Guten Tag,ich habe seit geraumer Zeit ein Problem das ich mir selbst zuzuschreiben habe,ich habe mir einen Crack gedownloadet...,diesen hab ich sofort wieder runtergehauen,später ist mir dann aufgefallen dass ESET sicht nichtmehr starten . Als Fehlermeldung steht dort dann:
Dieses Programm wurde durch eine Gruppenrichtlinie blockiert.
Könnte es sein dass ich mir durch den Crack Schadsoftware geholt habe, wie einen Virus oder Malware?
Vornerein schonmal Danke für die Antwort

Mfg deluxius

hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

• Starte jetzt FRST.
• Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
• Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
• Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 08-10-2014 01
Ran by david (administrator) on DAVID-PC on 10-10-2014 20:56:12
Running from C:\Users\david\Desktop
Loaded Profile: david (Available profiles: david & VERSUCH)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Spotify Ltd) C:\Users\david\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Nico Mak Computing) C:\Program Files\File Association Helper\FAHWindow.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Akamai Technologies, Inc.) C:\Users\david\AppData\Local\Akamai\netsession_win.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Akamai Technologies, Inc.) C:\Users\david\AppData\Local\Akamai\netsession_win.exe
() C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\CEPServiceManager4\CEPServiceManager.exe
() C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\HEX\Adobe CEF Helper.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\HEX\Adobe CEF Helper.exe
(Electronic Arts) C:\Program Files (x86)\Origin\Origin.exe
(Electronic Arts) C:\Program Files (x86)\Origin\OriginClientService.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(PC-Doctor, Inc.) C:\Program Files\My Dell\imstrayicon.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
() C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe
() C:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.0.224\deploy\LoLLauncher.exe
() C:\Riot Games\League of Legends\RADS\projects\lol_patcher\releases\0.0.0.8\deploy\LoLPatcher.exe
() C:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.113\deploy\LolClient.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
() C:\Users\david\AppData\Roaming\Microsoft\Windows\IEUpdate\hh.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [DellStage] => C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe [2195824 2012-02-01] ()
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [472984 2013-06-03] (Adobe Systems Incorporated)
HKLM\...\Run: [Nvtmru] => "C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe"
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2461504 2014-09-17] (NVIDIA Corporation)
HKLM\...\Run: [egui] => C:\Program Files\ESET\ESET Smart Security\egui.exe [5581888 2014-02-24] (ESET)
HKLM\...\Run: [FAHConsole] => C:\Program Files\File Association Helper\FAHConsole.exe [729272 2014-01-28] (Nico Mak Computing)
HKLM-x32\...\Run: [Dell Registration] => C:\Program Files (x86)\System Registration\prodreg.exe [4165440 2011-08-04] (Dell, Inc.)
HKLM-x32\...\Run: [RoxWatchTray] => C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe [240112 2010-11-25] (Sonic Solutions)
HKLM-x32\...\Run: [Desktop Disc Tool] => C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe [514544 2010-11-17] ()
HKLM-x32\...\Run: [AccuWeatherWidget] => C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe [968048 2012-02-01] ()
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe Creative Cloud] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2236816 2013-07-12] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59240 2011-09-27] (Apple Inc.)
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Avira <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\AVAST Software <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\ESET <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Kaspersky Lab <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files (x86)\Common Files\Symantec Shared <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\ESET <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [Facebook Update] => C:\Users\david\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2012-07-12] (Facebook Inc.)
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [Spotify Web Helper] => C:\Users\david\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1514040 2014-10-03] (Spotify Ltd)
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [1938112 2014-09-23] (Valve Corporation)
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [Akamai NetSession Interface] => C:\Users\david\AppData\Local\Akamai\netsession_win.exe [4672920 2014-04-17] (Akamai Technologies, Inc.)
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [AgolBemet] => regsvr32.exe "C:\ProgramData\AgolBemet\AgolBemet.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [AdneWbiql] => regsvr32.exe "C:\ProgramData\AdneWbiql\AdneWbiql.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [IqikWuge] => regsvr32.exe "C:\ProgramData\IqikWuge\IqikWuge.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OfuxDurov] => regsvr32.exe "C:\ProgramData\OfuxDurov\OfuxDurov.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [EbanOcaha] => regsvr32.exe "C:\ProgramData\EbanOcaha\EbanOcaha.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OpohEluda] => regsvr32.exe "C:\ProgramData\OpohEluda\OpohEluda.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OxereNazic] => regsvr32.exe "C:\ProgramData\OxereNazic\OxereNazic.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OlafcEhitu] => regsvr32.exe "C:\ProgramData\OlafcEhitu\OlafcEhitu.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [EdvapYexhu] => regsvr32.exe "C:\ProgramData\EdvapYexhu\EdvapYexhu.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [UkjaFtoq] => regsvr32.exe "C:\ProgramData\UkjaFtoq\UkjaFtoq.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [UkvoJojow] => regsvr32.exe "C:\ProgramData\UkvoJojow\UkvoJojow.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [ApmeJxel] => regsvr32.exe "C:\ProgramData\ApmeJxel\ApmeJxel.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OfqiTaxo] => regsvr32.exe "C:\ProgramData\OfqiTaxo\OfqiTaxo.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [AkoyaVgogi] => regsvr32.exe "C:\ProgramData\AkoyaVgogi\AkoyaVgogi.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [EADM] => C:\Program Files (x86)\Origin\Origin.exe [3600216 2014-09-16] (Electronic Arts)
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [AkmupUguge] => regsvr32.exe "C:\ProgramData\AkmupUguge\AkmupUguge.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [AmqiqPizet] => regsvr32.exe "C:\ProgramData\AmqiqPizet\AmqiqPizet.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OcniNtih] => regsvr32.exe "C:\ProgramData\OcniNtih\OcniNtih.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OnibErof] => regsvr32.exe "C:\ProgramData\OnibErof\OnibErof.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [UzeneKjojf] => regsvr32.exe "C:\ProgramData\UzeneKjojf\UzeneKjojf.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [IdobvItazx] => regsvr32.exe "C:\ProgramData\IdobvItazx\IdobvItazx.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [UlhuGisc] => regsvr32.exe "C:\ProgramData\UlhuGisc\UlhuGisc.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [22041192 2014-08-27] (Skype Technologies S.A.)
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [hh] => C:\Users\david\AppData\Roaming\Microsoft\Windows\IEUpdate\hh.exe [134656 2012-01-27] ()
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\RunOnce: [Application Restart #0] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [852808 2014-09-23] (Google Inc.)
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\RunOnce: [hh] => C:\Users\david\AppData\Roaming\Microsoft\Windows\IEUpdate\hh.exe [134656 2012-01-27] ()
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Policies\Explorer: [HideSCAHealth] 1
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Policies\Explorer: [Run] "C:\Users\david\AppData\Roaming\Microsoft\Windows\IEUpdate\hh.exe"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\MountPoints2: {1b512607-389d-11e2-b1b2-d4bed9b97b5e} - G:\pushinst.exe
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Command Processor: "C:\Users\david\AppData\Roaming\Microsoft\Windows\IEUpdate\hh.exe" <===== ATTENTION!
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...0c966feabec1\InprocServer32: [Default-shell32] C:\Users\david\AppData\Local\{1547a4df-a060-bca0-5da2-aff15ee51e9d}\n. ATTENTION! ====> ZeroAccess/Alureon?
HKU\S-1-5-18\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [22041192 2014-08-27] (Skype Technologies S.A.)
AppInit_DLLs: c:\progra~3\bitguard\271832~1.68\{c16c1~1\loader.dll => c:\progra~3\bitguard\271832~1.68\{c16c1~1\loader.dll File Not Found
AppInit_DLLs-x32: c:\progra~3\bitguard\271832~1.68\{c16c1~1\bitguard.dll => "c:\progra~3\bitguard\271832~1.68\{c16c1~1\bitguard.dll" File Not Found
Startup: C:\Users\david\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hh.lnk
ShortcutTarget: hh.lnk -> C:\Users\david\AppData\Roaming\Microsoft\Windows\IEUpdate\hh.exe ()
ShellIconOverlayIdentifiers: [ AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_v_1_1_0_x64.dll ()
ShellIconOverlayIdentifiers: [ AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_v_1_1_0_x64.dll ()
ShellIconOverlayIdentifiers: [ AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_v_1_1_0_x64.dll ()
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File
BootExecute: autocheck autochk * aswBoot.exe /M:c2da9b9a2a /wow /dir:"C:\Program Files\AVAST Software\Avast"

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = 
SearchScopes: HKLM-x32 - DefaultScope value is missing.
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: No Name -> {1FB251BE-1A9B-16AD-99F8-A54DD1FBA160} ->  No File
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: DVDVideoSoft IE Extension -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll (DVDVideoSoft Ltd.)
BHO-x32: No Name -> {1FB251BE-1A9B-16AD-99F8-A54DD1FBA160} ->  No File
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
BHO-x32: No Name -> {a235e1e3-6296-4710-af39-104a7faa6c7c} ->  No File
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: DVDVideoSoft IE Extension -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.)
BHO-x32: No Name -> {f236ca79-3123-4afb-9f74-e98117ad5625} ->  No File
Toolbar: HKLM - No Name - !{1BB22D38-A411-4B13-A746-C2A4F4EC7344} -  No File
Toolbar: HKLM - No Name - !{5018CFD2-804D-4C99-9F81-25EAEA2769DE} -  No File
Toolbar: HKLM - No Name - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  No File
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  No File
Toolbar: HKLM-x32 - No Name - !{1BB22D38-A411-4B13-A746-C2A4F4EC7344} -  No File
Toolbar: HKLM-x32 - No Name - !{5018CFD2-804D-4C99-9F81-25EAEA2769DE} -  No File
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default
FF NewTab: user_pref("browser.newtab.url", "");
FF DefaultSearchEngine: Google
FF SearchEngineOrder.1: Google
FF SelectedSearchEngine: user_pref("browser.search.selectedEngine", "");
FF Homepage: user_pref("browser.startup.homepage", "");
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1205146.dll (Adobe Systems, Inc.)
FF Plugin-x32: @esn/esnlaunch,version=1.138.0 -> C:\Program Files (x86)\Battlelog Web Plugins\1.138.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=2.1.7 -> C:\Program Files (x86)\Battlelog Web Plugins\2.1.7\npesnlaunch.dll No File
FF Plugin-x32: @esn/npbattlelog,version=2.4.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.4.0\npbattlelog.dll (EA Digital Illusions CE AB)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\david\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\david\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF user.js: detected! => C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\user.js
FF Extension: Amazon-Icon - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\Extensions\amazon-icon@giga.de [2014-04-16]
FF Extension: Stylish - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\Extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8}.xpi [2012-10-08]
FF Extension: NoScript - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2012-10-07]
FF Extension: Adblock Plus - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-09-08]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-07-14]
FF HKLM\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird
FF Extension: ESET Smart Security Extension - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird [2014-08-14]
FF HKLM-x32\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird
FF HKCU\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff
FF Extension: Download videos and MP3s from YouTube - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-04-22]
FF Extension: No Name - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\extensions\battlefieldheroespatcher@ea.com [Not Found]
FF Extension: No Name - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\extensions\battlefieldplay4free@ea.com [Not Found]
FF Extension: No Name - C:\Program Files\AVAST Software\Avast\WebRep\FF [Not Found]
FF Extension: No Name - C:\Program Files (x86)\LyricsPal\125.xpi [Not Found]
FF Extension: No Name - C:\Program Files (x86)\FromDocToPDF_65\bar\1.bin [Not Found]
FF Extension: No Name - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\extensions\{2894a412-e091-6466-9ab8-ea76561654ca} [Not Found]

Chrome: 
=======
CHR HomePage: Default -> chrome://newtab
CHR Profile: C:\Users\david\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-03-20]
CHR Extension: (Google Drive) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-03-20]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-05]
CHR Extension: (YouTube) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-03-20]
CHR Extension: (Google-Suche) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-03-20]
CHR Extension: (Stylish) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\fjnbnpbmkenffdnngjfgmeleoegfcffe [2013-07-03]
CHR Extension: (AdBlock) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2013-07-03]
CHR Extension: (Skype Click to Call) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2014-07-20]
CHR Extension: (Google Wallet) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-22]
CHR Extension: (Battlefield Play4Free) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\oiokahphinmbmakkehgelkmpolmnbkdh [2014-04-06]
CHR Extension: (Google Mail) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-03-20]
CHR HKCU\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\DVDVideoSoftBrowserExtension.crx [2014-04-22]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14]
CHR HKLM-x32\...\Chrome\Extension: [mkcedibhemacmilmkpndpkoidlnmgngg] - C:\Users\david\ChromeExtensions\mkcedibhemacmilmkpndpkoidlnmgngg\amazon.crx [2013-04-30]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [448384 2014-08-04] ()
S3 BRSptSvc; C:\ProgramData\BitRaider\BRSptSvc.exe [477960 2014-04-11] (BitRaider, LLC)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
R2 ekrn; C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe [1343408 2014-02-24] (ESET)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1149760 2014-09-17] (NVIDIA Corporation)
S3 npggsvc; C:\Windows\SysWOW64\GameMon.des [3191392 2014-05-15] (INCA Internet Co., Ltd.)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1796928 2014-09-17] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19440960 2014-09-17] (NVIDIA Corporation)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76152 2014-06-21] ()
S2 AviraUpgradeService; "C:\Windows\TEMP\AVSETUP_53f13fa6\avupgsvc.exe" /TEMPSTART:""C:\Windows\TEMP\AVSETUP_53f13fa6\setup.exe" /NOTEMPCLEANUP /CLEANUPSRCFILES"

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S4 aswSP; No ImagePath
S3 BRDriver64; C:\ProgramData\BitRaider\BRDriver64.sys [75048 2013-10-08] (BitRaider)
R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [168256 2013-09-17] (ESET)
R2 epfw; C:\Windows\System32\DRIVERS\epfw.sys [220232 2013-09-17] (ESET)
R1 EpfwLWF; C:\Windows\System32\DRIVERS\EpfwLWF.sys [44120 2013-09-17] (ESET)
R0 epfwwfp; C:\Windows\System32\DRIVERS\epfwwfp.sys [62136 2013-09-17] (ESET)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [20288 2014-09-17] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38048 2014-09-04] (NVIDIA Corporation)
S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [386680 2014-09-13] (Duplex Secure Ltd.)
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]
S3 X6va008; \??\C:\Windows\SysWOW64\Drivers\X6va008 [X]
S3 X6va011; \??\C:\Windows\SysWOW64\Drivers\X6va011 [X]
S3 xhunter1; \??\C:\Windows\xhunter1.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-10 20:56 - 2014-10-10 20:58 - 00029239 _____ () C:\Users\david\Desktop\FRST.txt
2014-10-10 20:56 - 2014-10-10 20:56 - 00000000 ____D () C:\FRST
2014-10-10 20:55 - 2014-10-10 20:55 - 02109952 _____ (Farbar) C:\Users\david\Downloads\FRST64.exe
2014-10-10 20:55 - 2014-10-10 20:55 - 02109952 _____ (Farbar) C:\Users\david\Desktop\FRST64.exe
2014-10-10 19:12 - 2014-10-10 19:13 - 00000000 ____D () C:\Users\david\AppData\Roaming\SpaceEngineers
2014-10-06 21:21 - 2014-10-06 22:00 - 764194469 _____ ( ) C:\Users\david\Downloads\Call_of_Pripyat_Complete_v1.0.2_Setup.exe
2014-10-03 10:50 - 2014-10-03 10:50 - 00000000 ____D () C:\Users\david\Documents\Paradox Interactive
2014-09-29 20:45 - 2014-09-29 20:45 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies
2014-09-29 20:43 - 2014-09-13 22:13 - 00613696 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
2014-09-29 20:33 - 2014-09-17 06:51 - 01538880 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdagenco6420103.dll
2014-09-29 20:33 - 2014-09-17 06:51 - 00197408 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda64v.sys
2014-09-29 20:33 - 2014-09-17 06:51 - 00031520 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 31887680 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 24552592 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 20922512 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 19954520 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 18106152 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 17259664 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 14026304 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 13939272 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 13157696 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2014-09-29 20:33 - 2014-09-14 01:48 - 11392576 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 11330776 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 04287296 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 04008592 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 01876296 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434411.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 01539272 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434411.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 00957584 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 00925896 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 00919240 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 00894096 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 00867528 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 00352016 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 00303600 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 00174856 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 00156840 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 00026956 _____ () C:\Windows\system32\nvinfo.pb
2014-09-29 18:41 - 2014-09-29 18:41 - 00000000 ____D () C:\NVIDIA
2014-09-29 18:34 - 2014-09-17 04:10 - 01715224 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll
2014-09-29 18:34 - 2014-09-17 04:10 - 01291280 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll
2014-09-29 18:32 - 2014-09-04 21:14 - 00038048 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2014-09-29 18:32 - 2014-09-04 21:14 - 00032416 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2014-09-29 18:29 - 2014-09-29 18:32 - 319671744 _____ (NVIDIA Corporation) C:\Users\david\Downloads\344.11-desktop-win8-win7-winvista-64bit-international-whql.exe
2014-09-29 01:11 - 2014-09-29 01:11 - 06626832 _____ (TeamViewer GmbH) C:\Users\david\Downloads\TeamViewer_Setup_de.exe
2014-09-25 01:04 - 2014-09-25 01:04 - 00342430 _____ () C:\Users\david\Downloads\lolhentai-1.6.3.sdt
2014-09-20 19:59 - 2014-09-20 19:59 - 00002466 _____ () C:\Users\VERSUCH\Desktop\SWAT 4 Single Player Demo.lnk
2014-09-20 19:59 - 2014-09-20 19:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VUGames
2014-09-20 19:51 - 2014-09-20 19:51 - 00367432 _____ () C:\Users\david\Downloads\SoftonicDownloader_for_s-w-a-t-4.exe
2014-09-16 20:14 - 2014-05-14 18:23 - 02477536 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-09-16 20:14 - 2014-05-14 18:23 - 00058336 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-09-16 20:14 - 2014-05-14 18:23 - 00044512 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-09-16 20:14 - 2014-05-14 18:21 - 02620928 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-09-16 20:13 - 2014-05-14 18:23 - 00700384 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-09-16 20:13 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2014-09-16 20:13 - 2014-05-14 18:23 - 00038880 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-09-16 20:13 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2014-09-16 20:13 - 2014-05-14 18:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-09-16 20:13 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2014-09-16 20:13 - 2014-05-14 09:23 - 00198600 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-09-16 20:13 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2014-09-16 20:13 - 2014-05-14 09:20 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-09-16 20:13 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2014-09-15 17:16 - 2014-09-15 17:16 - 00000000 ____D () C:\Users\david\AppData\Local\Skyrim
2014-09-15 14:02 - 2014-09-15 14:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-09-13 17:01 - 2014-09-13 17:01 - 00002994 _____ () C:\Windows\System32\Tasks\{27D2EB2D-97B3-45D7-92BF-F3A828E00E69}
2014-09-13 17:01 - 2014-09-13 17:01 - 00002994 _____ () C:\Windows\System32\Tasks\{0DD3DE14-B902-4045-B1FF-C97573D1D309}
2014-09-13 16:48 - 2014-09-13 16:49 - 01595776 _____ (ESET) C:\Users\david\Downloads\eset_smart_security_live_installer_.exe
2014-09-13 15:58 - 2014-09-13 15:58 - 00000000 ____D () C:\blabliblu
2014-09-13 15:42 - 2014-09-13 15:42 - 00000000 ____D () C:\Users\Public\Documents\DAEMON Tools Images
2014-09-13 15:01 - 2014-09-13 15:01 - 00386680 _____ (Duplex Secure Ltd.) C:\Windows\system32\Drivers\sptd.sys
2014-09-13 00:47 - 2014-09-13 00:47 - 13429504 _____ (Disc Soft Ltd) C:\Users\david\Downloads\DTLite4491-0356.exe
2014-09-11 06:39 - 2014-09-11 06:41 - 00001629 _____ () C:\Users\VERSUCH\Desktop\Sir.lnk
2014-09-11 06:39 - 2014-09-11 06:39 - 00000000 ____D () C:\Games
2014-09-11 00:10 - 2014-09-11 00:10 - 00000000 ____D () C:\ProgramData\Astroburn Lite
2014-09-10 23:40 - 2014-09-10 23:40 - 00000000 ____D () C:\ProgramData\UlhuGisc
2014-09-10 21:14 - 2014-09-11 00:01 - 00000000 ____D () C:\Users\david\AppData\Roaming\DAEMON Tools Lite
2014-09-10 21:12 - 2014-09-11 00:10 - 00000000 ____D () C:\ProgramData\DAEMON Tools Lite

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-10 20:58 - 2013-03-23 18:55 - 00000000 ____D () C:\Users\david\AppData\Local\CrashDumps
2014-10-10 20:54 - 2012-06-23 16:19 - 00000000 ____D () C:\Users\david\AppData\Roaming\Skype
2014-10-10 20:33 - 2013-07-01 13:47 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-10-10 20:19 - 2013-07-03 15:26 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-10-10 20:14 - 2012-06-23 16:32 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-10-10 20:10 - 2012-06-23 16:41 - 00000000 ____D () C:\Users\david\AppData\Roaming\TS3Client
2014-10-10 19:55 - 2014-09-08 20:25 - 00000000 ____D () C:\Users\david\Desktop\Cracks
2014-10-10 18:25 - 2012-06-24 18:15 - 00001138 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-243866017-1107141967-568923311-1001UA.job
2014-10-10 18:19 - 2013-07-03 15:26 - 00001108 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-10-10 14:01 - 2013-05-21 18:36 - 00003440 _____ () C:\Windows\System32\Tasks\PCDEventLauncherTask
2014-10-10 13:16 - 2014-01-02 12:25 - 01295903 _____ () C:\Windows\WindowsUpdate.log
2014-10-10 04:04 - 2012-11-01 17:03 - 00003930 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{963751FF-E6A0-461A-9D15-630985D8D304}
2014-10-10 02:00 - 2012-06-30 11:37 - 00000000 ____D () C:\Users\david\AppData\Local\Adobe
2014-10-10 00:25 - 2012-06-24 18:15 - 00001116 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-243866017-1107141967-568923311-1001Core.job
2014-10-09 21:07 - 2012-06-23 16:25 - 00000000 ____D () C:\ProgramData\Origin
2014-10-09 21:06 - 2014-08-27 23:16 - 00000000 ____D () C:\Program Files (x86)\Origin
2014-10-09 13:22 - 2009-07-14 06:45 - 00021072 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-09 13:22 - 2009-07-14 06:45 - 00021072 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-09 13:10 - 2014-01-01 20:14 - 00032179 _____ () C:\Windows\setupact.log
2014-10-09 13:10 - 2012-01-27 09:33 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-10-09 13:10 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-10-05 13:11 - 2014-08-11 02:34 - 00000000 ____D () C:\Users\david\Documents\BattleIslands
2014-10-04 22:03 - 2012-06-23 16:32 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-10-04 22:03 - 2012-06-23 16:32 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-10-04 22:03 - 2012-01-27 10:40 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-10-04 15:49 - 2014-01-06 03:51 - 00661582 _____ () C:\Windows\DirectX.log
2014-10-04 15:44 - 2013-06-02 22:16 - 00000000 ____D () C:\Users\david\AppData\Roaming\Spotify
2014-10-03 23:03 - 2013-06-24 22:20 - 00000000 ____D () C:\Users\david\AppData\Local\Spotify
2014-09-29 20:49 - 2013-09-17 19:46 - 00001349 _____ () C:\Users\Public\Desktop\GeForce Experience.lnk
2014-09-29 20:45 - 2012-06-23 20:58 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation
2014-09-29 20:44 - 2013-09-17 19:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2014-09-29 20:38 - 2012-01-27 09:33 - 00000000 ____D () C:\Program Files\NVIDIA Corporation
2014-09-29 18:38 - 2013-12-21 19:21 - 00000000 ____D () C:\Users\david\AppData\Local\NVIDIA Corporation
2014-09-29 18:34 - 2012-01-27 09:33 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation
2014-09-29 13:14 - 2012-01-27 11:20 - 00000000 ____D () C:\ProgramData\Sonic
2014-09-29 13:11 - 2014-01-07 16:07 - 00950000 _____ () C:\Windows\PFRO.log
2014-09-29 01:12 - 2012-07-18 17:29 - 00000000 ____D () C:\Users\david\AppData\Roaming\TeamViewer
2014-09-28 20:48 - 2012-10-03 16:54 - 00007599 _____ () C:\Users\david\AppData\Local\Resmon.ResmonCfg
2014-09-20 20:23 - 2012-01-27 10:58 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-09-19 05:52 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-09-18 15:15 - 2013-03-02 00:27 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-09-17 04:10 - 2013-12-21 18:53 - 02799784 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll
2014-09-17 04:10 - 2013-12-21 18:53 - 02193560 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll
2014-09-16 20:19 - 2012-06-24 09:00 - 00000000 ____D () C:\ProgramData\PCDr
2014-09-15 17:14 - 2012-06-29 13:21 - 00000000 ____D () C:\Users\david\Documents\My Games
2014-09-15 17:13 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-09-15 14:02 - 2014-08-26 05:17 - 00002517 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-09-15 14:02 - 2012-06-23 16:19 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-09-15 14:02 - 2012-01-27 11:00 - 00000000 ____D () C:\ProgramData\Skype
2014-09-14 01:48 - 2013-03-17 21:13 - 20589536 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
2014-09-14 01:48 - 2012-06-23 20:58 - 00984424 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll
2014-09-14 01:48 - 2012-01-27 18:13 - 16875856 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll
2014-09-14 01:48 - 2012-01-27 18:13 - 03223120 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll
2014-09-14 01:48 - 2012-01-27 18:13 - 02838424 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll
2014-09-13 23:53 - 2011-02-17 12:10 - 00062608 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll
2014-09-13 23:53 - 2011-02-17 11:10 - 02557640 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll
2014-09-13 23:53 - 2011-02-17 11:10 - 00934216 _____ (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
2014-09-13 23:53 - 2011-02-17 11:10 - 00385168 _____ (NVIDIA Corporation) C:\Windows\system32\nvmctray.dll
2014-09-13 23:53 - 2011-02-17 11:09 - 06890696 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll
2014-09-13 23:53 - 2011-02-17 11:09 - 03529872 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc64.dll
2014-09-13 17:53 - 2013-12-29 22:58 - 00001104 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 9.lnk
2014-09-13 17:05 - 2014-05-28 23:04 - 00000000 ____D () C:\Program Files (x86)\osu!
2014-09-13 01:00 - 2010-11-21 08:50 - 00699416 _____ () C:\Windows\system32\perfh007.dat
2014-09-13 01:00 - 2010-11-21 08:50 - 00149556 _____ () C:\Windows\system32\perfc007.dat
2014-09-13 01:00 - 2009-07-14 07:13 - 01620612 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-09-11 17:37 - 2012-06-23 20:59 - 03961833 _____ () C:\Windows\system32\nvcoproc.bin

ZeroAccess:
C:\Windows\Installer\{1547a4df-a060-bca0-5da2-aff15ee51e9d}
C:\Windows\Installer\{1547a4df-a060-bca0-5da2-aff15ee51e9d}\@

ZeroAccess:
C:\Users\david\AppData\Local\{1547a4df-a060-bca0-5da2-aff15ee51e9d}
C:\Users\david\AppData\Local\{1547a4df-a060-bca0-5da2-aff15ee51e9d}\@

Files to move or delete:
====================
C:\Users\david\AppData\Roaming\Microsoft\Windows\IEUpdate\hh.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-09-19 05:45

==================== End Of Log ============================
         

--- --- ---

--- --- ---


FRST Additions Logfile:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 08-10-2014 01
Ran by david at 2014-10-10 20:59:18
Running from C:\Users\david\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)


==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version:  - )
Adobe Creative Cloud (HKLM-x32\...\Adobe Creative Cloud) (Version: 2.0.2.189 - Adobe Systems Incorporated)
Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.167 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.09) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.09 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.0 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.0.5.146 - Adobe Systems, Inc.)
Akamai NetSession Interface (HKCU\...\Akamai) (Version:  - Akamai Technologies, Inc)
Any Video Converter 5.5.2 (HKLM-x32\...\Any Video Converter_is1) (Version:  - Any-Video-Converter.com)
Apple Application Support (HKLM-x32\...\{A83279FD-CA4B-4206-9535-90974DE76654}) (Version: 2.1.5 - Apple Inc.)
Arma 2 (HKLM-x32\...\Steam App 33900) (Version:  - Bohemia Interactive)
ARMA 2 Army of The Czech Republic - Data cache removal (HKLM-x32\...\A2ACR Data cache removal) (Version:  - )
ARMA 2: British Armed Forces - Data cache removal (HKLM-x32\...\A2BAF Data cache removal) (Version:  - )
Arma 2: British Armed Forces (HKLM-x32\...\Steam App 65700) (Version:  - Bohemia Interactive)
Arma 2: Operation Arrowhead (HKLM-x32\...\Steam App 33930) (Version:  - Bohemia Interactive)
ARMA 2: Private Military Company - Data cache removal (HKLM-x32\...\A2PMC Data cache removal) (Version:  - )
Arma 2: Private Military Company (HKLM-x32\...\Steam App 65720) (Version:  - Bohemia Interactive)
Awesomium Redistributable (HKLM-x32\...\{5BCB064B-9F65-4E15-BAFB-669E72E54FD9}) (Version: 1.7.4.2 - SIX Networks GmbH)
AwesomiumSetup (HKLM-x32\...\{19EF99D1-7EE6-4B5E-ABEE-0B3825F703B0}) (Version: 1.00.0000 - SIX Networks GmbH)
Battlelog Web Plugins (HKLM-x32\...\Battlelog Web Plugins) (Version: 2.4.0 - EA Digital Illusions CE AB)
BattlEye for OA Uninstall (HKLM-x32\...\BattlEye for OA) (Version:  - )
BitRaider Web Client (HKLM-x32\...\BitRaider Web Client) (Version: 1.1.9.4 - BitRaider, LLC)
CCG Launcher version 0.6 (HKLM-x32\...\{28362054-F79B-4697-A246-3ECF730E7E9D}_is1) (Version: 0.6 - Custom Combat Gaming)
CCleaner (HKLM\...\CCleaner) (Version: 4.09 - Piriform)
Conexant HD Audio (HKLM\...\CNXT_AUDIO_HDA) (Version: 8.50.4.0 - Conexant)
Counter-Strike: Global Offensive (HKLM-x32\...\Steam App 730) (Version:  - Valve)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DayZ (HKLM-x32\...\Steam App 221100) (Version:  - Bohemia Interactive)
DayZ Commander (HKLM-x32\...\{790412BB-B6CE-459B-9E17-7DA7C20FC98C}) (Version: 0.9.124 - Dotjosh Studios)
Dell DataSafe Local Backup - Support Software (HKLM-x32\...\{A9668246-FB70-4103-A1E3-66C9BC2EFB49}) (Version: 9.4.61 - Dell Inc.)
Dell DataSafe Local Backup (HKLM-x32\...\{0ED7EE95-6A97-47AA-AD73-152C08A15B04}) (Version: 9.4.61 - Dell Inc.)
Dell Edoc Viewer (HKLM\...\{8EBA8727-ADC2-477B-9D9A-1A1836BE4E05}) (Version: 1.0.0 - Dell Inc)
Dell Getting Started Guide (HKLM-x32\...\{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}) (Version: 1.00.0000 - Dell Inc.)
Dell MusicStage (HKLM-x32\...\{3255BC3F-32BA-41ED-93A0-B9AEB6CDD9E6}) (Version: 1.5.201.0 - Fingertapps)
Dell PhotoStage (HKLM-x32\...\{E4335E82-17B3-460F-9E70-39D9BC269DB3}) (Version: 1.5.0.65 - ArcSoft)
Dell Product Registration (HKLM-x32\...\{2A0F2CC5-3065-492C-8380-B03AA7106B1A}) (Version: 1.1.3 - Dell Inc.)
Dell Stage (HKLM-x32\...\{E2F57269-065E-4B19-8CDA-AB6C401FAF1A}) (Version: 1.7.209.0 - Fingertapps)
Dell VideoStage  (HKLM-x32\...\InstallShield_{DCE0E79A-B9AC-41AC-98C1-7EF0538BCA7F}) (Version: 1.2.0.1712 - CyberLink Corp.)
Dell VideoStage  (x32 Version: 1.2.0.1712 - CyberLink Corp.) Hidden
diclovit's mod pack 1.10.6 (HKLM-x32\...\{28B1238E-1C18-4637-A2B7-95315E94EB29}_is1) (Version: 1.10.6 - diclovit)
DirectX 9 Runtime (x32 Version: 1.00.0000 - Sonic Solutions) Hidden
eBay (HKLM-x32\...\{A8B88634-7F90-402F-B66A-86429755F6A5}) (Version: 1.4.0 - eBay Inc.)
Facebook Video Calling 3.1.0.521 (HKLM-x32\...\{2091F234-EB58-4B80-8C96-8EB78C808CF7}) (Version: 3.1.521 - Skype Limited)
Fantasy Voice Pack (HKLM-x32\...\{5F4C3E1F-87FC-41BD-B219-E4156BBD8AE5}) (Version: 1.3.2 - Screaming Bee)
File Association Helper (HKLM\...\{C168639F-5810-4EC8-B1E8-0251AA8A771C}) (Version: 1.2.225.65451 - WinZip Computing International, LLC)
FL Studio 11 (HKLM-x32\...\FL Studio 11) (Version:  - Image-Line)
Fraps (remove only) (HKLM-x32\...\Fraps) (Version:  - )
Free YouTube to MP3 Converter version 3.12.32.327 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.32.327 - DVDVideoSoft Ltd.)
Furry Voices for Second Life (HKLM-x32\...\{2032DA39-C844-43AE-B638-6A4F7496686E}) (Version: 1.3.1 - Screaming Bee)
Glyph (HKLM-x32\...\Glyph) (Version:  - Trion Worlds, Inc.)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 37.0.2062.124 - Google Inc.)
Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden
Haali Media Splitter (HKLM-x32\...\HaaliMkx) (Version:  - )
HexChat (x64) (HKLM\...\HexChat (x64)_is1) (Version: 2.9.5 - HexChat)
IL Shared Libraries (HKLM-x32\...\IL Shared Libraries) (Version:  - Image-Line)
Java 7 Update 25 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417025FF}) (Version: 7.0.250 - Oracle)
Java 7 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.250 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.5 - Sun Microsystems, Inc.) Hidden
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
League of Legends (HKLM-x32\...\{92606477-9366-4D3B-8AE3-6BE4B29727AB}) (Version: 1.3 - Riot Games)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Messenger Companion (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 RC (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50861 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 RC (Version: 4.5.50861 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Chart Controls for Microsoft .NET Framework 3.5 (KB2500170) (HKLM-x32\...\{41785C66-90F2-40CE-8CB5-1C94BFC97280}) (Version: 3.5.30730.0 - Microsoft Corporation)
Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{832D9DE0-8AFC-4689-9819-4DBBDEBD3E4F}) (Version: 3.5.92.0 - Microsoft Corporation)
Microsoft Games for Windows Marketplace (HKLM-x32\...\{4CB0307C-565E-4441-86BE-0DF2E4FB828C}) (Version: 3.5.50.0 - Microsoft Corporation)
Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 4.1.10329.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{820B6609-4C97-3A2B-B644-573B06A0F0CC}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft XNA Framework Redistributable 4.0 Refresh (HKLM-x32\...\{D69C8EDE-BBC5-436B-8E0E-C5A6D311CF4F}) (Version: 4.0.30901.0 - Microsoft Corporation)
Modern War Sounds (HKLM-x32\...\{A514E94F-C436-44C3-A1E9-1F58CD352669}) (Version: 1.0.1 - Screaming Bee)
Mozilla Firefox 22.0 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 22.0 (x86 en-US)) (Version: 22.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 22.0 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
My Dell (HKLM\...\PC-Doctor for Windows) (Version: 3.5.6426.22 - PC-Doctor, Inc.)
My Game Long Name (HKLM\...\UDK-c4ea7acb-501f-4c29-b8c6-daf02f547053) (Version:  - Epic Games, Inc.)
NVIDIA 3D Vision Controller-Treiber 344.11 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 344.11 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 344.11 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 344.11 - NVIDIA Corporation)
NVIDIA GeForce Experience 2.1.2 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.1.2 - NVIDIA Corporation)
NVIDIA GeForce Experience Service (Version: 16.13.42 - NVIDIA Corporation) Hidden
NVIDIA Grafiktreiber 344.11 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 344.11 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.32.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.32.1 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.162.1274 - NVIDIA Corporation) Hidden
NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA Network Service (Version: 2.0 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.14.0702 - NVIDIA Corporation) Hidden
NVIDIA PhysX-Systemsoftware 9.14.0702 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.14.0702 - NVIDIA Corporation)
NVIDIA ShadowPlay 16.13.42 (Version: 16.13.42 - NVIDIA Corporation) Hidden
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.12.6514 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 344.11 (Version: 344.11 - NVIDIA Corporation) Hidden
NVIDIA Update 16.13.42 (Version: 16.13.42 - NVIDIA Corporation) Hidden
NVIDIA Update Core (Version: 16.13.42 - NVIDIA Corporation) Hidden
NVIDIA Virtual Audio 1.2.25 (Version: 1.2.25 - NVIDIA Corporation) Hidden
Open Broadcaster Software (HKLM-x32\...\Open Broadcaster Software) (Version:  - )
OpenAL (HKLM-x32\...\OpenAL) (Version:  - )
OpenOffice 4.1.0 (HKLM-x32\...\{E19483E2-6C18-494D-A307-D4498BCFD2C7}) (Version: 4.10.9764 - Apache Software Foundation)
Origin (HKLM-x32\...\Origin) (Version: 9.4.21.2812 - Electronic Arts, Inc.)
osu! (HKLM-x32\...\{C3592426-531E-4110-911D-BFECE2CE284C}) (Version: 0.0.0.0 - peppy)
Paint.NET v3.5.10 (HKLM\...\{529125EF-E3AC-4B74-97E6-F688A7C0F1C0}) (Version: 3.60.0 - dotPDN LLC)
PhotoShowExpress (x32 Version: 2.0.063 - Sonic Solutions) Hidden
PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.994 - Even Balance, Inc.)
RBVirtualFolder64Inst (Version: 1.00.0000 - Roxio, Inc.) Hidden
Roxio Activation Module (x32 Version: 1.0 - Roxio) Hidden
Roxio BackOnTrack (x32 Version: 1.3.3 - Roxio) Hidden
Roxio Burn (x32 Version: 1.8 - Roxio) Hidden
Roxio Creator Starter (HKLM-x32\...\{6F0BBEFE-BE1C-419B-BA1F-D36C9E7915BC}) (Version: 12.1.77.0 - Roxio)
Roxio Creator Starter (x32 Version: 1.0.439 - Roxio) Hidden
Roxio Creator Starter (x32 Version: 5.0.0 - Roxio) Hidden
Roxio Express Labeler 3 (x32 Version: 3.2.2 - Roxio) Hidden
Roxio File Backup (Version: 1.3.2 - Roxio) Hidden
S.T.A.L.K.E.R.: Call of Pripyat (HKLM-x32\...\Steam App 41700) (Version:  - GSC Game World)
SHIELD Streaming (Version: 3.1.200 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 16.13.42 - NVIDIA Corporation) Hidden
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)
Skype™ 6.20 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.20.104 - Skype Technologies S.A.)
SlimDX Redistributable (March 2009) (HKLM-x32\...\{D5395E5F-4D45-4665-8F00-234FA33678AF}) (Version: 2.0.7.41 - SlimDX Group)
Snap.Do (HKLM-x32\...\{C0AF06AE-DA2A-4299-AD1A-F40C5C81E409}) (Version: 1.75.1.11559 - ReSoft Ltd.) <==== ATTENTION
Sonic CinePlayer Decoder Pack (x32 Version: 4.3.0 - Sonic Solutions) Hidden
Speccy (HKLM\...\Speccy) (Version: 1.21 - Piriform)
Special Effects Voices (HKLM-x32\...\{913C4C4F-9E3E-41A6-A614-1BDC1352A225}) (Version: 1.0.2 - Screaming Bee)
Spotify (HKCU\...\Spotify) (Version: 0.9.14.13.gba5645ad - Spotify AB)
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
TeamSpeak 3 Client (HKLM-x32\...\TeamSpeak 3 Client) (Version: 3.0.16 - TeamSpeak Systems GmbH)
TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.31064 - TeamViewer)
The Elder Scrolls V: Skyrim (HKLM-x32\...\Steam App 72850) (Version:  - Bethesda Game Studios)
Translator Fun Voice Pack (HKLM-x32\...\{C39768C1-82E7-4466-8526-2D8AC44B768F}) (Version: 1.5.1 - Screaming Bee)
Unity Web Player (HKCU\...\UnityWebPlayer) (Version:  - Unity Technologies ApS)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3555.0308 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Family Safety (Version: 15.4.3555.0308 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3555.0308 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Messenger (x32 Version: 15.4.3538.0513 - Microsoft Corporation) Hidden
Windows Live Messenger Companion Core (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
WinRAR 4.20 (32-Bit) (HKLM-x32\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-243866017-1107141967-568923311-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\david\AppData\Roaming\Dropbox\bin\Dropbox.exe /autoplay No File
CustomCLSID: HKU\S-1-5-21-243866017-1107141967-568923311-1001_Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32 -> C:\Users\david\AppData\Local\{1547a4df-a060-bca0-5da2-aff15ee51e9d}\n. No File

==================== Restore Points  =========================


==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {025FD671-2EEF-4565-B85B-E99DC670A632} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {050228F8-66AC-4C76-AE27-948A505E8A6E} - \DealPlyUpdate No Task File <==== ATTENTION
Task: {05B71C85-ADE4-49E6-85E4-2280A5CC3E95} - \DealPly No Task File <==== ATTENTION
Task: {11DB9A4D-AC00-48FD-8C89-CFBD238600BA} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-12-17] (Piriform Ltd)
Task: {14FEE834-0A77-4666-83CD-4195AE98AFDC} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-07-03] (Google Inc.)
Task: {180A7227-01BD-4F76-9E90-97066F8DD6D3} - \Desk 365 RunAsStdUser No Task File <==== ATTENTION
Task: {1F1BFE31-0A2E-45FF-A3DB-1E314EF1C341} - System32\Tasks\{103811C6-98C5-4593-9878-D64DB8906036} => C:\Program Files (x86)\SIX Networks\Play withSIX\Play withSIX.exe
Task: {25769AE3-0013-466B-AB46-C56E34A8C940} - System32\Tasks\PCDEventLauncherTask => C:\Program Files\My Dell\sessionchecker.exe [2014-01-31] (PC-Doctor, Inc.)
Task: {272AB684-61F9-4369-BB25-3E2D14AB93B7} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-07-03] (Google Inc.)
Task: {30633D0D-CC3E-4F8A-A0B2-A8576EC69707} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-10-04] (Adobe Systems Incorporated)
Task: {3CE2026C-48FF-4E0E-8E87-B2BEC94D3FEB} - System32\Tasks\{3EC173E2-65C5-4F3D-9C44-AB294852860F} => Firefox.exe hxxp://ui.skype.com/ui/0/5.10.0.116/de/go/help.faq.installer?LastError=1603
Task: {43341FCC-7348-47D8-9F41-D6AFD222A976} - System32\Tasks\Norton Identity Safe\Norton Error Processor => C:\Program Files (x86)\Norton Identity Safe\Engine\2013.3.0.26\SymErr.exe
Task: {4B85320F-65AB-4D6C-A326-B54A538E5EC3} - System32\Tasks\{27D2EB2D-97B3-45D7-92BF-F3A828E00E69} => C:\Users\david\Downloads\eset_smart_security_live_installer_.exe [2014-09-13] (ESET)
Task: {58D53B25-FB58-42AF-98A3-C15AAC1B20A3} - System32\Tasks\AdobeAAMUpdater-1.0-david-PC-VERSUCH => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2013-06-03] (Adobe Systems Incorporated)
Task: {5D612964-9217-449E-AD2E-30A7757D1F4B} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\My Dell\uaclauncher.exe [2014-01-31] (PC-Doctor, Inc.)
Task: {5EF56591-5D0A-42FE-8F5E-9E1E731F76C0} - System32\Tasks\{2AD196DC-2CAE-4FE8-A293-8C6E15211CB4} => C:\Program Files (x86)\SIX Networks\Play withSIX\Play withSIX.exe
Task: {615B1915-B622-4F2B-9A47-11815D450255} - \BitGuard No Task File <==== ATTENTION
Task: {712997D8-946B-482C-A0F1-57196C6E778A} - \Software Updater Ui No Task File <==== ATTENTION
Task: {78AFC96B-A918-470F-AEBD-5BA3AA39BB95} - \Software Updater No Task File <==== ATTENTION
Task: {7EA82062-ADEC-4EC2-88F3-1ABEA711A556} - System32\Tasks\{0DD3DE14-B902-4045-B1FF-C97573D1D309} => C:\Users\david\Downloads\eset_smart_security_live_installer_.exe [2014-09-13] (ESET)
Task: {91AD3C1E-5149-4913-B10D-3598A637B7B9} - System32\Tasks\{539A872B-467E-4F11-BD91-CF1F57AD6849} => Firefox.exe hxxp://ui.skype.com/ui/0/5.10.0.116/de/go/help.faq.installer?LastError=1603
Task: {9ACFE22B-2C00-4316-91D2-B56A0439C887} - System32\Tasks\Norton Identity Safe\Norton Error Analyzer => C:\Program Files (x86)\Norton Identity Safe\Engine\2013.3.0.26\SymErr.exe
Task: {A5342BC7-3B22-4987-AE79-BB41A042C0C1} - System32\Tasks\{617B6C21-B7A2-4967-ABF9-F012709DC422} => C:\Program Files (x86)\SIX Networks\Play withSIX\Play withSIX.exe
Task: {A8AC4178-E484-456F-AD29-3D0422444818} - System32\Tasks\AdobeAAMUpdater-1.0-david-PC-david => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2013-06-03] (Adobe Systems Incorporated)
Task: {B97EA42A-952F-46F6-931A-02CCD8E49590} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-243866017-1107141967-568923311-1001Core => C:\Users\david\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-12] (Facebook Inc.)
Task: {C0F4AE49-3168-4039-BED3-3BA7A681DF03} - System32\Tasks\SystemToolsDailyTest => uaclauncher.exe
Task: {C26F7851-C717-4F61-A13B-C3F0EAA24439} - System32\Tasks\{A84A8AB2-258F-4DE7-A802-D08915F5B339} => C:\Program Files (x86)\SIX Networks\Play withSIX\Play withSIX.exe
Task: {CA9A241F-8AC4-42DC-8428-EBF57E6ACA1B} - System32\Tasks\{FB8A7D5F-7399-47EA-90B6-7AC5055BA85B} => Firefox.exe hxxp://ui.skype.com/ui/0/5.10.0.116/de/go/help.faq.installer?LastError=1603
Task: {CE0B7FD3-9340-44F2-8ED2-3E00339CF47A} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-243866017-1107141967-568923311-1001UA => C:\Users\david\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-12] (Facebook Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-243866017-1107141967-568923311-1001Core.job => C:\Users\david\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-243866017-1107141967-568923311-1001UA.job => C:\Users\david\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2012-06-23 20:59 - 2014-09-13 23:53 - 00116880 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2012-06-23 19:03 - 2014-06-21 18:55 - 00076152 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2012-02-01 12:50 - 2012-02-01 12:50 - 00968048 _____ () C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe
2013-06-20 00:45 - 2013-06-20 00:45 - 04519280 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe
2013-04-20 11:25 - 2013-03-01 14:13 - 01300816 _____ () C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe
2014-09-03 18:40 - 2014-10-09 22:14 - 02448376 _____ () C:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.0.224\deploy\LoLLauncher.exe
2014-10-09 22:14 - 2014-10-09 22:14 - 04143096 _____ () C:\Riot Games\League of Legends\RADS\projects\lol_patcher\releases\0.0.0.8\deploy\LoLPatcher.exe
2013-07-10 13:41 - 2013-07-10 13:41 - 00074752 _____ () C:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.113\deploy\LolClient.exe
2012-01-27 18:27 - 2012-01-27 18:27 - 00134656 __RSH () C:\Users\david\AppData\Roaming\Microsoft\Windows\IEUpdate\hh.exe
2013-06-20 00:45 - 2013-06-20 00:45 - 03317616 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_v_1_1_0_x64.dll
2012-02-01 12:44 - 2012-02-01 12:44 - 08151040 _____ () C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\QtGui4.dll
2012-02-01 12:44 - 2012-02-01 12:44 - 02278400 _____ () C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\QtCore4.dll
2013-07-12 14:37 - 2013-07-12 14:37 - 32726528 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\HEX\libcef.dll
2013-03-13 13:42 - 2013-06-05 14:21 - 00071560 _____ () C:\Program Files (x86)\Common Files\Adobe\CEPServiceManager4\zlib1.dll
2013-06-20 00:45 - 2013-06-20 00:45 - 00381808 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CCInvokeAAM.dll
2013-07-12 14:37 - 2013-07-12 14:37 - 00736256 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\HEX\libglesv2.dll
2013-07-12 14:37 - 2013-07-12 14:37 - 00130048 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\HEX\libegl.dll
2014-08-27 23:19 - 2014-09-16 13:12 - 00962560 _____ () C:\Program Files (x86)\Origin\platforms\qwindows.dll
2014-08-27 23:19 - 2014-09-16 13:12 - 00024064 _____ () C:\Program Files (x86)\Origin\imageformats\qgif.dll
2014-08-27 23:19 - 2014-09-16 13:12 - 00025088 _____ () C:\Program Files (x86)\Origin\imageformats\qico.dll
2014-08-27 23:19 - 2014-09-16 13:12 - 00217088 _____ () C:\Program Files (x86)\Origin\imageformats\qjpeg.dll
2014-08-27 23:19 - 2014-09-16 13:12 - 00261632 _____ () C:\Program Files (x86)\Origin\imageformats\qmng.dll
2014-08-27 23:19 - 2014-09-16 13:12 - 00019968 _____ () C:\Program Files (x86)\Origin\imageformats\qtga.dll
2014-08-27 23:19 - 2014-09-16 13:12 - 00302592 _____ () C:\Program Files (x86)\Origin\imageformats\qtiff.dll
2014-08-27 23:19 - 2014-09-16 13:12 - 00018944 _____ () C:\Program Files (x86)\Origin\imageformats\qwbmp.dll
2014-09-25 01:21 - 2014-09-23 06:06 - 01098056 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.124\libglesv2.dll
2014-09-25 01:21 - 2014-09-23 06:06 - 00174408 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.124\libegl.dll
2014-09-25 01:21 - 2014-09-23 06:07 - 08577864 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.124\pdf.dll
2014-09-25 01:21 - 2014-09-23 06:07 - 00331592 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.124\ppGoogleNaClPluginChrome.dll
2014-09-25 01:21 - 2014-09-23 06:06 - 01660232 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.124\ffmpegsumo.dll
2014-08-29 03:58 - 2014-08-21 20:15 - 01171456 _____ () C:\Program Files (x86)\Steam\libavcodec-56.dll
2014-08-29 03:58 - 2014-08-21 20:15 - 00442368 _____ () C:\Program Files (x86)\Steam\libavutil-54.dll
2014-08-29 03:58 - 2014-08-21 20:15 - 00332800 _____ () C:\Program Files (x86)\Steam\libavresample-2.dll
2013-05-06 17:05 - 2014-09-03 21:28 - 00774656 _____ () C:\Program Files (x86)\Steam\SDL2.dll
2014-05-21 23:19 - 2014-09-23 06:32 - 02226880 _____ () C:\Program Files (x86)\Steam\video.dll
2014-08-29 03:58 - 2014-08-21 20:15 - 00403968 _____ () C:\Program Files (x86)\Steam\libavformat-56.dll
2014-08-29 03:58 - 2014-08-21 20:15 - 00485888 _____ () C:\Program Files (x86)\Steam\libswscale-3.dll
2013-06-06 14:06 - 2014-09-23 06:32 - 00679616 _____ () C:\Program Files (x86)\Steam\bin\chromehtml.DLL
2013-03-26 16:16 - 2014-09-05 01:29 - 34589376 _____ () C:\Program Files (x86)\Steam\bin\libcef.dll
2014-08-14 22:58 - 2014-09-05 01:29 - 00837824 _____ () C:\Program Files (x86)\Steam\bin\ffmpegsumo.dll
2014-10-09 22:14 - 2014-10-09 22:14 - 01629176 _____ () C:\Riot Games\League of Legends\RADS\projects\lol_patcher\releases\0.0.0.8\deploy\RiotLauncher.dll
2014-09-10 15:15 - 2014-09-10 15:15 - 42975744 _____ () C:\Riot Games\League of Legends\RADS\projects\lol_patcher\releases\0.0.0.8\deploy\libcef.dll
2014-09-10 15:15 - 2014-09-10 15:15 - 01559552 _____ () C:\Riot Games\League of Legends\RADS\projects\lol_patcher\releases\0.0.0.8\deploy\icui18n.dll
2014-09-10 15:15 - 2014-09-10 15:15 - 01241088 _____ () C:\Riot Games\League of Legends\RADS\projects\lol_patcher\releases\0.0.0.8\deploy\icuuc.dll
2014-09-10 15:15 - 2014-09-10 15:15 - 04945408 _____ () C:\Riot Games\League of Legends\RADS\projects\lol_patcher\releases\0.0.0.8\deploy\v8.dll
2014-10-09 22:14 - 2014-10-09 22:14 - 01708032 _____ () C:\Riot Games\League of Legends\RADS\projects\lol_patcher\releases\0.0.0.8\deploy\RiotRadsIO.dll
2013-07-10 13:41 - 2013-07-10 13:41 - 04774248 _____ () C:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.113\deploy\Adobe AIR\Versions\1.0\Resources\WebKit.dll
2013-07-10 13:41 - 2013-07-10 13:41 - 16032616 _____ () C:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.113\deploy\Adobe AIR\Versions\1.0\Resources\NPSWF32.dll
2014-09-25 01:21 - 2014-09-23 06:07 - 14891848 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.124\PepperFlash\pepflashplayer.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData\Temp:373E1720

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service"

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


========================= Accounts: ==========================

Administrator (S-1-5-21-243866017-1107141967-568923311-500 - Administrator - Disabled)
david (S-1-5-21-243866017-1107141967-568923311-1001 - Administrator - Enabled) => C:\Users\david
Gast (S-1-5-21-243866017-1107141967-568923311-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-243866017-1107141967-568923311-1002 - Limited - Enabled)
VERSUCH (S-1-5-21-243866017-1107141967-568923311-1004 - Administrator - Enabled) => C:\Users\VERSUCH

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (10/10/2014 08:59:48 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: explorer.exe, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000009593523
ID des fehlerhaften Prozesses: 0x2278
Startzeit der fehlerhaften Anwendung: 0xexplorer.exe0
Pfad der fehlerhaften Anwendung: explorer.exe1
Pfad des fehlerhaften Moduls: explorer.exe2
Berichtskennung: explorer.exe3

Error: (10/10/2014 08:58:35 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: explorer.exe, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000075d3523
ID des fehlerhaften Prozesses: 0x1470
Startzeit der fehlerhaften Anwendung: 0xexplorer.exe0
Pfad der fehlerhaften Anwendung: explorer.exe1
Pfad des fehlerhaften Moduls: explorer.exe2
Berichtskennung: explorer.exe3

Error: (10/10/2014 08:57:22 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: explorer.exe, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000005473523
ID des fehlerhaften Prozesses: 0x2c28
Startzeit der fehlerhaften Anwendung: 0xexplorer.exe0
Pfad der fehlerhaften Anwendung: explorer.exe1
Pfad des fehlerhaften Moduls: explorer.exe2
Berichtskennung: explorer.exe3

Error: (10/10/2014 08:55:33 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: explorer.exe, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000079c3523
ID des fehlerhaften Prozesses: 0x1d54
Startzeit der fehlerhaften Anwendung: 0xexplorer.exe0
Pfad der fehlerhaften Anwendung: explorer.exe1
Pfad des fehlerhaften Moduls: explorer.exe2
Berichtskennung: explorer.exe3

Error: (10/10/2014 08:54:13 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: explorer.exe, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000007893523
ID des fehlerhaften Prozesses: 0x1580
Startzeit der fehlerhaften Anwendung: 0xexplorer.exe0
Pfad der fehlerhaften Anwendung: explorer.exe1
Pfad des fehlerhaften Moduls: explorer.exe2
Berichtskennung: explorer.exe3

Error: (10/10/2014 08:53:01 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: explorer.exe, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000071a3523
ID des fehlerhaften Prozesses: 0xdfc
Startzeit der fehlerhaften Anwendung: 0xexplorer.exe0
Pfad der fehlerhaften Anwendung: explorer.exe1
Pfad des fehlerhaften Moduls: explorer.exe2
Berichtskennung: explorer.exe3

Error: (10/10/2014 08:51:51 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: explorer.exe, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000007123523
ID des fehlerhaften Prozesses: 0x1534
Startzeit der fehlerhaften Anwendung: 0xexplorer.exe0
Pfad der fehlerhaften Anwendung: explorer.exe1
Pfad des fehlerhaften Moduls: explorer.exe2
Berichtskennung: explorer.exe3

Error: (10/10/2014 08:50:43 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: explorer.exe, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc000041d
Fehleroffset: 0x00000000088d3523
ID des fehlerhaften Prozesses: 0x17c8
Startzeit der fehlerhaften Anwendung: 0xexplorer.exe0
Pfad der fehlerhaften Anwendung: explorer.exe1
Pfad des fehlerhaften Moduls: explorer.exe2
Berichtskennung: explorer.exe3

Error: (10/10/2014 08:50:38 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: explorer.exe, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000088d3523
ID des fehlerhaften Prozesses: 0x17c8
Startzeit der fehlerhaften Anwendung: 0xexplorer.exe0
Pfad der fehlerhaften Anwendung: explorer.exe1
Pfad des fehlerhaften Moduls: explorer.exe2
Berichtskennung: explorer.exe3

Error: (10/10/2014 08:49:15 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: explorer.exe, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000008e93523
ID des fehlerhaften Prozesses: 0x1a40
Startzeit der fehlerhaften Anwendung: 0xexplorer.exe0
Pfad der fehlerhaften Anwendung: explorer.exe1
Pfad des fehlerhaften Moduls: explorer.exe2
Berichtskennung: explorer.exe3


System errors:
=============
Error: (10/10/2014 08:58:49 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Heimnetzgruppen-Anbieter" ist vom Dienst "Funktionssuche-Ressourcenveröffentlichung" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%-2147024891

Error: (10/10/2014 08:58:49 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Funktionssuche-Ressourcenveröffentlichung" wurde mit folgendem Fehler beendet: 
%%-2147024891

Error: (10/10/2014 08:57:36 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Heimnetzgruppen-Anbieter" ist vom Dienst "Funktionssuche-Ressourcenveröffentlichung" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%-2147024891

Error: (10/10/2014 08:57:36 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Funktionssuche-Ressourcenveröffentlichung" wurde mit folgendem Fehler beendet: 
%%-2147024891

Error: (10/10/2014 08:55:48 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Heimnetzgruppen-Anbieter" ist vom Dienst "Funktionssuche-Ressourcenveröffentlichung" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%-2147024891

Error: (10/10/2014 08:55:48 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Funktionssuche-Ressourcenveröffentlichung" wurde mit folgendem Fehler beendet: 
%%-2147024891

Error: (10/10/2014 08:54:26 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Heimnetzgruppen-Anbieter" ist vom Dienst "Funktionssuche-Ressourcenveröffentlichung" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%-2147024891

Error: (10/10/2014 08:54:26 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Funktionssuche-Ressourcenveröffentlichung" wurde mit folgendem Fehler beendet: 
%%-2147024891

Error: (10/10/2014 08:53:14 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Heimnetzgruppen-Anbieter" ist vom Dienst "Funktionssuche-Ressourcenveröffentlichung" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%-2147024891

Error: (10/10/2014 08:53:14 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Funktionssuche-Ressourcenveröffentlichung" wurde mit folgendem Fehler beendet: 
%%-2147024891


Microsoft Office Sessions:
=========================
Error: (10/10/2014 08:59:48 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: explorer.exe6.1.7601.175674d672ee4unknown0.0.0.000000000c00000050000000009593523227801cfe4bc3592e969C:\Windows\explorer.exeunknown9af46f19-50af-11e4-9f78-d4bed9b97b5e

Error: (10/10/2014 08:58:35 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: explorer.exe6.1.7601.175674d672ee4unknown0.0.0.000000000c000000500000000075d3523147001cfe4bc0a2b6fb6C:\Windows\explorer.exeunknown6f909ef4-50af-11e4-9f78-d4bed9b97b5e

Error: (10/10/2014 08:57:22 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: explorer.exe6.1.7601.175674d672ee4unknown0.0.0.000000000c000000500000000054735232c2801cfe4bbc9784b50C:\Windows\explorer.exeunknown43c49598-50af-11e4-9f78-d4bed9b97b5e

Error: (10/10/2014 08:55:33 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: explorer.exe6.1.7601.175674d672ee4unknown0.0.0.000000000c000000500000000079c35231d5401cfe4bb98e9ed1eC:\Windows\explorer.exeunknown02ff487e-50af-11e4-9f78-d4bed9b97b5e

Error: (10/10/2014 08:54:13 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: explorer.exe6.1.7601.175674d672ee4unknown0.0.0.000000000c00000050000000007893523158001cfe4bb6e681bd8C:\Windows\explorer.exeunknownd2ea13b2-50ae-11e4-9f78-d4bed9b97b5e

Error: (10/10/2014 08:53:01 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: explorer.exe6.1.7601.175674d672ee4unknown0.0.0.000000000c000000500000000071a3523dfc01cfe4bb443be5e3C:\Windows\explorer.exeunknowna8664694-50ae-11e4-9f78-d4bed9b97b5e

Error: (10/10/2014 08:51:51 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: explorer.exe6.1.7601.175674d672ee4unknown0.0.0.000000000c00000050000000007123523153401cfe4bb1a1d92d2C:\Windows\explorer.exeunknown7e3a37b0-50ae-11e4-9f78-d4bed9b97b5e

Error: (10/10/2014 08:50:43 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: explorer.exe6.1.7601.175674d672ee4unknown0.0.0.000000000c000041d00000000088d352317c801cfe4baee60089cC:\Windows\explorer.exeunknown5643aeb3-50ae-11e4-9f78-d4bed9b97b5e

Error: (10/10/2014 08:50:38 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: explorer.exe6.1.7601.175674d672ee4unknown0.0.0.000000000c000000500000000088d352317c801cfe4baee60089cC:\Windows\explorer.exeunknown52e29cb9-50ae-11e4-9f78-d4bed9b97b5e

Error: (10/10/2014 08:49:15 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: explorer.exe6.1.7601.175674d672ee4unknown0.0.0.000000000c00000050000000008e935231a4001cfe4babd70762eC:\Windows\explorer.exeunknown216b88ce-50ae-11e4-9f78-d4bed9b97b5e


CodeIntegrity Errors:
===================================
  Date: 2014-08-14 11:44:57.261
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-08-14 11:44:57.256
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-08-14 11:44:57.254
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-08-14 11:44:57.197
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-08-14 11:44:57.161
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-08-14 11:44:57.142
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-08-12 14:05:02.217
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-08-12 14:05:02.197
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-08-12 14:05:02.195
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-08-12 14:05:02.127
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i5-2320 CPU @ 3.00GHz
Percentage of memory in use: 74%
Total physical RAM: 6126.64 MB
Available physical RAM: 1581.65 MB
Total Pagefile: 12251.48 MB
Available Pagefile: 5989.55 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:450.91 GB) (Free:49.96 GB) NTFS
Drive d: (DATAPART1) (Fixed) (Total:465.75 GB) (Free:372.23 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 465.8 GB) (Disk ID: F8FE908A)
Partition 1: (Not Active) - (Size=39 MB) - (Type=DE)
Partition 2: (Active) - (Size=14.8 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=450.9 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: F8FE909D)
Partition 1: (Not Active) - (Size=465.8 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

--- --- ---

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Avira <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\AVAST Software <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\ESET <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Kaspersky Lab <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files (x86)\Common Files\Symantec Shared <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\ESET <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION
         

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

• Starte nun FRST erneut und klicke den Entfernen Button.
• Das Tool erstellt eine Fixlog.txt.
• Poste mir deren Inhalt.

Lade Dir bitte von hier Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.

• Installiere und starte das Programm. (Bebilderte Anleitung zu Revo Uninstaller)
• Klicke auf Optionen und wähle als Sprache Deutsch.
• Suche im Uninstallerfeld nach den Programmen:
  
  Snap.Do
  
  
  
• Wähle die Programme nacheinander aus und klicke jedes Mal auf Uninstall.
• Wähle anschließend den Modus "Moderat" aus.
  
• Reste löschen:
  Klicke auf dann auf und dann auf .

 

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

• WICHTIG: Speichere Combofix auf deinem Desktop.
• Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
• Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
• Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
• Wenn Combofix fertig ist, wird es ein Logfile erstellen.
• Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 08-10-2014 01
Ran by david at 2014-10-11 19:06:41 Run:1
Running from C:\Users\david\Desktop
Loaded Profile: david (Available profiles: david & VERSUCH)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Avira <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\AVAST Software <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\ESET <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Kaspersky Lab <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files (x86)\Common Files\Symantec Shared <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\ESET <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION
*****************

HKLM => Group Policy Restriction on software restored successfully.
HKLM => Group Policy Restriction on software restored successfully.
HKLM => Group Policy Restriction on software restored successfully.
HKLM => Group Policy Restriction on software restored successfully.
HKLM => Group Policy Restriction on software restored successfully.
HKLM => Group Policy Restriction on software restored successfully.
HKLM => Group Policy Restriction on software restored successfully.
HKLM => Group Policy Restriction on software restored successfully.
HKLM => Group Policy Restriction on software restored successfully.

==== End of Fixlog ====

Combofix Logfile:

ComboFix 14-10-04.01 - david 11.10.2014  21:25:28.2.4 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.6127.976 [GMT 2:00]
ausgeführt von:: c:\users\david\Desktop\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\CFLog
c:\programdata\31260090b29de69f
c:\programdata\31260090b29de69f\{4820778D-AB0D-6D18-C316-52A6A0E1D507}
c:\programdata\31260090b29de69f\{A35CA8FF-CB7D-8361-1CB9-83219CD11C78}
c:\programdata\31260090b29de69f\{A35CA8FF-CB7D-8361-1CB9-83219CD11C78}.old
c:\programdata\31260090b29de69f\{AD11DADE-C597-45D9-D8C5-1D2EB0B89613}
c:\programdata\PCDr\6426\AddOnDownloaded\12856377-13ca-4a23-b36d-60217190121a.dll
c:\programdata\PCDr\6426\AddOnDownloaded\c234a47d-843f-4a61-889b-e1538e961da5.dll
c:\users\david\AppData\Local\Adobe\gccheck.exe
c:\users\david\AppData\Local\Adobe\gtbcheck.exe
c:\users\david\AppData\Roaming\appdata
c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014081920140820\index.dat
c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014082020140821\index.dat
c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014082120140822\index.dat
c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014082220140823\index.dat
c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014082320140824\index.dat
c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014082420140825\index.dat
c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014082520140826\index.dat
c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014082620140827\index.dat
c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014082720140828\index.dat
c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014083020140831\index.dat
c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014090420140905\index.dat
c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014090520140906\index.dat
c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014090820140909\index.dat
c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014090920140910\index.dat
c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014091020140911\index.dat
c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014091220140913\index.dat
c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014091320140914\index.dat
c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014091520140916\index.dat
c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014091620140917\index.dat
c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014091720140918\index.dat
c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014091820140919\index.dat
c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014092020140921\index.dat
c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014092220140923\index.dat
c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014092320140924\index.dat
c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014092420140925\index.dat
c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014092520140926\index.dat
c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014092620140927\index.dat
c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014092820140929\index.dat
c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014092920140930\index.dat
c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014093020141001\index.dat
c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014100120141002\index.dat
c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014100220141003\index.dat
c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014100320141004\index.dat
c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014100620141007\index.dat
c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014100820141009\index.dat
c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014100920141010\index.dat
c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014101120141012\index.dat
c:\users\david\AppData\Roaming\Microsoft\Windows\IEUpdate\hh.exe
c:\windows\SysWow64\SET71A0.tmp
c:\windows\SysWow64\SET951B.tmp
D:\install.exe
.
-- Vorheriger Suchlauf --
.
Infizierte Kopie von c:\windows\SysWow64\ntdll.dll wurde gefunden und desinfiziert 
Kopie von - c:\windows\winsxs\wow64_microsoft-windows-ntdll_31bf3856ad364e35_6.1.7601.17725_none_c147c22d473527e8\ntdll.dll wurde wiederhergestellt 
.
--------
.
.
(((((((((((((((((((((((   Dateien erstellt von 2014-09-11 bis 2014-10-11  ))))))))))))))))))))))))))))))
.
.
2014-10-11 20:49 . 2014-10-11 20:49	--------	d-sh--w-	c:\users\david\AppData\Roaming\AppData
2014-10-11 20:44 . 2014-10-11 20:44	--------	d-----w-	c:\users\hedev\AppData\Local\temp
2014-10-11 20:44 . 2014-10-11 20:44	--------	d-----w-	c:\users\Default\AppData\Local\temp
2014-10-11 20:30 . 2014-10-11 20:30	--------	d-----w-	c:\users\VERSUCH\AppData\Local\temp
2014-10-10 18:56 . 2014-10-11 17:06	--------	d-----w-	C:\FRST
2014-10-10 17:12 . 2014-10-10 17:13	--------	d-----w-	c:\users\david\AppData\Roaming\SpaceEngineers
2014-09-29 18:45 . 2014-09-29 18:45	--------	d-----w-	c:\program files (x86)\AGEIA Technologies
2014-09-29 18:43 . 2014-09-13 20:13	613696	----a-w-	c:\windows\SysWow64\nvStreaming.exe
2014-09-29 16:41 . 2014-09-29 16:41	--------	d-----w-	C:\NVIDIA
2014-09-29 16:34 . 2014-09-17 02:10	1715224	----a-w-	c:\windows\system32\nvspbridge64.dll
2014-09-29 16:34 . 2014-09-17 02:10	1291280	----a-w-	c:\windows\SysWow64\nvspbridge.dll
2014-09-29 16:32 . 2014-09-04 19:14	38048	----a-w-	c:\windows\system32\drivers\nvvad64v.sys
2014-09-29 16:32 . 2014-09-04 19:14	32416	----a-w-	c:\windows\SysWow64\nvaudcap32v.dll
2014-09-26 16:07 . 2014-09-26 16:07	--------	d-----w-	c:\users\david\AppData\Roaming\The Creative Assembly
2014-09-20 17:55 . 2014-09-20 17:55	--------	d-----w-	c:\program files (x86)\Common Files\InstallShield
2014-09-16 18:14 . 2014-05-14 16:23	44512	----a-w-	c:\windows\system32\wups2.dll
2014-09-16 18:14 . 2014-05-14 16:23	58336	----a-w-	c:\windows\system32\wuauclt.exe
2014-09-16 18:14 . 2014-05-14 16:23	2477536	----a-w-	c:\windows\system32\wuaueng.dll
2014-09-16 18:14 . 2014-05-14 16:21	2620928	----a-w-	c:\windows\system32\wucltux.dll
2014-09-16 18:13 . 2014-05-14 16:23	38880	----a-w-	c:\windows\system32\wups.dll
2014-09-16 18:13 . 2014-05-14 16:23	36320	----a-w-	c:\windows\SysWow64\wups.dll
2014-09-16 18:13 . 2014-05-14 16:23	700384	----a-w-	c:\windows\system32\wuapi.dll
2014-09-16 18:13 . 2014-05-14 16:23	581600	----a-w-	c:\windows\SysWow64\wuapi.dll
2014-09-16 18:13 . 2014-05-14 16:20	97792	----a-w-	c:\windows\system32\wudriver.dll
2014-09-16 18:13 . 2014-05-14 16:17	92672	----a-w-	c:\windows\SysWow64\wudriver.dll
2014-09-16 18:13 . 2014-05-14 07:23	198600	----a-w-	c:\windows\system32\wuwebv.dll
2014-09-16 18:13 . 2014-05-14 07:23	179656	----a-w-	c:\windows\SysWow64\wuwebv.dll
2014-09-16 18:13 . 2014-05-14 07:20	36864	----a-w-	c:\windows\system32\wuapp.exe
2014-09-16 18:13 . 2014-05-14 07:17	33792	----a-w-	c:\windows\SysWow64\wuapp.exe
2014-09-15 15:16 . 2014-09-15 15:16	--------	d-----w-	c:\users\david\AppData\Local\Skyrim
2014-09-15 12:02 . 2014-09-15 12:02	--------	d-----w-	c:\program files (x86)\Common Files\Skype
2014-09-13 13:58 . 2014-09-13 13:58	--------	d-----w-	C:\blabliblu
2014-09-13 13:01 . 2014-09-13 13:01	386680	----a-w-	c:\windows\system32\drivers\sptd.sys
2014-09-12 09:43 . 2014-09-12 09:43	227728	----a-w-	c:\program files (x86)\Internet Explorer\Plugins\nppdf32.dll
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-10-04 20:03 . 2012-06-23 14:32	701104	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2014-10-04 20:03 . 2012-01-27 08:40	71344	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-09-17 02:10 . 2013-12-21 16:53	2193560	----a-w-	c:\windows\SysWow64\nvspcap.dll
2014-09-17 02:10 . 2013-12-21 16:53	2799784	----a-w-	c:\windows\system32\nvspcap64.dll
2014-09-13 23:48 . 2013-03-17 19:13	20589536	----a-w-	c:\windows\system32\nvwgf2umx.dll
2014-09-13 23:48 . 2012-06-23 18:58	984424	----a-w-	c:\windows\system32\nvumdshimx.dll
2014-09-13 23:48 . 2012-01-27 16:13	16875856	----a-w-	c:\windows\SysWow64\nvd3dum.dll
2014-09-13 23:48 . 2012-01-27 16:13	3223120	----a-w-	c:\windows\system32\nvapi64.dll
2014-09-13 23:48 . 2012-01-27 16:13	2838424	----a-w-	c:\windows\SysWow64\nvapi.dll
2014-09-13 21:53 . 2011-02-17 09:09	6890696	----a-w-	c:\windows\system32\nvcpl.dll
2014-09-13 21:53 . 2011-02-17 09:09	3529872	----a-w-	c:\windows\system32\nvsvc64.dll
2014-09-13 21:53 . 2011-02-17 10:10	62608	----a-w-	c:\windows\system32\nvshext.dll
2014-09-13 21:53 . 2011-02-17 09:10	385168	----a-w-	c:\windows\system32\nvmctray.dll
2014-09-13 21:53 . 2011-02-17 09:10	934216	----a-w-	c:\windows\system32\nvvsvc.exe
2014-09-13 21:53 . 2011-02-17 09:10	2557640	----a-w-	c:\windows\system32\nvsvcr.dll
2014-09-11 15:37 . 2012-06-23 18:59	3961833	----a-w-	c:\windows\system32\nvcoproc.bin
2014-09-04 19:14 . 2013-09-17 17:48	34976	----a-w-	c:\windows\system32\nvaudcap64v.dll
2014-09-04 11:11 . 2010-06-24 11:33	23256	----a-w-	c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}]
2014-03-27 18:29	297128	----a-w-	c:\program files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Spotify Web Helper"="c:\users\david\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2014-10-03 1514040]
"Steam"="c:\program files (x86)\Steam\steam.exe" [2014-09-23 1938112]
"AgolBemet"="c:\programdata\AgolBemet\AgolBemet.dat" [2014-08-14 269208]
"AdneWbiql"="c:\programdata\AdneWbiql\AdneWbiql.dat" [2014-08-15 269208]
"IqikWuge"="c:\programdata\IqikWuge\IqikWuge.dat" [2014-08-16 269208]
"OfuxDurov"="c:\programdata\OfuxDurov\OfuxDurov.dat" [2014-08-16 269208]
"EbanOcaha"="c:\programdata\EbanOcaha\EbanOcaha.dat" [2014-08-16 269208]
"OpohEluda"="c:\programdata\OpohEluda\OpohEluda.dat" [2014-08-16 269208]
"OxereNazic"="c:\programdata\OxereNazic\OxereNazic.dat" [2014-08-16 269208]
"OlafcEhitu"="c:\programdata\OlafcEhitu\OlafcEhitu.dat" [2014-08-17 269208]
"EdvapYexhu"="c:\programdata\EdvapYexhu\EdvapYexhu.dat" [2014-08-17 269208]
"UkjaFtoq"="c:\programdata\UkjaFtoq\UkjaFtoq.dat" [2014-08-17 269208]
"UkvoJojow"="c:\programdata\UkvoJojow\UkvoJojow.dat" [2014-08-18 269208]
"ApmeJxel"="c:\programdata\ApmeJxel\ApmeJxel.dat" [2014-08-20 303104]
"OfqiTaxo"="c:\programdata\OfqiTaxo\OfqiTaxo.dat" [2014-08-24 339968]
"AkoyaVgogi"="c:\programdata\AkoyaVgogi\AkoyaVgogi.dat" [2014-08-26 339968]
"AkmupUguge"="c:\programdata\AkmupUguge\AkmupUguge.dat" [2014-08-28 282624]
"AmqiqPizet"="c:\programdata\AmqiqPizet\AmqiqPizet.dat" [2014-09-03 266240]
"OcniNtih"="c:\programdata\OcniNtih\OcniNtih.dat" [2014-09-05 278528]
"OnibErof"="c:\programdata\OnibErof\OnibErof.dat" [2014-09-05 274432]
"UzeneKjojf"="c:\programdata\UzeneKjojf\UzeneKjojf.dat" [2014-09-05 243712]
"IdobvItazx"="c:\programdata\IdobvItazx\IdobvItazx.dat" [2014-09-09 258048]
"UlhuGisc"="c:\programdata\UlhuGisc\UlhuGisc.dat" [2014-09-10 258048]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2014-08-27 22041192]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Dell Registration"="c:\program files (x86)\System Registration\prodreg.exe" [2011-08-04 4165440]
"RoxWatchTray"="c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe" [2010-11-25 240112]
"AccuWeatherWidget"="c:\program files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe" [2012-02-01 968048]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2014-08-21 959176]
"Adobe Creative Cloud"="c:\program files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe" [2013-07-12 2236816]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2014-08-27 22041192]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"Run"= "c:\users\david\AppData\Roaming\Microsoft\Windows\IEUpdate\hh.exe"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute	REG_MULTI_SZ   	autocheck autochk *\0aswBoot.exe /M:c2da9b9a2a /wow /dir:C:\Program
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
.
R2 AviraUpgradeService;Avira Upgrade Service;c:\windows\TEMP\AVSETUP_53f13fa6\avupgsvc.exe;c:\windows\TEMP\AVSETUP_53f13fa6\avupgsvc.exe [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 RoxWatch12;Roxio Hard Drive Watcher 12;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 BEService;BattlEye Service;c:\program files (x86)\Common Files\BattlEye\BEService.exe;c:\program files (x86)\Common Files\BattlEye\BEService.exe [x]
R3 BRDriver64;BRDriver64;c:\programdata\BitRaider\BRDriver64.sys;c:\programdata\BitRaider\BRDriver64.sys [x]
R3 BRSptSvc;BitRaider Mini-Support Service;c:\programdata\BitRaider\BRSptSvc.exe;c:\programdata\BitRaider\BRSptSvc.exe [x]
R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys;c:\windows\SYSNATIVE\drivers\EagleX64.sys [x]
R3 esgiguard;esgiguard;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [x]
R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des;c:\windows\SYSNATIVE\GameMon.des [x]
R3 RoxMediaDB12OEM;RoxMediaDB12OEM;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe [x]
R3 ScreamBAudioSvc;ScreamBee Audio;c:\windows\system32\drivers\ScreamingBAudio64.sys;c:\windows\SYSNATIVE\drivers\ScreamingBAudio64.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;%TsUsbGD.DeviceDesc.Generic%;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 X6va008;X6va008;c:\windows\SysWOW64\Drivers\X6va008;c:\windows\SysWOW64\Drivers\X6va008 [x]
R3 X6va011;X6va011;c:\windows\SysWOW64\Drivers\X6va011;c:\windows\SysWOW64\Drivers\X6va011 [x]
R3 xhunter1;xhunter1;c:\windows\xhunter1.sys;c:\windows\xhunter1.sys [x]
R4 aswSP;aswSP; [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S0 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys;c:\windows\SYSNATIVE\DRIVERS\epfwwfp.sys [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys;c:\windows\SYSNATIVE\Drivers\PxHlpa64.sys [x]
S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys;c:\windows\SYSNATIVE\DRIVERS\ehdrv.sys [x]
S1 EpfwLWF;Epfw NDIS LightWeight Filter;c:\windows\system32\DRIVERS\EpfwLWF.sys;c:\windows\SYSNATIVE\DRIVERS\EpfwLWF.sys [x]
S2 c2cautoupdatesvc;Skype Click to Call Updater;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [x]
S2 c2cpnrsvc;Skype Click to Call PNR Service;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [x]
S2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\x86\ekrn.exe;c:\program files\ESET\ESET Smart Security\x86\ekrn.exe [x]
S2 GfExperienceService;NVIDIA GeForce Experience Service;c:\program files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe;c:\program files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [x]
S2 NvNetworkService;NVIDIA Network Service;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [x]
S2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S2 TeamViewer9;TeamViewer 9;c:\program files (x86)\TeamViewer\Version9\TeamViewer_Service.exe;c:\program files (x86)\TeamViewer\Version9\TeamViewer_Service.exe [x]
S3 NvStreamKms;NvStreamKms;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [x]
S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad64v.sys;c:\windows\SYSNATIVE\drivers\nvvad64v.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-09-24 23:20	1096520	----a-w-	c:\program files (x86)\Google\Chrome\Application\37.0.2062.124\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2014-10-11 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-23 20:03]
.
2014-10-10 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-243866017-1107141967-568923311-1001Core.job
- c:\users\david\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-06-24 23:20]
.
2014-10-11 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-243866017-1107141967-568923311-1001UA.job
- c:\users\david\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-06-24 23:20]
.
2014-10-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-07-03 13:26]
.
2014-10-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-07-03 13:26]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}]
2014-03-20 16:08	357432	----a-w-	c:\program files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ AccExtIco1]
@="{AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47}"
[HKEY_CLASSES_ROOT\CLSID\{AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47}]
2013-06-19 22:45	3317616	----a-w-	c:\program files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_v_1_1_0_x64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ AccExtIco2]
@="{853B7E05-C47D-4985-909A-D0DC5C6D7303}"
[HKEY_CLASSES_ROOT\CLSID\{853B7E05-C47D-4985-909A-D0DC5C6D7303}]
2013-06-19 22:45	3317616	----a-w-	c:\program files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_v_1_1_0_x64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ AccExtIco3]
@="{42D38F2E-98E9-4382-B546-E24E4D6D04BB}"
[HKEY_CLASSES_ROOT\CLSID\{42D38F2E-98E9-4382-B546-E24E4D6D04BB}]
2013-06-19 22:45	3317616	----a-w-	c:\program files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_v_1_1_0_x64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellStage"="c:\program files (x86)\Dell Stage\Dell Stage\stage_primary.exe" [2012-02-01 2195824]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2013-06-03 472984]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2014-02-24 5581888]
"FAHConsole"="c:\program files\File Association Helper\FAHConsole.exe" [2014-01-28 729272]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com/
mDefault_Page_URL = hxxp://www.google.com
mStart Page = hxxp://www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = <local>
uSearchAssistant = hxxp://www.google.com
IE: Free YouTube to MP3 Converter - c:\program files (x86)\Common Files\DVDVideoSoft\plugins\freeytmp3downloader.htm
IE: {{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - c:\program files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\
FF - prefs.js: browser.search.selectedEngine - 
FF - prefs.js: browser.startup.homepage - 
FF - prefs.js: keyword.enabled - false
FF - user.js: extensions.mysearchdial.hmpg - false
FF - user.js: extensions.mysearchdial.hmpgUrl - hxxp://start.mysearchdial.com/?f=1&a=dvd_14_17_ch&cd=2XzuyEtN2Y1L1Qzu0DyE0B0E0Dzy0BzyyB0ByD0EtD0F0CtBtN0D0Tzu0SzzyEtAtN1L2XzutBtFtBtDtFtCtFtDtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2StB0B0A0EtA0E0C0CtGtC0AyDzytGyEyDtD0DtGzy0F0ByBtGyBtCtBzztByDzytCyDtAyBzz2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyB0Bzy0ByDtCyDtDtGtB0DtDyDtG0D0CtCyCtGzz0EyC0AtGtC0EzztAyC0CyEyB0FyDyEtA2Q&cr=1320803099&ir=
FF - user.js: extensions.mysearchdial.dfltSrch - false
FF - user.js: extensions.mysearchdial.srchPrvdr - Mysearchdial
FF - user.js: extensions.mysearchdial.dnsErr - true
FF - user.js: extensions.mysearchdial_i.newTab - false
FF - user.js: extensions.mysearchdial.newTabUrl - hxxp://start.mysearchdial.com/?f=2&a=dvd_14_17_ch&cd=2XzuyEtN2Y1L1Qzu0DyE0B0E0Dzy0BzyyB0ByD0EtD0F0CtBtN0D0Tzu0SzzyEtAtN1L2XzutBtFtBtDtFtCtFtDtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2StB0B0A0EtA0E0C0CtGtC0AyDzytGyEyDtD0DtGzy0F0ByBtGyBtCtBzztByDzytCyDtAyBzz2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyB0Bzy0ByDtCyDtDtGtB0DtDyDtG0D0CtCyCtGzz0EyC0AtGtC0EzztAyC0CyEyB0FyDyEtA2Q&cr=1320803099&ir=
FF - user.js: extensions.mysearchdial.tlbrSrchUrl - hxxp://start.mysearchdial.com/?f=3&a=dvd_14_17_ch&cd=2XzuyEtN2Y1L1Qzu0DyE0B0E0Dzy0BzyyB0ByD0EtD0F0CtBtN0D0Tzu0SzzyEtAtN1L2XzutBtFtBtDtFtCtFtDtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2StB0B0A0EtA0E0C0CtGtC0AyDzytGyEyDtD0DtGzy0F0ByBtGyBtCtBzztByDzytCyDtAyBzz2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyB0Bzy0ByDtCyDtDtGtB0DtDyDtG0D0CtCyCtGzz0EyC0AtGtC0EzztAyC0CyEyB0FyDyEtA2Q&cr=1320803099&ir=&q=
FF - user.js: extensions.mysearchdial.id - D4BED9B97B5E0FC2
FF - user.js: extensions.mysearchdial.instlDay - 16182
FF - user.js: extensions.mysearchdial.vrsn - 1.8.29.0
FF - user.js: extensions.mysearchdial.vrsni - 1.8.29.0
FF - user.js: extensions.mysearchdial_i.vrsnTs - 1.8.29.017:33:8
FF - user.js: extensions.mysearchdial.prtnrId - mysearchdial
FF - user.js: extensions.mysearchdial.prdct - mysearchdial
FF - user.js: extensions.mysearchdial.aflt - dvd_14_17_ch
FF - user.js: extensions.mysearchdial_i.smplGrp - none
FF - user.js: extensions.mysearchdial.tlbrId - base
FF - user.js: extensions.mysearchdial.instlRef - 140305_b
FF - user.js: extensions.mysearchdial.dfltLng - 
FF - user.js: extensions.mysearchdial.appId - {CA5CAA63-B27C-4963-9BEC-CB16A36D56F8}
FF - user.js: extensions.mysearchdial.excTlbr - false
FF - user.js: extensions.mysearchdial.cr - 1320803099
FF - user.js: extensions.mysearchdial.cd - 2XzuyEtN2Y1L1Qzu0DyE0B0E0Dzy0BzyyB0ByD0EtD0F0CtBtN0D0Tzu0SzzyEtAtN1L2XzutBtFtBtDtFtCtFtDtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2StB0B0A0EtA0E0C0CtGtC0AyDzytGyEyDtD0DtGzy0F0ByBtGyBtCtBzztByDzytCyDtAyBzz2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyB0Bzy0ByDtCyDtDtGtB0DtDyDtG0D0CtCyCtGzz0EyC0AtGtC0EzztAyC0CyEyB0FyDyEtA2Q
FF - user.js: extensions.mysearchdial.AL - 2
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
BHO-{1FB251BE-1A9B-16AD-99F8-A54DD1FBA160} - (no file)
BHO-{a235e1e3-6296-4710-af39-104a7faa6c7c} - (no file)
BHO-{f236ca79-3123-4afb-9f74-e98117ad5625} - (no file)
Toolbar-Locked - (no file)
Toolbar-10 - (no file)
Toolbar-!{5018CFD2-804D-4C99-9F81-25EAEA2769DE} - (no file)
c:\users\david\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hh.lnk - c:\users\david\AppData\Roaming\Microsoft\Windows\IEUpdate\hh.exe
BHO-{1FB251BE-1A9B-16AD-99F8-A54DD1FBA160} - (no file)
Toolbar-Locked - (no file)
Toolbar-10 - (no file)
ShellIconOverlayIdentifiers-{472083B0-C522-11CF-8763-00608CC02F24} - (no file)
HKLM-Run-Nvtmru - c:\program files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe
AddRemove-Battlelog Web Plugins - c:\program files (x86)\Battlelog Web Plugins\uninstall.exe
AddRemove-PunkBusterSvc - c:\program files (x86)\Origin Games\BFH Beta\pbsvc.exe
AddRemove-{28B1238E-1C18-4637-A2B7-95315E94EB29}_is1 - c:\games\World_of_Tanks\unins001.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\X6va008]
"ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va008"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\X6va011]
"ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va011"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_15_0_0_167_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_15_0_0_167_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_15_0_0_167_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_15_0_0_167_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_167.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.15"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_167.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_167.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_167.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
   00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\windows\SysWOW64\PnkBstrA.exe
c:\program files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
c:\program files (x86)\Common Files\Adobe\CEPServiceManager4\CEPServiceManager.exe
c:\program files (x86)\Steam\bin\steamwebhelper.exe
c:\program files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe
c:\program files (x86)\Adobe\Adobe Creative Cloud\HEX\Adobe CEF Helper.exe
c:\program files (x86)\Adobe\Adobe Creative Cloud\HEX\Adobe CEF Helper.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2014-10-11  22:54:26 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2014-10-11 20:54
.
Vor Suchlauf: 35 Verzeichnis(se), 65.429.893.120 Bytes frei
Nach Suchlauf: 38 Verzeichnis(se), 65.570.463.744 Bytes frei
.
- - End Of File - - 92079EB355DE2B74682F3514837A3C86
         

--- --- ---
A36C5E4F47E84449FF07ED3517B43A31

Downloade Dir bitte Malwarebytes Anti-Malware

• Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
• Starte Malwarebytes' Anti-Malware (MBAM).
• Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
• Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
• Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
• Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
• Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
• Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte AdwCleaner auf deinen Desktop.

• Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
• Starte die AdwCleaner.exe mit einem Doppelklick.
• Stimme den Nutzungsbedingungen zu.
• Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
  • "Tracing" Schlüssel löschen
  • Winsock Einstellungen zurücksetzen
  • Proxy Einstellungen zurücksetzen
  • Internet Explorer Richtlinien zurücksetzen
  • Chrome Richtlinien zurücksetzen
  • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
• Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
• Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
• Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

• Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
• Drücke eine beliebige Taste, um das Tool zu starten.
• Je nach System kann der Scan eine Weile dauern.
• Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
• Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

Malwarebytes Anti-Malware
Malwarebytes | Free Anti-Malware & Internet Security Software

Suchlauf Datum: 12.10.2014
Suchlauf-Zeit: 15:40:49
Logdatei: mbam.txt
Administrator: Ja

Version: 2.00.2.1012
Malware Datenbank: v2014.03.04.09
Rootkit Datenbank: v2014.10.11.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Self-protection: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: david

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 293140
Verstrichene Zeit: 10 Min, 4 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristics: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registrierungsschlüssel: 12
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{D40753C7-8A59-4C1F-BE88-C300F4624D5B}, In Quarantäne, [88c1f00f14661026c14e89ebd72b9d63],
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{C292AD0A-C11F-479B-B8DB-743E72D283B0}, In Quarantäne, [88c1f00f14661026c14e89ebd72b9d63],
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{C292AD0A-C11F-479B-B8DB-743E72D283B0}, In Quarantäne, [88c1f00f14661026c14e89ebd72b9d63],
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\CLASSES\esrv.mysearchdialESrvc.1, In Quarantäne, [88c1f00f14661026c14e89ebd72b9d63],
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\CLASSES\esrv.mysearchdialESrvc, In Quarantäne, [88c1f00f14661026c14e89ebd72b9d63],
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\esrv.mysearchdialESrvc, In Quarantäne, [88c1f00f14661026c14e89ebd72b9d63],
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\esrv.mysearchdialESrvc.1, In Quarantäne, [88c1f00f14661026c14e89ebd72b9d63],
PUP.Optional.DealPly.A, HKU\S-1-5-21-243866017-1107141967-568923311-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{4B6ACEA2-308A-4876-AD36-57CEC5B4FCC7}, In Quarantäne, [c485a15e99e1d16545013c0429d99967],
PUP.Optional.DealPly.A, HKU\S-1-5-21-243866017-1107141967-568923311-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{4B6ACEA2-308A-4876-AD36-57CEC5B4FCC7}, In Quarantäne, [c485a15e99e1d16545013c0429d99967],
PUP.Optional.PCSpeedUp.A, HKLM\SOFTWARE\SPEEDCHECKER LIMITED\PC Speed Up, In Quarantäne, [99b00cf3f08a6bcb92aaa709877cdc24],
PUP.Optional.InstallCore.A, HKU\S-1-5-21-243866017-1107141967-568923311-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE\1I1T1Q1S, In Quarantäne, [4cfdfb04532738fea0d84d47fe046d93],
PUP.Optional.InstallCore.A, HKU\S-1-5-21-243866017-1107141967-568923311-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE, In Quarantäne, [ea5f32cd7bff76c06569fbafd62d7090],

Registrierungswerte: 1
PUP.Optional.InstallCore.A, HKU\S-1-5-21-243866017-1107141967-568923311-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE|tb, zr2X2X1G1S1F2V1S2Q0V, In Quarantäne, [ea5f32cd7bff76c06569fbafd62d7090]

Registrierungsdaten: 2
PUP.Optional.Qone8, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Gut: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Schlecht: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),Ersetzt,[5aef48b7b5c5a6909ba8a7882ada748c]
PUM.Disabled.SecurityCenter, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SECURITY CENTER|UpdatesDisableNotify, 1, Gut: (0), Schlecht: (1),Ersetzt,[8cbd0df2e496033345bef03a44c01ee2]

Ordner: 2
PUP.Optional.OpenCandy, C:\Users\david\AppData\Roaming\OpenCandy, In Quarantäne, [50f93bc43e3c3501d5b643434eb445bb],
PUP.Optional.OpenCandy, C:\Users\david\AppData\Roaming\OpenCandy\5A60C4946D3F459D8ABD3CDD76C780A5, In Quarantäne, [50f93bc43e3c3501d5b643434eb445bb],

Dateien: 2
PUP.Optional.OpenCandy, C:\Users\david\Downloads\DTLite4491-0356.exe, In Quarantäne, [fd4c59a63446a195955166eb1aea38c8],
PUP.Optional.OpenCandy, C:\Users\david\AppData\Roaming\OpenCandy\5A60C4946D3F459D8ABD3CDD76C780A5\Trial-14.0.1000.89_de-DE_1004732_DE-1.exe, In Quarantäne, [50f93bc43e3c3501d5b643434eb445bb],

Physische Sektoren: 0
(No malicious items detected)


(end)

AdwCleaner Logfile:

# AdwCleaner v3.311 - Bericht erstellt am 12/10/2014 um 16:03:22
# Aktualisiert 30/09/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : david - DAVID-PC
# Gestartet von : C:\Users\david\Downloads\AdwCleaner_3.311.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\Program Files (x86)\vGrabber-software
Ordner Gelöscht : C:\Users\david\AppData\LocalLow\DataMngr
Ordner Gelöscht : C:\Users\david\AppData\LocalLow\Mysearchdial
Ordner Gelöscht : C:\Users\david\Documents\Optimizer Pro
Ordner Gelöscht : C:\Users\VERSUCH\AppData\Roaming\Mozilla\Firefox\Profiles\j2om1l2w.default\Extensions\staged\ffxtlbr@mysearchdial.com
Ordner Gelöscht : C:\Users\VERSUCH\AppData\Local\Google\Chrome\User Data\Default\Extensions\anapakpgfbcahenpocgaidhcoladocle
Ordner Gelöscht : C:\Users\VERSUCH\AppData\Local\Google\Chrome\User Data\Default\Extensions\canmieadikjafpekoppfdcohgnkgihpa
Datei Gelöscht : C:\END
Datei Gelöscht : C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\user.js
Datei Gelöscht : C:\Users\VERSUCH\AppData\Roaming\Mozilla\Firefox\Profiles\j2om1l2w.default\user.js

***** [ Tasks ] *****

Task Gelöscht : BitGuard
Task Gelöscht : Dealply
Task Gelöscht : DealPlyUpdate
Task Gelöscht : Desk 365 RunAsStdUser
Task Gelöscht : Software Updater Ui
Task Gelöscht : Software Updater

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\mkcedibhemacmilmkpndpkoidlnmgngg
Schlüssel Gelöscht : HKCU\Software\Google\Chrome\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\esrv.EXE
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\biclient_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\biclient_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\desk365_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\desk365_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\LatestDLMgr_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\LatestDLMgr_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MYSEAR~1_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MYSEAR~1_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MySearchDial_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MySearchDial_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\optimizerpro_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\optimizerpro_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\optprostart_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\optprostart_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SearchSettings_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SearchSettings_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\UpdateTask_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\UpdateTask_RASMANCS
Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\webcakeupdater
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_s-w-a-t-4_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_s-w-a-t-4_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{C292AD0A-C11F-479B-B8DB-743E72D283B0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{065C1A21-97F8-45FB-A9F0-861B60FACEC8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3204358F-5904-46A6-841F-D6B5BE3EF4E3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3AE67737-0E3E-44AA-AA5E-46A68BF017FF}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3EE5B726-044A-48D2-AA7B-049BD9A0F62A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{60FBBE03-57FF-49D8-B38E-053D3F489825}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{6A5182F1-C0B8-42B8-96CC-7F329CD46913}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{6C153418-8E4D-4FAF-AF27-5201E38463A7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A26A2F05-AC4D-4A1E-9531-9125F7309B78}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CC5D6240-7DF0-435D-9B9B-F8586A99DE86}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F343045E-E20A-46E1-82D8-9962C43EFC9E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FBB360DC-CB6C-4D6A-808A-2C773151BFFF}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FFD7DDAC-EC28-42A5-8D39-917B9078604B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A235E1E3-6296-4710-AF39-104A7FAA6C7C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F236CA79-3123-4AFB-9F74-E98117AD5625}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{0400EBCA-042C-4000-AA89-9713FBEDB671}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{0BD19251-4B4B-4B94-AB16-617106245BB7}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{3281114F-BCAB-45E3-80D9-A6CD64D4E636}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{44533FCB-F9FB-436A-8B6B-CF637B2D465A}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{44B29DDD-CF7A-454A-A275-A322A398D93F}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{A4DE94DB-DF03-45A3-8A5D-D1B7464B242D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{AA0F50A8-2618-4AE4-A779-9F7378555A8F}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{B2DB115C-8278-4947-9A07-57B53D1C4215}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{B97FC455-DB33-431D-84DB-6F1514110BD5}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C67281E0-78F5-4E49-9FAE-4B1B2ADAF17B}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E72E9312-0367-4216-BFC7-21485FA8390B}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{F6CCB6C9-127E-44AE-8552-B94356F39FFE}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{FFD25630-2734-4AE9-88E6-21BF6525F3FE}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{49606DC7-976D-4030-A74E-9FB5C842FA68}
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\RegisteredApplicationsEx
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
Schlüssel Gelöscht : HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}
Schlüssel Gelöscht : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Schlüssel Gelöscht : HKLM\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C}
Schlüssel Gelöscht : HKLM\SOFTWARE\mysearchdial
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A35CA8FF-CB7D-8361-1CB9-83219CD11C78}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Speedchecker Limited
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\00E944CB89111313EAF35A0553F547F9
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0238BBE24EA3A70408B81E4BB89C15E5
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\29799DE249E7DBC459FC6C8F07EB8375
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3152E1F19977892449DC968802CE8964
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\53F55AF3F4049ED3FA6EA6F88E414E24
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\649A52D257CA5DB4EAAE8BA9EB23E467
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\68E4BF4B11615E03C97732FD581AB607
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8CE3DDAB2D152683FBCEB4866BCD2B0F
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AF6CE16AFEA5C9A39B766468A8B35C21
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FB1E44269B58F433A8C8E671E37CFDCF

***** [ Browser ] *****

-\\ Internet Explorer v9.0.8112.16447


-\\ Mozilla Firefox v22.0 (en-US)

[ Datei : C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\prefs.js ]


[ Datei : C:\Users\VERSUCH\AppData\Roaming\Mozilla\Firefox\Profiles\j2om1l2w.default\prefs.js ]


-\\ Google Chrome v37.0.2062.124

[ Datei : C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\preferences ]


[ Datei : C:\Users\VERSUCH\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Gelöscht [Extension] : dhdepfaagokllfmhfbcfmocaeigmoebo
Gelöscht [Extension] : fbmimoidopbghbcmdmpkjaffffmcbmbg
Gelöscht [Extension] : hphibigbodkkohoglgfkddblldpfohjl
Gelöscht [Extension] : kdcnnmifdmlmjffdgeieikcokcogpbej
Gelöscht [Extension] : kincjchfokkeneeofpeefomkikfkiedl
Gelöscht [Extension] : kkkeikdkpjenmoiicggnnodbkebafgpc
Gelöscht [Extension] : mkcedibhemacmilmkpndpkoidlnmgngg
Gelöscht [Extension] : pgmfkblbflahhponhjmkcnpjinenhlnc
Gelöscht [Extension] : anapakpgfbcahenpocgaidhcoladocle
Gelöscht [Extension] : canmieadikjafpekoppfdcohgnkgihpa

*************************

AdwCleaner[R0].txt - [59055 octets] - [23/11/2013 13:09:43]
AdwCleaner[R1].txt - [5396 octets] - [09/12/2013 18:40:43]
AdwCleaner[R2].txt - [11021 octets] - [12/10/2014 16:02:22]
AdwCleaner[S0].txt - [54852 octets] - [23/11/2013 13:11:23]
AdwCleaner[S1].txt - [5318 octets] - [09/12/2013 18:41:36]
AdwCleaner[S2].txt - [10669 octets] - [12/10/2014 16:03:22]

########## EOF - C:\AdwCleaner\AdwCleaner[S2].txt - [10730 octets] ##########
         

--- --- ---

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.3.2 (10.09.2014:1)
OS: Windows 7 Home Premium x64
Ran by david on 12.10.2014 at 16:08:45,98
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\pricepeep_02042013_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\pricepeep_02042013_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110011501160}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\pricepeep_02042013_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\pricepeep_02042013_RASMANCS
Successfully deleted: [Registry Key - Orphan] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FB251BE-1A9B-16AD-99F8-A54DD1FBA160}
Successfully deleted: [Registry Key - Orphan] HKEY_CLASSES_ROOT\CLSID\{1FB251BE-1A9B-16AD-99F8-A54DD1FBA160}
Successfully deleted: [Registry Key - Orphan] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FB251BE-1A9B-16AD-99F8-A54DD1FBA160}
Successfully deleted: [Registry Key - Orphan] HKEY_CLASSES_ROOT\CLSID\{1FB251BE-1A9B-16AD-99F8-A54DD1FBA160}



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\Windows\syswow64\ai_recyclebin"
Successfully deleted: [Empty Folder] C:\Users\david\appdata\local\{1547a4df-a060-bca0-5da2-aff15ee51e9d}



~~~ FireFox

Successfully deleted: [File] C:\user.js
Successfully deleted: [Folder] C:\Users\david\AppData\Roaming\mozilla\firefox\profiles\2mmwkhvz.default\extensions\staged
Emptied folder: C:\Users\david\AppData\Roaming\mozilla\firefox\profiles\2mmwkhvz.default\minidumps [187 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 12.10.2014 at 16:12:54,33
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-10-2014
Ran by david (administrator) on DAVID-PC on 12-10-2014 16:13:44
Running from C:\Users\david\Desktop
Loaded Profile: david (Available profiles: david & VERSUCH)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Spotify Ltd) C:\Users\david\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Nico Mak Computing) C:\Program Files\File Association Helper\FAHWindow.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
() C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\CEPServiceManager4\CEPServiceManager.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
() C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\HEX\Adobe CEF Helper.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\HEX\Adobe CEF Helper.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [DellStage] => C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe [2195824 2012-02-01] ()
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [472984 2013-06-03] (Adobe Systems Incorporated)
HKLM\...\Run: [Nvtmru] => "C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe"
HKLM\...\Run: [egui] => C:\Program Files\ESET\ESET Smart Security\egui.exe [5581888 2014-02-24] (ESET)
HKLM\...\Run: [FAHConsole] => C:\Program Files\File Association Helper\FAHConsole.exe [729272 2014-01-28] (Nico Mak Computing)
HKLM-x32\...\Run: [Dell Registration] => C:\Program Files (x86)\System Registration\prodreg.exe [4165440 2011-08-04] (Dell, Inc.)
HKLM-x32\...\Run: [RoxWatchTray] => C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe [240112 2010-11-25] (Sonic Solutions)
HKLM-x32\...\Run: [AccuWeatherWidget] => C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe [968048 2012-02-01] ()
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe Creative Cloud] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2236816 2013-07-12] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59240 2011-09-27] (Apple Inc.)
HKLM Group Policy restriction on software: C:\Program Files\ESET <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\AVAST Software <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\ESET <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files (x86)\Common Files\Symantec Shared <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Avira <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Kaspersky Lab <====== ATTENTION
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [Spotify Web Helper] => C:\Users\david\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1514040 2014-10-03] (Spotify Ltd)
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [1938112 2014-09-23] (Valve Corporation)
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [AgolBemet] => regsvr32.exe "C:\ProgramData\AgolBemet\AgolBemet.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [AdneWbiql] => regsvr32.exe "C:\ProgramData\AdneWbiql\AdneWbiql.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [IqikWuge] => regsvr32.exe "C:\ProgramData\IqikWuge\IqikWuge.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OfuxDurov] => regsvr32.exe "C:\ProgramData\OfuxDurov\OfuxDurov.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [EbanOcaha] => regsvr32.exe "C:\ProgramData\EbanOcaha\EbanOcaha.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OpohEluda] => regsvr32.exe "C:\ProgramData\OpohEluda\OpohEluda.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OxereNazic] => regsvr32.exe "C:\ProgramData\OxereNazic\OxereNazic.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OlafcEhitu] => regsvr32.exe "C:\ProgramData\OlafcEhitu\OlafcEhitu.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [EdvapYexhu] => regsvr32.exe "C:\ProgramData\EdvapYexhu\EdvapYexhu.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [UkjaFtoq] => regsvr32.exe "C:\ProgramData\UkjaFtoq\UkjaFtoq.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [UkvoJojow] => regsvr32.exe "C:\ProgramData\UkvoJojow\UkvoJojow.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [ApmeJxel] => regsvr32.exe "C:\ProgramData\ApmeJxel\ApmeJxel.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OfqiTaxo] => regsvr32.exe "C:\ProgramData\OfqiTaxo\OfqiTaxo.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [AkoyaVgogi] => regsvr32.exe "C:\ProgramData\AkoyaVgogi\AkoyaVgogi.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [AkmupUguge] => regsvr32.exe "C:\ProgramData\AkmupUguge\AkmupUguge.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [AmqiqPizet] => regsvr32.exe "C:\ProgramData\AmqiqPizet\AmqiqPizet.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OcniNtih] => regsvr32.exe "C:\ProgramData\OcniNtih\OcniNtih.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OnibErof] => regsvr32.exe "C:\ProgramData\OnibErof\OnibErof.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [UzeneKjojf] => regsvr32.exe "C:\ProgramData\UzeneKjojf\UzeneKjojf.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [IdobvItazx] => regsvr32.exe "C:\ProgramData\IdobvItazx\IdobvItazx.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [UlhuGisc] => regsvr32.exe "C:\ProgramData\UlhuGisc\UlhuGisc.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [22041192 2014-08-27] (Skype Technologies S.A.)
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [6482200 2014-09-26] (Piriform Ltd)
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Policies\Explorer: [Run] "C:\Users\david\AppData\Roaming\Microsoft\Windows\IEUpdate\hh.exe"
HKU\S-1-5-18\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [22041192 2014-08-27] (Skype Technologies S.A.)
ShellIconOverlayIdentifiers: [ AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_v_1_1_0_x64.dll ()
ShellIconOverlayIdentifiers: [ AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_v_1_1_0_x64.dll ()
ShellIconOverlayIdentifiers: [ AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_v_1_1_0_x64.dll ()
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File
BootExecute: autocheck autochk * aswBoot.exe /M:c2da9b9a2a /wow /dir:C:\Program

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - No Name - !{1BB22D38-A411-4B13-A746-C2A4F4EC7344} -  No File
Toolbar: HKLM - No Name - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  No File
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  No File
Toolbar: HKLM-x32 - No Name - !{1BB22D38-A411-4B13-A746-C2A4F4EC7344} -  No File
Toolbar: HKLM-x32 - No Name - !{5018CFD2-804D-4C99-9F81-25EAEA2769DE} -  No File
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default
FF NewTab: user_pref("browser.newtab.url", "");
FF DefaultSearchEngine: Google
FF SearchEngineOrder.1: Google
FF SelectedSearchEngine: user_pref("browser.search.selectedEngine", "");
FF Homepage: user_pref("browser.startup.homepage", "");
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1205146.dll (Adobe Systems, Inc.)
FF Plugin-x32: @esn/esnlaunch,version=1.138.0 -> C:\Program Files (x86)\Battlelog Web Plugins\1.138.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=2.1.7 -> C:\Program Files (x86)\Battlelog Web Plugins\2.1.7\npesnlaunch.dll No File
FF Plugin-x32: @esn/npbattlelog,version=2.4.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.4.0\npbattlelog.dll (EA Digital Illusions CE AB)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\david\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\david\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Extension: Amazon-Icon - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\Extensions\amazon-icon@giga.de [2014-04-16]
FF Extension: Stylish - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\Extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8}.xpi [2012-10-08]
FF Extension: NoScript - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2012-10-07]
FF Extension: Adblock Plus - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-09-08]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-07-14]
FF HKLM\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird
FF Extension: ESET Smart Security Extension - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird [2014-08-14]
FF HKLM-x32\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird
FF HKCU\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff
FF Extension: Download videos and MP3s from YouTube - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-04-22]
FF Extension: No Name - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\extensions\battlefieldheroespatcher@ea.com [Not Found]
FF Extension: No Name - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\extensions\battlefieldplay4free@ea.com [Not Found]
FF Extension: No Name - C:\Program Files\AVAST Software\Avast\WebRep\FF [Not Found]
FF Extension: No Name - C:\Program Files (x86)\LyricsPal\125.xpi [Not Found]
FF Extension: No Name - C:\Program Files (x86)\FromDocToPDF_65\bar\1.bin [Not Found]
FF Extension: No Name - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\extensions\{2894a412-e091-6466-9ab8-ea76561654ca} [Not Found]

Chrome: 
=======
CHR HomePage: Default -> chrome://newtab
CHR Profile: C:\Users\david\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-03-20]
CHR Extension: (Google Drive) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-03-20]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-05]
CHR Extension: (YouTube) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-03-20]
CHR Extension: (Google-Suche) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-03-20]
CHR Extension: (Stylish) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\fjnbnpbmkenffdnngjfgmeleoegfcffe [2013-07-03]
CHR Extension: (AdBlock) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2013-07-03]
CHR Extension: (Skype Click to Call) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2014-07-20]
CHR Extension: (Google Wallet) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-22]
CHR Extension: (Battlefield Play4Free) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\oiokahphinmbmakkehgelkmpolmnbkdh [2014-04-06]
CHR Extension: (Google Mail) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-03-20]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [448384 2014-08-04] ()
S3 BRSptSvc; C:\ProgramData\BitRaider\BRSptSvc.exe [477960 2014-04-11] (BitRaider, LLC)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
R2 ekrn; C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe [1343408 2014-02-24] (ESET)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1149760 2014-09-17] (NVIDIA Corporation)
S3 npggsvc; C:\Windows\SysWOW64\GameMon.des [3191392 2014-05-15] (INCA Internet Co., Ltd.)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1796928 2014-09-17] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19440960 2014-09-17] (NVIDIA Corporation)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76152 2014-06-21] ()
S2 AviraUpgradeService; "C:\Windows\TEMP\AVSETUP_53f13fa6\avupgsvc.exe" /TEMPSTART:""C:\Windows\TEMP\AVSETUP_53f13fa6\setup.exe" /NOTEMPCLEANUP /CLEANUPSRCFILES"

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S4 aswSP; No ImagePath
S3 BRDriver64; C:\ProgramData\BitRaider\BRDriver64.sys [75048 2013-10-08] (BitRaider)
R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [168256 2013-09-17] (ESET)
R2 epfw; C:\Windows\System32\DRIVERS\epfw.sys [220232 2013-09-17] (ESET)
R1 EpfwLWF; C:\Windows\System32\DRIVERS\EpfwLWF.sys [44120 2013-09-17] (ESET)
R0 epfwwfp; C:\Windows\System32\DRIVERS\epfwwfp.sys [62136 2013-09-17] (ESET)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [20288 2014-09-17] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38048 2014-09-04] (NVIDIA Corporation)
S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [386680 2014-09-13] (Duplex Secure Ltd.)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]
S3 PCDSRVC{D3412D80-CF3B4A27-06020200}_0; \??\c:\program files\my dell\pcdsrvc_x64.pkms [X]
S3 X6va008; \??\C:\Windows\SysWOW64\Drivers\X6va008 [X]
S3 X6va011; \??\C:\Windows\SysWOW64\Drivers\X6va011 [X]
S3 xhunter1; \??\C:\Windows\xhunter1.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-12 16:13 - 2014-10-12 16:13 - 00000000 ____D () C:\Users\david\Desktop\FRST-OlderVersion
2014-10-12 16:12 - 2014-10-12 16:12 - 00002316 _____ () C:\Users\david\Desktop\JRT.txt
2014-10-12 16:08 - 2014-10-12 16:08 - 01705755 _____ (Thisisu) C:\Users\david\Downloads\JRT.exe
2014-10-12 16:08 - 2014-10-12 16:08 - 01705755 _____ (Thisisu) C:\Users\david\Desktop\JRT.exe
2014-10-12 16:08 - 2014-10-12 16:08 - 00000000 ____D () C:\Windows\ERUNT
2014-10-12 16:03 - 2014-10-12 16:03 - 00000000 _____ () C:\Users\david\Downloads\C6E7.tmp
2014-10-12 16:01 - 2014-10-12 16:01 - 01375089 _____ () C:\Users\david\Downloads\AdwCleaner_3.311.exe
2014-10-12 16:01 - 2014-10-12 16:01 - 01375089 _____ () C:\Users\david\Downloads\AdwCleaner_3.311 (1).exe
2014-10-12 15:59 - 2014-10-12 15:59 - 00004314 _____ () C:\Users\david\Desktop\mbam.txt
2014-10-12 15:56 - 2014-10-12 15:56 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\48230029.sys
2014-10-12 15:40 - 2014-10-12 15:56 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-10-12 15:40 - 2014-10-12 15:40 - 00001104 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-10-12 15:40 - 2014-10-12 15:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-10-12 15:40 - 2014-10-12 15:40 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-10-12 15:40 - 2014-10-12 15:40 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-10-12 15:40 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-10-12 15:40 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-10-12 15:40 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-10-12 15:39 - 2014-10-12 15:39 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\david\Downloads\mbam-setup-2.0.2.1012.exe
2014-10-12 12:20 - 2014-10-12 12:21 - 04965896 _____ (Piriform Ltd) C:\Users\david\Downloads\ccsetup418.exe
2014-10-12 12:19 - 2014-10-12 12:19 - 00003206 _____ () C:\Windows\System32\Tasks\{536105BA-DC87-4426-BF21-07E3D6160448}
2014-10-11 23:01 - 2014-10-11 23:01 - 01660616 _____ (ESET) C:\Users\david\Downloads\eset_smart_security_live_installer.exe
2014-10-11 22:54 - 2014-10-11 22:54 - 00033935 _____ () C:\ComboFix.txt
2014-10-11 20:04 - 2014-10-11 22:54 - 00000000 ____D () C:\Qoobox
2014-10-11 20:04 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-10-11 20:04 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-10-11 20:04 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-10-11 20:04 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-10-11 20:04 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-10-11 20:04 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-10-11 20:04 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-10-11 20:04 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-10-11 20:01 - 2014-10-11 22:53 - 00000000 ____D () C:\Windows\erdnt
2014-10-11 20:00 - 2014-10-11 20:00 - 05582481 ____R (Swearware) C:\Users\david\Downloads\ComboFix.exe
2014-10-11 20:00 - 2014-10-11 20:00 - 05582481 ____R (Swearware) C:\Users\david\Desktop\ComboFix.exe
2014-10-11 19:10 - 2014-10-11 19:10 - 00000740 _____ () C:\Users\david\Desktop\Revo Uninstaller.lnk
2014-10-11 19:09 - 2014-10-11 19:09 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\david\Downloads\revosetup95.exe
2014-10-10 21:18 - 2014-10-10 21:18 - 00000000 ____D () C:\Windows\pss
2014-10-10 20:59 - 2014-10-10 21:00 - 00047985 _____ () C:\Users\david\Desktop\Addition.txt
2014-10-10 20:56 - 2014-10-12 16:13 - 00011595 _____ () C:\Users\david\Desktop\FRST.txt
2014-10-10 20:56 - 2014-10-12 16:13 - 00000000 ____D () C:\FRST
2014-10-10 20:55 - 2014-10-12 16:13 - 02110464 _____ (Farbar) C:\Users\david\Desktop\FRST64.exe
2014-10-10 20:55 - 2014-10-10 20:55 - 02109952 _____ (Farbar) C:\Users\david\Downloads\FRST64.exe
2014-10-10 19:12 - 2014-10-10 19:13 - 00000000 ____D () C:\Users\david\AppData\Roaming\SpaceEngineers
2014-10-06 21:21 - 2014-10-06 22:00 - 764194469 _____ ( ) C:\Users\david\Downloads\Call_of_Pripyat_Complete_v1.0.2_Setup.exe
2014-10-03 10:50 - 2014-10-03 10:50 - 00000000 ____D () C:\Users\david\Documents\Paradox Interactive
2014-09-29 20:45 - 2014-09-29 20:45 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies
2014-09-29 20:43 - 2014-09-13 22:13 - 00613696 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
2014-09-29 20:33 - 2014-09-17 06:51 - 01538880 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdagenco6420103.dll
2014-09-29 20:33 - 2014-09-17 06:51 - 00197408 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda64v.sys
2014-09-29 20:33 - 2014-09-17 06:51 - 00031520 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 31887680 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 24552592 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 20922512 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 19954520 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 18106152 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 17259664 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 14026304 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 13939272 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 13157696 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2014-09-29 20:33 - 2014-09-14 01:48 - 11392576 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 11330776 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 04287296 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 04008592 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 01876296 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434411.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 01539272 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434411.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 00957584 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 00925896 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 00919240 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 00894096 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 00867528 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 00352016 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 00303600 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 00174856 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 00156840 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 00026956 _____ () C:\Windows\system32\nvinfo.pb
2014-09-29 18:41 - 2014-09-29 18:41 - 00000000 ____D () C:\NVIDIA
2014-09-29 18:34 - 2014-09-17 04:10 - 01715224 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll
2014-09-29 18:34 - 2014-09-17 04:10 - 01291280 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll
2014-09-29 18:32 - 2014-09-04 21:14 - 00038048 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2014-09-29 18:32 - 2014-09-04 21:14 - 00032416 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2014-09-29 18:29 - 2014-09-29 18:32 - 319671744 _____ (NVIDIA Corporation) C:\Users\david\Downloads\344.11-desktop-win8-win7-winvista-64bit-international-whql.exe
2014-09-29 01:11 - 2014-09-29 01:11 - 06626832 _____ (TeamViewer GmbH) C:\Users\david\Downloads\TeamViewer_Setup_de.exe
2014-09-25 01:04 - 2014-09-25 01:04 - 00342430 _____ () C:\Users\david\Downloads\lolhentai-1.6.3.sdt
2014-09-20 19:59 - 2014-09-20 19:59 - 00002466 _____ () C:\Users\VERSUCH\Desktop\SWAT 4 Single Player Demo.lnk
2014-09-20 19:59 - 2014-09-20 19:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VUGames
2014-09-20 19:51 - 2014-09-20 19:51 - 00367432 _____ () C:\Users\david\Downloads\SoftonicDownloader_for_s-w-a-t-4.exe
2014-09-16 20:14 - 2014-05-14 18:23 - 02477536 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-09-16 20:14 - 2014-05-14 18:23 - 00058336 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-09-16 20:14 - 2014-05-14 18:23 - 00044512 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-09-16 20:14 - 2014-05-14 18:21 - 02620928 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-09-16 20:13 - 2014-05-14 18:23 - 00700384 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-09-16 20:13 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2014-09-16 20:13 - 2014-05-14 18:23 - 00038880 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-09-16 20:13 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2014-09-16 20:13 - 2014-05-14 18:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-09-16 20:13 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2014-09-16 20:13 - 2014-05-14 09:23 - 00198600 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-09-16 20:13 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2014-09-16 20:13 - 2014-05-14 09:20 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-09-16 20:13 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2014-09-15 17:16 - 2014-09-15 17:16 - 00000000 ____D () C:\Users\david\AppData\Local\Skyrim
2014-09-15 14:02 - 2014-09-15 14:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-09-13 17:01 - 2014-09-13 17:01 - 00002994 _____ () C:\Windows\System32\Tasks\{27D2EB2D-97B3-45D7-92BF-F3A828E00E69}
2014-09-13 17:01 - 2014-09-13 17:01 - 00002994 _____ () C:\Windows\System32\Tasks\{0DD3DE14-B902-4045-B1FF-C97573D1D309}
2014-09-13 16:48 - 2014-09-13 16:49 - 01595776 _____ (ESET) C:\Users\david\Downloads\eset_smart_security_live_installer_.exe
2014-09-13 15:58 - 2014-09-13 15:58 - 00000000 ____D () C:\blabliblu
2014-09-13 15:42 - 2014-09-13 15:42 - 00000000 ____D () C:\Users\Public\Documents\DAEMON Tools Images
2014-09-13 15:01 - 2014-09-13 15:01 - 00386680 _____ (Duplex Secure Ltd.) C:\Windows\system32\Drivers\sptd.sys

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-12 16:14 - 2012-06-23 16:32 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-10-12 16:12 - 2009-07-14 06:45 - 00021072 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-12 16:12 - 2009-07-14 06:45 - 00021072 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-12 16:08 - 2014-01-02 12:25 - 01381899 _____ () C:\Windows\WindowsUpdate.log
2014-10-12 16:06 - 2012-06-30 11:37 - 00000000 ____D () C:\Users\david\AppData\Local\Adobe
2014-10-12 16:06 - 2012-06-23 16:19 - 00000000 ____D () C:\Users\david\AppData\Roaming\Skype
2014-10-12 16:05 - 2014-01-01 20:14 - 00032851 _____ () C:\Windows\setupact.log
2014-10-12 16:05 - 2013-07-03 15:26 - 00001108 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-10-12 16:05 - 2013-07-01 13:47 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-10-12 16:05 - 2012-01-27 09:33 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-10-12 16:05 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-10-12 16:04 - 2014-01-07 16:07 - 00953452 _____ () C:\Windows\PFRO.log
2014-10-12 16:03 - 2013-11-23 13:09 - 00000000 ____D () C:\AdwCleaner
2014-10-12 15:25 - 2012-06-24 18:15 - 00001138 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-243866017-1107141967-568923311-1001UA.job
2014-10-12 15:19 - 2013-07-03 15:26 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-10-12 14:51 - 2012-06-23 16:41 - 00000000 ____D () C:\Users\david\AppData\Roaming\TS3Client
2014-10-12 12:48 - 2012-09-09 17:58 - 00000000 ____D () C:\Users\david\AppData\Local\Apps\2.0
2014-10-12 12:44 - 2013-05-21 18:36 - 00003440 _____ () C:\Windows\System32\Tasks\PCDEventLauncherTask
2014-10-12 12:24 - 2012-06-27 19:00 - 00000784 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-10-12 12:24 - 2012-06-27 19:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2014-10-12 12:24 - 2012-06-27 19:00 - 00000000 ____D () C:\Program Files\CCleaner
2014-10-12 05:47 - 2012-11-01 17:03 - 00003930 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{963751FF-E6A0-461A-9D15-630985D8D304}
2014-10-12 00:25 - 2012-06-24 18:15 - 00001116 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-243866017-1107141967-568923311-1001Core.job
2014-10-11 22:54 - 2009-07-14 05:20 - 00000000 ____D () C:\Users\Default
2014-10-11 22:48 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-10-10 21:20 - 2013-03-23 18:55 - 00000000 ____D () C:\Users\david\AppData\Local\CrashDumps
2014-10-10 19:55 - 2014-09-08 20:25 - 00000000 ____D () C:\Users\david\Desktop\Cracks
2014-10-09 21:07 - 2012-06-23 16:25 - 00000000 ____D () C:\ProgramData\Origin
2014-10-09 21:06 - 2014-08-27 23:16 - 00000000 ____D () C:\Program Files (x86)\Origin
2014-10-05 13:11 - 2014-08-11 02:34 - 00000000 ____D () C:\Users\david\Documents\BattleIslands
2014-10-04 22:03 - 2012-06-23 16:32 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-10-04 22:03 - 2012-06-23 16:32 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-10-04 22:03 - 2012-01-27 10:40 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-10-04 15:49 - 2014-01-06 03:51 - 00661582 _____ () C:\Windows\DirectX.log
2014-10-04 15:44 - 2013-06-02 22:16 - 00000000 ____D () C:\Users\david\AppData\Roaming\Spotify
2014-10-03 23:03 - 2013-06-24 22:20 - 00000000 ____D () C:\Users\david\AppData\Local\Spotify
2014-09-29 20:49 - 2013-09-17 19:46 - 00001349 _____ () C:\Users\Public\Desktop\GeForce Experience.lnk
2014-09-29 20:45 - 2012-06-23 20:58 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation
2014-09-29 20:44 - 2013-09-17 19:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2014-09-29 20:38 - 2012-01-27 09:33 - 00000000 ____D () C:\Program Files\NVIDIA Corporation
2014-09-29 18:38 - 2013-12-21 19:21 - 00000000 ____D () C:\Users\david\AppData\Local\NVIDIA Corporation
2014-09-29 18:34 - 2012-01-27 09:33 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation
2014-09-29 13:14 - 2012-01-27 11:20 - 00000000 ____D () C:\ProgramData\Sonic
2014-09-29 01:12 - 2012-07-18 17:29 - 00000000 ____D () C:\Users\david\AppData\Roaming\TeamViewer
2014-09-28 20:48 - 2012-10-03 16:54 - 00007599 _____ () C:\Users\david\AppData\Local\Resmon.ResmonCfg
2014-09-20 20:23 - 2012-01-27 10:58 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-09-19 05:52 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-09-18 15:15 - 2013-03-02 00:27 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-09-17 04:10 - 2013-12-21 18:53 - 02799784 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll
2014-09-17 04:10 - 2013-12-21 18:53 - 02193560 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll
2014-09-16 20:19 - 2012-06-24 09:00 - 00000000 ____D () C:\ProgramData\PCDr
2014-09-15 17:14 - 2012-06-29 13:21 - 00000000 ____D () C:\Users\david\Documents\My Games
2014-09-15 17:13 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-09-15 14:02 - 2014-08-26 05:17 - 00002517 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-09-15 14:02 - 2012-06-23 16:19 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-09-15 14:02 - 2012-01-27 11:00 - 00000000 ____D () C:\ProgramData\Skype
2014-09-14 01:48 - 2013-03-17 21:13 - 20589536 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
2014-09-14 01:48 - 2012-06-23 20:58 - 00984424 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll
2014-09-14 01:48 - 2012-01-27 18:13 - 16875856 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll
2014-09-14 01:48 - 2012-01-27 18:13 - 03223120 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll
2014-09-14 01:48 - 2012-01-27 18:13 - 02838424 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll
2014-09-13 23:53 - 2011-02-17 12:10 - 00062608 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll
2014-09-13 23:53 - 2011-02-17 11:10 - 02557640 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll
2014-09-13 23:53 - 2011-02-17 11:10 - 00934216 _____ (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
2014-09-13 23:53 - 2011-02-17 11:10 - 00385168 _____ (NVIDIA Corporation) C:\Windows\system32\nvmctray.dll
2014-09-13 23:53 - 2011-02-17 11:09 - 06890696 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll
2014-09-13 23:53 - 2011-02-17 11:09 - 03529872 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc64.dll
2014-09-13 17:53 - 2013-12-29 22:58 - 00001104 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 9.lnk
2014-09-13 17:05 - 2014-05-28 23:04 - 00000000 ____D () C:\Program Files (x86)\osu!
2014-09-13 01:00 - 2010-11-21 08:50 - 00699416 _____ () C:\Windows\system32\perfh007.dat
2014-09-13 01:00 - 2010-11-21 08:50 - 00149556 _____ () C:\Windows\system32\perfc007.dat
2014-09-13 01:00 - 2009-07-14 07:13 - 01620612 _____ () C:\Windows\system32\PerfStringBackup.INI

ZeroAccess:
C:\Windows\Installer\{1547a4df-a060-bca0-5da2-aff15ee51e9d}
C:\Windows\Installer\{1547a4df-a060-bca0-5da2-aff15ee51e9d}\@

ZeroAccess:
C:\Users\david\AppData\Local\{1547a4df-a060-bca0-5da2-aff15ee51e9d}
C:\Users\david\AppData\Local\{1547a4df-a060-bca0-5da2-aff15ee51e9d}\@

Some content of TEMP:
====================
C:\Users\david\AppData\Local\Temp\InstHelper.exe
C:\Users\david\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-09-19 05:45

==================== End Of Log ============================
         

--- --- ---

--- --- ---

--- --- ---

--- --- ---

Außerdem lässt sich ESET wieder nicht öffnen wegen Gruppenrichtlinien(?!?!?!?)

So,jetzt hab ich das mit der Fixlist.txt wiederholt und es ist wieder ok

ESET Online Scanner

• Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
• Lade und starte Eset Online Scanner
• Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
• Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
• Klicke auf Starten.
• Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Klicke am Ende des Suchlaufs auf Fertig stellen.
• Schließe das Fenster von ESET.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte SecurityCheck und:

• Speichere es auf dem Desktop.
• Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
• Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=aef44c87e8bee247909276d9062540b9
# engine=20571
# end=finished
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-10-13 03:58:46
# local_time=2014-10-13 05:58:46 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 16003 164845776 0 0
# compatibility_mode_1='ESET Smart Security 7.0'
# compatibility_mode=8221 16777213 100 100 5171763 33795668 0 0
# scanned=306593
# found=105
# cleaned=0
# scan_time=6634
# nod_component=V3 Build:0x30000000
sh=D6E3758123FA1C4B9945BBF3359584ABA79C90F3 ft=1 fh=1253b0cb81c9b1bd vn="Win32/DealPly.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\DealPly\DealPlyUpdate.exe.vir"
sh=143416AAC4F6000C3A3235EB4EC955B4D0B6955E ft=1 fh=b68409d87b15670c vn="Win32/DealPly.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\DealPly\DealPlyUpdateVer.exe.vir"
sh=99DF98DFEF4B483889FA88162D20EE46340A5DBE ft=1 fh=e6e2c196b2ffcb6f vn="Win32/Toolbar.MyWebSearch.W evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65auxstb.dll.vir"
sh=56CF4F2AC44C6ADD5CDCD419BA4B99D22DC7A0E3 ft=1 fh=46ed14ba69906e9f vn="Win32/Toolbar.MyWebSearch.X evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65barsvc.exe.vir"
sh=0FF3588ECB69D2B18C6FAEC012672CA2F60314F6 ft=1 fh=731190b7425307d6 vn="Win32/Toolbar.MyWebSearch.W evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65bprtct.dll.vir"
sh=12FF3195BDACA5482034AAC3C3E132D5ADA421A9 ft=1 fh=982f80d197512813 vn="Win32/Toolbar.MyWebSearch.AA evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65brstub.dll.vir"
sh=0C88EFCFA1C77D597111125A6C031CEB47B18BA7 ft=1 fh=b856def4c7346ea3 vn="Win32/Toolbar.MyWebSearch.AA evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65dlghk.dll.vir"
sh=8090E240F528004402B29C11E5072BED79D95384 ft=1 fh=73e118282d8d3c4a vn="Win32/Toolbar.MyWebSearch.AA evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65dyn.dll.vir"
sh=2CA2EA6CF1AD1FE87C25D4AB6B1C7729E48C6390 ft=1 fh=a34a8b9082c46c86 vn="Win32/Toolbar.MyWebSearch.AA evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65feedmg.dll.vir"
sh=9788294F2B8AB28DBAE4C73BB61A6B1200BDD89D ft=1 fh=af8ed8fd644fe8ac vn="Win32/Toolbar.MyWebSearch.AA evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65highin.exe.vir"
sh=9D54BAF23397E5F1444BC6471052AD234B76FBD3 ft=1 fh=2ab58862c927227b vn="Win32/Toolbar.MyWebSearch.AA evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65hkstub.dll.vir"
sh=978867B422339E68971E56C49C66F14F2ACD745D ft=1 fh=dd289cd2c7a55037 vn="Win32/Toolbar.MyWebSearch.AA evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65httpct.dll.vir"
sh=DC971C75FFCE77CC952FB6660A2603E09D62D4D9 ft=1 fh=ac2f97e786bfc982 vn="Win32/Toolbar.MyWebSearch.AA evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65idle.dll.vir"
sh=AFCAAC5845D81A407C63733E4A7D007167F96BE8 ft=1 fh=02b0c8de8c8e9f1e vn="Win32/Toolbar.MyWebSearch.W evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65impipe.exe.vir"
sh=556C4FCA5D890F17B7B5040A601B42452A205E29 ft=1 fh=0f2a31b21601aeb5 vn="Win32/Toolbar.MyWebSearch.AA evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65medint.exe.vir"
sh=3EB4A6A25199E6339EC04F36189C71738DE63CE7 ft=1 fh=eafb3b5bfaf84345 vn="Win32/Toolbar.MyWebSearch.AA evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65mlbtn.dll.vir"
sh=DFD07B722E317D1CDDAAB7D5B31BFAB57CC5E739 ft=1 fh=507b4871517a4ad4 vn="Win32/Toolbar.MyWebSearch.AA evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65msg.dll.vir"
sh=77C8DC985373B1E5D9035ECB3A831C7DD1ABFD55 ft=1 fh=e1f880731de07609 vn="Win32/Toolbar.MyWebSearch.AA evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65radio.dll.vir"
sh=C5F26031D5E0C487BFF0D60AA44603135BF60395 ft=1 fh=a846ae5344ec78c3 vn="Win32/Toolbar.MyWebSearch.AA evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65regfft.dll.vir"
sh=A2F202F68FEF2A31E9FE3AE124A46B908349778C ft=1 fh=bf17c6b7704b10fd vn="Win32/Toolbar.MyWebSearch.W evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65reghk.dll.vir"
sh=65D604A070334183E5034CDEEC5838E46D705794 ft=1 fh=3d9a604351eb1640 vn="Win32/Toolbar.MyWebSearch.AA evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65regiet.dll.vir"
sh=72E48F7F37E208A52AD975EAECAB29FC50223C27 ft=1 fh=958a563919bf5cc2 vn="Win32/Toolbar.MyWebSearch.AA evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65script.dll.vir"
sh=496310EE0816B49176E03226DB102FAE9AA452B4 ft=1 fh=ceffc168909c0690 vn="Win32/Toolbar.MyWebSearch.AA evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65sknlcr.dll.vir"
sh=F5946D49A70A64072739370E7BAD592FE4799EA1 ft=1 fh=5bc3efb780caf8fa vn="Win32/Toolbar.MyWebSearch.W evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65skplay.exe.vir"
sh=8ACE75F6C2417666AD9D60837B72D78B394C3944 ft=1 fh=ae6d89138faf571c vn="Win32/Toolbar.MyWebSearch.W evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65SrchMn.exe.vir"
sh=110033F4A78DCA521E8BA73F75747E4E3B6AE545 ft=1 fh=21686246ae128bdd vn="Win32/Toolbar.MyWebSearch.AA evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65uabtn.dll.vir"
sh=630D5FC9ACC4932C87263895F554F8C3CB6D4B4A ft=1 fh=b81ce565a99a556c vn="Win64/Toolbar.MyWebSearch.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\FromDocToPDF_65\bar\1.bin\AppIntegrator64.exe.vir"
sh=374E378A91209732B48C8416D1E9805E98FDCFA9 ft=1 fh=6da58ad1308c1c96 vn="Win64/Toolbar.MyWebSearch.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\FromDocToPDF_65\bar\1.bin\AppIntegratorStub64.dll.vir"
sh=3D7CD376DFDB97512A376E85FBB7F04344C051B6 ft=1 fh=e0ed2601e18686d8 vn="Win64/Toolbar.MyWebSearch.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\FromDocToPDF_65\bar\1.bin\Hpg64.dll.vir"
sh=6FD2998EC2109C6D2AB8816D908D712A3D380FA2 ft=1 fh=709275a08cc237b9 vn="Win32/Toolbar.MyWebSearch.T evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\FromDocToPDF_65\bar\1.bin\NP65Stub.dll.vir"
sh=B8944722E8D577E67925DD4A72D1D8E44C3BC6CA ft=1 fh=6f8a20cf4b11d7b0 vn="Win32/Toolbar.MyWebSearch.AA evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\FromDocToPDF_65\bar\1.bin\T8EXTPEX.DLL.vir"
sh=76039D5A64EF897B1AA388EED70452774019DB59 ft=1 fh=890f56b03e669e11 vn="Win32/Somoto.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\david\AppData\Local\FilesFrog Update Checker\update_checker.exe.vir"
sh=BDF49E9DB1E7F1DF379077EE4D651A841F88EE43 ft=1 fh=b964e189b9898c4e vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\david\AppData\Local\Smartbar\Application\amfclgbdpgndipgoegfpkkgobahigbcl\GoogleChromeRemotePlugin.dll.vir"
sh=48C826EF00938F035C91C9F6B3E167CB21D96633 ft=1 fh=59fac0a23423ab50 vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\david\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_16.dll.vi r"
sh=45F4ABE93E1FB333545719948B418FB1207A5085 ft=1 fh=3a58b09db4698b9d vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\david\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_17.dll.vi r"
sh=FED76CBD8D5660DEC60B3F16547372DEE7F87FA6 ft=1 fh=9705b06916654cd4 vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\david\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_18.dll.vi r"
sh=C8F23EFE19C6A36D8921AE5C96F95808EBEFBE05 ft=1 fh=8064b8d931435e04 vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\david\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_19.dll.vi r"
sh=C7E054C7BA58AE2D703DB29C52346A3ED84FEF57 ft=1 fh=53532950b9749a4f vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\david\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_20.dll.vi r"
sh=C546BA3CA78F93EB65DCCEA191BC40B9F940E2EA ft=1 fh=6fd80785d353cf5d vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\david\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_21.dll.vi r"
sh=1549CF4F9282F1B42A58B5E050E12EF0AD669798 ft=1 fh=ffe6693d8bc7d6c5 vn="Win32/Toolbar.Babylon.I evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\david\AppData\Roaming\BabSolution\Shared\BabMaint.exe.vir"
sh=143416AAC4F6000C3A3235EB4EC955B4D0B6955E ft=1 fh=b68409d87b15670c vn="Win32/DealPly.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\david\AppData\Roaming\DealPly\UpdateProc\UpdateTask.exe.vir"
sh=48C826EF00938F035C91C9F6B3E167CB21D96633 ft=1 fh=59fac0a23423ab50 vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\Extensions\{2894a412-e091-6466-9ab8-ea76561654ca}\components\SmartbarFireFoxRemotePlugin_16.dll.vir"
sh=45F4ABE93E1FB333545719948B418FB1207A5085 ft=1 fh=3a58b09db4698b9d vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\Extensions\{2894a412-e091-6466-9ab8-ea76561654ca}\components\SmartbarFireFoxRemotePlugin_17.dll.vir"
sh=FED76CBD8D5660DEC60B3F16547372DEE7F87FA6 ft=1 fh=9705b06916654cd4 vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\Extensions\{2894a412-e091-6466-9ab8-ea76561654ca}\components\SmartbarFireFoxRemotePlugin_18.dll.vir"
sh=C8F23EFE19C6A36D8921AE5C96F95808EBEFBE05 ft=1 fh=8064b8d931435e04 vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\Extensions\{2894a412-e091-6466-9ab8-ea76561654ca}\components\SmartbarFireFoxRemotePlugin_19.dll.vir"
sh=C7E054C7BA58AE2D703DB29C52346A3ED84FEF57 ft=1 fh=53532950b9749a4f vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\Extensions\{2894a412-e091-6466-9ab8-ea76561654ca}\components\SmartbarFireFoxRemotePlugin_20.dll.vir"
sh=C546BA3CA78F93EB65DCCEA191BC40B9F940E2EA ft=1 fh=6fd80785d353cf5d vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\Extensions\{2894a412-e091-6466-9ab8-ea76561654ca}\components\SmartbarFireFoxRemotePlugin_21.dll.vir"
sh=D9A47983E4D8E67F12BC190A8BE3B659411D123A ft=1 fh=63c40146d214be9b vn="Win32/InstallBrain evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\Uninstall Information\ib_uninst_361\uninstall.exe"
sh=D9A47983E4D8E67F12BC190A8BE3B659411D123A ft=1 fh=63c40146d214be9b vn="Win32/InstallBrain evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\Uninstall Information\ib_uninst_442\uninstall.exe"
sh=D9A47983E4D8E67F12BC190A8BE3B659411D123A ft=1 fh=63c40146d214be9b vn="Win32/InstallBrain evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\Uninstall Information\ib_uninst_455\uninstall.exe"
sh=D9A47983E4D8E67F12BC190A8BE3B659411D123A ft=1 fh=63c40146d214be9b vn="Win32/InstallBrain evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\Uninstall Information\ib_uninst_518\uninstall.exe"
sh=D9A47983E4D8E67F12BC190A8BE3B659411D123A ft=1 fh=63c40146d214be9b vn="Win32/InstallBrain evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\Uninstall Information\ib_uninst_519\uninstall.exe"
sh=4EE209ABEE9D3DC3127F1796A73503F4ACAC954A ft=1 fh=df7e0c350b53f941 vn="Win32/PSW.Papras.CX Trojaner" ac=I fn="C:\ProgramData\AbewgOcluk\AbewgOcluk.dat"
sh=4EE209ABEE9D3DC3127F1796A73503F4ACAC954A ft=1 fh=df7e0c350b53f941 vn="Win32/PSW.Papras.CX Trojaner" ac=I fn="C:\ProgramData\AdneWbiql\AdneWbiql.dat"
sh=4EE209ABEE9D3DC3127F1796A73503F4ACAC954A ft=1 fh=df7e0c350b53f941 vn="Win32/PSW.Papras.CX Trojaner" ac=I fn="C:\ProgramData\AgolBemet\AgolBemet.dat"
sh=231FDBB0835B7165187DCD020E30DA6DCBAAC40F ft=1 fh=a1cb973671c52be2 vn="Win32/PSW.Papras.DJ Trojaner" ac=I fn="C:\ProgramData\AkmupUguge\AkmupUguge.dat"
sh=0B471E11AECB3E8BC7BEEBB7D3712B3EA28D6DF6 ft=1 fh=34bf2e27b2f00fa4 vn="Win32/PSW.Papras.CP Trojaner" ac=I fn="C:\ProgramData\AkoyaVgogi\AkoyaVgogi.dat"
sh=D34239554573F008EE1B9A4C9C0A4E14A5FCFFF3 ft=1 fh=3da748770c2769f4 vn="Win32/PSW.Papras.DR Trojaner" ac=I fn="C:\ProgramData\AmqiqPizet\AmqiqPizet.dat"
sh=B597999D94CF8489899AB37080277B0B4D4BBF3E ft=1 fh=b0d762835dd86ebf vn="Win32/PSW.Papras.DJ Trojaner" ac=I fn="C:\ProgramData\ApmeJxel\ApmeJxel.dat"
sh=4EE209ABEE9D3DC3127F1796A73503F4ACAC954A ft=1 fh=df7e0c350b53f941 vn="Win32/PSW.Papras.CX Trojaner" ac=I fn="C:\ProgramData\EbanOcaha\EbanOcaha.dat"
sh=4EE209ABEE9D3DC3127F1796A73503F4ACAC954A ft=1 fh=df7e0c350b53f941 vn="Win32/PSW.Papras.CX Trojaner" ac=I fn="C:\ProgramData\EdvapYexhu\EdvapYexhu.dat"
sh=4EE209ABEE9D3DC3127F1796A73503F4ACAC954A ft=1 fh=df7e0c350b53f941 vn="Win32/PSW.Papras.CX Trojaner" ac=I fn="C:\ProgramData\EzekoTahit\EzekoTahit.dat"
sh=49D8EF6835A6DE734EAD4E0B2CBBC65735CD5C17 ft=1 fh=b7c2cf7d50fb560b vn="Win32/InstalleRex.L evtl. unerwünschte Anwendung" ac=I fn="C:\ProgramData\InstallMate\{D1E9524F-6F96-4A26-A8CD-27B40A0A70B9}\Custom.dll"
sh=4EE209ABEE9D3DC3127F1796A73503F4ACAC954A ft=1 fh=df7e0c350b53f941 vn="Win32/PSW.Papras.CX Trojaner" ac=I fn="C:\ProgramData\IqikWuge\IqikWuge.dat"
sh=C82DE4B723515AFE0E8B4EFD33882BE50633C5ED ft=1 fh=4798528b570f1298 vn="Win32/PSW.Papras.DR Trojaner" ac=I fn="C:\ProgramData\OcniNtih\OcniNtih.dat"
sh=4EE209ABEE9D3DC3127F1796A73503F4ACAC954A ft=1 fh=df7e0c350b53f941 vn="Win32/PSW.Papras.CX Trojaner" ac=I fn="C:\ProgramData\OdwewEzuce\OdwewEzuce.dat"
sh=0B471E11AECB3E8BC7BEEBB7D3712B3EA28D6DF6 ft=1 fh=34bf2e27b2f00fa4 vn="Win32/PSW.Papras.CP Trojaner" ac=I fn="C:\ProgramData\OfqiTaxo\OfqiTaxo.dat"
sh=4EE209ABEE9D3DC3127F1796A73503F4ACAC954A ft=1 fh=df7e0c350b53f941 vn="Win32/PSW.Papras.CX Trojaner" ac=I fn="C:\ProgramData\OfuxDurov\OfuxDurov.dat"
sh=4EE209ABEE9D3DC3127F1796A73503F4ACAC954A ft=1 fh=df7e0c350b53f941 vn="Win32/PSW.Papras.CX Trojaner" ac=I fn="C:\ProgramData\OlafcEhitu\OlafcEhitu.dat"
sh=9A4E26F49E2BBC55ACAF4E8A4FBE96A2D8AE6162 ft=1 fh=ddfa1c972cc4cd39 vn="Win32/PSW.Papras.DR Trojaner" ac=I fn="C:\ProgramData\OnibErof\OnibErof.dat"
sh=4EE209ABEE9D3DC3127F1796A73503F4ACAC954A ft=1 fh=df7e0c350b53f941 vn="Win32/PSW.Papras.CX Trojaner" ac=I fn="C:\ProgramData\OpohEluda\OpohEluda.dat"
sh=4EE209ABEE9D3DC3127F1796A73503F4ACAC954A ft=1 fh=df7e0c350b53f941 vn="Win32/PSW.Papras.CX Trojaner" ac=I fn="C:\ProgramData\OxereNazic\OxereNazic.dat"
sh=4EE209ABEE9D3DC3127F1796A73503F4ACAC954A ft=1 fh=df7e0c350b53f941 vn="Win32/PSW.Papras.CX Trojaner" ac=I fn="C:\ProgramData\UgeceNezxo\UgeceNezxo.dat"
sh=4EE209ABEE9D3DC3127F1796A73503F4ACAC954A ft=1 fh=df7e0c350b53f941 vn="Win32/PSW.Papras.CX Trojaner" ac=I fn="C:\ProgramData\UkjaFtoq\UkjaFtoq.dat"
sh=4EE209ABEE9D3DC3127F1796A73503F4ACAC954A ft=1 fh=df7e0c350b53f941 vn="Win32/PSW.Papras.CX Trojaner" ac=I fn="C:\ProgramData\UkvoJojow\UkvoJojow.dat"
sh=4EE209ABEE9D3DC3127F1796A73503F4ACAC954A ft=1 fh=df7e0c350b53f941 vn="Win32/PSW.Papras.CX Trojaner" ac=I fn="C:\ProgramData\UxzoqYoxuz\UxzoqYoxuz.dat"
sh=15BA7A48CE702BB40B26C14FE7BD1644B65D8C1F ft=1 fh=7ea0f02e160fa23a vn="Win32/PSW.Papras.DJ Trojaner" ac=I fn="C:\ProgramData\UzeneKjojf\UzeneKjojf.dat"
sh=4EE209ABEE9D3DC3127F1796A73503F4ACAC954A ft=1 fh=df7e0c350b53f941 vn="Win32/PSW.Papras.CX Trojaner" ac=I fn="C:\Users\All Users\AbewgOcluk\AbewgOcluk.dat"
sh=4EE209ABEE9D3DC3127F1796A73503F4ACAC954A ft=1 fh=df7e0c350b53f941 vn="Win32/PSW.Papras.CX Trojaner" ac=I fn="C:\Users\All Users\AdneWbiql\AdneWbiql.dat"
sh=4EE209ABEE9D3DC3127F1796A73503F4ACAC954A ft=1 fh=df7e0c350b53f941 vn="Win32/PSW.Papras.CX Trojaner" ac=I fn="C:\Users\All Users\AgolBemet\AgolBemet.dat"
sh=231FDBB0835B7165187DCD020E30DA6DCBAAC40F ft=1 fh=a1cb973671c52be2 vn="Win32/PSW.Papras.DJ Trojaner" ac=I fn="C:\Users\All Users\AkmupUguge\AkmupUguge.dat"
sh=0B471E11AECB3E8BC7BEEBB7D3712B3EA28D6DF6 ft=1 fh=34bf2e27b2f00fa4 vn="Win32/PSW.Papras.CP Trojaner" ac=I fn="C:\Users\All Users\AkoyaVgogi\AkoyaVgogi.dat"
sh=D34239554573F008EE1B9A4C9C0A4E14A5FCFFF3 ft=1 fh=3da748770c2769f4 vn="Win32/PSW.Papras.DR Trojaner" ac=I fn="C:\Users\All Users\AmqiqPizet\AmqiqPizet.dat"
sh=B597999D94CF8489899AB37080277B0B4D4BBF3E ft=1 fh=b0d762835dd86ebf vn="Win32/PSW.Papras.DJ Trojaner" ac=I fn="C:\Users\All Users\ApmeJxel\ApmeJxel.dat"
sh=4EE209ABEE9D3DC3127F1796A73503F4ACAC954A ft=1 fh=df7e0c350b53f941 vn="Win32/PSW.Papras.CX Trojaner" ac=I fn="C:\Users\All Users\EbanOcaha\EbanOcaha.dat"
sh=4EE209ABEE9D3DC3127F1796A73503F4ACAC954A ft=1 fh=df7e0c350b53f941 vn="Win32/PSW.Papras.CX Trojaner" ac=I fn="C:\Users\All Users\EdvapYexhu\EdvapYexhu.dat"
sh=4EE209ABEE9D3DC3127F1796A73503F4ACAC954A ft=1 fh=df7e0c350b53f941 vn="Win32/PSW.Papras.CX Trojaner" ac=I fn="C:\Users\All Users\EzekoTahit\EzekoTahit.dat"
sh=49D8EF6835A6DE734EAD4E0B2CBBC65735CD5C17 ft=1 fh=b7c2cf7d50fb560b vn="Win32/InstalleRex.L evtl. unerwünschte Anwendung" ac=I fn="C:\Users\All Users\InstallMate\{D1E9524F-6F96-4A26-A8CD-27B40A0A70B9}\Custom.dll"
sh=4EE209ABEE9D3DC3127F1796A73503F4ACAC954A ft=1 fh=df7e0c350b53f941 vn="Win32/PSW.Papras.CX Trojaner" ac=I fn="C:\Users\All Users\IqikWuge\IqikWuge.dat"
sh=C82DE4B723515AFE0E8B4EFD33882BE50633C5ED ft=1 fh=4798528b570f1298 vn="Win32/PSW.Papras.DR Trojaner" ac=I fn="C:\Users\All Users\OcniNtih\OcniNtih.dat"
sh=4EE209ABEE9D3DC3127F1796A73503F4ACAC954A ft=1 fh=df7e0c350b53f941 vn="Win32/PSW.Papras.CX Trojaner" ac=I fn="C:\Users\All Users\OdwewEzuce\OdwewEzuce.dat"
sh=0B471E11AECB3E8BC7BEEBB7D3712B3EA28D6DF6 ft=1 fh=34bf2e27b2f00fa4 vn="Win32/PSW.Papras.CP Trojaner" ac=I fn="C:\Users\All Users\OfqiTaxo\OfqiTaxo.dat"
sh=4EE209ABEE9D3DC3127F1796A73503F4ACAC954A ft=1 fh=df7e0c350b53f941 vn="Win32/PSW.Papras.CX Trojaner" ac=I fn="C:\Users\All Users\OfuxDurov\OfuxDurov.dat"
sh=4EE209ABEE9D3DC3127F1796A73503F4ACAC954A ft=1 fh=df7e0c350b53f941 vn="Win32/PSW.Papras.CX Trojaner" ac=I fn="C:\Users\All Users\OlafcEhitu\OlafcEhitu.dat"
sh=9A4E26F49E2BBC55ACAF4E8A4FBE96A2D8AE6162 ft=1 fh=ddfa1c972cc4cd39 vn="Win32/PSW.Papras.DR Trojaner" ac=I fn="C:\Users\All Users\OnibErof\OnibErof.dat"
sh=4EE209ABEE9D3DC3127F1796A73503F4ACAC954A ft=1 fh=df7e0c350b53f941 vn="Win32/PSW.Papras.CX Trojaner" ac=I fn="C:\Users\All Users\OpohEluda\OpohEluda.dat"
sh=4EE209ABEE9D3DC3127F1796A73503F4ACAC954A ft=1 fh=df7e0c350b53f941 vn="Win32/PSW.Papras.CX Trojaner" ac=I fn="C:\Users\All Users\OxereNazic\OxereNazic.dat"
sh=4EE209ABEE9D3DC3127F1796A73503F4ACAC954A ft=1 fh=df7e0c350b53f941 vn="Win32/PSW.Papras.CX Trojaner" ac=I fn="C:\Users\All Users\UgeceNezxo\UgeceNezxo.dat"
sh=4EE209ABEE9D3DC3127F1796A73503F4ACAC954A ft=1 fh=df7e0c350b53f941 vn="Win32/PSW.Papras.CX Trojaner" ac=I fn="C:\Users\All Users\UkjaFtoq\UkjaFtoq.dat"
sh=4EE209ABEE9D3DC3127F1796A73503F4ACAC954A ft=1 fh=df7e0c350b53f941 vn="Win32/PSW.Papras.CX Trojaner" ac=I fn="C:\Users\All Users\UkvoJojow\UkvoJojow.dat"
sh=4EE209ABEE9D3DC3127F1796A73503F4ACAC954A ft=1 fh=df7e0c350b53f941 vn="Win32/PSW.Papras.CX Trojaner" ac=I fn="C:\Users\All Users\UxzoqYoxuz\UxzoqYoxuz.dat"
sh=15BA7A48CE702BB40B26C14FE7BD1644B65D8C1F ft=1 fh=7ea0f02e160fa23a vn="Win32/PSW.Papras.DJ Trojaner" ac=I fn="C:\Users\All Users\UzeneKjojf\UzeneKjojf.dat"
sh=39A46FEA3BDD809C2AC0FA05915422FD7C8A6C9E ft=1 fh=7ffefd4dcecdb4d1 vn="Win32/OpenCandy potenziell unsichere Anwendung" ac=I fn="C:\Users\david\Desktop\Dubstep\flstudio_11.1.exe"
sh=9A3475327FC02A2434383C1FF3B41C90FA27E2FE ft=1 fh=53854597d8020bfc vn="Win32/Somoto.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\david\Local Settings\Application Data\Bundled software uninstaller\biclient.exe"
sh=7D46D39AEE256EED7AB0AA6EF0E9A422831C01DC ft=1 fh=5623ddb773ac081b vn="Win32/OpenCandy potenziell unsichere Anwendung" ac=I fn="C:\Users\VERSUCH\Downloads\FreeYouTubeToMP3Converter5628.exe"

Results of screen317's Security Check version 0.99.87
Windows 7 Service Pack 1 x64 (UAC is disabled!)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
ESET Smart Security 7.0
Antivirus out of date! (On Access scanning disabled!)
`````````Anti-malware/Other Utilities Check:`````````
Java 7 Update 25
Java version out of Date!
Adobe Flash Player 15.0.0.152
Adobe Reader XI
Mozilla Firefox 22.0 Firefox out of Date!
Google Chrome 37.0.2062.120
Google Chrome 37.0.2062.124
````````Process Check: objlist.exe by Laurent````````
ESET NOD32 Antivirus egui.exe
ESET NOD32 Antivirus ekrn.exe
windows defender MpCmdRun.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````

frisches FRST log fehlt.

ups mein fehler
FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-10-2014
Ran by david (administrator) on DAVID-PC on 14-10-2014 16:23:37
Running from C:\Users\david\Desktop
Loaded Profile: david (Available profiles: david & VERSUCH)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\egui.exe
(Spotify Ltd) C:\Users\david\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Nico Mak Computing) C:\Program Files\File Association Helper\FAHWindow.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
() C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\CEPServiceManager4\CEPServiceManager.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
() C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\HEX\Adobe CEF Helper.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\HEX\Adobe CEF Helper.exe
(PC-Doctor, Inc.) C:\Program Files\My Dell\imstrayicon.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [DellStage] => C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe [2195824 2012-02-01] ()
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [472984 2013-06-03] (Adobe Systems Incorporated)
HKLM\...\Run: [Nvtmru] => "C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe"
HKLM\...\Run: [egui] => C:\Program Files\ESET\ESET Smart Security\egui.exe [5581888 2014-02-24] (ESET)
HKLM\...\Run: [FAHConsole] => C:\Program Files\File Association Helper\FAHConsole.exe [729272 2014-01-28] (Nico Mak Computing)
HKLM-x32\...\Run: [Dell Registration] => C:\Program Files (x86)\System Registration\prodreg.exe [4165440 2011-08-04] (Dell, Inc.)
HKLM-x32\...\Run: [RoxWatchTray] => C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe [240112 2010-11-25] (Sonic Solutions)
HKLM-x32\...\Run: [AccuWeatherWidget] => C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe [968048 2012-02-01] ()
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe Creative Cloud] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2236816 2013-07-12] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59240 2011-09-27] (Apple Inc.)
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [Spotify Web Helper] => C:\Users\david\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1514040 2014-10-03] (Spotify Ltd)
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [1938112 2014-09-23] (Valve Corporation)
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [AgolBemet] => regsvr32.exe "C:\ProgramData\AgolBemet\AgolBemet.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [AdneWbiql] => regsvr32.exe "C:\ProgramData\AdneWbiql\AdneWbiql.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [IqikWuge] => regsvr32.exe "C:\ProgramData\IqikWuge\IqikWuge.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OfuxDurov] => regsvr32.exe "C:\ProgramData\OfuxDurov\OfuxDurov.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [EbanOcaha] => regsvr32.exe "C:\ProgramData\EbanOcaha\EbanOcaha.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OpohEluda] => regsvr32.exe "C:\ProgramData\OpohEluda\OpohEluda.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OxereNazic] => regsvr32.exe "C:\ProgramData\OxereNazic\OxereNazic.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OlafcEhitu] => regsvr32.exe "C:\ProgramData\OlafcEhitu\OlafcEhitu.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [EdvapYexhu] => regsvr32.exe "C:\ProgramData\EdvapYexhu\EdvapYexhu.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [UkjaFtoq] => regsvr32.exe "C:\ProgramData\UkjaFtoq\UkjaFtoq.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [UkvoJojow] => regsvr32.exe "C:\ProgramData\UkvoJojow\UkvoJojow.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [ApmeJxel] => regsvr32.exe "C:\ProgramData\ApmeJxel\ApmeJxel.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OfqiTaxo] => regsvr32.exe "C:\ProgramData\OfqiTaxo\OfqiTaxo.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [AkoyaVgogi] => regsvr32.exe "C:\ProgramData\AkoyaVgogi\AkoyaVgogi.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [AkmupUguge] => regsvr32.exe "C:\ProgramData\AkmupUguge\AkmupUguge.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [AmqiqPizet] => regsvr32.exe "C:\ProgramData\AmqiqPizet\AmqiqPizet.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OcniNtih] => regsvr32.exe "C:\ProgramData\OcniNtih\OcniNtih.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OnibErof] => regsvr32.exe "C:\ProgramData\OnibErof\OnibErof.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [UzeneKjojf] => regsvr32.exe "C:\ProgramData\UzeneKjojf\UzeneKjojf.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [IdobvItazx] => regsvr32.exe "C:\ProgramData\IdobvItazx\IdobvItazx.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [UlhuGisc] => regsvr32.exe "C:\ProgramData\UlhuGisc\UlhuGisc.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [22041192 2014-08-27] (Skype Technologies S.A.)
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [6482200 2014-09-26] (Piriform Ltd)
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Policies\Explorer: [Run] "C:\Users\david\AppData\Roaming\Microsoft\Windows\IEUpdate\hh.exe"
HKU\S-1-5-18\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [22041192 2014-08-27] (Skype Technologies S.A.)
ShellIconOverlayIdentifiers: [ AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_v_1_1_0_x64.dll ()
ShellIconOverlayIdentifiers: [ AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_v_1_1_0_x64.dll ()
ShellIconOverlayIdentifiers: [ AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_v_1_1_0_x64.dll ()
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File
BootExecute: autocheck autochk * aswBoot.exe /M:c2da9b9a2a /wow /dir:C:\Program

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - No Name - !{1BB22D38-A411-4B13-A746-C2A4F4EC7344} -  No File
Toolbar: HKLM - No Name - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  No File
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  No File
Toolbar: HKLM-x32 - No Name - !{1BB22D38-A411-4B13-A746-C2A4F4EC7344} -  No File
Toolbar: HKLM-x32 - No Name - !{5018CFD2-804D-4C99-9F81-25EAEA2769DE} -  No File
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default
FF NewTab: user_pref("browser.newtab.url", "");
FF DefaultSearchEngine: Google
FF SearchEngineOrder.1: Google
FF SelectedSearchEngine: user_pref("browser.search.selectedEngine", "");
FF Homepage: user_pref("browser.startup.homepage", "");
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1205146.dll (Adobe Systems, Inc.)
FF Plugin-x32: @esn/esnlaunch,version=1.138.0 -> C:\Program Files (x86)\Battlelog Web Plugins\1.138.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=2.1.7 -> C:\Program Files (x86)\Battlelog Web Plugins\2.1.7\npesnlaunch.dll No File
FF Plugin-x32: @esn/npbattlelog,version=2.4.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.4.0\npbattlelog.dll (EA Digital Illusions CE AB)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\david\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\david\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Extension: Amazon-Icon - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\Extensions\amazon-icon@giga.de [2014-04-16]
FF Extension: Stylish - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\Extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8}.xpi [2012-10-08]
FF Extension: NoScript - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2012-10-07]
FF Extension: Adblock Plus - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-09-08]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-07-14]
FF HKLM\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird
FF Extension: ESET Smart Security Extension - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird [2014-08-14]
FF HKLM-x32\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird
FF HKCU\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff
FF Extension: Download videos and MP3s from YouTube - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-04-22]
FF Extension: No Name - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\extensions\battlefieldheroespatcher@ea.com [Not Found]
FF Extension: No Name - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\extensions\battlefieldplay4free@ea.com [Not Found]
FF Extension: No Name - C:\Program Files\AVAST Software\Avast\WebRep\FF [Not Found]
FF Extension: No Name - C:\Program Files (x86)\LyricsPal\125.xpi [Not Found]
FF Extension: No Name - C:\Program Files (x86)\FromDocToPDF_65\bar\1.bin [Not Found]
FF Extension: No Name - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\extensions\{2894a412-e091-6466-9ab8-ea76561654ca} [Not Found]

Chrome: 
=======
CHR HomePage: Default -> chrome://newtab
CHR Profile: C:\Users\david\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-03-20]
CHR Extension: (Google Drive) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-03-20]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-05]
CHR Extension: (YouTube) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-03-20]
CHR Extension: (Google-Suche) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-03-20]
CHR Extension: (Stylish) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\fjnbnpbmkenffdnngjfgmeleoegfcffe [2013-07-03]
CHR Extension: (AdBlock) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2013-07-03]
CHR Extension: (Skype Click to Call) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2014-07-20]
CHR Extension: (Google Wallet) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-22]
CHR Extension: (Battlefield Play4Free) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\oiokahphinmbmakkehgelkmpolmnbkdh [2014-04-06]
CHR Extension: (Google Mail) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-03-20]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [448384 2014-08-04] ()
S3 BRSptSvc; C:\ProgramData\BitRaider\BRSptSvc.exe [477960 2014-04-11] (BitRaider, LLC)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
R2 ekrn; C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe [1343408 2014-02-24] (ESET)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1149760 2014-09-17] (NVIDIA Corporation)
S3 npggsvc; C:\Windows\SysWOW64\GameMon.des [3191392 2014-05-15] (INCA Internet Co., Ltd.)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1796928 2014-09-17] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19440960 2014-09-17] (NVIDIA Corporation)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76152 2014-06-21] ()
S2 AviraUpgradeService; "C:\Windows\TEMP\AVSETUP_53f13fa6\avupgsvc.exe" /TEMPSTART:""C:\Windows\TEMP\AVSETUP_53f13fa6\setup.exe" /NOTEMPCLEANUP /CLEANUPSRCFILES"

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S4 aswSP; No ImagePath
S3 BRDriver64; C:\ProgramData\BitRaider\BRDriver64.sys [75048 2013-10-08] (BitRaider)
R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [168256 2013-09-17] (ESET)
R2 epfw; C:\Windows\System32\DRIVERS\epfw.sys [220232 2013-09-17] (ESET)
R1 EpfwLWF; C:\Windows\System32\DRIVERS\EpfwLWF.sys [44120 2013-09-17] (ESET)
R0 epfwwfp; C:\Windows\System32\DRIVERS\epfwwfp.sys [62136 2013-09-17] (ESET)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [20288 2014-09-17] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38048 2014-09-04] (NVIDIA Corporation)
S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [386680 2014-09-13] (Duplex Secure Ltd.)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]
S3 X6va008; \??\C:\Windows\SysWOW64\Drivers\X6va008 [X]
S3 X6va011; \??\C:\Windows\SysWOW64\Drivers\X6va011 [X]
S3 xhunter1; \??\C:\Windows\xhunter1.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-14 16:24 - 2014-10-14 16:24 - 00000000 ____D () C:\Users\david\Desktop\Neuer Ordner
2014-10-13 18:56 - 2014-10-13 18:56 - 00705224 _____ (ESET) C:\Windows\eins2666.dll
2014-10-13 18:51 - 2014-10-13 18:52 - 01660616 _____ (ESET) C:\Users\david\Downloads\eset_smart_security_live_installer (1).exe
2014-10-13 18:40 - 2014-10-13 18:40 - 00001034 _____ () C:\Users\david\Desktop\checkup.txt
2014-10-13 18:17 - 2014-10-13 18:17 - 00854417 _____ () C:\Users\david\Downloads\SecurityCheck.exe
2014-10-13 18:17 - 2014-10-13 18:17 - 00854417 _____ () C:\Users\david\Desktop\SecurityCheck.exe
2014-10-13 16:03 - 2014-10-13 16:03 - 02347384 _____ (ESET) C:\Users\david\Downloads\esetsmartinstaller_deu.exe
2014-10-13 13:28 - 2014-10-13 13:28 - 00001106 _____ () C:\Users\david\Desktop\dings.txt
2014-10-13 13:27 - 2014-10-13 13:27 - 00001106 _____ () C:\Users\david\Desktop\die sachen für die fixlist.txt
2014-10-12 16:13 - 2014-10-12 16:13 - 00000000 ____D () C:\Users\david\Desktop\FRST-OlderVersion
2014-10-12 16:12 - 2014-10-12 16:12 - 00002316 _____ () C:\Users\david\Desktop\JRT.txt
2014-10-12 16:08 - 2014-10-12 16:08 - 01705755 _____ (Thisisu) C:\Users\david\Downloads\JRT.exe
2014-10-12 16:08 - 2014-10-12 16:08 - 01705755 _____ (Thisisu) C:\Users\david\Desktop\JRT.exe
2014-10-12 16:08 - 2014-10-12 16:08 - 00000000 ____D () C:\Windows\ERUNT
2014-10-12 16:03 - 2014-10-12 16:03 - 00000000 _____ () C:\Users\david\Downloads\C6E7.tmp
2014-10-12 16:01 - 2014-10-12 16:01 - 01375089 _____ () C:\Users\david\Downloads\AdwCleaner_3.311.exe
2014-10-12 16:01 - 2014-10-12 16:01 - 01375089 _____ () C:\Users\david\Downloads\AdwCleaner_3.311 (1).exe
2014-10-12 15:59 - 2014-10-12 15:59 - 00004314 _____ () C:\Users\david\Desktop\mbam.txt
2014-10-12 15:56 - 2014-10-12 15:56 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\48230029.sys
2014-10-12 15:40 - 2014-10-12 15:56 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-10-12 15:40 - 2014-10-12 15:40 - 00001104 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-10-12 15:40 - 2014-10-12 15:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-10-12 15:40 - 2014-10-12 15:40 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-10-12 15:40 - 2014-10-12 15:40 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-10-12 15:40 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-10-12 15:40 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-10-12 15:40 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-10-12 15:39 - 2014-10-12 15:39 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\david\Downloads\mbam-setup-2.0.2.1012.exe
2014-10-12 12:20 - 2014-10-12 12:21 - 04965896 _____ (Piriform Ltd) C:\Users\david\Downloads\ccsetup418.exe
2014-10-12 12:19 - 2014-10-12 12:19 - 00003206 _____ () C:\Windows\System32\Tasks\{536105BA-DC87-4426-BF21-07E3D6160448}
2014-10-11 23:01 - 2014-10-11 23:01 - 01660616 _____ (ESET) C:\Users\david\Downloads\eset_smart_security_live_installer.exe
2014-10-11 22:54 - 2014-10-11 22:54 - 00033935 _____ () C:\ComboFix.txt
2014-10-11 20:04 - 2014-10-11 22:54 - 00000000 ____D () C:\Qoobox
2014-10-11 20:04 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-10-11 20:04 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-10-11 20:04 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-10-11 20:04 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-10-11 20:04 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-10-11 20:04 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-10-11 20:04 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-10-11 20:04 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-10-11 20:01 - 2014-10-11 22:53 - 00000000 ____D () C:\Windows\erdnt
2014-10-11 20:00 - 2014-10-11 20:00 - 05582481 ____R (Swearware) C:\Users\david\Downloads\ComboFix.exe
2014-10-11 20:00 - 2014-10-11 20:00 - 05582481 ____R (Swearware) C:\Users\david\Desktop\ComboFix.exe
2014-10-11 19:10 - 2014-10-11 19:10 - 00000740 _____ () C:\Users\david\Desktop\Revo Uninstaller.lnk
2014-10-11 19:09 - 2014-10-11 19:09 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\david\Downloads\revosetup95.exe
2014-10-10 21:18 - 2014-10-10 21:18 - 00000000 ____D () C:\Windows\pss
2014-10-10 20:59 - 2014-10-10 21:00 - 00047985 _____ () C:\Users\david\Desktop\Addition.txt
2014-10-10 20:56 - 2014-10-14 16:23 - 00020861 _____ () C:\Users\david\Desktop\FRST.txt
2014-10-10 20:56 - 2014-10-14 16:23 - 00000000 ____D () C:\FRST
2014-10-10 20:55 - 2014-10-12 16:13 - 02110464 _____ (Farbar) C:\Users\david\Desktop\FRST64.exe
2014-10-10 20:55 - 2014-10-10 20:55 - 02109952 _____ (Farbar) C:\Users\david\Downloads\FRST64.exe
2014-10-10 19:12 - 2014-10-10 19:13 - 00000000 ____D () C:\Users\david\AppData\Roaming\SpaceEngineers
2014-10-06 21:21 - 2014-10-06 22:00 - 764194469 _____ ( ) C:\Users\david\Downloads\Call_of_Pripyat_Complete_v1.0.2_Setup.exe
2014-10-03 10:50 - 2014-10-03 10:50 - 00000000 ____D () C:\Users\david\Documents\Paradox Interactive
2014-09-29 20:45 - 2014-09-29 20:45 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies
2014-09-29 20:43 - 2014-09-13 22:13 - 00613696 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
2014-09-29 20:33 - 2014-09-17 06:51 - 01538880 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdagenco6420103.dll
2014-09-29 20:33 - 2014-09-17 06:51 - 00197408 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda64v.sys
2014-09-29 20:33 - 2014-09-17 06:51 - 00031520 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 31887680 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 24552592 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 20922512 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 19954520 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 18106152 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 17259664 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 14026304 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 13939272 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 13157696 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2014-09-29 20:33 - 2014-09-14 01:48 - 11392576 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 11330776 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 04287296 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 04008592 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 01876296 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434411.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 01539272 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434411.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 00957584 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 00925896 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 00919240 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 00894096 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 00867528 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 00352016 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 00303600 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 00174856 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 00156840 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 00026956 _____ () C:\Windows\system32\nvinfo.pb
2014-09-29 18:41 - 2014-09-29 18:41 - 00000000 ____D () C:\NVIDIA
2014-09-29 18:34 - 2014-09-17 04:10 - 01715224 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll
2014-09-29 18:34 - 2014-09-17 04:10 - 01291280 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll
2014-09-29 18:32 - 2014-09-04 21:14 - 00038048 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2014-09-29 18:32 - 2014-09-04 21:14 - 00032416 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2014-09-29 18:29 - 2014-09-29 18:32 - 319671744 _____ (NVIDIA Corporation) C:\Users\david\Downloads\344.11-desktop-win8-win7-winvista-64bit-international-whql.exe
2014-09-29 01:11 - 2014-09-29 01:11 - 06626832 _____ (TeamViewer GmbH) C:\Users\david\Downloads\TeamViewer_Setup_de.exe
2014-09-25 01:04 - 2014-09-25 01:04 - 00342430 _____ () C:\Users\david\Downloads\lolhentai-1.6.3.sdt
2014-09-20 19:59 - 2014-09-20 19:59 - 00002466 _____ () C:\Users\VERSUCH\Desktop\SWAT 4 Single Player Demo.lnk
2014-09-20 19:59 - 2014-09-20 19:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VUGames
2014-09-20 19:51 - 2014-09-20 19:51 - 00367432 _____ () C:\Users\david\Downloads\SoftonicDownloader_for_s-w-a-t-4.exe
2014-09-16 20:14 - 2014-05-14 18:23 - 02477536 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-09-16 20:14 - 2014-05-14 18:23 - 00058336 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-09-16 20:14 - 2014-05-14 18:23 - 00044512 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-09-16 20:14 - 2014-05-14 18:21 - 02620928 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-09-16 20:13 - 2014-05-14 18:23 - 00700384 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-09-16 20:13 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2014-09-16 20:13 - 2014-05-14 18:23 - 00038880 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-09-16 20:13 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2014-09-16 20:13 - 2014-05-14 18:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-09-16 20:13 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2014-09-16 20:13 - 2014-05-14 09:23 - 00198600 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-09-16 20:13 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2014-09-16 20:13 - 2014-05-14 09:20 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-09-16 20:13 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2014-09-15 17:16 - 2014-09-15 17:16 - 00000000 ____D () C:\Users\david\AppData\Local\Skyrim
2014-09-15 14:02 - 2014-09-15 14:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-14 16:19 - 2013-07-03 15:26 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-10-14 16:14 - 2012-06-23 16:32 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-10-14 16:09 - 2012-06-23 16:19 - 00000000 ____D () C:\Users\david\AppData\Roaming\Skype
2014-10-14 15:57 - 2013-07-01 13:47 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-10-14 15:48 - 2013-05-21 18:36 - 00003440 _____ () C:\Windows\System32\Tasks\PCDEventLauncherTask
2014-10-14 15:38 - 2012-11-01 17:03 - 00003930 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{963751FF-E6A0-461A-9D15-630985D8D304}
2014-10-14 15:25 - 2012-06-24 18:15 - 00001138 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-243866017-1107141967-568923311-1001UA.job
2014-10-14 15:16 - 2009-07-14 06:45 - 00021072 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-14 15:16 - 2009-07-14 06:45 - 00021072 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-14 15:14 - 2014-01-02 12:25 - 01505120 _____ () C:\Windows\WindowsUpdate.log
2014-10-14 15:12 - 2012-06-30 11:37 - 00000000 ____D () C:\Users\david\AppData\Local\Adobe
2014-10-14 15:08 - 2013-07-03 15:26 - 00001108 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-10-14 15:07 - 2014-01-01 20:14 - 00033243 _____ () C:\Windows\setupact.log
2014-10-14 15:06 - 2014-01-07 16:07 - 00954286 _____ () C:\Windows\PFRO.log
2014-10-14 15:06 - 2012-01-27 09:33 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-10-14 15:06 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-10-14 05:45 - 2013-06-02 22:16 - 00000000 ____D () C:\Users\david\AppData\Roaming\Spotify
2014-10-14 01:33 - 2012-06-23 16:41 - 00000000 ____D () C:\Users\david\AppData\Roaming\TS3Client
2014-10-14 00:25 - 2012-06-24 18:15 - 00001116 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-243866017-1107141967-568923311-1001Core.job
2014-10-13 21:01 - 2013-06-24 22:20 - 00000000 ____D () C:\Users\david\AppData\Local\Spotify
2014-10-12 16:28 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-10-12 16:03 - 2013-11-23 13:09 - 00000000 ____D () C:\AdwCleaner
2014-10-12 12:48 - 2012-09-09 17:58 - 00000000 ____D () C:\Users\david\AppData\Local\Apps\2.0
2014-10-12 12:24 - 2012-06-27 19:00 - 00000784 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-10-12 12:24 - 2012-06-27 19:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2014-10-12 12:24 - 2012-06-27 19:00 - 00000000 ____D () C:\Program Files\CCleaner
2014-10-11 22:54 - 2009-07-14 05:20 - 00000000 ____D () C:\Users\Default
2014-10-11 22:48 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-10-10 21:20 - 2013-03-23 18:55 - 00000000 ____D () C:\Users\david\AppData\Local\CrashDumps
2014-10-10 19:55 - 2014-09-08 20:25 - 00000000 ____D () C:\Users\david\Desktop\Cracks
2014-10-09 21:07 - 2012-06-23 16:25 - 00000000 ____D () C:\ProgramData\Origin
2014-10-09 21:06 - 2014-08-27 23:16 - 00000000 ____D () C:\Program Files (x86)\Origin
2014-10-05 13:11 - 2014-08-11 02:34 - 00000000 ____D () C:\Users\david\Documents\BattleIslands
2014-10-04 22:03 - 2012-06-23 16:32 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-10-04 22:03 - 2012-06-23 16:32 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-10-04 22:03 - 2012-01-27 10:40 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-10-04 15:49 - 2014-01-06 03:51 - 00661582 _____ () C:\Windows\DirectX.log
2014-09-29 20:49 - 2013-09-17 19:46 - 00001349 _____ () C:\Users\Public\Desktop\GeForce Experience.lnk
2014-09-29 20:45 - 2012-06-23 20:58 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation
2014-09-29 20:44 - 2013-09-17 19:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2014-09-29 20:38 - 2012-01-27 09:33 - 00000000 ____D () C:\Program Files\NVIDIA Corporation
2014-09-29 18:38 - 2013-12-21 19:21 - 00000000 ____D () C:\Users\david\AppData\Local\NVIDIA Corporation
2014-09-29 18:34 - 2012-01-27 09:33 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation
2014-09-29 13:14 - 2012-01-27 11:20 - 00000000 ____D () C:\ProgramData\Sonic
2014-09-29 01:12 - 2012-07-18 17:29 - 00000000 ____D () C:\Users\david\AppData\Roaming\TeamViewer
2014-09-28 20:48 - 2012-10-03 16:54 - 00007599 _____ () C:\Users\david\AppData\Local\Resmon.ResmonCfg
2014-09-20 20:23 - 2012-01-27 10:58 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-09-19 05:52 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-09-18 15:15 - 2013-03-02 00:27 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-09-17 04:10 - 2013-12-21 18:53 - 02799784 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll
2014-09-17 04:10 - 2013-12-21 18:53 - 02193560 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll
2014-09-16 20:19 - 2012-06-24 09:00 - 00000000 ____D () C:\ProgramData\PCDr
2014-09-15 17:14 - 2012-06-29 13:21 - 00000000 ____D () C:\Users\david\Documents\My Games
2014-09-15 14:02 - 2014-08-26 05:17 - 00002517 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-09-15 14:02 - 2012-06-23 16:19 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-09-15 14:02 - 2012-01-27 11:00 - 00000000 ____D () C:\ProgramData\Skype
2014-09-14 01:48 - 2013-03-17 21:13 - 20589536 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
2014-09-14 01:48 - 2012-06-23 20:58 - 00984424 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll
2014-09-14 01:48 - 2012-01-27 18:13 - 16875856 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll
2014-09-14 01:48 - 2012-01-27 18:13 - 03223120 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll
2014-09-14 01:48 - 2012-01-27 18:13 - 02838424 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll

ZeroAccess:
C:\Windows\Installer\{1547a4df-a060-bca0-5da2-aff15ee51e9d}
C:\Windows\Installer\{1547a4df-a060-bca0-5da2-aff15ee51e9d}\@

ZeroAccess:
C:\Users\david\AppData\Local\{1547a4df-a060-bca0-5da2-aff15ee51e9d}
C:\Users\david\AppData\Local\{1547a4df-a060-bca0-5da2-aff15ee51e9d}\@

Some content of TEMP:
====================
C:\Users\david\AppData\Local\Temp\InstHelper.exe
C:\Users\david\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-09-19 05:45

==================== End Of Log ============================
         

--- --- ---

--- --- ---


FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-10-2014
Ran by david (administrator) on DAVID-PC on 14-10-2014 16:23:37
Running from C:\Users\david\Desktop
Loaded Profile: david (Available profiles: david & VERSUCH)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\egui.exe
(Spotify Ltd) C:\Users\david\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Nico Mak Computing) C:\Program Files\File Association Helper\FAHWindow.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
() C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\CEPServiceManager4\CEPServiceManager.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
() C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\HEX\Adobe CEF Helper.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\HEX\Adobe CEF Helper.exe
(PC-Doctor, Inc.) C:\Program Files\My Dell\imstrayicon.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [DellStage] => C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe [2195824 2012-02-01] ()
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [472984 2013-06-03] (Adobe Systems Incorporated)
HKLM\...\Run: [Nvtmru] => "C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe"
HKLM\...\Run: [egui] => C:\Program Files\ESET\ESET Smart Security\egui.exe [5581888 2014-02-24] (ESET)
HKLM\...\Run: [FAHConsole] => C:\Program Files\File Association Helper\FAHConsole.exe [729272 2014-01-28] (Nico Mak Computing)
HKLM-x32\...\Run: [Dell Registration] => C:\Program Files (x86)\System Registration\prodreg.exe [4165440 2011-08-04] (Dell, Inc.)
HKLM-x32\...\Run: [RoxWatchTray] => C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe [240112 2010-11-25] (Sonic Solutions)
HKLM-x32\...\Run: [AccuWeatherWidget] => C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe [968048 2012-02-01] ()
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe Creative Cloud] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2236816 2013-07-12] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59240 2011-09-27] (Apple Inc.)
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [Spotify Web Helper] => C:\Users\david\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1514040 2014-10-03] (Spotify Ltd)
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [1938112 2014-09-23] (Valve Corporation)
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [AgolBemet] => regsvr32.exe "C:\ProgramData\AgolBemet\AgolBemet.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [AdneWbiql] => regsvr32.exe "C:\ProgramData\AdneWbiql\AdneWbiql.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [IqikWuge] => regsvr32.exe "C:\ProgramData\IqikWuge\IqikWuge.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OfuxDurov] => regsvr32.exe "C:\ProgramData\OfuxDurov\OfuxDurov.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [EbanOcaha] => regsvr32.exe "C:\ProgramData\EbanOcaha\EbanOcaha.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OpohEluda] => regsvr32.exe "C:\ProgramData\OpohEluda\OpohEluda.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OxereNazic] => regsvr32.exe "C:\ProgramData\OxereNazic\OxereNazic.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OlafcEhitu] => regsvr32.exe "C:\ProgramData\OlafcEhitu\OlafcEhitu.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [EdvapYexhu] => regsvr32.exe "C:\ProgramData\EdvapYexhu\EdvapYexhu.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [UkjaFtoq] => regsvr32.exe "C:\ProgramData\UkjaFtoq\UkjaFtoq.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [UkvoJojow] => regsvr32.exe "C:\ProgramData\UkvoJojow\UkvoJojow.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [ApmeJxel] => regsvr32.exe "C:\ProgramData\ApmeJxel\ApmeJxel.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OfqiTaxo] => regsvr32.exe "C:\ProgramData\OfqiTaxo\OfqiTaxo.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [AkoyaVgogi] => regsvr32.exe "C:\ProgramData\AkoyaVgogi\AkoyaVgogi.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [AkmupUguge] => regsvr32.exe "C:\ProgramData\AkmupUguge\AkmupUguge.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [AmqiqPizet] => regsvr32.exe "C:\ProgramData\AmqiqPizet\AmqiqPizet.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OcniNtih] => regsvr32.exe "C:\ProgramData\OcniNtih\OcniNtih.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OnibErof] => regsvr32.exe "C:\ProgramData\OnibErof\OnibErof.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [UzeneKjojf] => regsvr32.exe "C:\ProgramData\UzeneKjojf\UzeneKjojf.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [IdobvItazx] => regsvr32.exe "C:\ProgramData\IdobvItazx\IdobvItazx.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [UlhuGisc] => regsvr32.exe "C:\ProgramData\UlhuGisc\UlhuGisc.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [22041192 2014-08-27] (Skype Technologies S.A.)
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [6482200 2014-09-26] (Piriform Ltd)
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Policies\Explorer: [Run] "C:\Users\david\AppData\Roaming\Microsoft\Windows\IEUpdate\hh.exe"
HKU\S-1-5-18\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [22041192 2014-08-27] (Skype Technologies S.A.)
ShellIconOverlayIdentifiers: [ AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_v_1_1_0_x64.dll ()
ShellIconOverlayIdentifiers: [ AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_v_1_1_0_x64.dll ()
ShellIconOverlayIdentifiers: [ AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_v_1_1_0_x64.dll ()
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File
BootExecute: autocheck autochk * aswBoot.exe /M:c2da9b9a2a /wow /dir:C:\Program

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - No Name - !{1BB22D38-A411-4B13-A746-C2A4F4EC7344} -  No File
Toolbar: HKLM - No Name - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  No File
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  No File
Toolbar: HKLM-x32 - No Name - !{1BB22D38-A411-4B13-A746-C2A4F4EC7344} -  No File
Toolbar: HKLM-x32 - No Name - !{5018CFD2-804D-4C99-9F81-25EAEA2769DE} -  No File
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default
FF NewTab: user_pref("browser.newtab.url", "");
FF DefaultSearchEngine: Google
FF SearchEngineOrder.1: Google
FF SelectedSearchEngine: user_pref("browser.search.selectedEngine", "");
FF Homepage: user_pref("browser.startup.homepage", "");
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1205146.dll (Adobe Systems, Inc.)
FF Plugin-x32: @esn/esnlaunch,version=1.138.0 -> C:\Program Files (x86)\Battlelog Web Plugins\1.138.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=2.1.7 -> C:\Program Files (x86)\Battlelog Web Plugins\2.1.7\npesnlaunch.dll No File
FF Plugin-x32: @esn/npbattlelog,version=2.4.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.4.0\npbattlelog.dll (EA Digital Illusions CE AB)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\david\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\david\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Extension: Amazon-Icon - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\Extensions\amazon-icon@giga.de [2014-04-16]
FF Extension: Stylish - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\Extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8}.xpi [2012-10-08]
FF Extension: NoScript - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2012-10-07]
FF Extension: Adblock Plus - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-09-08]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-07-14]
FF HKLM\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird
FF Extension: ESET Smart Security Extension - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird [2014-08-14]
FF HKLM-x32\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird
FF HKCU\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff
FF Extension: Download videos and MP3s from YouTube - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-04-22]
FF Extension: No Name - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\extensions\battlefieldheroespatcher@ea.com [Not Found]
FF Extension: No Name - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\extensions\battlefieldplay4free@ea.com [Not Found]
FF Extension: No Name - C:\Program Files\AVAST Software\Avast\WebRep\FF [Not Found]
FF Extension: No Name - C:\Program Files (x86)\LyricsPal\125.xpi [Not Found]
FF Extension: No Name - C:\Program Files (x86)\FromDocToPDF_65\bar\1.bin [Not Found]
FF Extension: No Name - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\extensions\{2894a412-e091-6466-9ab8-ea76561654ca} [Not Found]

Chrome: 
=======
CHR HomePage: Default -> chrome://newtab
CHR Profile: C:\Users\david\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-03-20]
CHR Extension: (Google Drive) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-03-20]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-05]
CHR Extension: (YouTube) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-03-20]
CHR Extension: (Google-Suche) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-03-20]
CHR Extension: (Stylish) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\fjnbnpbmkenffdnngjfgmeleoegfcffe [2013-07-03]
CHR Extension: (AdBlock) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2013-07-03]
CHR Extension: (Skype Click to Call) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2014-07-20]
CHR Extension: (Google Wallet) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-22]
CHR Extension: (Battlefield Play4Free) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\oiokahphinmbmakkehgelkmpolmnbkdh [2014-04-06]
CHR Extension: (Google Mail) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-03-20]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [448384 2014-08-04] ()
S3 BRSptSvc; C:\ProgramData\BitRaider\BRSptSvc.exe [477960 2014-04-11] (BitRaider, LLC)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
R2 ekrn; C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe [1343408 2014-02-24] (ESET)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1149760 2014-09-17] (NVIDIA Corporation)
S3 npggsvc; C:\Windows\SysWOW64\GameMon.des [3191392 2014-05-15] (INCA Internet Co., Ltd.)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1796928 2014-09-17] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19440960 2014-09-17] (NVIDIA Corporation)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76152 2014-06-21] ()
S2 AviraUpgradeService; "C:\Windows\TEMP\AVSETUP_53f13fa6\avupgsvc.exe" /TEMPSTART:""C:\Windows\TEMP\AVSETUP_53f13fa6\setup.exe" /NOTEMPCLEANUP /CLEANUPSRCFILES"

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S4 aswSP; No ImagePath
S3 BRDriver64; C:\ProgramData\BitRaider\BRDriver64.sys [75048 2013-10-08] (BitRaider)
R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [168256 2013-09-17] (ESET)
R2 epfw; C:\Windows\System32\DRIVERS\epfw.sys [220232 2013-09-17] (ESET)
R1 EpfwLWF; C:\Windows\System32\DRIVERS\EpfwLWF.sys [44120 2013-09-17] (ESET)
R0 epfwwfp; C:\Windows\System32\DRIVERS\epfwwfp.sys [62136 2013-09-17] (ESET)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [20288 2014-09-17] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38048 2014-09-04] (NVIDIA Corporation)
S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [386680 2014-09-13] (Duplex Secure Ltd.)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]
S3 X6va008; \??\C:\Windows\SysWOW64\Drivers\X6va008 [X]
S3 X6va011; \??\C:\Windows\SysWOW64\Drivers\X6va011 [X]
S3 xhunter1; \??\C:\Windows\xhunter1.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-14 16:24 - 2014-10-14 16:24 - 00000000 ____D () C:\Users\david\Desktop\Neuer Ordner
2014-10-13 18:56 - 2014-10-13 18:56 - 00705224 _____ (ESET) C:\Windows\eins2666.dll
2014-10-13 18:51 - 2014-10-13 18:52 - 01660616 _____ (ESET) C:\Users\david\Downloads\eset_smart_security_live_installer (1).exe
2014-10-13 18:40 - 2014-10-13 18:40 - 00001034 _____ () C:\Users\david\Desktop\checkup.txt
2014-10-13 18:17 - 2014-10-13 18:17 - 00854417 _____ () C:\Users\david\Downloads\SecurityCheck.exe
2014-10-13 18:17 - 2014-10-13 18:17 - 00854417 _____ () C:\Users\david\Desktop\SecurityCheck.exe
2014-10-13 16:03 - 2014-10-13 16:03 - 02347384 _____ (ESET) C:\Users\david\Downloads\esetsmartinstaller_deu.exe
2014-10-13 13:28 - 2014-10-13 13:28 - 00001106 _____ () C:\Users\david\Desktop\dings.txt
2014-10-13 13:27 - 2014-10-13 13:27 - 00001106 _____ () C:\Users\david\Desktop\die sachen für die fixlist.txt
2014-10-12 16:13 - 2014-10-12 16:13 - 00000000 ____D () C:\Users\david\Desktop\FRST-OlderVersion
2014-10-12 16:12 - 2014-10-12 16:12 - 00002316 _____ () C:\Users\david\Desktop\JRT.txt
2014-10-12 16:08 - 2014-10-12 16:08 - 01705755 _____ (Thisisu) C:\Users\david\Downloads\JRT.exe
2014-10-12 16:08 - 2014-10-12 16:08 - 01705755 _____ (Thisisu) C:\Users\david\Desktop\JRT.exe
2014-10-12 16:08 - 2014-10-12 16:08 - 00000000 ____D () C:\Windows\ERUNT
2014-10-12 16:03 - 2014-10-12 16:03 - 00000000 _____ () C:\Users\david\Downloads\C6E7.tmp
2014-10-12 16:01 - 2014-10-12 16:01 - 01375089 _____ () C:\Users\david\Downloads\AdwCleaner_3.311.exe
2014-10-12 16:01 - 2014-10-12 16:01 - 01375089 _____ () C:\Users\david\Downloads\AdwCleaner_3.311 (1).exe
2014-10-12 15:59 - 2014-10-12 15:59 - 00004314 _____ () C:\Users\david\Desktop\mbam.txt
2014-10-12 15:56 - 2014-10-12 15:56 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\48230029.sys
2014-10-12 15:40 - 2014-10-12 15:56 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-10-12 15:40 - 2014-10-12 15:40 - 00001104 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-10-12 15:40 - 2014-10-12 15:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-10-12 15:40 - 2014-10-12 15:40 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-10-12 15:40 - 2014-10-12 15:40 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-10-12 15:40 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-10-12 15:40 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-10-12 15:40 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-10-12 15:39 - 2014-10-12 15:39 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\david\Downloads\mbam-setup-2.0.2.1012.exe
2014-10-12 12:20 - 2014-10-12 12:21 - 04965896 _____ (Piriform Ltd) C:\Users\david\Downloads\ccsetup418.exe
2014-10-12 12:19 - 2014-10-12 12:19 - 00003206 _____ () C:\Windows\System32\Tasks\{536105BA-DC87-4426-BF21-07E3D6160448}
2014-10-11 23:01 - 2014-10-11 23:01 - 01660616 _____ (ESET) C:\Users\david\Downloads\eset_smart_security_live_installer.exe
2014-10-11 22:54 - 2014-10-11 22:54 - 00033935 _____ () C:\ComboFix.txt
2014-10-11 20:04 - 2014-10-11 22:54 - 00000000 ____D () C:\Qoobox
2014-10-11 20:04 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-10-11 20:04 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-10-11 20:04 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-10-11 20:04 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-10-11 20:04 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-10-11 20:04 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-10-11 20:04 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-10-11 20:04 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-10-11 20:01 - 2014-10-11 22:53 - 00000000 ____D () C:\Windows\erdnt
2014-10-11 20:00 - 2014-10-11 20:00 - 05582481 ____R (Swearware) C:\Users\david\Downloads\ComboFix.exe
2014-10-11 20:00 - 2014-10-11 20:00 - 05582481 ____R (Swearware) C:\Users\david\Desktop\ComboFix.exe
2014-10-11 19:10 - 2014-10-11 19:10 - 00000740 _____ () C:\Users\david\Desktop\Revo Uninstaller.lnk
2014-10-11 19:09 - 2014-10-11 19:09 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\david\Downloads\revosetup95.exe
2014-10-10 21:18 - 2014-10-10 21:18 - 00000000 ____D () C:\Windows\pss
2014-10-10 20:59 - 2014-10-10 21:00 - 00047985 _____ () C:\Users\david\Desktop\Addition.txt
2014-10-10 20:56 - 2014-10-14 16:23 - 00020861 _____ () C:\Users\david\Desktop\FRST.txt
2014-10-10 20:56 - 2014-10-14 16:23 - 00000000 ____D () C:\FRST
2014-10-10 20:55 - 2014-10-12 16:13 - 02110464 _____ (Farbar) C:\Users\david\Desktop\FRST64.exe
2014-10-10 20:55 - 2014-10-10 20:55 - 02109952 _____ (Farbar) C:\Users\david\Downloads\FRST64.exe
2014-10-10 19:12 - 2014-10-10 19:13 - 00000000 ____D () C:\Users\david\AppData\Roaming\SpaceEngineers
2014-10-06 21:21 - 2014-10-06 22:00 - 764194469 _____ ( ) C:\Users\david\Downloads\Call_of_Pripyat_Complete_v1.0.2_Setup.exe
2014-10-03 10:50 - 2014-10-03 10:50 - 00000000 ____D () C:\Users\david\Documents\Paradox Interactive
2014-09-29 20:45 - 2014-09-29 20:45 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies
2014-09-29 20:43 - 2014-09-13 22:13 - 00613696 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
2014-09-29 20:33 - 2014-09-17 06:51 - 01538880 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdagenco6420103.dll
2014-09-29 20:33 - 2014-09-17 06:51 - 00197408 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda64v.sys
2014-09-29 20:33 - 2014-09-17 06:51 - 00031520 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 31887680 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 24552592 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 20922512 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 19954520 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 18106152 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 17259664 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 14026304 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 13939272 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 13157696 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2014-09-29 20:33 - 2014-09-14 01:48 - 11392576 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 11330776 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 04287296 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 04008592 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 01876296 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434411.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 01539272 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434411.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 00957584 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 00925896 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 00919240 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 00894096 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 00867528 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 00352016 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 00303600 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 00174856 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 00156840 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 00026956 _____ () C:\Windows\system32\nvinfo.pb
2014-09-29 18:41 - 2014-09-29 18:41 - 00000000 ____D () C:\NVIDIA
2014-09-29 18:34 - 2014-09-17 04:10 - 01715224 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll
2014-09-29 18:34 - 2014-09-17 04:10 - 01291280 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll
2014-09-29 18:32 - 2014-09-04 21:14 - 00038048 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2014-09-29 18:32 - 2014-09-04 21:14 - 00032416 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2014-09-29 18:29 - 2014-09-29 18:32 - 319671744 _____ (NVIDIA Corporation) C:\Users\david\Downloads\344.11-desktop-win8-win7-winvista-64bit-international-whql.exe
2014-09-29 01:11 - 2014-09-29 01:11 - 06626832 _____ (TeamViewer GmbH) C:\Users\david\Downloads\TeamViewer_Setup_de.exe
2014-09-25 01:04 - 2014-09-25 01:04 - 00342430 _____ () C:\Users\david\Downloads\lolhentai-1.6.3.sdt
2014-09-20 19:59 - 2014-09-20 19:59 - 00002466 _____ () C:\Users\VERSUCH\Desktop\SWAT 4 Single Player Demo.lnk
2014-09-20 19:59 - 2014-09-20 19:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VUGames
2014-09-20 19:51 - 2014-09-20 19:51 - 00367432 _____ () C:\Users\david\Downloads\SoftonicDownloader_for_s-w-a-t-4.exe
2014-09-16 20:14 - 2014-05-14 18:23 - 02477536 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-09-16 20:14 - 2014-05-14 18:23 - 00058336 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-09-16 20:14 - 2014-05-14 18:23 - 00044512 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-09-16 20:14 - 2014-05-14 18:21 - 02620928 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-09-16 20:13 - 2014-05-14 18:23 - 00700384 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-09-16 20:13 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2014-09-16 20:13 - 2014-05-14 18:23 - 00038880 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-09-16 20:13 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2014-09-16 20:13 - 2014-05-14 18:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-09-16 20:13 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2014-09-16 20:13 - 2014-05-14 09:23 - 00198600 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-09-16 20:13 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2014-09-16 20:13 - 2014-05-14 09:20 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-09-16 20:13 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2014-09-15 17:16 - 2014-09-15 17:16 - 00000000 ____D () C:\Users\david\AppData\Local\Skyrim
2014-09-15 14:02 - 2014-09-15 14:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-14 16:19 - 2013-07-03 15:26 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-10-14 16:14 - 2012-06-23 16:32 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-10-14 16:09 - 2012-06-23 16:19 - 00000000 ____D () C:\Users\david\AppData\Roaming\Skype
2014-10-14 15:57 - 2013-07-01 13:47 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-10-14 15:48 - 2013-05-21 18:36 - 00003440 _____ () C:\Windows\System32\Tasks\PCDEventLauncherTask
2014-10-14 15:38 - 2012-11-01 17:03 - 00003930 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{963751FF-E6A0-461A-9D15-630985D8D304}
2014-10-14 15:25 - 2012-06-24 18:15 - 00001138 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-243866017-1107141967-568923311-1001UA.job
2014-10-14 15:16 - 2009-07-14 06:45 - 00021072 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-14 15:16 - 2009-07-14 06:45 - 00021072 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-14 15:14 - 2014-01-02 12:25 - 01505120 _____ () C:\Windows\WindowsUpdate.log
2014-10-14 15:12 - 2012-06-30 11:37 - 00000000 ____D () C:\Users\david\AppData\Local\Adobe
2014-10-14 15:08 - 2013-07-03 15:26 - 00001108 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-10-14 15:07 - 2014-01-01 20:14 - 00033243 _____ () C:\Windows\setupact.log
2014-10-14 15:06 - 2014-01-07 16:07 - 00954286 _____ () C:\Windows\PFRO.log
2014-10-14 15:06 - 2012-01-27 09:33 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-10-14 15:06 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-10-14 05:45 - 2013-06-02 22:16 - 00000000 ____D () C:\Users\david\AppData\Roaming\Spotify
2014-10-14 01:33 - 2012-06-23 16:41 - 00000000 ____D () C:\Users\david\AppData\Roaming\TS3Client
2014-10-14 00:25 - 2012-06-24 18:15 - 00001116 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-243866017-1107141967-568923311-1001Core.job
2014-10-13 21:01 - 2013-06-24 22:20 - 00000000 ____D () C:\Users\david\AppData\Local\Spotify
2014-10-12 16:28 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-10-12 16:03 - 2013-11-23 13:09 - 00000000 ____D () C:\AdwCleaner
2014-10-12 12:48 - 2012-09-09 17:58 - 00000000 ____D () C:\Users\david\AppData\Local\Apps\2.0
2014-10-12 12:24 - 2012-06-27 19:00 - 00000784 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-10-12 12:24 - 2012-06-27 19:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2014-10-12 12:24 - 2012-06-27 19:00 - 00000000 ____D () C:\Program Files\CCleaner
2014-10-11 22:54 - 2009-07-14 05:20 - 00000000 ____D () C:\Users\Default
2014-10-11 22:48 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-10-10 21:20 - 2013-03-23 18:55 - 00000000 ____D () C:\Users\david\AppData\Local\CrashDumps
2014-10-10 19:55 - 2014-09-08 20:25 - 00000000 ____D () C:\Users\david\Desktop\Cracks
2014-10-09 21:07 - 2012-06-23 16:25 - 00000000 ____D () C:\ProgramData\Origin
2014-10-09 21:06 - 2014-08-27 23:16 - 00000000 ____D () C:\Program Files (x86)\Origin
2014-10-05 13:11 - 2014-08-11 02:34 - 00000000 ____D () C:\Users\david\Documents\BattleIslands
2014-10-04 22:03 - 2012-06-23 16:32 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-10-04 22:03 - 2012-06-23 16:32 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-10-04 22:03 - 2012-01-27 10:40 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-10-04 15:49 - 2014-01-06 03:51 - 00661582 _____ () C:\Windows\DirectX.log
2014-09-29 20:49 - 2013-09-17 19:46 - 00001349 _____ () C:\Users\Public\Desktop\GeForce Experience.lnk
2014-09-29 20:45 - 2012-06-23 20:58 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation
2014-09-29 20:44 - 2013-09-17 19:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2014-09-29 20:38 - 2012-01-27 09:33 - 00000000 ____D () C:\Program Files\NVIDIA Corporation
2014-09-29 18:38 - 2013-12-21 19:21 - 00000000 ____D () C:\Users\david\AppData\Local\NVIDIA Corporation
2014-09-29 18:34 - 2012-01-27 09:33 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation
2014-09-29 13:14 - 2012-01-27 11:20 - 00000000 ____D () C:\ProgramData\Sonic
2014-09-29 01:12 - 2012-07-18 17:29 - 00000000 ____D () C:\Users\david\AppData\Roaming\TeamViewer
2014-09-28 20:48 - 2012-10-03 16:54 - 00007599 _____ () C:\Users\david\AppData\Local\Resmon.ResmonCfg
2014-09-20 20:23 - 2012-01-27 10:58 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-09-19 05:52 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-09-18 15:15 - 2013-03-02 00:27 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-09-17 04:10 - 2013-12-21 18:53 - 02799784 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll
2014-09-17 04:10 - 2013-12-21 18:53 - 02193560 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll
2014-09-16 20:19 - 2012-06-24 09:00 - 00000000 ____D () C:\ProgramData\PCDr
2014-09-15 17:14 - 2012-06-29 13:21 - 00000000 ____D () C:\Users\david\Documents\My Games
2014-09-15 14:02 - 2014-08-26 05:17 - 00002517 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-09-15 14:02 - 2012-06-23 16:19 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-09-15 14:02 - 2012-01-27 11:00 - 00000000 ____D () C:\ProgramData\Skype
2014-09-14 01:48 - 2013-03-17 21:13 - 20589536 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
2014-09-14 01:48 - 2012-06-23 20:58 - 00984424 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll
2014-09-14 01:48 - 2012-01-27 18:13 - 16875856 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll
2014-09-14 01:48 - 2012-01-27 18:13 - 03223120 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll
2014-09-14 01:48 - 2012-01-27 18:13 - 02838424 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll

ZeroAccess:
C:\Windows\Installer\{1547a4df-a060-bca0-5da2-aff15ee51e9d}
C:\Windows\Installer\{1547a4df-a060-bca0-5da2-aff15ee51e9d}\@

ZeroAccess:
C:\Users\david\AppData\Local\{1547a4df-a060-bca0-5da2-aff15ee51e9d}
C:\Users\david\AppData\Local\{1547a4df-a060-bca0-5da2-aff15ee51e9d}\@

Some content of TEMP:
====================
C:\Users\david\AppData\Local\Temp\InstHelper.exe
C:\Users\david\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-09-19 05:45

==================== End Of Log ============================
         

--- --- ---

--- --- ---

Java und Firefox updaten.

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

C:\Program Files (x86)\Uninstall Information
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [AgolBemet] => regsvr32.exe "C:\ProgramData\AgolBemet\AgolBemet.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [AdneWbiql] => regsvr32.exe "C:\ProgramData\AdneWbiql\AdneWbiql.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [IqikWuge] => regsvr32.exe "C:\ProgramData\IqikWuge\IqikWuge.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OfuxDurov] => regsvr32.exe "C:\ProgramData\OfuxDurov\OfuxDurov.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [EbanOcaha] => regsvr32.exe "C:\ProgramData\EbanOcaha\EbanOcaha.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OpohEluda] => regsvr32.exe "C:\ProgramData\OpohEluda\OpohEluda.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OxereNazic] => regsvr32.exe "C:\ProgramData\OxereNazic\OxereNazic.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OlafcEhitu] => regsvr32.exe "C:\ProgramData\OlafcEhitu\OlafcEhitu.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [EdvapYexhu] => regsvr32.exe "C:\ProgramData\EdvapYexhu\EdvapYexhu.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [UkjaFtoq] => regsvr32.exe "C:\ProgramData\UkjaFtoq\UkjaFtoq.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [UkvoJojow] => regsvr32.exe "C:\ProgramData\UkvoJojow\UkvoJojow.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [ApmeJxel] => regsvr32.exe "C:\ProgramData\ApmeJxel\ApmeJxel.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OfqiTaxo] => regsvr32.exe "C:\ProgramData\OfqiTaxo\OfqiTaxo.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [AkoyaVgogi] => regsvr32.exe "C:\ProgramData\AkoyaVgogi\AkoyaVgogi.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [AkmupUguge] => regsvr32.exe "C:\ProgramData\AkmupUguge\AkmupUguge.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [AmqiqPizet] => regsvr32.exe "C:\ProgramData\AmqiqPizet\AmqiqPizet.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OcniNtih] => regsvr32.exe "C:\ProgramData\OcniNtih\OcniNtih.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OnibErof] => regsvr32.exe "C:\ProgramData\OnibErof\OnibErof.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [UzeneKjojf] => regsvr32.exe "C:\ProgramData\UzeneKjojf\UzeneKjojf.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [IdobvItazx] => regsvr32.exe "C:\ProgramData\IdobvItazx\IdobvItazx.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [UlhuGisc] => regsvr32.exe "C:\ProgramData\UlhuGisc\UlhuGisc.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Policies\Explorer: [Run] "C:\Users\david\AppData\Roaming\Microsoft\Windows\IEUpdate\hh.exe"
BootExecute: autocheck autochk * aswBoot.exe /M:c2da9b9a2a /wow /dir:C:\Program
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]
S3 X6va008; \??\C:\Windows\SysWOW64\Drivers\X6va008 [X]
S3 X6va011; \??\C:\Windows\SysWOW64\Drivers\X6va011 [X]
S3 xhunter1; \??\C:\Windows\xhunter1.sys [X]
C:\Windows\Installer\{1547a4df-a060-bca0-5da2-aff15ee51e9d}
C:\Windows\Installer\{1547a4df-a060-bca0-5da2-aff15ee51e9d}\@
C:\Users\david\AppData\Local\{1547a4df-a060-bca0-5da2-aff15ee51e9d}
C:\Users\david\AppData\Local\{1547a4df-a060-bca0-5da2-aff15ee51e9d}\@
C:\ProgramData\AbewgOcluk
C:\ProgramData\AdneWbiql
C:\ProgramData\AgolBemet
C:\ProgramData\AkmupUguge
C:\ProgramData\AkoyaVgogi
C:\ProgramData\AmqiqPizet
C:\ProgramData\ApmeJxel
C:\ProgramData\EbanOcaha
C:\ProgramData\EdvapYexhu
C:\ProgramData\EzekoTahit
C:\ProgramData\InstallMate
C:\ProgramData\IqikWuge
C:\ProgramData\OcniNtih
C:\ProgramData\OdwewEzuce
C:\ProgramData\OfqiTaxo
C:\ProgramData\OfuxDurov
C:\ProgramData\OlafcEhitu
C:\ProgramData\OnibErof
C:\ProgramData\OpohEluda
C:\ProgramData\OxereNazic
C:\ProgramData\UgeceNezxo
C:\ProgramData\UkjaFtoq
C:\ProgramData\UkvoJojow
C:\ProgramData\UxzoqYoxuz
C:\ProgramData\UzeneKjojf
Emptytemp:
         

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

• Starte nun FRST erneut und klicke den Entfernen Button.
• Das Tool erstellt eine Fixlog.txt.
• Poste mir deren Inhalt.

Alle Passwörter und Zugänge ändern. Frisches FRST log bitte.

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 15-10-2014 02
Ran by david at 2014-10-16 01:09:09 Run:5
Running from C:\Users\david\Desktop
Loaded Profile: david (Available profiles: david & VERSUCH)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
C:\Program Files (x86)\Uninstall Information
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [AgolBemet] => regsvr32.exe "C:\ProgramData\AgolBemet\AgolBemet.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [AdneWbiql] => regsvr32.exe "C:\ProgramData\AdneWbiql\AdneWbiql.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [IqikWuge] => regsvr32.exe "C:\ProgramData\IqikWuge\IqikWuge.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OfuxDurov] => regsvr32.exe "C:\ProgramData\OfuxDurov\OfuxDurov.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [EbanOcaha] => regsvr32.exe "C:\ProgramData\EbanOcaha\EbanOcaha.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OpohEluda] => regsvr32.exe "C:\ProgramData\OpohEluda\OpohEluda.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OxereNazic] => regsvr32.exe "C:\ProgramData\OxereNazic\OxereNazic.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OlafcEhitu] => regsvr32.exe "C:\ProgramData\OlafcEhitu\OlafcEhitu.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [EdvapYexhu] => regsvr32.exe "C:\ProgramData\EdvapYexhu\EdvapYexhu.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [UkjaFtoq] => regsvr32.exe "C:\ProgramData\UkjaFtoq\UkjaFtoq.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [UkvoJojow] => regsvr32.exe "C:\ProgramData\UkvoJojow\UkvoJojow.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [ApmeJxel] => regsvr32.exe "C:\ProgramData\ApmeJxel\ApmeJxel.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OfqiTaxo] => regsvr32.exe "C:\ProgramData\OfqiTaxo\OfqiTaxo.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [AkoyaVgogi] => regsvr32.exe "C:\ProgramData\AkoyaVgogi\AkoyaVgogi.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [AkmupUguge] => regsvr32.exe "C:\ProgramData\AkmupUguge\AkmupUguge.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [AmqiqPizet] => regsvr32.exe "C:\ProgramData\AmqiqPizet\AmqiqPizet.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OcniNtih] => regsvr32.exe "C:\ProgramData\OcniNtih\OcniNtih.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OnibErof] => regsvr32.exe "C:\ProgramData\OnibErof\OnibErof.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [UzeneKjojf] => regsvr32.exe "C:\ProgramData\UzeneKjojf\UzeneKjojf.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [IdobvItazx] => regsvr32.exe "C:\ProgramData\IdobvItazx\IdobvItazx.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [UlhuGisc] => regsvr32.exe "C:\ProgramData\UlhuGisc\UlhuGisc.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Policies\Explorer: [Run] "C:\Users\david\AppData\Roaming\Microsoft\Windows\IEUpdate\hh.exe"
BootExecute: autocheck autochk * aswBoot.exe /M:c2da9b9a2a /wow /dir:C:\Program
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]
S3 X6va008; \??\C:\Windows\SysWOW64\Drivers\X6va008 [X]
S3 X6va011; \??\C:\Windows\SysWOW64\Drivers\X6va011 [X]
S3 xhunter1; \??\C:\Windows\xhunter1.sys [X]
C:\Windows\Installer\{1547a4df-a060-bca0-5da2-aff15ee51e9d}
C:\Windows\Installer\{1547a4df-a060-bca0-5da2-aff15ee51e9d}\@
C:\Users\david\AppData\Local\{1547a4df-a060-bca0-5da2-aff15ee51e9d}
C:\Users\david\AppData\Local\{1547a4df-a060-bca0-5da2-aff15ee51e9d}\@
C:\ProgramData\AbewgOcluk
C:\ProgramData\AdneWbiql
C:\ProgramData\AgolBemet
C:\ProgramData\AkmupUguge
C:\ProgramData\AkoyaVgogi
C:\ProgramData\AmqiqPizet
C:\ProgramData\ApmeJxel
C:\ProgramData\EbanOcaha
C:\ProgramData\EdvapYexhu
C:\ProgramData\EzekoTahit
C:\ProgramData\InstallMate
C:\ProgramData\IqikWuge
C:\ProgramData\OcniNtih
C:\ProgramData\OdwewEzuce
C:\ProgramData\OfqiTaxo
C:\ProgramData\OfuxDurov
C:\ProgramData\OlafcEhitu
C:\ProgramData\OnibErof
C:\ProgramData\OpohEluda
C:\ProgramData\OxereNazic
C:\ProgramData\UgeceNezxo
C:\ProgramData\UkjaFtoq
C:\ProgramData\UkvoJojow
C:\ProgramData\UxzoqYoxuz
C:\ProgramData\UzeneKjojf
Emptytemp:
*****************

C:\Program Files (x86)\Uninstall Information => Moved successfully.
HKU\S-1-5-21-243866017-1107141967-568923311-1001\Software\Microsoft\Windows\CurrentVersion\Run\\AgolBemet => value deleted successfully.
HKU\S-1-5-21-243866017-1107141967-568923311-1001\Software\Microsoft\Windows\CurrentVersion\Run\\AdneWbiql => value deleted successfully.
HKU\S-1-5-21-243866017-1107141967-568923311-1001\Software\Microsoft\Windows\CurrentVersion\Run\\IqikWuge => value deleted successfully.
HKU\S-1-5-21-243866017-1107141967-568923311-1001\Software\Microsoft\Windows\CurrentVersion\Run\\OfuxDurov => value deleted successfully.
HKU\S-1-5-21-243866017-1107141967-568923311-1001\Software\Microsoft\Windows\CurrentVersion\Run\\EbanOcaha => value deleted successfully.
HKU\S-1-5-21-243866017-1107141967-568923311-1001\Software\Microsoft\Windows\CurrentVersion\Run\\OpohEluda => value deleted successfully.
HKU\S-1-5-21-243866017-1107141967-568923311-1001\Software\Microsoft\Windows\CurrentVersion\Run\\OxereNazic => value deleted successfully.
HKU\S-1-5-21-243866017-1107141967-568923311-1001\Software\Microsoft\Windows\CurrentVersion\Run\\OlafcEhitu => value deleted successfully.
HKU\S-1-5-21-243866017-1107141967-568923311-1001\Software\Microsoft\Windows\CurrentVersion\Run\\EdvapYexhu => value deleted successfully.
HKU\S-1-5-21-243866017-1107141967-568923311-1001\Software\Microsoft\Windows\CurrentVersion\Run\\UkjaFtoq => value deleted successfully.
HKU\S-1-5-21-243866017-1107141967-568923311-1001\Software\Microsoft\Windows\CurrentVersion\Run\\UkvoJojow => value deleted successfully.
HKU\S-1-5-21-243866017-1107141967-568923311-1001\Software\Microsoft\Windows\CurrentVersion\Run\\ApmeJxel => value deleted successfully.
HKU\S-1-5-21-243866017-1107141967-568923311-1001\Software\Microsoft\Windows\CurrentVersion\Run\\OfqiTaxo => value deleted successfully.
HKU\S-1-5-21-243866017-1107141967-568923311-1001\Software\Microsoft\Windows\CurrentVersion\Run\\AkoyaVgogi => value deleted successfully.
HKU\S-1-5-21-243866017-1107141967-568923311-1001\Software\Microsoft\Windows\CurrentVersion\Run\\AkmupUguge => value deleted successfully.
HKU\S-1-5-21-243866017-1107141967-568923311-1001\Software\Microsoft\Windows\CurrentVersion\Run\\AmqiqPizet => value deleted successfully.
HKU\S-1-5-21-243866017-1107141967-568923311-1001\Software\Microsoft\Windows\CurrentVersion\Run\\OcniNtih => value deleted successfully.
HKU\S-1-5-21-243866017-1107141967-568923311-1001\Software\Microsoft\Windows\CurrentVersion\Run\\OnibErof => value deleted successfully.
HKU\S-1-5-21-243866017-1107141967-568923311-1001\Software\Microsoft\Windows\CurrentVersion\Run\\UzeneKjojf => value deleted successfully.
HKU\S-1-5-21-243866017-1107141967-568923311-1001\Software\Microsoft\Windows\CurrentVersion\Run\\IdobvItazx => value deleted successfully.
HKU\S-1-5-21-243866017-1107141967-568923311-1001\Software\Microsoft\Windows\CurrentVersion\Run\\UlhuGisc => value deleted successfully.
HKU\S-1-5-21-243866017-1107141967-568923311-1001\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\\Run => value deleted successfully.
HKLM\System\CurrentControlSet\Control\Session Manager\\BootExecute => Value was restored successfully.
esgiguard => Service deleted successfully.
X6va008 => Service deleted successfully.
X6va011 => Service deleted successfully.
xhunter1 => Service deleted successfully.
C:\Windows\Installer\{1547a4df-a060-bca0-5da2-aff15ee51e9d} => Moved successfully.
"C:\Windows\Installer\{1547a4df-a060-bca0-5da2-aff15ee51e9d}\@" => File/Directory not found.
C:\Users\david\AppData\Local\{1547a4df-a060-bca0-5da2-aff15ee51e9d} => Moved successfully.
"C:\Users\david\AppData\Local\{1547a4df-a060-bca0-5da2-aff15ee51e9d}\@" => File/Directory not found.
C:\ProgramData\AbewgOcluk => Moved successfully.
C:\ProgramData\AdneWbiql => Moved successfully.
C:\ProgramData\AgolBemet => Moved successfully.
C:\ProgramData\AkmupUguge => Moved successfully.
C:\ProgramData\AkoyaVgogi => Moved successfully.
C:\ProgramData\AmqiqPizet => Moved successfully.
C:\ProgramData\ApmeJxel => Moved successfully.
C:\ProgramData\EbanOcaha => Moved successfully.
C:\ProgramData\EdvapYexhu => Moved successfully.
C:\ProgramData\EzekoTahit => Moved successfully.
C:\ProgramData\InstallMate => Moved successfully.
C:\ProgramData\IqikWuge => Moved successfully.
C:\ProgramData\OcniNtih => Moved successfully.
C:\ProgramData\OdwewEzuce => Moved successfully.
C:\ProgramData\OfqiTaxo => Moved successfully.
C:\ProgramData\OfuxDurov => Moved successfully.
C:\ProgramData\OlafcEhitu => Moved successfully.
C:\ProgramData\OnibErof => Moved successfully.
C:\ProgramData\OpohEluda => Moved successfully.
C:\ProgramData\OxereNazic => Moved successfully.
C:\ProgramData\UgeceNezxo => Moved successfully.
C:\ProgramData\UkjaFtoq => Moved successfully.
C:\ProgramData\UkvoJojow => Moved successfully.
C:\ProgramData\UxzoqYoxuz => Moved successfully.
C:\ProgramData\UzeneKjojf => Moved successfully.
EmptyTemp: => Removed 618.8 MB temporary data.


The system needed a reboot.

==== End of Fixlog ====

FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 15-10-2014 02
Ran by david (administrator) on DAVID-PC on 16-10-2014 18:47:25
Running from C:\Users\david\Desktop
Loaded Profile: david (Available profiles: david & VERSUCH)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Nico Mak Computing) C:\Program Files\File Association Helper\FAHWindow.exe
(Spotify Ltd) C:\Users\david\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
() C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\CEPServiceManager4\CEPServiceManager.exe
() C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\HEX\Adobe CEF Helper.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\HEX\Adobe CEF Helper.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
() C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe
() C:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.0.224\deploy\LoLLauncher.exe
() C:\Riot Games\League of Legends\RADS\projects\lol_patcher\releases\0.0.0.8\deploy\LoLPatcher.exe
() C:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.113\deploy\LolClient.exe
(PC-Doctor, Inc.) C:\Program Files\My Dell\imstrayicon.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [DellStage] => C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe [2195824 2012-02-01] ()
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [472984 2013-06-03] (Adobe Systems Incorporated)
HKLM\...\Run: [Nvtmru] => "C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe"
HKLM\...\Run: [egui] => C:\Program Files\ESET\ESET Smart Security\egui.exe [5581888 2014-02-24] (ESET)
HKLM\...\Run: [FAHConsole] => C:\Program Files\File Association Helper\FAHConsole.exe [729272 2014-01-28] (Nico Mak Computing)
HKLM-x32\...\Run: [Dell Registration] => C:\Program Files (x86)\System Registration\prodreg.exe [4165440 2011-08-04] (Dell, Inc.)
HKLM-x32\...\Run: [RoxWatchTray] => C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe [240112 2010-11-25] (Sonic Solutions)
HKLM-x32\...\Run: [AccuWeatherWidget] => C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe [968048 2012-02-01] ()
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe Creative Cloud] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2236816 2013-07-12] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59240 2011-09-27] (Apple Inc.)
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Avira <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\ESET <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files (x86)\Common Files\Symantec Shared <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\ESET <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Kaspersky Lab <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\AVAST Software <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Malwarebytes <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [Spotify Web Helper] => C:\Users\david\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1514040 2014-10-03] (Spotify Ltd)
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [1938112 2014-09-23] (Valve Corporation)
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [22041192 2014-08-27] (Skype Technologies S.A.)
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [6482200 2014-09-26] (Piriform Ltd)
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OpohEluda] => regsvr32.exe "C:\ProgramData\OpohEluda\OpohEluda.dat"
HKU\S-1-5-18\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [22041192 2014-08-27] (Skype Technologies S.A.)
ShellIconOverlayIdentifiers: [ AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_v_1_1_0_x64.dll ()
ShellIconOverlayIdentifiers: [ AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_v_1_1_0_x64.dll ()
ShellIconOverlayIdentifiers: [ AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_v_1_1_0_x64.dll ()
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - No Name - !{1BB22D38-A411-4B13-A746-C2A4F4EC7344} -  No File
Toolbar: HKLM - No Name - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  No File
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  No File
Toolbar: HKLM-x32 - No Name - !{1BB22D38-A411-4B13-A746-C2A4F4EC7344} -  No File
Toolbar: HKLM-x32 - No Name - !{5018CFD2-804D-4C99-9F81-25EAEA2769DE} -  No File
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default
FF NewTab: user_pref("browser.newtab.url", "");
FF DefaultSearchEngine: Google
FF SearchEngineOrder.1: Google
FF SelectedSearchEngineuser_pref("browser.search.selectedEngine", "");: user_pref("browser.search.selectedEngine", "");
FF Homepage: user_pref("browser.startup.homepage", "");
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1205146.dll (Adobe Systems, Inc.)
FF Plugin-x32: @esn/esnlaunch,version=1.138.0 -> C:\Program Files (x86)\Battlelog Web Plugins\1.138.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=2.1.7 -> C:\Program Files (x86)\Battlelog Web Plugins\2.1.7\npesnlaunch.dll No File
FF Plugin-x32: @esn/npbattlelog,version=2.4.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.4.0\npbattlelog.dll (EA Digital Illusions CE AB)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\david\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\david\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Extension: Amazon-Icon - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\Extensions\amazon-icon@giga.de [2014-04-16]
FF Extension: Stylish - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\Extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8}.xpi [2012-10-08]
FF Extension: NoScript - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2012-10-07]
FF Extension: Adblock Plus - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-09-08]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-07-14]
FF HKLM\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird
FF Extension: ESET Smart Security Extension - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird [2014-08-14]
FF HKLM-x32\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird
FF HKCU\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff
FF Extension: Download videos and MP3s from YouTube - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-04-22]
FF Extension: No Name - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\extensions\battlefieldheroespatcher@ea.com [Not Found]
FF Extension: No Name - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\extensions\battlefieldplay4free@ea.com [Not Found]
FF Extension: No Name - C:\Program Files\AVAST Software\Avast\WebRep\FF [Not Found]
FF Extension: No Name - C:\Program Files (x86)\LyricsPal\125.xpi [Not Found]
FF Extension: No Name - C:\Program Files (x86)\FromDocToPDF_65\bar\1.bin [Not Found]
FF Extension: No Name - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\extensions\{2894a412-e091-6466-9ab8-ea76561654ca} [Not Found]

Chrome: 
=======
CHR HomePage: Default -> chrome://newtab
CHR Profile: C:\Users\david\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-03-20]
CHR Extension: (Google Drive) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-03-20]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-05]
CHR Extension: (YouTube) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-03-20]
CHR Extension: (Google-Suche) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-03-20]
CHR Extension: (Stylish) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\fjnbnpbmkenffdnngjfgmeleoegfcffe [2013-07-03]
CHR Extension: (AdBlock) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2013-07-03]
CHR Extension: (Skype Click to Call) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2014-07-20]
CHR Extension: (Google Wallet) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-22]
CHR Extension: (Battlefield Play4Free) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\oiokahphinmbmakkehgelkmpolmnbkdh [2014-04-06]
CHR Extension: (Google Mail) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-03-20]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [448384 2014-08-04] ()
S3 BRSptSvc; C:\ProgramData\BitRaider\BRSptSvc.exe [477960 2014-04-11] (BitRaider, LLC)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
R2 ekrn; C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe [1343408 2014-02-24] (ESET)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1149760 2014-09-17] (NVIDIA Corporation)
S3 npggsvc; C:\Windows\SysWOW64\GameMon.des [3191392 2014-05-15] (INCA Internet Co., Ltd.)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1796928 2014-09-17] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19440960 2014-09-17] (NVIDIA Corporation)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76152 2014-06-21] ()
S2 AviraUpgradeService; "C:\Windows\TEMP\AVSETUP_53f13fa6\avupgsvc.exe" /TEMPSTART:""C:\Windows\TEMP\AVSETUP_53f13fa6\setup.exe" /NOTEMPCLEANUP /CLEANUPSRCFILES"

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S4 aswSP; No ImagePath
S3 BRDriver64; C:\ProgramData\BitRaider\BRDriver64.sys [75048 2013-10-08] (BitRaider)
R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [168256 2013-09-17] (ESET)
R2 epfw; C:\Windows\System32\DRIVERS\epfw.sys [220232 2013-09-17] (ESET)
R1 EpfwLWF; C:\Windows\System32\DRIVERS\EpfwLWF.sys [44120 2013-09-17] (ESET)
R0 epfwwfp; C:\Windows\System32\DRIVERS\epfwwfp.sys [62136 2013-09-17] (ESET)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [20288 2014-09-17] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38048 2014-09-04] (NVIDIA Corporation)
S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [386680 2014-09-13] (Duplex Secure Ltd.)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-16 18:47 - 2014-10-16 18:47 - 00022759 _____ () C:\Users\david\Desktop\FRST.txt
2014-10-16 01:09 - 2014-10-16 01:09 - 00000000 ____D () C:\ProgramData\OpohEluda
2014-10-14 16:24 - 2014-10-16 01:08 - 00000000 ____D () C:\Users\david\Desktop\TrojanerBoard
2014-10-13 18:51 - 2014-10-13 18:52 - 01660616 _____ (ESET) C:\Users\david\Downloads\eset_smart_security_live_installer (1).exe
2014-10-13 18:40 - 2014-10-13 18:40 - 00001034 _____ () C:\Users\david\Desktop\checkup.txt
2014-10-13 18:17 - 2014-10-13 18:17 - 00854417 _____ () C:\Users\david\Downloads\SecurityCheck.exe
2014-10-13 16:03 - 2014-10-13 16:03 - 02347384 _____ (ESET) C:\Users\david\Downloads\esetsmartinstaller_deu.exe
2014-10-12 16:13 - 2014-10-16 01:09 - 00000000 ____D () C:\Users\david\Desktop\FRST-OlderVersion
2014-10-12 16:08 - 2014-10-12 16:08 - 01705755 _____ (Thisisu) C:\Users\david\Downloads\JRT.exe
2014-10-12 16:08 - 2014-10-12 16:08 - 00000000 ____D () C:\Windows\ERUNT
2014-10-12 16:03 - 2014-10-12 16:03 - 00000000 _____ () C:\Users\david\Downloads\C6E7.tmp
2014-10-12 16:01 - 2014-10-12 16:01 - 01375089 _____ () C:\Users\david\Downloads\AdwCleaner_3.311.exe
2014-10-12 16:01 - 2014-10-12 16:01 - 01375089 _____ () C:\Users\david\Downloads\AdwCleaner_3.311 (1).exe
2014-10-12 15:56 - 2014-10-12 15:56 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\48230029.sys
2014-10-12 15:40 - 2014-10-12 15:56 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-10-12 15:40 - 2014-10-12 15:40 - 00001104 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-10-12 15:40 - 2014-10-12 15:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-10-12 15:40 - 2014-10-12 15:40 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-10-12 15:40 - 2014-10-12 15:40 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-10-12 15:40 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-10-12 15:40 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-10-12 15:40 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-10-12 15:39 - 2014-10-12 15:39 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\david\Downloads\mbam-setup-2.0.2.1012.exe
2014-10-12 12:20 - 2014-10-12 12:21 - 04965896 _____ (Piriform Ltd) C:\Users\david\Downloads\ccsetup418.exe
2014-10-12 12:19 - 2014-10-12 12:19 - 00003206 _____ () C:\Windows\System32\Tasks\{536105BA-DC87-4426-BF21-07E3D6160448}
2014-10-11 23:01 - 2014-10-11 23:01 - 01660616 _____ (ESET) C:\Users\david\Downloads\eset_smart_security_live_installer.exe
2014-10-11 22:54 - 2014-10-11 22:54 - 00033935 _____ () C:\ComboFix.txt
2014-10-11 20:04 - 2014-10-11 22:54 - 00000000 ____D () C:\Qoobox
2014-10-11 20:04 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-10-11 20:04 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-10-11 20:04 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-10-11 20:04 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-10-11 20:04 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-10-11 20:04 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-10-11 20:04 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-10-11 20:04 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-10-11 20:01 - 2014-10-11 22:53 - 00000000 ____D () C:\Windows\erdnt
2014-10-11 20:00 - 2014-10-11 20:00 - 05582481 ____R (Swearware) C:\Users\david\Downloads\ComboFix.exe
2014-10-11 20:00 - 2014-10-11 20:00 - 05582481 ____R (Swearware) C:\Users\david\Desktop\ComboFix.exe
2014-10-11 19:09 - 2014-10-11 19:09 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\david\Downloads\revosetup95.exe
2014-10-10 21:18 - 2014-10-10 21:18 - 00000000 ____D () C:\Windows\pss
2014-10-10 20:56 - 2014-10-16 18:47 - 00000000 ____D () C:\FRST
2014-10-10 20:55 - 2014-10-16 01:09 - 02111488 _____ (Farbar) C:\Users\david\Desktop\FRST64.exe
2014-10-10 20:55 - 2014-10-10 20:55 - 02109952 _____ (Farbar) C:\Users\david\Downloads\FRST64.exe
2014-10-10 19:12 - 2014-10-10 19:13 - 00000000 ____D () C:\Users\david\AppData\Roaming\SpaceEngineers
2014-10-06 21:21 - 2014-10-06 22:00 - 764194469 _____ ( ) C:\Users\david\Downloads\Call_of_Pripyat_Complete_v1.0.2_Setup.exe
2014-10-03 10:50 - 2014-10-03 10:50 - 00000000 ____D () C:\Users\david\Documents\Paradox Interactive
2014-09-29 20:45 - 2014-09-29 20:45 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies
2014-09-29 20:43 - 2014-09-13 22:13 - 00613696 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
2014-09-29 20:33 - 2014-09-17 06:51 - 01538880 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdagenco6420103.dll
2014-09-29 20:33 - 2014-09-17 06:51 - 00197408 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda64v.sys
2014-09-29 20:33 - 2014-09-17 06:51 - 00031520 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 31887680 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 24552592 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 20922512 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 19954520 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 18106152 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 17259664 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 14026304 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 13939272 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 13157696 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2014-09-29 20:33 - 2014-09-14 01:48 - 11392576 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 11330776 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 04287296 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 04008592 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 01876296 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434411.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 01539272 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434411.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 00957584 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 00925896 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 00919240 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 00894096 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 00867528 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 00352016 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 00303600 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 00174856 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 00156840 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 00026956 _____ () C:\Windows\system32\nvinfo.pb
2014-09-29 18:41 - 2014-09-29 18:41 - 00000000 ____D () C:\NVIDIA
2014-09-29 18:34 - 2014-09-17 04:10 - 01715224 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll
2014-09-29 18:34 - 2014-09-17 04:10 - 01291280 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll
2014-09-29 18:32 - 2014-09-04 21:14 - 00038048 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2014-09-29 18:32 - 2014-09-04 21:14 - 00032416 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2014-09-29 18:29 - 2014-09-29 18:32 - 319671744 _____ (NVIDIA Corporation) C:\Users\david\Downloads\344.11-desktop-win8-win7-winvista-64bit-international-whql.exe
2014-09-29 01:11 - 2014-09-29 01:11 - 06626832 _____ (TeamViewer GmbH) C:\Users\david\Downloads\TeamViewer_Setup_de.exe
2014-09-25 01:04 - 2014-09-25 01:04 - 00342430 _____ () C:\Users\david\Downloads\lolhentai-1.6.3.sdt
2014-09-20 19:59 - 2014-09-20 19:59 - 00002466 _____ () C:\Users\VERSUCH\Desktop\SWAT 4 Single Player Demo.lnk
2014-09-20 19:59 - 2014-09-20 19:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VUGames
2014-09-20 19:51 - 2014-09-20 19:51 - 00367432 _____ () C:\Users\david\Downloads\SoftonicDownloader_for_s-w-a-t-4.exe
2014-09-16 20:14 - 2014-05-14 18:23 - 02477536 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-09-16 20:14 - 2014-05-14 18:23 - 00058336 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-09-16 20:14 - 2014-05-14 18:23 - 00044512 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-09-16 20:14 - 2014-05-14 18:21 - 02620928 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-09-16 20:13 - 2014-05-14 18:23 - 00700384 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-09-16 20:13 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2014-09-16 20:13 - 2014-05-14 18:23 - 00038880 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-09-16 20:13 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2014-09-16 20:13 - 2014-05-14 18:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-09-16 20:13 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2014-09-16 20:13 - 2014-05-14 09:23 - 00198600 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-09-16 20:13 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2014-09-16 20:13 - 2014-05-14 09:20 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-09-16 20:13 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-16 18:45 - 2013-07-01 13:47 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-10-16 18:43 - 2012-06-23 16:19 - 00000000 ____D () C:\Users\david\AppData\Roaming\Skype
2014-10-16 18:25 - 2012-06-24 18:15 - 00001138 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-243866017-1107141967-568923311-1001UA.job
2014-10-16 18:19 - 2013-07-03 15:26 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-10-16 18:19 - 2013-07-03 15:26 - 00001108 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-10-16 18:14 - 2012-06-23 16:32 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-10-16 16:22 - 2013-05-21 18:36 - 00003440 _____ () C:\Windows\System32\Tasks\PCDEventLauncherTask
2014-10-16 13:20 - 2009-07-14 06:45 - 00021072 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-16 13:20 - 2009-07-14 06:45 - 00021072 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-16 13:15 - 2014-01-02 12:25 - 01633945 _____ () C:\Windows\WindowsUpdate.log
2014-10-16 13:13 - 2012-06-30 11:37 - 00000000 ____D () C:\Users\david\AppData\Local\Adobe
2014-10-16 13:12 - 2014-01-01 20:14 - 00033747 _____ () C:\Windows\setupact.log
2014-10-16 13:12 - 2012-01-27 09:33 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-10-16 13:12 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-10-16 01:13 - 2014-01-07 16:07 - 01374658 _____ () C:\Windows\PFRO.log
2014-10-16 01:11 - 2013-06-02 22:16 - 00000000 ____D () C:\Users\david\AppData\Roaming\Spotify
2014-10-16 01:09 - 2012-06-23 16:41 - 00000000 ____D () C:\Users\david\AppData\Roaming\TS3Client
2014-10-16 00:25 - 2012-06-24 18:15 - 00001116 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-243866017-1107141967-568923311-1001Core.job
2014-10-15 17:52 - 2012-11-01 17:03 - 00003930 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{963751FF-E6A0-461A-9D15-630985D8D304}
2014-10-13 21:01 - 2013-06-24 22:20 - 00000000 ____D () C:\Users\david\AppData\Local\Spotify
2014-10-12 16:28 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-10-12 16:03 - 2013-11-23 13:09 - 00000000 ____D () C:\AdwCleaner
2014-10-12 12:48 - 2012-09-09 17:58 - 00000000 ____D () C:\Users\david\AppData\Local\Apps\2.0
2014-10-12 12:24 - 2012-06-27 19:00 - 00000784 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-10-12 12:24 - 2012-06-27 19:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2014-10-12 12:24 - 2012-06-27 19:00 - 00000000 ____D () C:\Program Files\CCleaner
2014-10-11 22:54 - 2009-07-14 05:20 - 00000000 ____D () C:\Users\Default
2014-10-11 22:48 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-10-10 21:20 - 2013-03-23 18:55 - 00000000 ____D () C:\Users\david\AppData\Local\CrashDumps
2014-10-10 19:55 - 2014-09-08 20:25 - 00000000 ____D () C:\Users\david\Desktop\Cracks
2014-10-09 21:07 - 2012-06-23 16:25 - 00000000 ____D () C:\ProgramData\Origin
2014-10-09 21:06 - 2014-08-27 23:16 - 00000000 ____D () C:\Program Files (x86)\Origin
2014-10-05 13:11 - 2014-08-11 02:34 - 00000000 ____D () C:\Users\david\Documents\BattleIslands
2014-10-04 22:03 - 2012-06-23 16:32 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-10-04 22:03 - 2012-06-23 16:32 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-10-04 22:03 - 2012-01-27 10:40 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-10-04 15:49 - 2014-01-06 03:51 - 00661582 _____ () C:\Windows\DirectX.log
2014-09-29 20:49 - 2013-09-17 19:46 - 00001349 _____ () C:\Users\Public\Desktop\GeForce Experience.lnk
2014-09-29 20:45 - 2012-06-23 20:58 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation
2014-09-29 20:44 - 2013-09-17 19:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2014-09-29 20:38 - 2012-01-27 09:33 - 00000000 ____D () C:\Program Files\NVIDIA Corporation
2014-09-29 18:38 - 2013-12-21 19:21 - 00000000 ____D () C:\Users\david\AppData\Local\NVIDIA Corporation
2014-09-29 18:34 - 2012-01-27 09:33 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation
2014-09-29 13:14 - 2012-01-27 11:20 - 00000000 ____D () C:\ProgramData\Sonic
2014-09-29 01:12 - 2012-07-18 17:29 - 00000000 ____D () C:\Users\david\AppData\Roaming\TeamViewer
2014-09-28 20:48 - 2012-10-03 16:54 - 00007599 _____ () C:\Users\david\AppData\Local\Resmon.ResmonCfg
2014-09-20 20:23 - 2012-01-27 10:58 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-09-19 05:52 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-09-18 15:15 - 2013-03-02 00:27 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-09-17 04:10 - 2013-12-21 18:53 - 02799784 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll
2014-09-17 04:10 - 2013-12-21 18:53 - 02193560 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll
2014-09-16 20:19 - 2012-06-24 09:00 - 00000000 ____D () C:\ProgramData\PCDr

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-09-19 05:45

==================== End Of Log ============================
         

--- --- ---

--- --- ---

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Avira <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\ESET <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files (x86)\Common Files\Symantec Shared <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\ESET <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Kaspersky Lab <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\AVAST Software <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Malwarebytes <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OpohEluda] => regsvr32.exe "C:\ProgramData\OpohEluda\OpohEluda.dat"
C:\ProgramData\OpohEluda
         

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

• Starte nun FRST erneut und klicke den Entfernen Button.
• Das Tool erstellt eine Fixlog.txt.
• Poste mir deren Inhalt.

Nochmal ein frisches FRST log bitte.

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 16-10-2014
Ran by david at 2014-10-17 13:14:33 Run:6
Running from C:\Users\david\Desktop
Loaded Profile: david (Available profiles: david & VERSUCH)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Avira <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\ESET <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files (x86)\Common Files\Symantec Shared <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\ESET <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Kaspersky Lab <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\AVAST Software <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Malwarebytes <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OpohEluda] => regsvr32.exe "C:\ProgramData\OpohEluda\OpohEluda.dat"
C:\ProgramData\OpohEluda
*****************

HKLM => Group Policy Restriction on software restored successfully.
HKLM => Group Policy Restriction on software restored successfully.
HKLM => Group Policy Restriction on software restored successfully.
HKLM => Group Policy Restriction on software restored successfully.
HKLM => Group Policy Restriction on software restored successfully.
HKLM => Group Policy Restriction on software restored successfully.
HKLM => Group Policy Restriction on software restored successfully.
HKLM => Group Policy Restriction on software restored successfully.
HKLM => Group Policy Restriction on software restored successfully.
HKLM => Group Policy Restriction on software restored successfully.
HKU\S-1-5-21-243866017-1107141967-568923311-1001\Software\Microsoft\Windows\CurrentVersion\Run\\OpohEluda => value deleted successfully.
C:\ProgramData\OpohEluda => Moved successfully.

==== End of Fixlog ====

FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 16-10-2014
Ran by david (administrator) on DAVID-PC on 17-10-2014 13:15:06
Running from C:\Users\david\Desktop
Loaded Profile: david (Available profiles: david & VERSUCH)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Nico Mak Computing) C:\Program Files\File Association Helper\FAHWindow.exe
(Spotify Ltd) C:\Users\david\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
() C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\CEPServiceManager4\CEPServiceManager.exe
() C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\HEX\Adobe CEF Helper.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\HEX\Adobe CEF Helper.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [DellStage] => C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe [2195824 2012-02-01] ()
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [472984 2013-06-03] (Adobe Systems Incorporated)
HKLM\...\Run: [Nvtmru] => "C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe"
HKLM\...\Run: [egui] => C:\Program Files\ESET\ESET Smart Security\egui.exe [5581888 2014-02-24] (ESET)
HKLM\...\Run: [FAHConsole] => C:\Program Files\File Association Helper\FAHConsole.exe [729272 2014-01-28] (Nico Mak Computing)
HKLM-x32\...\Run: [Dell Registration] => C:\Program Files (x86)\System Registration\prodreg.exe [4165440 2011-08-04] (Dell, Inc.)
HKLM-x32\...\Run: [RoxWatchTray] => C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe [240112 2010-11-25] (Sonic Solutions)
HKLM-x32\...\Run: [AccuWeatherWidget] => C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe [968048 2012-02-01] ()
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe Creative Cloud] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2236816 2013-07-12] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59240 2011-09-27] (Apple Inc.)
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [Spotify Web Helper] => C:\Users\david\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1514040 2014-10-03] (Spotify Ltd)
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [1938112 2014-09-23] (Valve Corporation)
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [22041192 2014-08-27] (Skype Technologies S.A.)
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [6482200 2014-09-26] (Piriform Ltd)
HKU\S-1-5-18\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [22041192 2014-08-27] (Skype Technologies S.A.)
ShellIconOverlayIdentifiers: [ AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_v_1_1_0_x64.dll ()
ShellIconOverlayIdentifiers: [ AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_v_1_1_0_x64.dll ()
ShellIconOverlayIdentifiers: [ AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_v_1_1_0_x64.dll ()
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - No Name - !{1BB22D38-A411-4B13-A746-C2A4F4EC7344} -  No File
Toolbar: HKLM - No Name - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  No File
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  No File
Toolbar: HKLM-x32 - No Name - !{1BB22D38-A411-4B13-A746-C2A4F4EC7344} -  No File
Toolbar: HKLM-x32 - No Name - !{5018CFD2-804D-4C99-9F81-25EAEA2769DE} -  No File
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default
FF NewTab: user_pref("browser.newtab.url", "");
FF DefaultSearchEngine: Google
FF SearchEngineOrder.1: Google
FF SelectedSearchEngineuser_pref("browser.search.selectedEngine", "");: user_pref("browser.search.selectedEngine", "");
FF Homepage: user_pref("browser.startup.homepage", "");
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1205146.dll (Adobe Systems, Inc.)
FF Plugin-x32: @esn/esnlaunch,version=1.138.0 -> C:\Program Files (x86)\Battlelog Web Plugins\1.138.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=2.1.7 -> C:\Program Files (x86)\Battlelog Web Plugins\2.1.7\npesnlaunch.dll No File
FF Plugin-x32: @esn/npbattlelog,version=2.4.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.4.0\npbattlelog.dll (EA Digital Illusions CE AB)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\david\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\david\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Extension: Amazon-Icon - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\Extensions\amazon-icon@giga.de [2014-04-16]
FF Extension: Stylish - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\Extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8}.xpi [2012-10-08]
FF Extension: NoScript - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2012-10-07]
FF Extension: Adblock Plus - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-09-08]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-07-14]
FF HKLM\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird
FF Extension: ESET Smart Security Extension - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird [2014-08-14]
FF HKLM-x32\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird
FF HKCU\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff
FF Extension: Download videos and MP3s from YouTube - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-04-22]
FF Extension: No Name - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\extensions\battlefieldheroespatcher@ea.com [Not Found]
FF Extension: No Name - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\extensions\battlefieldplay4free@ea.com [Not Found]
FF Extension: No Name - C:\Program Files\AVAST Software\Avast\WebRep\FF [Not Found]
FF Extension: No Name - C:\Program Files (x86)\LyricsPal\125.xpi [Not Found]
FF Extension: No Name - C:\Program Files (x86)\FromDocToPDF_65\bar\1.bin [Not Found]
FF Extension: No Name - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\extensions\{2894a412-e091-6466-9ab8-ea76561654ca} [Not Found]

Chrome: 
=======
CHR HomePage: Default -> chrome://newtab
CHR Profile: C:\Users\david\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-03-20]
CHR Extension: (Google Drive) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-03-20]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-05]
CHR Extension: (YouTube) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-03-20]
CHR Extension: (Google-Suche) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-03-20]
CHR Extension: (Stylish) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\fjnbnpbmkenffdnngjfgmeleoegfcffe [2013-07-03]
CHR Extension: (AdBlock) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2013-07-03]
CHR Extension: (Skype Click to Call) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2014-07-20]
CHR Extension: (Google Wallet) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-22]
CHR Extension: (Battlefield Play4Free) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\oiokahphinmbmakkehgelkmpolmnbkdh [2014-04-06]
CHR Extension: (Google Mail) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-03-20]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [448384 2014-08-04] ()
S3 BRSptSvc; C:\ProgramData\BitRaider\BRSptSvc.exe [477960 2014-04-11] (BitRaider, LLC)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
R2 ekrn; C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe [1343408 2014-02-24] (ESET)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1149760 2014-09-17] (NVIDIA Corporation)
S3 npggsvc; C:\Windows\SysWOW64\GameMon.des [3191392 2014-05-15] (INCA Internet Co., Ltd.)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1796928 2014-09-17] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19440960 2014-09-17] (NVIDIA Corporation)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76152 2014-06-21] ()
S2 AviraUpgradeService; "C:\Windows\TEMP\AVSETUP_53f13fa6\avupgsvc.exe" /TEMPSTART:""C:\Windows\TEMP\AVSETUP_53f13fa6\setup.exe" /NOTEMPCLEANUP /CLEANUPSRCFILES"

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S4 aswSP; No ImagePath
S3 BRDriver64; C:\ProgramData\BitRaider\BRDriver64.sys [75048 2013-10-08] (BitRaider)
R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [168256 2013-09-17] (ESET)
R2 epfw; C:\Windows\System32\DRIVERS\epfw.sys [220232 2013-09-17] (ESET)
R1 EpfwLWF; C:\Windows\System32\DRIVERS\EpfwLWF.sys [44120 2013-09-17] (ESET)
R0 epfwwfp; C:\Windows\System32\DRIVERS\epfwwfp.sys [62136 2013-09-17] (ESET)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [20288 2014-09-17] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38048 2014-09-04] (NVIDIA Corporation)
S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [386680 2014-09-13] (Duplex Secure Ltd.)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-16 18:48 - 2014-10-16 18:48 - 00043177 _____ () C:\Users\david\Desktop\Addition.txt
2014-10-16 18:47 - 2014-10-17 13:15 - 00009201 _____ () C:\Users\david\Desktop\FRST.txt
2014-10-14 16:24 - 2014-10-16 01:08 - 00000000 ____D () C:\Users\david\Desktop\TrojanerBoard
2014-10-13 18:51 - 2014-10-13 18:52 - 01660616 _____ (ESET) C:\Users\david\Downloads\eset_smart_security_live_installer (1).exe
2014-10-13 18:40 - 2014-10-13 18:40 - 00001034 _____ () C:\Users\david\Desktop\checkup.txt
2014-10-13 18:17 - 2014-10-13 18:17 - 00854417 _____ () C:\Users\david\Downloads\SecurityCheck.exe
2014-10-13 16:03 - 2014-10-13 16:03 - 02347384 _____ (ESET) C:\Users\david\Downloads\esetsmartinstaller_deu.exe
2014-10-12 16:13 - 2014-10-17 13:14 - 00000000 ____D () C:\Users\david\Desktop\FRST-OlderVersion
2014-10-12 16:08 - 2014-10-12 16:08 - 01705755 _____ (Thisisu) C:\Users\david\Downloads\JRT.exe
2014-10-12 16:08 - 2014-10-12 16:08 - 00000000 ____D () C:\Windows\ERUNT
2014-10-12 16:03 - 2014-10-12 16:03 - 00000000 _____ () C:\Users\david\Downloads\C6E7.tmp
2014-10-12 16:01 - 2014-10-12 16:01 - 01375089 _____ () C:\Users\david\Downloads\AdwCleaner_3.311.exe
2014-10-12 16:01 - 2014-10-12 16:01 - 01375089 _____ () C:\Users\david\Downloads\AdwCleaner_3.311 (1).exe
2014-10-12 15:56 - 2014-10-12 15:56 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\48230029.sys
2014-10-12 15:40 - 2014-10-12 15:56 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-10-12 15:40 - 2014-10-12 15:40 - 00001104 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-10-12 15:40 - 2014-10-12 15:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-10-12 15:40 - 2014-10-12 15:40 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-10-12 15:40 - 2014-10-12 15:40 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-10-12 15:40 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-10-12 15:40 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-10-12 15:40 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-10-12 15:39 - 2014-10-12 15:39 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\david\Downloads\mbam-setup-2.0.2.1012.exe
2014-10-12 12:20 - 2014-10-12 12:21 - 04965896 _____ (Piriform Ltd) C:\Users\david\Downloads\ccsetup418.exe
2014-10-12 12:19 - 2014-10-12 12:19 - 00003206 _____ () C:\Windows\System32\Tasks\{536105BA-DC87-4426-BF21-07E3D6160448}
2014-10-11 23:01 - 2014-10-11 23:01 - 01660616 _____ (ESET) C:\Users\david\Downloads\eset_smart_security_live_installer.exe
2014-10-11 22:54 - 2014-10-11 22:54 - 00033935 _____ () C:\ComboFix.txt
2014-10-11 20:04 - 2014-10-11 22:54 - 00000000 ____D () C:\Qoobox
2014-10-11 20:04 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-10-11 20:04 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-10-11 20:04 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-10-11 20:04 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-10-11 20:04 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-10-11 20:04 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-10-11 20:04 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-10-11 20:04 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-10-11 20:01 - 2014-10-11 22:53 - 00000000 ____D () C:\Windows\erdnt
2014-10-11 20:00 - 2014-10-11 20:00 - 05582481 ____R (Swearware) C:\Users\david\Downloads\ComboFix.exe
2014-10-11 20:00 - 2014-10-11 20:00 - 05582481 ____R (Swearware) C:\Users\david\Desktop\ComboFix.exe
2014-10-11 19:09 - 2014-10-11 19:09 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\david\Downloads\revosetup95.exe
2014-10-10 21:18 - 2014-10-10 21:18 - 00000000 ____D () C:\Windows\pss
2014-10-10 20:56 - 2014-10-17 13:15 - 00000000 ____D () C:\FRST
2014-10-10 20:55 - 2014-10-17 13:14 - 02112000 _____ (Farbar) C:\Users\david\Desktop\FRST64.exe
2014-10-10 20:55 - 2014-10-10 20:55 - 02109952 _____ (Farbar) C:\Users\david\Downloads\FRST64.exe
2014-10-10 19:12 - 2014-10-10 19:13 - 00000000 ____D () C:\Users\david\AppData\Roaming\SpaceEngineers
2014-10-06 21:21 - 2014-10-06 22:00 - 764194469 _____ ( ) C:\Users\david\Downloads\Call_of_Pripyat_Complete_v1.0.2_Setup.exe
2014-10-03 10:50 - 2014-10-03 10:50 - 00000000 ____D () C:\Users\david\Documents\Paradox Interactive
2014-09-29 20:45 - 2014-09-29 20:45 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies
2014-09-29 20:43 - 2014-09-13 22:13 - 00613696 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
2014-09-29 20:33 - 2014-09-17 06:51 - 01538880 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdagenco6420103.dll
2014-09-29 20:33 - 2014-09-17 06:51 - 00197408 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda64v.sys
2014-09-29 20:33 - 2014-09-17 06:51 - 00031520 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 31887680 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 24552592 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 20922512 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 19954520 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 18106152 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 17259664 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 14026304 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 13939272 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 13157696 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2014-09-29 20:33 - 2014-09-14 01:48 - 11392576 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 11330776 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 04287296 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 04008592 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 01876296 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434411.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 01539272 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434411.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 00957584 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 00925896 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 00919240 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 00894096 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 00867528 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 00352016 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 00303600 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 00174856 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 00156840 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll
2014-09-29 20:33 - 2014-09-14 01:48 - 00026956 _____ () C:\Windows\system32\nvinfo.pb
2014-09-29 18:41 - 2014-09-29 18:41 - 00000000 ____D () C:\NVIDIA
2014-09-29 18:34 - 2014-09-17 04:10 - 01715224 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll
2014-09-29 18:34 - 2014-09-17 04:10 - 01291280 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll
2014-09-29 18:32 - 2014-09-04 21:14 - 00038048 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2014-09-29 18:32 - 2014-09-04 21:14 - 00032416 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2014-09-29 18:29 - 2014-09-29 18:32 - 319671744 _____ (NVIDIA Corporation) C:\Users\david\Downloads\344.11-desktop-win8-win7-winvista-64bit-international-whql.exe
2014-09-29 01:11 - 2014-09-29 01:11 - 06626832 _____ (TeamViewer GmbH) C:\Users\david\Downloads\TeamViewer_Setup_de.exe
2014-09-25 01:04 - 2014-09-25 01:04 - 00342430 _____ () C:\Users\david\Downloads\lolhentai-1.6.3.sdt
2014-09-20 19:59 - 2014-09-20 19:59 - 00002466 _____ () C:\Users\VERSUCH\Desktop\SWAT 4 Single Player Demo.lnk
2014-09-20 19:59 - 2014-09-20 19:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VUGames
2014-09-20 19:51 - 2014-09-20 19:51 - 00367432 _____ () C:\Users\david\Downloads\SoftonicDownloader_for_s-w-a-t-4.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-17 13:14 - 2012-06-23 16:32 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-10-17 13:11 - 2014-01-02 12:25 - 01692820 _____ () C:\Windows\WindowsUpdate.log
2014-10-17 13:10 - 2012-06-30 11:37 - 00000000 ____D () C:\Users\david\AppData\Local\Adobe
2014-10-17 13:10 - 2012-06-23 16:19 - 00000000 ____D () C:\Users\david\AppData\Roaming\Skype
2014-10-17 13:08 - 2014-01-01 20:14 - 00033915 _____ () C:\Windows\setupact.log
2014-10-17 13:08 - 2013-07-03 15:26 - 00001108 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-10-17 13:08 - 2013-07-01 13:47 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-10-17 13:08 - 2012-01-27 09:33 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-10-17 13:08 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-10-17 07:06 - 2013-06-02 22:16 - 00000000 ____D () C:\Users\david\AppData\Roaming\Spotify
2014-10-17 07:06 - 2012-06-23 16:41 - 00000000 ____D () C:\Users\david\AppData\Roaming\TS3Client
2014-10-17 06:25 - 2012-06-24 18:15 - 00001138 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-243866017-1107141967-568923311-1001UA.job
2014-10-17 06:19 - 2013-07-03 15:26 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-10-17 00:25 - 2012-06-24 18:15 - 00001116 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-243866017-1107141967-568923311-1001Core.job
2014-10-16 19:20 - 2012-11-01 17:03 - 00003930 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{963751FF-E6A0-461A-9D15-630985D8D304}
2014-10-16 16:22 - 2013-05-21 18:36 - 00003440 _____ () C:\Windows\System32\Tasks\PCDEventLauncherTask
2014-10-16 13:20 - 2009-07-14 06:45 - 00021072 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-16 13:20 - 2009-07-14 06:45 - 00021072 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-16 01:13 - 2014-01-07 16:07 - 01374658 _____ () C:\Windows\PFRO.log
2014-10-13 21:01 - 2013-06-24 22:20 - 00000000 ____D () C:\Users\david\AppData\Local\Spotify
2014-10-12 16:28 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-10-12 16:03 - 2013-11-23 13:09 - 00000000 ____D () C:\AdwCleaner
2014-10-12 12:48 - 2012-09-09 17:58 - 00000000 ____D () C:\Users\david\AppData\Local\Apps\2.0
2014-10-12 12:24 - 2012-06-27 19:00 - 00000784 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-10-12 12:24 - 2012-06-27 19:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2014-10-12 12:24 - 2012-06-27 19:00 - 00000000 ____D () C:\Program Files\CCleaner
2014-10-11 22:54 - 2009-07-14 05:20 - 00000000 ____D () C:\Users\Default
2014-10-11 22:48 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-10-10 21:20 - 2013-03-23 18:55 - 00000000 ____D () C:\Users\david\AppData\Local\CrashDumps
2014-10-10 19:55 - 2014-09-08 20:25 - 00000000 ____D () C:\Users\david\Desktop\Cracks
2014-10-09 21:07 - 2012-06-23 16:25 - 00000000 ____D () C:\ProgramData\Origin
2014-10-09 21:06 - 2014-08-27 23:16 - 00000000 ____D () C:\Program Files (x86)\Origin
2014-10-05 13:11 - 2014-08-11 02:34 - 00000000 ____D () C:\Users\david\Documents\BattleIslands
2014-10-04 22:03 - 2012-06-23 16:32 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-10-04 22:03 - 2012-06-23 16:32 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-10-04 22:03 - 2012-01-27 10:40 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-10-04 15:49 - 2014-01-06 03:51 - 00661582 _____ () C:\Windows\DirectX.log
2014-09-29 20:49 - 2013-09-17 19:46 - 00001349 _____ () C:\Users\Public\Desktop\GeForce Experience.lnk
2014-09-29 20:45 - 2012-06-23 20:58 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation
2014-09-29 20:44 - 2013-09-17 19:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2014-09-29 20:38 - 2012-01-27 09:33 - 00000000 ____D () C:\Program Files\NVIDIA Corporation
2014-09-29 18:38 - 2013-12-21 19:21 - 00000000 ____D () C:\Users\david\AppData\Local\NVIDIA Corporation
2014-09-29 18:34 - 2012-01-27 09:33 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation
2014-09-29 13:14 - 2012-01-27 11:20 - 00000000 ____D () C:\ProgramData\Sonic
2014-09-29 01:12 - 2012-07-18 17:29 - 00000000 ____D () C:\Users\david\AppData\Roaming\TeamViewer
2014-09-28 20:48 - 2012-10-03 16:54 - 00007599 _____ () C:\Users\david\AppData\Local\Resmon.ResmonCfg
2014-09-20 20:23 - 2012-01-27 10:58 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-09-19 05:52 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-09-18 15:15 - 2013-03-02 00:27 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-09-17 04:10 - 2013-12-21 18:53 - 02799784 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll
2014-09-17 04:10 - 2013-12-21 18:53 - 02193560 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-10-17 04:28

==================== End Of Log ============================
         

--- --- ---

--- --- ---