 22:18 - 2013-06-04 11:14 - 00000000 ____D () C:\Users\BBQPitBoyz\Documents\Outlook-Dateien
2014-03-28 12:38 - 2013-04-22 21:50 - 00004114 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-03-28 12:38 - 2013-04-22 21:50 - 00003862 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-03-27 01:39 - 2014-03-27 07:50 - 14358210 _____ () C:\Users\BBQPitBoyz\Desktop\ArnoldHandbLogistik2008.rar
2014-03-22 23:20 - 2014-03-22 23:20 - 00000000 ____D () C:\Users\BBQPitBoyz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Album Art Downloader
2014-03-22 23:20 - 2014-03-22 23:20 - 00000000 ____D () C:\Users\BBQPitBoyz\AppData\Local\AlbumArtDownloader
2014-03-22 23:20 - 2014-03-22 23:20 - 00000000 ____D () C:\Program Files\AlbumArtDownloader
2014-03-22 09:56 - 2014-03-22 09:56 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-03-22 09:56 - 2014-03-22 09:56 - 00000000 ____D () C:\Users\BBQPitBoyz\AppData\Local\Skype
2014-03-22 09:56 - 2013-04-17 21:41 - 00000000 ____D () C:\ProgramData\Skype
2014-03-21 22:21 - 2014-03-21 22:20 - 00000000 ____D () C:\Users\BBQPitBoyz\AppData\Local\Arma 3
2014-03-21 22:20 - 2014-03-21 22:20 - 00000000 ____D () C:\Users\BBQPitBoyz\Documents\Arma 3
2014-03-21 22:20 - 2014-03-21 22:20 - 00000000 ____D () C:\ProgramData\Bohemia Interactive

Files to move or delete:
====================
C:\Users\BBQPitBoyz\Rar.exe
C:\Users\BBQPitBoyz\RarExt.dll
C:\Users\BBQPitBoyz\RarExt32.dll
C:\Users\BBQPitBoyz\rarnew.dat
C:\Users\BBQPitBoyz\UnRAR.exe
C:\Users\BBQPitBoyz\zipnew.dat


Some content of TEMP:
====================
C:\Users\BBQPitBoyz\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-04-09 15:51

==================== End Of Log ============================

--- --- ---

Danke schonmal...

schrauber · 18.04.2014, 16:12

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

bowiewowie · 18.04.2014, 18:17

Hallo schrauber, ich glaube fast habens wir (du) geschafft. ESET hat noch 2 Dateien gefunden die ihm nicht gefallen und der Layer ist immer noch da -.-

ESET:

Code:

ATTFilter

C:\AdwCleaner\Quarantine\C\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\_Setupx.dll.vir	a variant of Win32/Adware.Yontoo.B application
C:\Users\BBQPitBoyz\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00044e	HTML/ScrInject.B.Gen virus

Security Check:

Code:

ATTFilter

 Results of screen317's Security Check version 0.99.81  
 Windows 7 Service Pack 1 x64 (UAC is enabled)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:`````````````` 
avast! Antivirus   
 Antivirus up to date!   
`````````Anti-malware/Other Utilities Check:````````` 
 Call of Duty Ghosts  
 Java 7 Update 51  
 Adobe Flash Player 13.0.0.182  
 Adobe Reader XI  
 Mozilla Firefox (28.0) 
 Google Chrome 33.0.1750.154  
 Google Chrome 34.0.1847.116  
````````Process Check: objlist.exe by Laurent````````  
 AVAST Software Avast AvastSvc.exe  
 AVAST Software Avast AvastUI.exe  
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  
````````````````````End of Log``````````````````````

FRST:

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 17-04-2014
Ran by BBQPitBoyz (administrator) on BBQPITBOYZ-PC on 18-04-2014 19:12:25
Running from C:\Users\BBQPitBoyz\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal


==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Hi-Rez Studios) S:\GaMeZ\Tribes Ascend\HiPatchService.exe
() C:\Users\BBQPitBoyz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Core Temp.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Microsoft Corporation) C:\Program Files\Microsoft IntelliPoint\ipoint.exe
(Microsoft Corporation) C:\Program Files\Microsoft IntelliType Pro\itype.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Learnpulse) C:\Users\BBQPitBoyz\AppData\Local\Learnpulse\Screenpresso\Screenpresso.exe
() C:\Program Files (x86)\puush\puush.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.23.9\GoogleCrashHandler.exe
(Disc Soft Ltd) C:\Program Files (x86)\DAEMON Tools Lite\DTShellHlp.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.23.9\GoogleCrashHandler64.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12936848 2012-07-13] (Realtek Semiconductor)
HKLM\...\Run: [IntelliPoint] => C:\Program Files\Microsoft IntelliPoint\ipoint.exe [2417032 2011-08-01] (Microsoft Corporation)
HKLM\...\Run: [itype] => C:\Program Files\Microsoft IntelliType Pro\itype.exe [2306448 2010-07-21] (Microsoft Corporation)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [285240 2012-09-01] (Intel Corporation)
HKLM-x32\...\Run: [ControlCenter3] => C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-11-07] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [185896 2013-10-28] (Geek Software GmbH)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [3854640 2014-04-08] (AVAST Software)
HKU\S-1-5-21-2923481869-3162173556-2377066677-1000\...\Run: [Screenpresso] => C:\Users\BBQPitBoyz\AppData\Local\Learnpulse\Screenpresso\Screenpresso.exe [10256912 2014-03-12] (Learnpulse)
HKU\S-1-5-21-2923481869-3162173556-2377066677-1000\...\Run: [puush] => C:\Program Files (x86)\puush\puush.exe [567880 2014-01-08] ()
HKU\S-1-5-21-2923481869-3162173556-2377066677-1000\...\Run: [GoogleChromeAutoLaunch_EF836093D41F1E88A6425FE21F6CFE69] => C:\Users\BBQPitBoyz\AppData\Local\Google\Chrome\Application\chrome.exe [841032 2014-04-02] (Google Inc.)
HKU\S-1-5-21-2923481869-3162173556-2377066677-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [20922016 2014-02-10] (Skype Technologies S.A.)
AppInit_DLLs: C:\PROGRA~2\SupTab\SearchProtect64.dll => C:\PROGRA~2\SupTab\SearchProtect64.dll File Not Found
Startup: C:\Users\BBQPitBoyz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Core Temp.exe ()
Startup: C:\Users\BBQPitBoyz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CoreTemp.ini ()

==================== Internet (Whitelisted) ====================

ProxyServer: :0
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=ironmsd04&cd=2XzuyEtN2Y1L1Qzu0B0CyD0F0FyEzz0ByBzz0AzyzzyD0AzztN0D0Tzu0SyEyBtAtN1L2XzutBtFtBtFtCtFyDtCyDtN1L1Czu1L1C1F1G1H1B1QtDyE&cr=1744334573&ir=
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=ironmsd04&cd=2XzuyEtN2Y1L1Qzu0B0CyD0F0FyEzz0ByBzz0AzyzzyD0AzztN0D0Tzu0SyEyBtAtN1L2XzutBtFtBtFtCtFyDtCyDtN1L1Czu1L1C1F1G1H1B1QtDyE&cr=1744334573&ir=
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search
BHO: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre8\bin\ssv.dll (Oracle Corporation)
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre8\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  No File
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL (Microsoft Corporation)
Handler: saphtmlp - {D1F8BD1E-7967-11D2-B43A-006094B9EADB} -  No File
Handler: sapr3 - {D1F8BD1E-7967-11D2-B43A-006094B9EADB} -  No File
Handler-x32: saphtmlp - {D1F8BD1E-7967-11D2-B43A-006094B9EADB} - s:\programme\sapgui\saphtmlp.dll (SAP, Walldorf)
Handler-x32: sapr3 - {D1F8BD1E-7967-11D2-B43A-006094B9EADB} - s:\programme\sapgui\saphtmlp.dll (SAP, Walldorf)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default
FF Homepage: gmx.de|youtube.de/subscriptions|mydealz.de
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_182.dll ()
FF Plugin: @java.com/DTPlugin,version=11.0.2 - C:\Program Files\Java\jre8\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.0.2 - C:\Program Files\Java\jre8\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MICROS~3\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.6 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_182.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1210150.dll (Adobe Systems, Inc.)
FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=2.1.4 - C:\Program Files (x86)\Battlelog Web Plugins\2.1.4\npesnlaunch.dll No File
FF Plugin-x32: @esn/npbattlelog,version=2.3.1 - C:\Program Files (x86)\Battlelog Web Plugins\2.3.1\npbattlelog.dll (EA Digital Illusions CE AB)
FF Plugin-x32: @esn/npbattlelog,version=2.3.2 - C:\Program Files (x86)\Battlelog Web Plugins\2.3.2\npbattlelog.dll (EA Digital Illusions CE AB)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 - C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @stonetrip.com/ShiVaWebPlayer,version=1.8.0.0 - C:\Users\BBQPitBoyz\AppData\Roaming\..\LocalLow\StoneTrip\Web Player\npShiVa3D.dll (StoneTrip)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\BBQPitBoyz\AppData\Local\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\BBQPitBoyz\AppData\Local\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\BBQPitBoyz\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Flash Video Downloader - Full HD Download - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\artur.dubovoy@gmail.com [2014-03-09]
FF Extension: German Dictionary - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\de-DE@dictionaries.addons.mozilla.org [2013-08-08]
FF Extension: United States English Spellchecker - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\en-US@dictionaries.addons.mozilla.org [2013-08-08]
FF Extension: YouTube Unblocker - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\youtubeunblocker@unblocker.yt [2014-04-18]
FF Extension: WOT - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2013-11-27]
FF Extension: Snip-Me - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\addon@snip-me.de.xpi [2013-04-17]
FF Extension: Add to Amazon Wish List Button - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\amznUWL2@amazon.com.xpi [2013-04-17]
FF Extension: Ghostery - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\firefox@ghostery.com.xpi [2013-08-03]
FF Extension: FastestFox - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\smarterwiki@wikiatic.com.xpi [2013-04-17]
FF Extension: Free Hide IP - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\support@free-hideip.com.xpi [2013-05-14]
FF Extension: GMX MailCheck - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\toolbar@gmx.net.xpi [2013-08-15]
FF Extension: YouTube to MP3 - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\youtube2mp3@mondayx.de.xpi [2013-04-17]
FF Extension: {0aa6a016-77fb-4f7b-8db0-f0d8b886339c} - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\{0aa6a016-77fb-4f7b-8db0-f0d8b886339c}.xpi [2013-10-31]
FF Extension: Flagfox - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b}.xpi [2014-03-08]
FF Extension: Unity Web Player Updater Pro - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\{177ad903-e11c-4952-89ac-e019391e0360}.xpi [2013-11-06]
FF Extension: Stylish - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8}.xpi [2013-11-16]
FF Extension: Multirow Bookmarks Toolbar Plus - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\{4c7097f7-08f2-4ef2-9b9f-f95fa4cbb064}.xpi [2013-04-17]
FF Extension: NoScript - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2013-04-17]
FF Extension: ReloadEvery - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\{888d99e7-e8b5-46a3-851e-1ec45da1e644}.xpi [2013-04-17]
FF Extension: Gutscheinaffe - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\{9220f99f-5b7d-4a4d-97ca-209991796400}.xpi [2013-09-03]
FF Extension: StumbleUpon - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\{AE93811A-5C9A-4d34-8462-F7B864FC4696}.xpi [2013-04-17]
FF Extension: SoundCloud Downloader - Technowise - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\{c8d3bc80-0810-4d21-a2c2-be5f2b2832ac}.xpi [2013-10-28]
FF Extension: Adblock Plus - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-02-27]
FF Extension: Multirow Bookmarks Toolbar - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\{FBF6D7FB-F305-4445-BB3D-FEF66579A033}.xpi [2013-04-17]
FF Extension: Adblock Edge - C:\Users\BBQPitBoyz\AppData\Roaming\Mozilla\Firefox\Profiles\t4p4ixn4.default\Extensions\{fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi [2013-07-22]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2013-04-17]

Chrome: 
=======
CHR StartupUrls: "hxxp://www.sweet-page.com/?type=hp&ts=1397411834&from=cor&uid=SamsungXSSDX840XSeries_S14CNEAD305402K"
CHR Extension: (Google Wallet) - C:\Users\BBQPitBoyz\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-19]

==================== Services (Whitelisted) =================

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-04-08] (AVAST Software)
S3 CGVPNCliSrvc; C:\Program Files\CyberGhost VPN\CGVPNCliService.exe [2438696 2012-04-26] (mobile concepts GmbH)
R2 HiPatchService; S:\GaMeZ\Tribes Ascend\HiPatchService.exe [9216 2013-12-13] (Hi-Rez Studios)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-10-31] ()

==================== Drivers (Whitelisted) ====================

R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-04-08] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-04-08] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-04-08] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1039096 2014-04-08] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423240 2014-04-08] (AVAST Software)
R3 aswStm; C:\Windows\system32\drivers\aswStm.sys [84816 2014-04-08] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [208928 2014-04-08] ()
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2013-04-17] (DT Soft Ltd)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28216 2012-09-01] (Intel Corporation)
S3 vtcdrv; C:\Windows\System32\DRIVERS\vtcdrv.sys [25088 2010-05-17] (Windows (R) Win 7 DDK provider)
R3 ALSysIO; \??\C:\Users\BBQPIT~1\AppData\Local\Temp\ALSysIO64.sys [X]
S3 AsrCDDrv; \??\C:\Windows\SysWOW64\Drivers\AsrCDDrv.sys [X]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 cpuz136; \??\C:\Windows\TEMP\cpuz136\cpuz136_x64.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-04-18 19:12 - 2014-04-18 19:12 - 00019944 _____ () C:\Users\BBQPitBoyz\Desktop\FRST.txt
2014-04-18 19:10 - 2014-04-18 19:10 - 00000831 _____ () C:\Users\BBQPitBoyz\Desktop\checkup.txt
2014-04-18 19:09 - 2014-04-18 19:09 - 00987448 _____ () C:\Users\BBQPitBoyz\Desktop\SecurityCheck.exe
2014-04-18 19:08 - 2014-04-18 19:08 - 00000363 _____ () C:\Users\BBQPitBoyz\Desktop\esetneu.txt
2014-04-18 10:40 - 2014-04-18 03:09 - 1663848412 _____ () C:\Users\BBQPitBoyz\Desktop\Germanys.Next.Topmodel.S09E11.German.WS.HDTVRiP.x264-GDR.mkv
2014-04-18 10:39 - 2014-04-17 15:44 - 01480792 _____ (Alexander Roshal) C:\Users\BBQPitBoyz\WinRAR.exe
2014-04-18 10:39 - 2014-04-17 15:44 - 00165976 _____ (Alexander Roshal) C:\Users\BBQPitBoyz\Uninstall.exe
2014-04-18 10:39 - 2014-04-17 15:44 - 00061528 _____ () C:\Users\BBQPitBoyz\Ace32Loader.exe
2014-04-18 10:39 - 2011-04-19 00:53 - 00199680 _____ (Igor Pavlov) C:\Users\BBQPitBoyz\7zxa.dll
2014-04-18 10:39 - 2005-08-26 02:50 - 00077312 _____ () C:\Users\BBQPitBoyz\UNACEV2.DLL
2014-04-17 16:25 - 2014-04-17 16:25 - 00000000 ____D () C:\Users\BBQPitBoyz\Desktop\FRST-OlderVersion
2014-04-17 16:24 - 2014-04-17 16:24 - 00001763 _____ () C:\Users\BBQPitBoyz\Desktop\JRT.txt
2014-04-17 16:19 - 2014-04-17 16:19 - 00000000 ____D () C:\Windows\ERUNT
2014-04-17 16:19 - 2014-04-17 16:18 - 01016261 _____ (Thisisu) C:\Users\BBQPitBoyz\Desktop\JRT.exe
2014-04-17 16:18 - 2014-04-17 16:18 - 00001186 _____ () C:\Users\BBQPitBoyz\Desktop\AdwCleaner[S1].txt
2014-04-17 16:13 - 2014-04-17 16:13 - 00004105 _____ () C:\Users\BBQPitBoyz\Desktop\MBAM1.txt
2014-04-17 16:00 - 2014-04-17 16:12 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-17 16:00 - 2014-04-17 16:00 - 00001106 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-04-17 16:00 - 2014-04-17 16:00 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-17 16:00 - 2014-04-17 16:00 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-04-17 16:00 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-17 16:00 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-17 16:00 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-04-17 15:59 - 2014-04-17 15:59 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\BBQPitBoyz\Desktop\mbam-setup-2.0.1.1004.exe
2014-04-16 18:31 - 2014-04-16 18:28 - 01426178 _____ () C:\Users\BBQPitBoyz\Desktop\AdwCleaner.exe
2014-04-16 18:31 - 2014-04-14 20:38 - 02347384 _____ (ESET) C:\Users\BBQPitBoyz\Desktop\esetsmartinstaller_enu.exe
2014-04-16 18:28 - 2014-04-17 16:17 - 00000000 ____D () C:\AdwCleaner
2014-04-16 18:24 - 2014-04-17 15:43 - 00258560 _____ () C:\Users\BBQPitBoyz\Default64.SFX
2014-04-16 18:24 - 2014-04-17 15:43 - 00238592 _____ (Alexander Roshal) C:\Users\BBQPitBoyz\WinCon64.SFX
2014-04-16 18:24 - 2014-04-17 15:43 - 00210944 _____ () C:\Users\BBQPitBoyz\Default.SFX
2014-04-16 18:24 - 2014-04-17 15:43 - 00198656 _____ (Alexander Roshal) C:\Users\BBQPitBoyz\WinCon.SFX
2014-04-16 18:24 - 2014-04-17 15:43 - 00180224 _____ () C:\Users\BBQPitBoyz\Zip64.SFX
2014-04-16 18:24 - 2014-04-17 15:43 - 00156160 _____ () C:\Users\BBQPitBoyz\Zip.SFX
2014-04-16 18:13 - 2014-04-16 18:13 - 00024056 _____ () C:\Users\BBQPitBoyz\Desktop\combofix2.txt
2014-04-16 18:12 - 2014-04-16 18:12 - 00024056 _____ () C:\ComboFix.txt
2014-04-16 18:02 - 2014-04-16 18:02 - 00001268 _____ () C:\Users\BBQPitBoyz\Desktop\Revo Uninstaller.lnk
2014-04-16 18:02 - 2014-04-16 18:02 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-04-14 21:57 - 2014-04-14 21:57 - 00017055 _____ () C:\Users\BBQPitBoyz\Desktop\Gmer.txt
2014-04-14 21:53 - 2014-04-14 21:53 - 00380416 _____ () C:\Users\BBQPitBoyz\Desktop\Gmer-19357.exe
2014-04-14 21:51 - 2014-04-18 19:12 - 00000000 ____D () C:\FRST
2014-04-14 21:50 - 2014-04-17 16:25 - 02158592 _____ (Farbar) C:\Users\BBQPitBoyz\Desktop\FRST64.exe
2014-04-14 21:48 - 2014-04-14 21:48 - 00050477 _____ () C:\Users\BBQPitBoyz\Desktop\Defogger.exe
2014-04-14 21:48 - 2014-04-14 21:48 - 00000168 _____ () C:\Users\BBQPitBoyz\defogger_reenable
2014-04-14 21:43 - 2014-04-14 21:43 - 00027309 _____ () C:\Users\BBQPitBoyz\Desktop\combofix.txt
2014-04-14 20:38 - 2014-04-14 20:38 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-04-14 20:22 - 2014-04-14 20:22 - 00000085 _____ () C:\Windows\wininit.ini
2014-04-14 20:22 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-04-14 20:22 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-04-14 20:22 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-04-14 20:22 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-04-14 20:22 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-04-14 20:22 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-04-14 20:22 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-04-14 20:22 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-04-14 20:18 - 2014-04-16 18:13 - 00000000 ____D () C:\Qoobox
2014-04-14 20:18 - 2014-04-14 20:34 - 00000000 ____D () C:\Windows\erdnt
2014-04-14 20:14 - 2014-04-14 20:18 - 05194807 ____R (Swearware) C:\Users\BBQPitBoyz\Desktop\ComboFix.exe
2014-04-13 20:07 - 2014-04-13 20:07 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-04-13 20:07 - 2014-04-13 20:07 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-04-13 20:07 - 2014-04-13 20:07 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-04-13 20:07 - 2014-04-13 20:07 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-04-13 14:37 - 2014-04-13 14:37 - 00000000 ____D () C:\Users\BBQPitBoyz\AppData\Roaming\Krautscape
2014-04-11 23:53 - 2014-04-11 23:53 - 00000000 __SHD () C:\Users\BBQPitBoyz\AppData\Local\EmieUserList
2014-04-11 23:53 - 2014-04-11 23:53 - 00000000 __SHD () C:\Users\BBQPitBoyz\AppData\Local\EmieSiteList
2014-04-11 07:22 - 2014-03-06 12:21 - 23549440 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-11 07:22 - 2014-03-06 11:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-11 07:22 - 2014-03-06 11:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-04-11 07:22 - 2014-03-06 11:19 - 17387008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-11 07:22 - 2014-03-06 10:59 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-04-11 07:22 - 2014-03-06 10:57 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-04-11 07:22 - 2014-03-06 10:57 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-04-11 07:22 - 2014-03-06 10:53 - 02767360 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-04-11 07:22 - 2014-03-06 10:40 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-04-11 07:22 - 2014-03-06 10:39 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-04-11 07:22 - 2014-03-06 10:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-11 07:22 - 2014-03-06 10:32 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-04-11 07:22 - 2014-03-06 10:29 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-04-11 07:22 - 2014-03-06 10:29 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-04-11 07:22 - 2014-03-06 10:28 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-04-11 07:22 - 2014-03-06 10:15 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-04-11 07:22 - 2014-03-06 10:11 - 05784064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-04-11 07:22 - 2014-03-06 10:09 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-04-11 07:22 - 2014-03-06 10:03 - 00586240 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-04-11 07:22 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-04-11 07:22 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-04-11 07:22 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-04-11 07:22 - 2014-03-06 09:56 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-04-11 07:22 - 2014-03-06 09:48 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-04-11 07:22 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-04-11 07:22 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-04-11 07:22 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-04-11 07:22 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-04-11 07:22 - 2014-03-06 09:42 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-04-11 07:22 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-04-11 07:22 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-04-11 07:22 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-04-11 07:22 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-04-11 07:22 - 2014-03-06 09:21 - 00628736 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-04-11 07:22 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-04-11 07:22 - 2014-03-06 09:11 - 02043904 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-04-11 07:22 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-04-11 07:22 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-04-11 07:22 - 2014-03-06 08:53 - 13551104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-04-11 07:22 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-04-11 07:22 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-04-11 07:22 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-04-11 07:22 - 2014-03-06 08:22 - 02260480 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-04-11 07:22 - 2014-03-06 07:58 - 01400832 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-04-11 07:22 - 2014-03-06 07:50 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-04-11 07:22 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-04-11 07:22 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-04-11 07:22 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-04-10 06:18 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-04-10 06:18 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2014-04-10 06:18 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2014-04-10 06:18 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2014-04-10 06:18 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2014-04-10 06:18 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2014-04-10 06:18 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-04-10 06:18 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2014-04-10 06:18 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2014-04-10 06:18 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2014-04-10 06:18 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2014-04-10 06:18 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2014-04-10 06:18 - 2014-02-04 04:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2014-04-10 06:18 - 2014-02-04 04:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2014-04-10 06:18 - 2014-02-04 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll
2014-04-10 06:18 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll
2014-04-10 06:18 - 2014-01-24 04:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2014-04-08 17:59 - 2014-04-08 17:59 - 00000000 ____D () C:\Users\BBQPitBoyz\AppData\Roaming\AVAST Software
2014-04-08 06:59 - 2014-04-13 20:06 - 00000000 ____D () C:\Program Files\Java
2014-04-08 06:59 - 2014-04-13 19:38 - 00312728 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-04-08 06:59 - 2014-04-13 19:38 - 00191384 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-04-08 06:59 - 2014-04-13 19:38 - 00111000 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2014-04-08 06:59 - 2014-04-13 19:37 - 00190872 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-04-08 06:46 - 2014-04-08 06:46 - 00084816 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2014-04-08 06:46 - 2014-04-08 06:46 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-03-30 16:57 - 2014-03-30 16:58 - 00000000 ____D () C:\Users\BBQPitBoyz\Desktop\Goat.Simulator-DOGE
2014-03-29 09:53 - 2014-03-29 09:53 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-03-28 22:20 - 2014-04-14 17:52 - 00000000 ___RD () C:\Users\BBQPitBoyz\Dropbox
2014-03-27 07:50 - 2014-03-27 01:39 - 14358210 _____ () C:\Users\BBQPitBoyz\Desktop\ArnoldHandbLogistik2008.rar
2014-03-22 23:20 - 2014-03-22 23:20 - 00000000 ____D () C:\Users\BBQPitBoyz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Album Art Downloader
2014-03-22 23:20 - 2014-03-22 23:20 - 00000000 ____D () C:\Users\BBQPitBoyz\AppData\Local\AlbumArtDownloader
2014-03-22 23:20 - 2014-03-22 23:20 - 00000000 ____D () C:\Program Files\AlbumArtDownloader
2014-03-22 09:56 - 2014-03-22 09:56 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-03-22 09:56 - 2014-03-22 09:56 - 00000000 ____D () C:\Users\BBQPitBoyz\AppData\Local\Skype
2014-03-21 22:20 - 2014-03-21 22:21 - 00000000 ____D () C:\Users\BBQPitBoyz\AppData\Local\Arma 3
2014-03-21 22:20 - 2014-03-21 22:20 - 00000000 ____D () C:\Users\BBQPitBoyz\Documents\Arma 3
2014-03-21 22:20 - 2014-03-21 22:20 - 00000000 ____D () C:\ProgramData\Bohemia Interactive

==================== One Month Modified Files and Folders =======

2014-04-18 19:12 - 2014-04-18 19:12 - 00019944 _____ () C:\Users\BBQPitBoyz\Desktop\FRST.txt
2014-04-18 19:12 - 2014-04-14 21:51 - 00000000 ____D () C:\FRST
2014-04-18 19:10 - 2014-04-18 19:10 - 00000831 _____ () C:\Users\BBQPitBoyz\Desktop\checkup.txt
2014-04-18 19:09 - 2014-04-18 19:09 - 00987448 _____ () C:\Users\BBQPitBoyz\Desktop\SecurityCheck.exe
2014-04-18 19:08 - 2014-04-18 19:08 - 00000363 _____ () C:\Users\BBQPitBoyz\Desktop\esetneu.txt
2014-04-18 19:06 - 2013-08-21 17:37 - 00000000 ____D () C:\Users\BBQPitBoyz\Documents\Ubisoft
2014-04-18 19:06 - 2013-04-17 16:15 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-04-18 18:47 - 2013-04-17 21:41 - 00000000 ____D () C:\Users\BBQPitBoyz\AppData\Roaming\Skype
2014-04-18 18:43 - 2013-04-22 21:50 - 00001118 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-04-18 18:36 - 2013-04-17 16:10 - 01544081 _____ () C:\Windows\WindowsUpdate.log
2014-04-18 18:15 - 2013-04-17 17:36 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-04-18 18:13 - 2013-09-19 12:00 - 00001140 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2923481869-3162173556-2377066677-1000UA.job
2014-04-18 18:13 - 2013-09-19 12:00 - 00001088 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2923481869-3162173556-2377066677-1000Core.job
2014-04-18 16:20 - 2009-07-14 06:51 - 00101832 _____ () C:\Windows\setupact.log
2014-04-18 12:42 - 2013-05-19 18:36 - 00000000 ____D () C:\Users\BBQPitBoyz\AppData\Roaming\vlc
2014-04-18 11:43 - 2013-04-22 21:50 - 00001114 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-04-18 10:39 - 2013-04-17 19:08 - 00000000 ____D () C:\Users\BBQPitBoyz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-04-18 10:39 - 2013-04-17 19:06 - 00000000 ____D () C:\Users\BBQPitBoyz\Formats
2014-04-18 10:39 - 2013-04-17 16:09 - 00000000 ____D () C:\Users\BBQPitBoyz
2014-04-18 09:55 - 2009-07-14 06:45 - 00025872 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-18 09:55 - 2009-07-14 06:45 - 00025872 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-18 09:52 - 2013-04-18 08:04 - 00710518 _____ () C:\Windows\system32\perfh007.dat
2014-04-18 09:52 - 2013-04-18 08:04 - 00154482 _____ () C:\Windows\system32\perfc007.dat
2014-04-18 09:52 - 2009-07-14 07:13 - 01653072 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-18 09:47 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-18 03:09 - 2014-04-18 10:40 - 1663848412 _____ () C:\Users\BBQPitBoyz\Desktop\Germanys.Next.Topmodel.S09E11.German.WS.HDTVRiP.x264-GDR.mkv
2014-04-17 19:12 - 2013-04-17 17:09 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-04-17 16:25 - 2014-04-17 16:25 - 00000000 ____D () C:\Users\BBQPitBoyz\Desktop\FRST-OlderVersion
2014-04-17 16:25 - 2014-04-14 21:50 - 02158592 _____ (Farbar) C:\Users\BBQPitBoyz\Desktop\FRST64.exe
2014-04-17 16:24 - 2014-04-17 16:24 - 00001763 _____ () C:\Users\BBQPitBoyz\Desktop\JRT.txt
2014-04-17 16:19 - 2014-04-17 16:19 - 00000000 ____D () C:\Windows\ERUNT
2014-04-17 16:18 - 2014-04-17 16:19 - 01016261 _____ (Thisisu) C:\Users\BBQPitBoyz\Desktop\JRT.exe
2014-04-17 16:18 - 2014-04-17 16:18 - 00001186 _____ () C:\Users\BBQPitBoyz\Desktop\AdwCleaner[S1].txt
2014-04-17 16:17 - 2014-04-16 18:28 - 00000000 ____D () C:\AdwCleaner
2014-04-17 16:13 - 2014-04-17 16:13 - 00004105 _____ () C:\Users\BBQPitBoyz\Desktop\MBAM1.txt
2014-04-17 16:12 - 2014-04-17 16:00 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-17 16:11 - 2010-11-21 05:47 - 00369852 _____ () C:\Windows\PFRO.log
2014-04-17 16:00 - 2014-04-17 16:00 - 00001106 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-04-17 16:00 - 2014-04-17 16:00 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-17 16:00 - 2014-04-17 16:00 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-04-17 15:59 - 2014-04-17 15:59 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\BBQPitBoyz\Desktop\mbam-setup-2.0.1.1004.exe
2014-04-17 15:44 - 2014-04-18 10:39 - 01480792 _____ (Alexander Roshal) C:\Users\BBQPitBoyz\WinRAR.exe
2014-04-17 15:44 - 2014-04-18 10:39 - 00165976 _____ (Alexander Roshal) C:\Users\BBQPitBoyz\Uninstall.exe
2014-04-17 15:44 - 2014-04-18 10:39 - 00061528 _____ () C:\Users\BBQPitBoyz\Ace32Loader.exe
2014-04-17 15:44 - 2013-04-17 19:06 - 00524376 _____ (Alexander Roshal) C:\Users\BBQPitBoyz\Rar.exe
2014-04-17 15:44 - 2013-04-17 19:06 - 00330840 _____ (Alexander Roshal) C:\Users\BBQPitBoyz\UnRAR.exe
2014-04-17 15:44 - 2013-04-17 19:06 - 00316504 _____ (Alexander Roshal) C:\Users\BBQPitBoyz\RarExt.dll
2014-04-17 15:44 - 2013-04-17 19:06 - 00297922 _____ () C:\Users\BBQPitBoyz\WinRAR.chm
2014-04-17 15:44 - 2013-04-17 19:06 - 00265304 _____ (Alexander Roshal) C:\Users\BBQPitBoyz\RarExt32.dll
2014-04-17 15:44 - 2013-04-17 19:06 - 00000443 _____ () C:\Users\BBQPitBoyz\Uninstall.lst
2014-04-17 15:43 - 2014-04-16 18:24 - 00258560 _____ () C:\Users\BBQPitBoyz\Default64.SFX
2014-04-17 15:43 - 2014-04-16 18:24 - 00238592 _____ (Alexander Roshal) C:\Users\BBQPitBoyz\WinCon64.SFX
2014-04-17 15:43 - 2014-04-16 18:24 - 00210944 _____ () C:\Users\BBQPitBoyz\Default.SFX
2014-04-17 15:43 - 2014-04-16 18:24 - 00198656 _____ (Alexander Roshal) C:\Users\BBQPitBoyz\WinCon.SFX
2014-04-17 15:43 - 2014-04-16 18:24 - 00180224 _____ () C:\Users\BBQPitBoyz\Zip64.SFX
2014-04-17 15:43 - 2014-04-16 18:24 - 00156160 _____ () C:\Users\BBQPitBoyz\Zip.SFX
2014-04-17 15:26 - 2013-05-05 01:11 - 00000000 ____D () C:\Users\BBQPitBoyz\Documents\Benutzerdefinierte Office-Vorlagen
2014-04-16 18:28 - 2014-04-16 18:31 - 01426178 _____ () C:\Users\BBQPitBoyz\Desktop\AdwCleaner.exe
2014-04-16 18:24 - 2013-04-17 17:36 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-04-16 18:24 - 2013-04-17 17:36 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-04-16 18:24 - 2013-04-17 17:36 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-04-16 18:13 - 2014-04-16 18:13 - 00024056 _____ () C:\Users\BBQPitBoyz\Desktop\combofix2.txt
2014-04-16 18:13 - 2014-04-14 20:18 - 00000000 ____D () C:\Qoobox
2014-04-16 18:12 - 2014-04-16 18:12 - 00024056 _____ () C:\ComboFix.txt
2014-04-16 18:11 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-04-16 18:02 - 2014-04-16 18:02 - 00001268 _____ () C:\Users\BBQPitBoyz\Desktop\Revo Uninstaller.lnk
2014-04-16 18:02 - 2014-04-16 18:02 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-04-15 17:00 - 2013-11-22 23:20 - 00000000 ____D () C:\Users\BBQPitBoyz\Desktop\Fitness
2014-04-15 13:56 - 2013-04-17 16:17 - 00113136 _____ () C:\Users\BBQPitBoyz\AppData\Local\GDIPFONTCACHEV1.DAT
2014-04-15 13:56 - 2009-07-14 06:45 - 00448360 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-04-15 07:33 - 2013-04-18 10:03 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-04-15 07:33 - 2009-07-14 05:20 - 00000000 ____D () C:\Program Files\Common Files\System
2014-04-15 07:33 - 2009-07-14 04:34 - 00000478 _____ () C:\Windows\win.ini
2014-04-15 07:32 - 2009-07-14 05:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2014-04-14 22:03 - 2013-06-20 16:59 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-04-14 21:58 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-04-14 21:57 - 2014-04-14 21:57 - 00017055 _____ () C:\Users\BBQPitBoyz\Desktop\Gmer.txt
2014-04-14 21:53 - 2014-04-14 21:53 - 00380416 _____ () C:\Users\BBQPitBoyz\Desktop\Gmer-19357.exe
2014-04-14 21:48 - 2014-04-14 21:48 - 00050477 _____ () C:\Users\BBQPitBoyz\Desktop\Defogger.exe
2014-04-14 21:48 - 2014-04-14 21:48 - 00000168 _____ () C:\Users\BBQPitBoyz\defogger_reenable
2014-04-14 21:43 - 2014-04-14 21:43 - 00027309 _____ () C:\Users\BBQPitBoyz\Desktop\combofix.txt
2014-04-14 20:38 - 2014-04-16 18:31 - 02347384 _____ (ESET) C:\Users\BBQPitBoyz\Desktop\esetsmartinstaller_enu.exe
2014-04-14 20:38 - 2014-04-14 20:38 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-04-14 20:35 - 2013-04-17 16:09 - 00000000 ___RD () C:\Users\BBQPitBoyz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-04-14 20:35 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default
2014-04-14 20:34 - 2014-04-14 20:18 - 00000000 ____D () C:\Windows\erdnt
2014-04-14 20:22 - 2014-04-14 20:22 - 00000085 _____ () C:\Windows\wininit.ini
2014-04-14 20:18 - 2014-04-14 20:14 - 05194807 ____R (Swearware) C:\Users\BBQPitBoyz\Desktop\ComboFix.exe
2014-04-14 17:52 - 2014-03-28 22:20 - 00000000 ___RD () C:\Users\BBQPitBoyz\Dropbox
2014-04-13 22:04 - 2013-04-18 22:16 - 00000000 ____D () C:\ProgramData\Origin
2014-04-13 20:07 - 2014-04-13 20:07 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-04-13 20:07 - 2014-04-13 20:07 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-04-13 20:07 - 2014-04-13 20:07 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-04-13 20:07 - 2014-04-13 20:07 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-04-13 20:07 - 2013-09-14 14:00 - 00000000 ____D () C:\ProgramData\Oracle
2014-04-13 20:07 - 2013-07-02 07:49 - 00000000 ____D () C:\Program Files (x86)\Java
2014-04-13 20:06 - 2014-04-08 06:59 - 00000000 ____D () C:\Program Files\Java
2014-04-13 19:38 - 2014-04-08 06:59 - 00312728 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-04-13 19:38 - 2014-04-08 06:59 - 00191384 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-04-13 19:38 - 2014-04-08 06:59 - 00111000 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2014-04-13 19:37 - 2014-04-08 06:59 - 00190872 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-04-13 17:51 - 2013-04-18 23:47 - 00214392 _____ () C:\Windows\SysWOW64\PnkBstrB.exe
2014-04-13 17:42 - 2013-04-18 23:47 - 00214392 _____ () C:\Windows\SysWOW64\PnkBstrB.ex0
2014-04-13 14:37 - 2014-04-13 14:37 - 00000000 ____D () C:\Users\BBQPitBoyz\AppData\Roaming\Krautscape
2014-04-12 09:35 - 2013-04-18 10:11 - 00000000 ____D () C:\Users\BBQPitBoyz\AppData\Local\Adobe
2014-04-11 23:53 - 2014-04-11 23:53 - 00000000 __SHD () C:\Users\BBQPitBoyz\AppData\Local\EmieUserList
2014-04-11 23:53 - 2014-04-11 23:53 - 00000000 __SHD () C:\Users\BBQPitBoyz\AppData\Local\EmieSiteList
2014-04-11 09:36 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-04-11 08:10 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-04-10 17:35 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-04-10 06:29 - 2013-11-09 22:51 - 00000000 ____D () C:\Windows\system32\MRT
2014-04-10 06:28 - 2013-11-09 22:51 - 90655440 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-04-08 17:59 - 2014-04-08 17:59 - 00000000 ____D () C:\Users\BBQPitBoyz\AppData\Roaming\AVAST Software
2014-04-08 06:46 - 2014-04-08 06:46 - 00084816 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2014-04-08 06:46 - 2014-04-08 06:46 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-04-08 06:46 - 2013-04-17 17:09 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2014-04-08 06:46 - 2013-04-17 17:09 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2014-04-08 06:46 - 2013-04-17 17:09 - 00334648 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-04-08 06:46 - 2013-04-17 17:09 - 00208928 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2014-04-08 06:46 - 2013-04-17 17:09 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2014-04-08 06:46 - 2013-04-17 17:09 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-04-08 06:46 - 2013-04-17 17:09 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2014-04-08 06:46 - 2013-04-17 17:09 - 00000000 _____ () C:\Windows\SysWOW64\config.nt
2014-04-08 06:46 - 2013-04-17 17:06 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-04-05 16:14 - 2013-04-17 19:06 - 00044873 _____ () C:\Users\BBQPitBoyz\WhatsNew.txt
2014-04-04 20:59 - 2013-10-28 13:28 - 00000000 ____D () C:\Users\BBQPitBoyz\Desktop\MANUTOPMUSIK
2014-04-03 19:59 - 2014-02-28 14:10 - 00000000 ____D () C:\Users\BBQPitBoyz\Desktop\eBooks NEED MOBI
2014-04-03 09:51 - 2014-04-17 16:00 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-03 09:51 - 2014-04-17 16:00 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-03 09:50 - 2014-04-17 16:00 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-04-01 17:36 - 2013-04-21 22:07 - 00000000 ____D () C:\Program Files (x86)\Battlelog Web Plugins
2014-03-31 09:35 - 2010-11-21 05:27 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-03-31 06:56 - 2013-04-17 17:05 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-03-30 18:08 - 2013-09-19 12:00 - 00004120 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2923481869-3162173556-2377066677-1000UA
2014-03-30 18:08 - 2013-09-19 12:00 - 00003724 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2923481869-3162173556-2377066677-1000Core
2014-03-30 16:59 - 2013-04-17 19:58 - 00000000 ____D () C:\Users\BBQPitBoyz\Documents\My Games
2014-03-30 16:58 - 2014-03-30 16:57 - 00000000 ____D () C:\Users\BBQPitBoyz\Desktop\Goat.Simulator-DOGE
2014-03-29 09:53 - 2014-03-29 09:53 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-03-28 22:18 - 2013-06-04 11:14 - 00000000 ____D () C:\Users\BBQPitBoyz\Documents\Outlook-Dateien
2014-03-28 12:38 - 2013-04-22 21:50 - 00004114 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-03-28 12:38 - 2013-04-22 21:50 - 00003862 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-03-27 01:39 - 2014-03-27 07:50 - 14358210 _____ () C:\Users\BBQPitBoyz\Desktop\ArnoldHandbLogistik2008.rar
2014-03-26 01:00 - 2013-04-17 19:06 - 00099256 _____ () C:\Users\BBQPitBoyz\Rar.txt
2014-03-22 23:20 - 2014-03-22 23:20 - 00000000 ____D () C:\Users\BBQPitBoyz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Album Art Downloader
2014-03-22 23:20 - 2014-03-22 23:20 - 00000000 ____D () C:\Users\BBQPitBoyz\AppData\Local\AlbumArtDownloader
2014-03-22 23:20 - 2014-03-22 23:20 - 00000000 ____D () C:\Program Files\AlbumArtDownloader
2014-03-22 09:56 - 2014-03-22 09:56 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-03-22 09:56 - 2014-03-22 09:56 - 00000000 ____D () C:\Users\BBQPitBoyz\AppData\Local\Skype
2014-03-22 09:56 - 2013-04-17 21:41 - 00000000 ____D () C:\ProgramData\Skype
2014-03-21 22:21 - 2014-03-21 22:20 - 00000000 ____D () C:\Users\BBQPitBoyz\AppData\Local\Arma 3
2014-03-21 22:20 - 2014-03-21 22:20 - 00000000 ____D () C:\Users\BBQPitBoyz\Documents\Arma 3
2014-03-21 22:20 - 2014-03-21 22:20 - 00000000 ____D () C:\ProgramData\Bohemia Interactive
2014-03-19 01:09 - 2013-04-17 19:06 - 00001241 _____ () C:\Users\BBQPitBoyz\RarFiles.lst

Files to move or delete:
====================
C:\Users\BBQPitBoyz\7zxa.dll
C:\Users\BBQPitBoyz\Ace32Loader.exe
C:\Users\BBQPitBoyz\Rar.exe
C:\Users\BBQPitBoyz\RarExt.dll
C:\Users\BBQPitBoyz\RarExt32.dll
C:\Users\BBQPitBoyz\rarnew.dat
C:\Users\BBQPitBoyz\UNACEV2.DLL
C:\Users\BBQPitBoyz\Uninstall.exe
C:\Users\BBQPitBoyz\UnRAR.exe
C:\Users\BBQPitBoyz\WinRAR.exe
C:\Users\BBQPitBoyz\zipnew.dat


Some content of TEMP:
====================
C:\Users\BBQPitBoyz\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-04-09 15:51

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

schrauber · 19.04.2014, 10:41

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

AppInit_DLLs: C:\PROGRA~2\SupTab\SearchProtect64.dll => C:\PROGRA~2\SupTab\SearchProtect64.dll File Not Found
ProxyServer: :0
CHR StartupUrls: "hxxp://www.sweet-page.com/?type=hp&ts=1397411834&from=cor&uid=SamsungXSSDX840XSeries_S14CNEAD305402K"

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

In welchem Browser?

bowiewowie · 19.04.2014, 13:01

Hier die Log-Datei von FRST:

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 17-04-2014
Ran by BBQPitBoyz at 2014-04-19 13:42:22 Run:1
Running from C:\Users\BBQPitBoyz\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
AppInit_DLLs: C:\PROGRA~2\SupTab\SearchProtect64.dll => C:\PROGRA~2\SupTab\SearchProtect64.dll File Not Found
ProxyServer: :0
CHR StartupUrls: "hxxp://www.sweet-page.com/?type=hp&ts=1397411834&from=cor&uid=SamsungXSSDX840XSeries_S14CNEAD305402K"
         
*****************

"C:\PROGRA~2\SupTab\SearchProtect64.dll" => Value Data removed successfully.
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => Value deleted successfully.
CHR StartupUrls: "hxxp://www.sweet-page.com/?type=hp&ts=1397411834&from=cor&uid=SamsungXSSDX840XSeries_S14CNEAD305402K" ==> The Chrome "Settings" can be used to fix the entry.

==== End of Fixlog ====

Ich benutze zu 99% den Firefox, habe aber gerade auch mal den CHROME getestet und da tritt selbiger Fehler auf. Das Ding scheint nicht weg zu wollen...

Ich hab mir jetzt mal das Add-on "Noscript" für Firefox runtergeladen und dieses blockt die nervige Anzeige.

Wenn du mir sagst, dass das kein Virus/Malware ist dann würde mir diese Lösung reichen, dennoch würde mich interessieren was dahintersteckt..

schrauber · 19.04.2014, 19:51

Revo Uninstaller - Download - Filepony
damit Firefox deinstallieren, keine Daten behalten, Reste entfernen lassen, neu installieren.

Dann:
https://support.mozilla.org/de/kb/fi...einfach-loesen

Revo Uninstaller - Download - Filepony
damit Firefox deinstallieren, keine Daten behalten, Reste entfernen lassen, neu installieren.

Dann:
https://support.mozilla.org/de/kb/fi...einfach-loesen

Poste bitte nochmal ein frisches FRST log. Problem noch da?

[Win7] Browser-Redirects zu fake "Java Update"

Log-Analyse und Auswertung: [Win7] Browser-Redirects zu fake "Java Update"