Win 8 - Versuchte Registryänderung

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Scan Date: 28.12.2014
Scan Time: 13:42:59
Logfile: mbam scan.txt
Administrator: Yes

Version: 2.00.4.1028
Malware Database: v2014.12.28.06
Rootkit Database: v2014.12.23.02
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 8.1
CPU: x64
File System: NTFS
User: janeisklar

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 376893
Time Elapsed: 17 min, 59 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 10
PUP.Optional.Snapdo.T, HKU\S-1-5-21-2855763909-2318779563-1536155455-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{006ee092-9658-4fd6-bd8e-a21a348e59f5}, Quarantined, [092d7eeabbc11026ae00ff18857ec33d], 
PUP.Optional.Snapdo.T, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{006EE092-9658-4FD6-BD8E-A21A348E59F5}, Quarantined, [092d7eeabbc11026ae00ff18857ec33d], 
Trojan.FakeMS.ED, HKLM\SOFTWARE\CLASSES\CLSID\{2D349E57-23E4-4A67-9624-F1DC6B65AABF}, Quarantined, [f3432345740860d64c0847aa50b152ae], 
PUP.Optional.CrossRider.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Crossrider, Quarantined, [0432e187bebefd39a74c0ac0ba4a6799], 
PUP.Optional.GeForce.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Ge-Force, Quarantined, [df57a7c1ea9285b1c1e8d106af552ad6], 
PUP.Optional.HQVideo.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\HQ-Video-Pro-2.1cV21.12, Quarantined, [1a1ce78189f3023491b2914b0ff51fe1], 
PUP.Optional.CrossRider.A, HKU\S-1-5-21-2855763909-2318779563-1536155455-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Crossrider, Quarantined, [ad899dcb611bd85eb340a228d82c827e], 
PUP.Optional.ShoppingHelper.A, HKU\S-1-5-21-2855763909-2318779563-1536155455-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SMARTBAR, Quarantined, [ba7c5315413bfb3baf5bdafe9f65c63a], 
PUP.Optional.ShopperPro, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}, Quarantined, [72c44d1b3b412d095109c8beb64f55ab], 
PUP.Optional.ShopperPro, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}, Quarantined, [72c44d1b3b412d095109c8beb64f55ab], 

Registry Values: 3
PUP.Optional.SmartBar, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR|{ae07101b-46d4-4a98-af68-0333ea26e113}, Smartbar, Quarantined, [3afcd296720a9a9ce13d165ab44f3ec2]
PUP.Optional.SmartBar, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\TOOLBAR|{ae07101b-46d4-4a98-af68-0333ea26e113}, Smartbar, Quarantined, [f73f5c0c403cb08606183a3609faed13]
PUP.Optional.ShoppingHelper.A, HKU\S-1-5-21-2855763909-2318779563-1536155455-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SMARTBAR|publisher, ShoppingHelper, Quarantined, [ba7c5315413bfb3baf5bdafe9f65c63a]

Registry Data: 7
PUP.Optional.SnapDo.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHURL|Default, hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZLLx3LpAeVW-lRGGSHpxmTbfKJHlnyK_aDwNHQOCwyOLJch7wqhi-1tfoQyLurXllxetPJfPUaBY3WvmpzdedmgeRHD-ERwsmikGWk8Tgzhg_CK0gWdVnWJQVN5biEK9uh0A59wDL7nNx5KZsM9jTataj7CahsOHuY4,&q={searchTerms}, Good: (www.google.com), Bad: (hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZLLx3LpAeVW-lRGGSHpxmTbfKJHlnyK_aDwNHQOCwyOLJch7wqhi-1tfoQyLurXllxetPJfPUaBY3WvmpzdedmgeRHD-ERwsmikGWk8Tgzhg_CK0gWdVnWJQVN5biEK9uh0A59wDL7nNx5KZsM9jTataj7CahsOHuY4,&q={searchTerms}),Replaced,[c17513550775d5619170690b82837f81]
PUP.Optional.SnapDo.A, HKU\S-1-5-21-2855763909-2318779563-1536155455-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZLLx3LpAeVW-lRGGSHpxmTbfKJHlnyK_aDwNHQOCwyOLJch7wqhi-1tfoQyLurXllxetPJfPUaBY3WvmpzdedmgeRHD-ERwsmikGWk8Tgzhg_CK0gWdVnWJQVN5biEK9uh0A59wDL7nNx5KZsM9jTataj7CahsOHuYk,&q={searchTerms}, Good: (www.google.com), Bad: (hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZLLx3LpAeVW-lRGGSHpxmTbfKJHlnyK_aDwNHQOCwyOLJch7wqhi-1tfoQyLurXllxetPJfPUaBY3WvmpzdedmgeRHD-ERwsmikGWk8Tgzhg_CK0gWdVnWJQVN5biEK9uh0A59wDL7nNx5KZsM9jTataj7CahsOHuYk,&q={searchTerms}),Replaced,[d75f75f33b4141f5798ba0d4da2b07f9]
PUP.Optional.SnapDo.A, HKU\S-1-5-21-2855763909-2318779563-1536155455-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZLLx3LpAeVW-lRGGSHpxmTbfKJHlnyK_aDwNHQOCwyOLJch7wqhi-1tfoQyLurXllxetPJfPUaBY3WvmpzdedmgeRHD-ERwsmikGWkNkWzOavfK1c5h1F1blx0g4YALiwok3ZMudnEKWQv-VhUsioWmKoJFtatiF2uE,, Good: (www.google.com), Bad: (hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZLLx3LpAeVW-lRGGSHpxmTbfKJHlnyK_aDwNHQOCwyOLJch7wqhi-1tfoQyLurXllxetPJfPUaBY3WvmpzdedmgeRHD-ERwsmikGWkNkWzOavfK1c5h1F1blx0g4YALiwok3ZMudnEKWQv-VhUsioWmKoJFtatiF2uE,),Replaced,[33034a1ef884b1854fb6cca8f70e51af]
PUP.Optional.SnapDo.A, HKU\S-1-5-21-2855763909-2318779563-1536155455-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Bar, hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZLLx3LpAeVW-lRGGSHpxmTbfKJHlnyK_aDwNHQOCwyOLJch7wqhi-1tfoQyLurXllxetPJfPUaBY3WvmpzdedmgeRHD-ERwsmikGWk8Tgzhg_CK0gWdVnWJQVN5biEK9uh0A59wDL7nNx5KZsM9jTataj7CahsOHuYk,&q={searchTerms}, Good: (www.google.com), Bad: (hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZLLx3LpAeVW-lRGGSHpxmTbfKJHlnyK_aDwNHQOCwyOLJch7wqhi-1tfoQyLurXllxetPJfPUaBY3WvmpzdedmgeRHD-ERwsmikGWk8Tgzhg_CK0gWdVnWJQVN5biEK9uh0A59wDL7nNx5KZsM9jTataj7CahsOHuYk,&q={searchTerms}),Replaced,[2f071e4a76061620a85b066e28ddb050]
PUP.Optional.SnapDo.A, HKU\S-1-5-21-2855763909-2318779563-1536155455-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH|Default_Search_URL, hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZLLx3LpAeVW-lRGGSHpxmTbfKJHlnyK_aDwNHQOCwyOLJch7wqhi-1tfoQyLurXllxetPJfPUaBY3WvmpzdedmgeRHD-ERwsmikGWk8Tgzhg_CK0gWdVnWJQVN5biEK9uh0A59wDL7nNx5KZsM9jTataj7CahsOHuYk,&q={searchTerms}, Good: (www.google.com), Bad: (hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZLLx3LpAeVW-lRGGSHpxmTbfKJHlnyK_aDwNHQOCwyOLJch7wqhi-1tfoQyLurXllxetPJfPUaBY3WvmpzdedmgeRHD-ERwsmikGWk8Tgzhg_CK0gWdVnWJQVN5biEK9uh0A59wDL7nNx5KZsM9jTataj7CahsOHuYk,&q={searchTerms}),Replaced,[9f9720485f1dee48d92df57f9570cf31]
PUP.Optional.SnapDo.A, HKU\S-1-5-21-2855763909-2318779563-1536155455-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH|SearchAssistant, hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZLLx3LpAeVW-lRGGSHpxmTbfKJHlnyK_aDwNHQOCwyOLJch7wqhi-1tfoQyLurXllxetPJfPUaBY3WvmpzdedmgeRHD-ERwsmikGWk8Tgzhg_CK0gWdVnWJQVN5biEK9uh0A59wDL7nNx5KZsM9jTataj7CahsOHuYk,&q={searchTerms}, Good: (www.google.com), Bad: (hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZLLx3LpAeVW-lRGGSHpxmTbfKJHlnyK_aDwNHQOCwyOLJch7wqhi-1tfoQyLurXllxetPJfPUaBY3WvmpzdedmgeRHD-ERwsmikGWk8Tgzhg_CK0gWdVnWJQVN5biEK9uh0A59wDL7nNx5KZsM9jTataj7CahsOHuYk,&q={searchTerms}),Replaced,[3105da8ede9e290d36d1b1c359ac827e]
PUP.Optional.SnapDo.A, HKU\S-1-5-21-2855763909-2318779563-1536155455-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHURL|Default, hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZLLx3LpAeVW-lRGGSHpxmTbfKJHlnyK_aDwNHQOCwyOLJch7wqhi-1tfoQyLurXllxetPJfPUaBY3WvmpzdedmgeRHD-ERwsmikGWk8Tgzhg_CK0gWdVnWJQVN5biEK9uh0A59wDL7nNx5KZsM9jTataj7CahsOHuYk,&q={searchTerms}, Good: (www.google.com), Bad: (hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZLLx3LpAeVW-lRGGSHpxmTbfKJHlnyK_aDwNHQOCwyOLJch7wqhi-1tfoQyLurXllxetPJfPUaBY3WvmpzdedmgeRHD-ERwsmikGWk8Tgzhg_CK0gWdVnWJQVN5biEK9uh0A59wDL7nNx5KZsM9jTataj7CahsOHuYk,&q={searchTerms}),Replaced,[4ee8491f5c20d264ad55db990afb03fd]

Folders: 0
(No malicious items detected)

Files: 8
Trojan.Ransom.ED, C:\ProgramData\EAF79594B.cpp, Quarantined, [42f4b1b7acd085b1497023dace3323dd], 
Trojan.Agent.ED, C:\ProgramData\Windows Genuine Advantage\{6BCC7DAA-0F61-4F4C-8BFA-38F32EA8636B}\powercpl31.dll, Quarantined, [96a037311a62270f6e7b1fe0b34e966a], 
Trojan.FakeMS.ED, C:\ProgramData\{F66CB4EE-546F-4D54-9332-216DE189AAB0}\d3d10core.dll, Delete-on-Reboot, [f3432345740860d64c0847aa50b152ae], 
PUP.Optional.HQVideo.A, C:\Users\janeisklar\AppData\Roaming\VIZGDEC.exe, Quarantined, [6fc7610788f4a59162488c2530d5956b], 
PUP.Optional.Sense.A, C:\Program Files (x86)\Sense\Sense-bho.dll, Quarantined, [88ae491fe09cc76fe15e4525d031eb15], 
Trojan.Ransom.ED, C:\Users\janeisklar\AppData\Local\Temp\bZKO.dll, Quarantined, [0c2a0e5a82fa6fc7e9d0af4e2fd24bb5], 
PUP.Optional.WebSearch.A, C:\Users\janeisklar\AppData\Roaming\Mozilla\Firefox\Profiles\kmpgplgm.default\searchplugins\Web Search.xml, Quarantined, [55e1e68229534de96c8e2a6cc83bdb25], 
PUP.Optional.CrossRider.A, C:\Users\janeisklar\AppData\Roaming\Mozilla\Firefox\Profiles\kmpgplgm.default\prefs.js, Good: (), Bad: (user_pref("extensions.crossrider.bic", "14a6d07cb674296d5c7cffb75ba263da");), Replaced,[fe3842260f6d83b3ca4349700afb619f]

Physical Sectors: 0
(No malicious items detected)


(end)
         

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 13:45 on 28/12/2014 (janeisklar)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
         

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-12-2014
Ran by Gast (ATTENTION: The logged in user is not administrator) on PIZZAPLANET on 28-12-2014 14:11:02
Running from C:\Users\Gast\Downloads
Loaded Profile: Gast (Available profiles: janeisklar & Gast)
Platform: Windows 8.1 Connected (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Pokki) C:\Users\Gast\AppData\Local\Pokki\Engine\StartMenuIndexer.exe
(Razer Inc.) C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe
(NOX) C:\Program Files (x86)\Ozone Gaming\Ozone Radon\Ozone_Radon.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Pokki) C:\Users\Gast\AppData\Local\Pokki\Engine\HostAppService.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Pokki) C:\Users\Gast\AppData\Local\Pokki\Engine\HostAppService.exe
(Comodo) C:\Program Files (x86)\Comodo\Dragon\dragon.exe
(Comodo) C:\Program Files (x86)\Comodo\Dragon\dragon.exe
(Comodo) C:\Program Files (x86)\Comodo\Dragon\dragon.exe
(Comodo) C:\Program Files (x86)\Comodo\Dragon\dragon.exe
(Comodo) C:\Program Files (x86)\Comodo\Dragon\dragon.exe
(Comodo) C:\Program Files (x86)\Comodo\Dragon\dragon.exe
(Comodo) C:\Program Files (x86)\Comodo\Dragon\dragon.exe
(Comodo) C:\Program Files (x86)\Comodo\Dragon\dragon.exe
(Comodo) C:\Program Files (x86)\Comodo\Dragon\dragon.exe
(Comodo) C:\Program Files (x86)\Comodo\Dragon\dragon.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13662936 2013-10-24] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_LENOVO_MICPKEY] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1368792 2013-11-13] (Realtek Semiconductor)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766688 2014-03-25] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [LVT] => C:\Program Files\Lenovo\LVT\LJYZ.exe [886112 2011-11-24] (Lenovo)
HKLM-x32\...\Run: [CLMLServer] => C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe [103720 2009-12-04] (CyberLink)
HKLM-x32\...\Run: [UpdateP2GoShortCut] => C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [214312 2011-12-06] (CyberLink Corp.)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Razer Synapse] => C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe [585536 2014-11-03] (Razer Inc.)
HKLM-x32\...\Run: [Ozone Radon Gaming Mouse] => C:\Program Files (x86)\Ozone Gaming\Ozone Radon\Ozone_Radon.exe [25473024 2011-09-28] (NOX)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [507776 2014-10-07] (Oracle Corporation)
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] => C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [3838800 2014-12-13] (LogMeIn Inc.)
HKLM-x32\...\Run: [YTDownloader] => "C:\Program Files (x86)\YTDownloader\YTDownloader.exe" /boot
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5225064 2014-12-28] (AVAST Software)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
HKLM-x32\...\RunOnce: [ Malwarebytes Anti-Malware  (cleanup)] => C:\ProgramData\Malwarebytes\ Malwarebytes Anti-Malware \mbamdor.exe [54072 2014-11-21] (Malwarebytes Corporation)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-2855763909-2318779563-1536155455-501\...\Run: [Pokki] => C:\Windows\system32\rundll32.exe "%LOCALAPPDATA%\Pokki\Engine\Launcher.dll",RunLaunchPlatform
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:60267;https=127.0.0.1:60267
ProxyEnable: [S-1-5-21-2855763909-2318779563-1536155455-501] => Internet Explorer proxy is enabled.
ProxyServer: [S-1-5-21-2855763909-2318779563-1536155455-501] => http=127.0.0.1:60267;https=127.0.0.1:60267
HKU\S-1-5-21-2855763909-2318779563-1536155455-501\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://lenovo13.msn.com/?pc=LCJB
HKU\S-1-5-21-2855763909-2318779563-1536155455-501\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://lenovo13.msn.com/?pc=LCJB
HKU\S-1-5-21-2855763909-2318779563-1536155455-501\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com
HKU\S-1-5-21-2855763909-2318779563-1536155455-501\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.lenovo.com
SearchScopes: HKLM-x32 -> DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = 
SearchScopes: HKU\S-1-5-21-2855763909-2318779563-1536155455-501 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?PC=WCUG&FORM=WCUGDF&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2855763909-2318779563-1536155455-501 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?PC=WCUG&FORM=WCUGDF&q={searchTerms}
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_15_0_0_246.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_246.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\4.0.60310.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @nitropdf.com/NitroPDF -> C:\Program Files (x86)\Nitro\Pro 9\npnitromozilla.dll (Nitro PDF)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-12-28]

Chrome: 
=======
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-12-28]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

Locked "EventLog" service could not be unlocked. <===== ATTENTION

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2014-03-25] (Advanced Micro Devices, Inc.) [File not signed]
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-12-28] (AVAST Software)
R3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [4012248 2014-12-28] (Avast Software)
S4 CGVPNCliService; C:\Program Files\CyberGhost 5\Service.exe [64616 2014-11-03] (CyberGhost S.R.L)
R2 DragonUpdater; C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe [2370240 2014-11-27] (Comodo Security Solutions, Inc.)
S4 Lenovo System Agent Service; C:\Program Files\Lenovo\iMController\SystemAgentService.exe [584960 2014-11-21] (LENOVO INCORPORATED.)
R2 lmhosts; C:\Windows\system32\svchost.exe [37768 2013-08-22] (Microsoft Corporation)
R2 lmhosts; C:\Windows\SysWOW64\svchost.exe [31552 2013-08-22] (Microsoft Corporation)
R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe [417552 2014-12-02] (LogMeIn, Inc.)
R2 NitroDriverReadSpool9; C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe [230920 2013-12-12] (Nitro PDF Software)
R2 NlaSvc; C:\Windows\System32\svchost.exe [37768 2013-08-22] (Microsoft Corporation)
R2 NlaSvc; C:\Windows\SysWOW64\svchost.exe [31552 2013-08-22] (Microsoft Corporation)
R2 nsi; C:\Windows\system32\svchost.exe [37768 2013-08-22] (Microsoft Corporation)
R2 nsi; C:\Windows\SysWOW64\svchost.exe [31552 2013-08-22] (Microsoft Corporation)
R2 Razer Game Scanner Service; C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe [183488 2014-10-31] ()
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
R2 tbaseprovisioning; C:\Windows\SysWOW64\tbaseprovisioning.exe [51712 2014-04-16] (Advanced Micro Devices, Inc.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [346872 2013-08-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23840 2013-08-22] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 amdkmcsp; C:\Windows\system32\DRIVERS\amdkmcsp.sys [85704 2014-04-16] (Advanced Micro Devices, Inc. )
R0 amdkmpfd; C:\Windows\System32\drivers\amdkmpfd.sys [36608 2014-04-16] (Advanced Micro Devices, Inc.)
R0 amdpsp; C:\Windows\System32\DRIVERS\amdpsp.sys [230088 2014-04-16] (Advanced Micro Devices, Inc. )
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-12-28] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [83280 2014-12-28] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-12-28] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-12-28] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1050432 2014-12-28] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [436624 2014-12-28] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [116728 2014-12-28] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [267632 2014-12-28] ()
R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWB6.sys [222720 2014-03-11] (Advanced Micro Devices)
R3 Hamachi; C:\Windows\system32\DRIVERS\Hamdrv.sys [45112 2014-12-13] (LogMeIn Inc.)
S3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [129752 2014-12-28] (Malwarebytes Corporation)
S3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew02.sys [4649440 2013-06-18] (Intel Corporation)
R3 rzendpt; C:\Windows\System32\drivers\rzendpt.sys [39592 2014-09-05] (Razer Inc)
R2 rzpmgrk; C:\WINDOWS\system32\drivers\rzpmgrk.sys [37184 2014-10-31] (Razer, Inc.)
R2 rzpnk; C:\WINDOWS\system32\drivers\rzpnk.sys [129600 2014-10-23] (Razer, Inc.)
R2 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [271752 2014-12-28] (Avast Software)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [124256 2013-08-22] (Microsoft Corporation)
S3 wsvd; C:\Windows\system32\DRIVERS\wsvd.sys [102376 2012-06-13] ("CyberLink)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-28 13:39 - 2014-12-28 13:42 - 00129752 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2014-12-28 13:39 - 2014-12-28 13:39 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-12-28 13:39 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2014-12-28 13:39 - 2014-11-21 06:14 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2014-12-28 13:39 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2014-12-28 13:18 - 2014-12-28 13:19 - 00000000 ____D () C:\Users\Gast
2014-12-28 13:12 - 2014-12-28 13:12 - 00000247 _____ () C:\WINDOWS\system32\2014-12-28-12-12-13.060-aswFe.exe-4244.log
2014-12-28 13:04 - 2014-12-28 13:12 - 00000247 _____ () C:\WINDOWS\system32\2014-12-28-12-04-46.021-aswFe.exe-4964.log
2014-12-28 13:04 - 2014-12-28 13:07 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-12-28 13:04 - 2014-12-28 13:04 - 00000197 _____ () C:\WINDOWS\system32\2014-12-28-12-04-42.094-AvastVBoxSVC.exe-1504.log
2014-12-28 13:04 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\WINDOWS\system32\sdnclean64.exe
2014-12-28 05:45 - 2014-12-28 14:02 - 00006102 _____ () C:\WINDOWS\PFRO.log
2014-12-28 02:48 - 2014-10-30 12:25 - 00275080 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2014-12-28 02:23 - 2014-12-28 02:23 - 00000247 _____ () C:\WINDOWS\system32\2014-12-28-01-23-41.042-aswFe.exe-8084.log
2014-12-28 02:11 - 2014-12-28 02:23 - 00000247 _____ () C:\WINDOWS\system32\2014-12-28-01-11-56.015-aswFe.exe-4244.log
2014-12-28 02:10 - 2014-12-28 02:10 - 00000197 _____ () C:\WINDOWS\system32\2014-12-28-01-10-36.020-AvastVBoxSVC.exe-8052.log
2014-12-28 01:23 - 2014-12-28 01:23 - 00364512 _____ (AVAST Software) C:\WINDOWS\system32\aswBoot.exe
2014-12-28 01:23 - 2014-12-28 01:23 - 00043152 _____ (AVAST Software) C:\WINDOWS\avastSS.scr
2014-12-28 01:10 - 2014-12-28 01:11 - 00000000 ____D () C:\WINDOWS\SysWOW64\vbox
2014-12-28 01:10 - 2014-12-28 01:11 - 00000000 ____D () C:\WINDOWS\system32\vbox
2014-12-28 01:04 - 2014-12-28 01:29 - 00000000 ____D () C:\Program Files (x86)\Google
2014-12-28 01:03 - 2014-12-28 01:23 - 01050432 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswsnx.sys
2014-12-28 01:03 - 2014-12-28 01:23 - 00436624 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSP.sys
2014-12-28 01:03 - 2014-12-28 01:23 - 00267632 _____ () C:\WINDOWS\system32\Drivers\aswVmm.sys
2014-12-28 01:03 - 2014-12-28 01:23 - 00116728 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswStm.sys
2014-12-28 01:03 - 2014-12-28 01:23 - 00093568 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswRdr2.sys
2014-12-28 01:03 - 2014-12-28 01:23 - 00083280 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswmonflt.sys
2014-12-28 01:03 - 2014-12-28 01:23 - 00065776 _____ () C:\WINDOWS\system32\Drivers\aswRvrt.sys
2014-12-28 01:03 - 2014-12-28 01:23 - 00029208 _____ () C:\WINDOWS\system32\Drivers\aswHwid.sys
2014-12-28 01:03 - 2014-12-28 01:03 - 00000000 ____D () C:\Program Files\LockHunter
2014-12-28 01:02 - 2014-12-28 01:02 - 00000000 ____D () C:\Program Files\AVAST Software
2014-12-27 22:57 - 2014-12-27 22:57 - 00057096 _____ (COMODO CA Limited) C:\WINDOWS\system32\certsentry.dll
2014-12-27 22:57 - 2014-12-27 22:57 - 00048392 _____ (COMODO CA Limited) C:\WINDOWS\SysWOW64\certsentry.dll
2014-12-27 22:57 - 2014-12-27 22:57 - 00000000 ____D () C:\Program Files (x86)\Comodo
2014-12-27 22:56 - 2014-12-27 22:56 - 01060864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfc71.dll
2014-12-27 20:16 - 2014-12-28 14:07 - 00194824 _____ () C:\WINDOWS\WindowsUpdate.log
2014-12-21 15:47 - 2014-12-21 15:47 - 00000000 ____D () C:\Program Files\CCleaner
2014-12-21 15:07 - 2014-12-21 15:07 - 00000000 _____ () C:\autoexec.bat
2014-12-21 14:23 - 2014-12-21 14:23 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-12-21 14:22 - 2014-12-28 14:01 - 00000000 ____D () C:\Program Files (x86)\Sense
2014-12-21 14:19 - 2014-12-21 15:07 - 00000000 ____D () C:\Program Files (x86)\globalUpdate
2014-12-20 17:09 - 2014-12-20 17:09 - 00000000 ____D () C:\Program Files (x86)\Helden-Software
2014-12-16 08:27 - 2014-12-16 08:27 - 00000000 ____D () C:\Program Files (x86)\LogMeIn Hamachi
2014-12-13 17:01 - 2014-12-13 17:01 - 00045112 ____H (LogMeIn Inc.) C:\WINDOWS\system32\Drivers\Hamdrv.sys
2014-12-13 13:45 - 2014-12-13 13:45 - 00066728 _____ (Eugene V. Muzychenko) C:\WINDOWS\system32\Drivers\vrtaucbl.sys
2014-12-13 13:45 - 2014-12-13 13:45 - 00000000 ____D () C:\Program Files\Virtual Audio Cable
2014-12-13 13:42 - 2014-12-13 13:42 - 00000000 ____D () C:\Program Files (x86)\WinRAR
2014-12-09 19:41 - 2014-12-09 19:41 - 00000000 ____D () C:\Program Files (x86)\TeamSpeak 3 Client
2014-12-09 14:00 - 2014-12-09 14:00 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-12-08 22:54 - 2014-12-08 22:55 - 00000000 ____D () C:\Program Files (x86)\JDownloader
2014-12-04 07:53 - 2014-12-04 07:52 - 00098216 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll
2014-12-04 07:52 - 2014-12-04 07:52 - 00000000 ____D () C:\Program Files (x86)\Java
2014-12-01 11:21 - 2014-12-01 11:29 - 00000000 ____D () C:\rads

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-28 14:09 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2014-12-28 14:04 - 2014-08-14 13:10 - 01948257 _____ () C:\WINDOWS\SysWOW64\rootpa.e2e
2014-12-28 14:02 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\InputMethod
2014-12-28 14:00 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2014-12-28 13:45 - 2014-11-15 18:09 - 00000000 ____D () C:\Users\janeisklar
2014-12-28 11:46 - 2013-08-22 16:36 - 00000000 ____D () C:\Program Files\Common Files\System
2014-12-28 05:46 - 2013-08-22 15:44 - 00374456 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2014-12-28 00:45 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\migwiz
2014-12-21 15:51 - 2013-08-22 16:36 - 00000000 ___HD () C:\WINDOWS\system32\GroupPolicy
2014-12-21 15:51 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\SysWOW64\GroupPolicy
2014-12-21 15:48 - 2014-11-16 20:17 - 00000000 ____D () C:\WINDOWS\Minidump
2014-12-21 15:48 - 2014-04-02 18:34 - 00000000 ____D () C:\WINDOWS\Panther
2014-12-18 11:55 - 2014-08-14 22:50 - 00764340 _____ () C:\WINDOWS\system32\perfh007.dat
2014-12-18 11:55 - 2014-08-14 22:50 - 00159160 _____ () C:\WINDOWS\system32\perfc007.dat
2014-12-18 11:55 - 2014-03-18 10:53 - 01776918 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2014-12-10 07:55 - 2014-11-15 18:34 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-12-08 15:14 - 2014-11-16 08:42 - 00000000 ____D () C:\mukke
2014-12-07 23:52 - 2014-11-16 13:22 - 00000000 ____D () C:\Program Files (x86)\EA Games

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

==================== End Of Log ============================
         

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 27-12-2014
Ran by Gast at 2014-12-28 13:49:55
Running from C:\Users\Gast\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)


==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.246 - Adobe Systems Incorporated)
AMD Catalyst Install Manager (HKLM\...\{A0EE5DB1-8E1F-7BB2-6734-9CDC5E8DF0DD}) (Version: 8.0.916.0 - Advanced Micro Devices, Inc.)
Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 10.0.2208 - AVAST Software)
BEACON (HKLM-x32\...\{259BF8E7-28DB-461F-8D7F-7B6E267D2502}_is1) (Version: 1.4.0509.0 - Lenovo Inc.)
CCleaner (HKLM\...\CCleaner) (Version: 5.00 - Piriform)
Comodo Dragon (HKLM-x32\...\Comodo Dragon) (Version: 36.1.1.21 - Comodo)
CyberGhost 5 (HKLM\...\CyberGhost 5_is1) (Version:  - CyberGhost S.R.L.)
Dependency Package Update (Version: 1.6.29.00 - Lenovo Inc.) Hidden
Dependency Package Update (Version: 1.6.32.00 - Lenovo Inc.) Hidden
Dependency Package Update (x32 Version: 1.6.32.00 - Lenovo Group Limited) Hidden
Driver & Application Installation (HKLM-x32\...\{BFECCF2A-F094-4066-8BFA-29CCBB7F6602}) (Version: 6.13.0621 - Lenovo)
foobar2000 v1.3.5 (HKLM-x32\...\foobar2000) (Version: 1.3.5 - Peter Pawlowski)
Java 8 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)
JDownloader 0.9 (HKLM-x32\...\5513-1208-7298-9440) (Version: 0.9 - AppWork GmbH)
League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games )
League of Legends (x32 Version: 3.0.1 - Riot Games ) Hidden
Lenovo Assistant (HKLM-x32\...\{B2DE4F30-B8C7-49C0-85B9-2F37A5290F00}) (Version: 2.0.0.29 - Lenovo)
Lenovo Dependency Package (HKLM\...\Lenovo Dependency Package_is1) (Version: 1.6.32.00 - Lenovo Group Limited)
Lenovo Experience Improvement (HKLM\...\LenovoExperienceImprovement) (Version: 1.0.19.0 - Lenovo)
Lenovo Power2Go (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.0.7408 - CyberLink Corp.)
Lenovo Power2Go (x32 Version: 6.0.7408 - CyberLink Corp.) Hidden
Lenovo Rescue System (HKLM-x32\...\InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}) (Version: 4.0.0.1901 - CyberLink Corp.)
Lenovo Rescue System (Version: 4.0.0.1901 - CyberLink Corp.) Hidden
Lenovo Web Start (HKU\S-1-5-21-2855763909-2318779563-1536155455-501\...\Pokki_04bb6df446330549a2cb8d67fbd1a745025b7bd1) (Version: 1.0.1.52728 - Pokki)
Lenovo Web Start (HKU\S-1-5-21-2855763909-2318779563-1536155455-501-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Pokki_04bb6df446330549a2cb8d67fbd1a745025b7bd1) (Version: 1.0.1.52728 - Pokki)
LockHunter 3.1, 32/64 bit (HKLM\...\LockHunter_is1) (Version:  - Crystal Rich Ltd)
LogMeIn Hamachi (HKLM-x32\...\LogMeIn Hamachi) (Version: 2.2.0.291 - LogMeIn, Inc.)
LogMeIn Hamachi (x32 Version: 2.2.0.291 - LogMeIn, Inc.) Hidden
LVT (HKLM-x32\...\{9E3469A6-443A-452C-BF44-8D7CE3A9A7E2}) (Version: 5.00.0914 - Lenovo)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 4.0.60310.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Mozilla Firefox 34.0.5 (x86 de) (HKLM-x32\...\Mozilla Firefox 34.0.5 (x86 de)) (Version: 34.0.5 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 33.1.1 - Mozilla)
MSXML4 Parser (HKLM-x32\...\{01501EBA-EC35-4F9F-8889-3BE346E5DA13}) (Version: 1.0.0 - Microsoft Game Studios)
Nitro Pro 9 (HKLM\...\{4C32F7E8-A65F-4D3C-9153-9F3B57CB6872}) (Version: 9.0.5.9 - Nitro)
NVIDIA PhysX v8.10.17 (HKLM-x32\...\{E4D15328-8C89-484B-B9AA-F5BE9EA6D01C}) (Version: 8.10.17 - NVIDIA Corporation)
Ozone Radon (HKLM-x32\...\{B50AB875-64A2-4D12-BB48-B15611B48CE0}) (Version: 1.0.0 - Ozone Gaming)
PSP Application (Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Razer Synapse 2.0 (HKLM-x32\...\{0D78BEE2-F8FF-4498-AF1A-3FF81CED8AC6}) (Version: 1.18.18.23036 - Razer Inc.)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9600.39054 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.18.621.2013 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7106 - Realtek Semiconductor Corp.)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
Startmenü (HKU\S-1-5-21-2855763909-2318779563-1536155455-501\...\Pokki) (Version: 0.268.2.183 - Pokki)
Startmenü (HKU\S-1-5-21-2855763909-2318779563-1536155455-501-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Pokki) (Version: 0.268.2.183 - Pokki)
TeamSpeak 3 Client (HKLM-x32\...\TeamSpeak 3 Client) (Version: 3.0.16 - TeamSpeak Systems GmbH)
Virtual Audio Cable 4.10 (HKLM\...\Virtual Audio Cable 4.10) (Version:  - )
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN)
WinRAR 5.20 (32-Bit) (HKLM-x32\...\WinRAR archiver) (Version: 5.20.0 - win.rar GmbH)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

Could not list restore points.
Check "winmgmt" service or repair WMI.


==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 14:25 - 2013-08-22 14:25 - 00000824 ____N C:\WINDOWS\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)


==================== Loaded Modules (whitelisted) =============

2014-03-25 09:23 - 2014-03-25 09:23 - 00102400 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\Windows:nlsPreferences

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Hamachi2Svc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\Services: CGVPNCliService => 2
MSCONFIG\Services: Lenovo System Agent Service => 2
MSCONFIG\Services: MpsSvc => 2
HKLM\...\StartupApproved\StartupFolder: => "FamilySafetyGuide.lnk"
HKLM\...\StartupApproved\Run32: => "CLMLServer"
HKLM\...\StartupApproved\Run32: => "LVT"
HKLM\...\StartupApproved\Run32: => "jmekey"
HKLM\...\StartupApproved\Run32: => "mcpltui_exe"
HKLM\...\StartupApproved\Run32: => "UpdateP2GoShortCut"
HKLM\...\StartupApproved\Run32: => "jmesoft"
HKLM\...\StartupApproved\Run32: => "LogMeIn Hamachi Ui"
HKLM\...\StartupApproved\Run32: => "SunJavaUpdateSched"
HKLM\...\StartupApproved\Run32: => "SPDriver"
HKLM\...\StartupApproved\Run32: => "YTDownloader"

========================= Accounts: ==========================


==================== Faulty Device Manager Devices =============

Could not list Devices. Check "winmgmt" service or repair WMI.


==================== Event log errors: =========================

Could not start eventlog service, could not read events.

Systemfehler 5 aufgetreten.

Zugriff verweigert


==================== Memory info =========================== 

Processor: AMD A6-6310 APU with AMD Radeon R4 Graphics 
Percentage of memory in use: 62%
Total physical RAM: 3518.09 MB
Available physical RAM: 1306.25 MB
Total Pagefile: 4414.09 MB
Available Pagefile: 1635.6 MB
Total Virtual: 131072 MB
Available Virtual: 131071.8 MB

==================== Drives ================================

Drive c: (Windows8_OS) (Fixed) (Total:439.5 GB) (Free:319.55 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

==================== End Of Log ============================
         

C:\WINDOWS\system32\config\system: Der Prozess kann nicht auf die Dateien zugreifen, da sie von einem anderen Prozess verwendet werden.
         

Fehler beim Laden des Moduls 
"C:\ProgramData\MojjUtaw\WetayOdewu.atw".

Stellen sie sicher, dass die Binärdatei am angegeben 
Pfad gespeichert ist, oder debuggen Sie die Datei, um 
Probleme mit der binären Datei oder abhängigen 
DLL-Dateien auszuschließen.

Der Vorgang konnte nicht erfolgreich abgeschlossen 
werden, da die Datei einen Virus oder möglicherweise
unerwünschte Software enthält
         

Problem beim Starten von C:\PROGRA~3\EAF79594b.cpp
Das angegebene Modul wurde nicht gefunden.
         

12/28/2014 11:34
Prüfung aller lokalen Laufwerke

Datei C:\Program Files\Common Files\System\SysMenu64.dll ist infiziert von Win32:Adware-CDO [PUP], Gelöscht
Datei C:\Users\janeisklar\AppData\Local\Microsoft\Windows\INetCache\IE\1YCP6HRJ\2A705B474D5945352B6D2143707D7D516779E5B95F32A784A51EA2FF1B3596D4B0BAFEC92FC04C2D60C32949C163F0E0[1].htm ist infiziert von HTML:RedirBA-inf [Trj], In Container verschoben
Datei C:\Users\janeisklar\AppData\Local\Microsoft\Windows\INetCache\IE\1YCP6HRJ\8SXAGZ9F.htm ist infiziert von HTML:Iframe-inf, In Container verschoben
Datei C:\Users\janeisklar\AppData\Local\Microsoft\Windows\INetCache\IE\1YCP6HRJ\ads[3].htm ist infiziert von JS:ScriptIP-inf [Trj], Gelöscht
Datei C:\Users\janeisklar\AppData\Local\Microsoft\Windows\INetCache\IE\AAXFUOCO\0H5D97HS.htm ist infiziert von HTML:Iframe-inf, In Container verschoben
Datei C:\Users\janeisklar\AppData\Local\Microsoft\Windows\INetCache\IE\AAXFUOCO\DZX1JPSG.htm ist infiziert von HTML:Iframe-inf, In Container verschoben
Datei C:\Users\janeisklar\AppData\Local\Microsoft\Windows\INetCache\IE\AAXFUOCO\HGPFF8BA.htm ist infiziert von HTML:Iframe-inf, In Container verschoben
Datei C:\Users\janeisklar\AppData\Local\Microsoft\Windows\INetCache\IE\AAXFUOCO\V4VJWICQ.htm ist infiziert von HTML:Iframe-inf, In Container verschoben
Datei C:\Users\janeisklar\AppData\Local\Microsoft\Windows\INetCache\IE\BVB1K5PU\ads[4].htm ist infiziert von JS:ScriptIP-inf [Trj], In Container verschoben
Datei C:\Users\janeisklar\AppData\Local\Microsoft\Windows\INetCache\IE\GEFHBFT4\15ZH2VMU.htm ist infiziert von HTML:Iframe-inf, Gelöscht
Datei C:\Users\janeisklar\AppData\Local\Microsoft\Windows\INetCache\IE\GEFHBFT4\ads[2].htm ist infiziert von JS:ScriptIP-inf [Trj], In Container verschoben
Datei C:\Users\janeisklar\AppData\Local\Microsoft\Windows\INetCache\IE\GEFHBFT4\ads[3].htm ist infiziert von JS:ScriptIP-inf [Trj], In Container verschoben
Datei C:\Users\janeisklar\AppData\Local\Microsoft\Windows\INetCache\IE\GEFHBFT4\GPLMM73O.htm ist infiziert von HTML:Iframe-inf, Gelöscht
Datei C:\Users\janeisklar\AppData\Local\Microsoft\Windows\INetCache\IE\GEFHBFT4\KFMCAR1Y.htm ist infiziert von HTML:Iframe-inf, Gelöscht
Datei C:\Users\janeisklar\AppData\Local\Microsoft\Windows\INetCache\IE\GEFHBFT4\S1XTQDGI.htm ist infiziert von HTML:Iframe-inf, Gelöscht
Datei C:\Users\janeisklar\AppData\Local\Microsoft\Windows\INetCache\IE\KAI3YID8\L6BM1C80.htm ist infiziert von HTML:Iframe-inf, Gelöscht
Datei C:\Users\janeisklar\AppData\Local\Microsoft\Windows\INetCache\IE\TB8IZ766\bush-hospital[1].htm ist infiziert von HTML:Iframe-inf, Gelöscht
Datei C:\Users\janeisklar\AppData\Local\Microsoft\Windows\INetCache\IE\TB8IZ766\E5BKMDV0.htm ist infiziert von HTML:Iframe-inf, Gelöscht
Datei C:\Users\janeisklar\AppData\Local\Microsoft\Windows\INetCache\IE\TB8IZ766\js[1].js ist infiziert von JS:ScriptPE-inf [Trj], Gelöscht
Datei C:\Users\janeisklar\AppData\Local\Microsoft\Windows\INetCache\IE\TB8IZ766\KCCKG8SB.htm ist infiziert von HTML:Iframe-inf, Gelöscht
Datei C:\Users\janeisklar\AppData\Local\Microsoft\Windows\INetCache\IE\TB8IZ766\U51OF1YE.htm ist infiziert von HTML:Iframe-inf, Gelöscht
Datei C:\Users\janeisklar\AppData\Local\Microsoft\Windows\INetCache\IE\V8ZLP8Y6\RAZ2X6S4.htm ist infiziert von HTML:Iframe-inf, Gelöscht
Datei C:\Users\janeisklar\AppData\Local\Microsoft\Windows\INetCache\IE\X1IHDP50\ads[1].htm ist infiziert von JS:ScriptIP-inf [Trj], In Container verschoben
Datei C:\Users\janeisklar\AppData\Local\Microsoft\Windows\INetCache\IE\X1IHDP50\ads[2].htm ist infiziert von JS:ScriptIP-inf [Trj], In Container verschoben
Datei C:\Users\janeisklar\AppData\Local\Microsoft\Windows\INetCache\IE\X1IHDP50\IU2XVET5.htm ist infiziert von HTML:Iframe-inf, Gelöscht
Datei C:\Users\janeisklar\AppData\Local\Microsoft\Windows\INetCache\IE\X1IHDP50\IWMP8EAH.htm ist infiziert von HTML:Iframe-inf, Gelöscht
Datei C:\Users\janeisklar\AppData\Local\Temp\627D.tmp ist infiziert von Win32:Malware-gen, Gelöscht
Datei C:\Users\janeisklar\AppData\Local\Temp\UpdateFlashPlayer_f48a8679.exe ist infiziert von Win32:MalOb-HX [Cryp], Gelöscht
Datei C:\Users\janeisklar\AppData\Roaming\EIZDOGM.exe ist infiziert von Win32:Malware-gen, Gelöscht
Datei C:\Users\janeisklar\AppData\Roaming\FRVOIK.exe ist infiziert von Win32:Trojan-gen, Gelöscht
Datei C:\Users\janeisklar\AppData\Roaming\WF.exe ist infiziert von Win32:Malware-gen, Gelöscht
Anzahl durchsuchter Ordner: 48632
Anzahl der geprüften Dateien: 441371
Anzahl infizierter Dateien: 31