AntiViren Programme lassen sich nicht starten/installieren. Und beim MicrosoftSecurityCenter kann ich den EchtzeitSchutz nicht aktivieren!

SynexTV · 07.06.2015, 11:29

Hallo erstmal,

ich habe nun das Problem das ich egal welches AntiViren Programm nicht mehr starten kann. Und da ich vermute, das dies mit einer/mehreren Vire/n zusammenhängt melde ich mich hier.
Es kommt immer die Meldung: "Auf das angegebene Gerät, bzw. den Pfad oder die Datei kann nicht zugegriffen werden. Sie verfügen eventuell nicht über ausreichende Berechtigungen, um auf das Element zugreifen zu können." - Dies ist so obwohl ich an den Berechtigungen im Programm/Datei Vollzugriff für mein Benutzer drin habe (Adminitrator bin ich immer gewesen).

Diese Meldung kommt aber nicht, wenn ich den Microsoft Security Center starte.
Den der hat nur den Echtzeitschutz deaktiviert. Wenn ich diesen aktiviere bekomm ich aber nach einer Zeit die Meldung: "Der Echtzeitschutz konnte nicht aktiviert werden. Dieser Vorgang wurde wegen Zeitüberschreitung zurückgegeben." bei dem normalen Suchverlauf bei dem Programm (MSC) wird nichts gefunden.

Bis jetzt habe ich eine Logfile mit FSS und eine Logfile mit OTL:

OTL-File:

OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 07.06.2015 12:03:39 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = D:\DATEN\David\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.11.9600.17801)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
7,89 Gb Total Physical Memory | 4,20 Gb Available Physical Memory | 53,22% Memory free
15,89 Gb Paging File | 12,01 Gb Available in Paging File | 75,58% Paging File free
Paging file location(s): d:\pagefile.sys 8192 8192 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 107,32 Gb Total Space | 5,81 Gb Free Space | 5,41% Space Free | Partition Type: NTFS
Drive D: | 931,51 Gb Total Space | 136,56 Gb Free Space | 14,66% Space Free | Partition Type: NTFS
Drive E: | 7,55 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
 
Computer Name: BLACKMATRIX | User Name: David | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - D:\DATEN\David\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)
PRC - C:\Program Files (x86)\Google\Update\1.3.27.5\GoogleCrashHandler.exe (Google Inc.)
PRC - C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe (Microsoft Corporation)
PRC - C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe (Microsoft Corporation)
PRC - C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe (TeamViewer GmbH)
PRC - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
PRC - D:\DATEN\Razer Cortex\RzKLService.exe (Razer Inc.)
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Programme\CyberGhost 5\Service.exe (CyberGhost S.R.L)
PRC - C:\Windows\SysWOW64\PnkBstrA.exe ()
PRC - D:\XAMPP\mysql\bin\mysqld.exe ()
PRC - D:\XAMPP\apache\bin\httpd.exe (Apache Software Foundation)
PRC - C:\Program Files (x86)\BlueStacks\HD-UpdaterService.exe (BlueStack Systems, Inc.)
PRC - C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe (BlueStack Systems, Inc.)
PRC - C:\Users\David\usbdriver\25_escape\conn\ss_conn_service.exe (DEVGURU Co., LTD.)
PRC - C:\Programme\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
PRC - C:\Programme\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe (Intel Corporation)
PRC - D:\XAMPP\FileZillaFTP\FileZillaServer.exe (FileZilla Project)
PRC - C:\Program Files (x86)\avmwlanstick\WlanNetService.exe (AVM Berlin)
PRC - C:\Program Files (x86)\Hama\Wireless LAN RTL8188CU\RtWlan.exe (Realtek Semiconductor Corp.)
PRC - C:\Program Files (x86)\Hama\Wireless LAN RTL8188CU\RtlService.exe (Realtek)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.81\PepperFlash\pepflashplayer.dll ()
MOD - C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.81\libglesv2.dll ()
MOD - C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.81\libegl.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Servf73e6522#\8d17de4cf6bd55506c509502178d2c20\System.ServiceModel.Web.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.IdentityModel\dd7948371a8babd1bc4291924ec94d05\System.IdentityModel.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.ServiceModel\a78078ff6ff0c28ef3bf65bd84e193f0\System.ServiceModel.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\a0b4e6b92d9c147d801a6f2e3a15080b\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\c61bafa9d029e3f2bf83bd5af3f1f5ac\System.Core.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\908075c4922acdf834c67ac802814c9d\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System\d18e2115a3270f89663fce831547f534\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\93a0883923e78cc3e80b7ac4a9768c60\SMDiagnostics.ni.dll ()
MOD - C:\Program Files (x86)\NVIDIA Corporation\Update Core\detoured.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\187177229c00aec6dec613ea4b9ff209\System.Runtime.Serialization.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Servd1dec626#\14cc73701aac461eb89d6473a88fcd56\System.ServiceModel.Internals.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\1196cc375887ce75f134047505fe19bf\System.Xaml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\3d6ee4ffbd9a86ac1e7b01800b6fe9c7\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\dd2f9ea99ac0f984b9dc430824638c9f\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\d1265d6159ea876f9d63ea4c1361b587\mscorlib.ni.dll ()
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - (DiagTrack) -- C:\Windows\SysNative\diagtrack.dll (Microsoft Corporation)
SRV:64bit: - (IEEtwCollectorService) -- C:\Windows\SysNative\IEEtwCollector.exe (Microsoft Corporation)
SRV:64bit: - (igfxCUIService1.0.0.0) -- C:\Windows\SysNative\igfxCUIService.exe (Intel Corporation)
SRV:64bit: - (AppleChargerSrv) -- C:\Windows\SysNative\AppleChargerSrv.exe ()
SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV:64bit: - (f8794fcc) -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (Razer Game Scanner Service) -- C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe ()
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (c2cpnrsvc) -- C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe (Microsoft Corporation)
SRV - (c2cautoupdatesvc) -- C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe (Microsoft Corporation)
SRV - (NisSrv) -- C:\Programme\Microsoft Security Client\NisSrv.exe (Microsoft Corporation)
SRV - (MsMpSvc) -- C:\Programme\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)
SRV - (AdobeUpdateService) -- C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe (Adobe Systems Incorporated)
SRV - (TeamViewer) -- C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (NvNetworkService) -- C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe (NVIDIA Corporation)
SRV - (GfExperienceService) -- C:\Programme\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe (NVIDIA Corporation)
SRV - (NvStreamSvc) -- C:\Programme\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (NVIDIA Corporation)
SRV - (cphs) -- C:\Windows\SysWOW64\IntelCpHeciSvc.exe (Intel Corporation)
SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (Stereo Service) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (RzKLService) -- D:\DATEN\Razer Cortex\RzKLService.exe (Razer Inc.)
SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (CGVPNCliService) -- C:\Programme\CyberGhost 5\Service.exe (CyberGhost S.R.L)
SRV - (PnkBstrA) -- C:\Windows\SysWOW64\PnkBstrA.exe ()
SRV - (mysql) -- D:\XAMPP\mysql\bin\mysqld.exe ()
SRV - (Apache2.4) -- D:\XAMPP\apache\bin\httpd.exe (Apache Software Foundation)
SRV - (BstHdUpdaterSvc) -- C:\Program Files (x86)\BlueStacks\HD-UpdaterService.exe (BlueStack Systems, Inc.)
SRV - (BstHdLogRotatorSvc) -- C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe (BlueStack Systems, Inc.)
SRV - (BstHdAndroidSvc) -- C:\Program Files (x86)\BlueStacks\HD-Service.exe (BlueStack Systems, Inc.)
SRV - (ss_conn_service) -- C:\Users\David\usbdriver\25_escape\conn\ss_conn_service.exe (DEVGURU Co., LTD.)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (IAStorDataMgrSvc) -- C:\Programme\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
SRV - (LMS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)
SRV - (jhi_service) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe (Intel Corporation)
SRV - (Intel(R) -- C:\Programme\Intel\iCLS Client\SocketHeciServer.exe (Intel(R) Corporation)
SRV - (Intel(R) -- C:\Programme\Intel\iCLS Client\HeciServer.exe (Intel(R) Corporation)
SRV - (wlidsvc) -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.)
SRV - (FileZilla Server) -- D:\XAMPP\FileZillaFTP\FileZillaServer.exe (FileZilla Project)
SRV - (AVM WLAN Connection Service) -- C:\Program Files (x86)\avmwlanstick\WlanNetService.exe (AVM Berlin)
SRV - (Realtek11nCU) -- C:\Program Files (x86)\Hama\Wireless LAN RTL8188CU\RtlService.exe (Realtek)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (MWAC) -- C:\Windows\SysNative\drivers\ [2015.06.05 13:29:03 | 000,000,000 | ---D | M]
DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\ [2015.06.05 13:29:03 | 000,000,000 | ---D | M]
DRV:64bit: - (epp64) -- C:\Windows\SysNative\drivers\epp64.sys (Emsisoft GmbH)
DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)
DRV:64bit: - (NisDrv) -- C:\Windows\SysNative\drivers\NisDrvWFP.sys (Microsoft Corporation)
DRV:64bit: - (rzpmgrk) -- C:\Windows\SysNative\drivers\rzpmgrk.sys (Razer, Inc.)
DRV:64bit: - (NVHDA) -- C:\Windows\SysNative\drivers\nvhda64v.sys (NVIDIA Corporation)
DRV:64bit: - (rzudd) -- C:\Windows\SysNative\drivers\rzudd.sys (Razer Inc)
DRV:64bit: - (rzendpt) -- C:\Windows\SysNative\drivers\rzendpt.sys (Razer Inc)
DRV:64bit: - (rzpnk) -- C:\Windows\SysNative\drivers\rzpnk.sys (Razer, Inc.)
DRV:64bit: - (nvvad_WaveExtensible) -- C:\Windows\SysNative\drivers\nvvad64v.sys (NVIDIA Corporation)
DRV:64bit: - (EuMusDesignVirtualAudioCableWdm) -- C:\Windows\SysNative\drivers\vrtaucbl.sys (Eugene V. Muzychenko)
DRV:64bit: - (netfilter64) -- C:\Windows\SysNative\drivers\netfilter64.sys (NetFilterSDK.com)
DRV:64bit: - (XSplit_Dummy) -- C:\Windows\SysNative\drivers\xspltspk.sys (SplitmediaLabs Limited)
DRV:64bit: - (ssudmdm) -- C:\Windows\SysNative\drivers\ssudmdm.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV:64bit: - (dg_ssudbus) -- C:\Windows\SysNative\drivers\ssudbus.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV:64bit: - (taphss6) -- C:\Windows\SysNative\drivers\taphss6.sys (Anchorfree Inc.)
DRV:64bit: - (usbrndis6) -- C:\Windows\SysNative\drivers\usb80236.sys (Microsoft Corporation)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (IntcDAud) -- C:\Windows\SysNative\drivers\IntcDAud.sys (Intel(R) Corporation)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (tap0901) -- C:\Windows\SysNative\drivers\tap0901.sys (The OpenVPN Project)
DRV:64bit: - (VClone) -- C:\Windows\SysNative\drivers\VClone.sys (Elaborate Bytes AG)
DRV:64bit: - (UsbCharger) -- C:\Windows\SysNative\drivers\UsbCharger.sys ()
DRV:64bit: - (iaStorA) -- C:\Windows\SysNative\drivers\iaStorA.sys (Intel Corporation)
DRV:64bit: - (iaStorF) -- C:\Windows\SysNative\drivers\iaStorF.sys (Intel Corporation)
DRV:64bit: - (iusb3hcs) -- C:\Windows\SysNative\drivers\iusb3hcs.sys (Intel Corporation)
DRV:64bit: - (iusb3xhc) -- C:\Windows\SysNative\drivers\iusb3xhc.sys (Intel Corporation)
DRV:64bit: - (iusb3hub) -- C:\Windows\SysNative\drivers\iusb3hub.sys (Intel Corporation)
DRV:64bit: - (LADF_RenderOnly) -- C:\Windows\SysNative\drivers\ladfGSRamd64.sys (Logitech)
DRV:64bit: - (LADF_CaptureOnly) -- C:\Windows\SysNative\drivers\ladfGSCamd64.sys (Logitech)
DRV:64bit: - (MEIx64) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (ElbyCDIO) -- C:\Windows\SysNative\drivers\ElbyCDIO.sys (Elaborate Bytes AG)
DRV:64bit: - (AppleCharger) -- C:\Windows\SysNative\drivers\AppleCharger.sys ()
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek                                            )
DRV:64bit: - (RdpVideoMiniport) -- C:\Windows\SysNative\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV:64bit: - (TsUsbGD) -- C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)
DRV:64bit: - (ScreamBAudioSvc) -- C:\Windows\SysNative\drivers\ScreamingBAudio64.sys (Screaming Bee LLC)
DRV:64bit: - (PxHlpa64) -- C:\Windows\SysNative\drivers\PxHlpa64.sys (Corel Corporation)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (dmvsc) -- C:\Windows\SysNative\drivers\dmvsc.sys (Microsoft Corporation)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (FWLANUSB) -- C:\Windows\SysNative\drivers\fwlanusb.sys (AVM GmbH)
DRV:64bit: - (avmeject) -- C:\Windows\SysNative\drivers\avmeject.sys (AVM Berlin)
DRV:64bit: - (RTL8192cu) -- C:\Windows\SysNative\drivers\RTL8192cu.sys (Realtek Semiconductor Corporation                           )
DRV:64bit: - (KovaPlusFltr) -- C:\Windows\SysNative\drivers\KovaPlusFltr.sys (ROCCAT Development, Inc.)
DRV:64bit: - (LGVirHid) -- C:\Windows\SysNative\drivers\LGVirHid.sys (Logitech Inc.)
DRV:64bit: - (LGBusEnum) -- C:\Windows\SysNative\drivers\LGBusEnum.sys (Logitech Inc.)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (hamachi) -- C:\Windows\SysNative\drivers\hamachi.sys (LogMeIn, Inc.)
DRV - (NvStreamKms) -- C:\Programme\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys (NVIDIA Corporation)
DRV - (BstHdDrv) -- C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys (BlueStack Systems)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = www.google.com
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = www.google.com
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = www.google.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = www.google.com
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = Preserve
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = www.google.com
IE - HKCU\..\SearchScopes,DefaultScope = {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=SamsungXSSDX840XEVOX120GB_S1D5NSAF121893F&ts=1427816371&type=default&q={searchTerms}
IE - HKCU\..\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}: "URL" = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=SamsungXSSDX840XEVOX120GB_S1D5NSAF121893F&ts=1427816371&type=default&q={searchTerms}
IE - HKCU\..\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}: "URL" = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=SamsungXSSDX840XEVOX120GB_S1D5NSAF121893F&ts=1427816371&type=default&q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <-loopback>
 
========== FireFox ==========
 
FF - prefs.js..browser.search.isUS: false
FF - prefs.js..browser.search.searchengine.alias: "mystartsearch"
FF - prefs.js..browser.search.searchengine.desc: "this is my first firefox searchEngine"
FF - prefs.js..browser.search.searchengine.iconURL: "hxxp://www.mystartsearch.com/favicon.ico"
FF - prefs.js..browser.search.searchengine.name: "mystartsearch"
FF - prefs.js..browser.search.searchengine.ptid: "cmi"
FF - prefs.js..browser.search.searchengine.uid: "SamsungXSSDX840XEVOX120GB_S1D5NSAF121893F"
FF - prefs.js..browser.search.searchengine.url: "hxxp://www.mystartsearch.com/web/?type=ds&ts=1427816256&from=cmi&uid=SamsungXSSDX840XEVOX120GB_S1D5NSAF121893F&q={searchTerms}"
FF - prefs.js..browser.search.selectedEngine: "mystartsearch"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..extensions.enabledAddons: SQLiteManager%40mrinalkant.blogspot.com:0.8.3
FF - prefs.js..extensions.enabledAddons: d4db60df25f14dae9dd18%40185c395f9e794c9ab86be3eb.com:0.95.26
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:35.0.1
 
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_188.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.75.2: C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.75.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll ( Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\adobe.com/AdobeAAMDetect: C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll (Adobe Systems)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_188.dll ()
FF - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF - HKLM\Software\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI ipt;version=3.0.72: C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF - HKLM\Software\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI updater: C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=16.4.3508.0205: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.5: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.1.3: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKLM\Software\MozillaPlugins\adobe.com/AdobeAAMDetect: C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll (Adobe Systems)
FF - HKCU\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\David\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll File not found
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2014.02.23 17:46:59 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2014.02.23 17:46:59 | 000,000,000 | ---D | M]
 
[2015.02.02 19:22:08 | 000,000,000 | ---D | M] (No name found) -- C:\Users\David\AppData\Roaming\mozilla\Extensions
[2015.04.12 12:08:54 | 000,000,000 | ---D | M] (No name found) -- C:\Users\David\AppData\Roaming\mozilla\Firefox\Profiles\3e36n754.default\extensions
[2015.03.01 15:05:33 | 000,000,000 | ---D | M] (Hotspot Shield) -- C:\Users\David\AppData\Roaming\mozilla\Firefox\Profiles\3e36n754.default\extensions\{c95a4e8e-816d-4655-8c79-d736da1adb6d}
[2015.05.28 15:40:42 | 000,000,000 | ---D | M] (No name found) -- C:\Users\David\AppData\Roaming\mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com
[2015.04.10 15:53:32 | 000,000,000 | ---D | M] (No name found) -- C:\Users\David\AppData\Roaming\mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData
[2015.04.30 16:55:40 | 000,000,000 | ---D | M] (No name found) -- C:\Users\David\AppData\Roaming\mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins
[2015.04.10 15:53:32 | 000,000,000 | ---D | M] (No name found) -- C:\Users\David\AppData\Roaming\mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\userCode
[2015.03.30 18:38:39 | 000,256,855 | ---- | M] () (No name found) -- C:\Users\David\AppData\Roaming\mozilla\firefox\profiles\3e36n754.default\extensions\SQLiteManager@mrinalkant.blogspot.com.xpi
[2014.04.19 15:12:16 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2015.04.27 17:17:19 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\browser\extensions
 
========== Chrome  ==========
 
CHR - Extension: No name found = C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\
CHR - Extension: No name found = C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\
CHR - Extension: No name found = C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\
CHR - Extension: No name found = C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.30_0\
CHR - Extension: No name found = C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik\2.2015.522.11440_0\
CHR - Extension: No name found = C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg\0.3.0.5_0\
CHR - Extension: No name found = C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkcedibhemacmilmkpndpkoidlnmgngg\1.0_0\
CHR - Extension: No name found = C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.1.0_0\
CHR - Extension: No name found = C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\
 
O1 HOSTS File: ([2014.07.17 12:20:50 | 000,000,864 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 activation.cloud.techsmith.com
O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2:64bit: - BHO: (Skype Click to Call for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (Skype Click to Call for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [IAStorIcon] C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe ()
O4:64bit: - HKLM..\Run: [Launch LCore] C:\Program Files\Logitech Gaming Software\LCore.exe (Logitech Inc.)
O4:64bit: - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [NvBackend] C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe (NVIDIA Corporation)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [ShadowPlay] C:\Windows\SysNative\nvspcap64.dll (NVIDIA Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisallowRun = 1
O9:64bit: - Extra Button: Skype Click to Call settings - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
O9 - Extra Button: Skype Click to Call settings - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: clonewarsadventures.com ([]* in Vertrauenswürdige Sites)
O15 - HKCU\..Trusted Domains: freerealms.com ([]* in Vertrauenswürdige Sites)
O15 - HKCU\..Trusted Domains: soe.com ([]* in Vertrauenswürdige Sites)
O15 - HKCU\..Trusted Domains: sony.com ([]* in Vertrauenswürdige Sites)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{17950414-67CC-4B8D-A95E-D8BE2CEDDFD6}: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2819232C-2970-415D-9405-6BE33BB1A11C}: DhcpNameServer = 192.168.42.129
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{39CDAB4C-AF78-4B54-A647-3D52412D59EF}: DhcpNameServer = 192.168.42.129
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{43CAEC79-0EA7-4502-9A85-3A4687FA5802}: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{45604D2E-909F-44D3-9DE8-DFA256A48B5F}: NameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{55E5253A-01DA-475A-921C-A3761D85B756}: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B8B08C50-EBA7-463E-BA89-5738FEF1CF52}: DhcpNameServer = 192.168.42.129
O18:64bit: - Protocol\Handler\skypec2c {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\skypec2c {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\System32\Userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - ("C:\Windows\system32\clientsvr.exe") - C:\Windows\SysWow64\clientsvr.exe (TeamSpeak Systems GmbH)
O20 - HKCU Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKCU Winlogon: Shell - ("C:\Users\David\AppData\Local\Temp\uLow.exe") - C:\Users\David\AppData\Local\Temp\uLow.exe ()
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) -  File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O22:64bit: - SharedTaskScheduler: {E31004D1-A431-41B8-826F-E902F9D95C81} - Windows DreamScene - C:\Windows\SysNative\DreamScene.dll (Microsoft Corporation)
O27:64bit: - HKLM IFEO\a2service.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27:64bit: - HKLM IFEO\AvastSvc.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27:64bit: - HKLM IFEO\AvastUI.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27:64bit: - HKLM IFEO\avcenter.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27:64bit: - HKLM IFEO\avconfig.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27:64bit: - HKLM IFEO\avgcsrvx.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27:64bit: - HKLM IFEO\avgidsagent.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27:64bit: - HKLM IFEO\avgnt.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27:64bit: - HKLM IFEO\avgrsx.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27:64bit: - HKLM IFEO\avgui.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27:64bit: - HKLM IFEO\avgwdsvc.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27:64bit: - HKLM IFEO\Avira.OE.ServiceHost.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27:64bit: - HKLM IFEO\Avira.OE.Systray.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27:64bit: - HKLM IFEO\avp.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27:64bit: - HKLM IFEO\bdagent.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27:64bit: - HKLM IFEO\ccuac.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27:64bit: - HKLM IFEO\ComboFix.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27:64bit: - HKLM IFEO\egui.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27:64bit: - HKLM IFEO\GameScannerService.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27:64bit: - HKLM IFEO\hijackthis.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27:64bit: - HKLM IFEO\instup.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27:64bit: - HKLM IFEO\keyscrambler.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27:64bit: - HKLM IFEO\mbam.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27:64bit: - HKLM IFEO\mbamgui.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27:64bit: - HKLM IFEO\mbampt.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27:64bit: - HKLM IFEO\mbamscheduler.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27:64bit: - HKLM IFEO\mbamservice.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27:64bit: - HKLM IFEO\MSASCui.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27:64bit: - HKLM IFEO\rstrui.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27:64bit: - HKLM IFEO\spybotsd.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27:64bit: - HKLM IFEO\update.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27:64bit: - HKLM IFEO\wireshark.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27:64bit: - HKLM IFEO\wsctool.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27:64bit: - HKLM IFEO\zlclient.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27 - HKLM IFEO\a2service.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27 - HKLM IFEO\AvastSvc.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27 - HKLM IFEO\AvastUI.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27 - HKLM IFEO\avcenter.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27 - HKLM IFEO\avconfig.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27 - HKLM IFEO\avgcsrvx.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27 - HKLM IFEO\avgidsagent.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27 - HKLM IFEO\avgnt.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27 - HKLM IFEO\avgrsx.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27 - HKLM IFEO\avgui.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27 - HKLM IFEO\avgwdsvc.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27 - HKLM IFEO\Avira.OE.ServiceHost.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27 - HKLM IFEO\Avira.OE.Systray.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27 - HKLM IFEO\avp.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27 - HKLM IFEO\bdagent.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27 - HKLM IFEO\ccuac.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27 - HKLM IFEO\ComboFix.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27 - HKLM IFEO\egui.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27 - HKLM IFEO\GameScannerService.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27 - HKLM IFEO\hijackthis.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27 - HKLM IFEO\instup.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27 - HKLM IFEO\keyscrambler.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27 - HKLM IFEO\mbam.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27 - HKLM IFEO\mbamgui.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27 - HKLM IFEO\mbampt.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27 - HKLM IFEO\mbamscheduler.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27 - HKLM IFEO\mbamservice.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27 - HKLM IFEO\MSASCui.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27 - HKLM IFEO\rstrui.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27 - HKLM IFEO\spybotsd.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27 - HKLM IFEO\update.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27 - HKLM IFEO\wireshark.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27 - HKLM IFEO\wsctool.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O27 - HKLM IFEO\zlclient.exe: Debugger - C:\ProgramData\760039\sysmon.exe ()
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{07722855-9c9c-11e3-8253-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{07722855-9c9c-11e3-8253-806e6f6e6963}\Shell\AutoRun\command - "" = H:\pushinst.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2015.06.07 12:02:32 | 000,602,112 | ---- | C] (OldTimer Tools) -- D:\DATEN\David\Desktop\OTL.exe
[2015.06.05 13:25:29 | 000,000,000 | ---D | C] -- C:\Users\David\AppData\Local\MFAData
[2015.06.05 13:25:29 | 000,000,000 | ---D | C] -- C:\ProgramData\MFAData
[2015.06.02 13:28:26 | 000,000,000 | ---D | C] -- C:\Users\David\AppData\Local\GWX
[2015.06.01 16:50:36 | 000,000,000 | ---D | C] -- C:\Users\David\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Counter-Strike
[2015.05.29 16:50:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
[2015.05.29 16:49:37 | 000,107,736 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbamchameleon.sys
[2015.05.29 16:49:37 | 000,063,704 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mwac.sys
[2015.05.29 16:49:37 | 000,025,816 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2015.05.29 14:05:30 | 005,628,678 | ---- | C] (Swearware) -- D:\DATEN\David\Desktop\ComboFix.exe
[2015.05.28 19:33:22 | 000,351,744 | ---- | C] (TeamSpeak Systems GmbH) -- C:\Windows\SysWow64\clientsvr.exe
[2015.05.27 17:59:24 | 000,000,000 | ---D | C] -- C:\Users\David\AppData\Roaming\Imminent
[2015.05.27 17:58:58 | 000,000,000 | -HSD | C] -- C:\ProgramData\760139
[2015.05.27 17:58:58 | 000,000,000 | -HSD | C] -- C:\ProgramData\760039
[2015.05.24 20:37:36 | 000,890,880 | ---- | C] (Microsoft) -- D:\DATEN\David\Desktop\Matchmaking Server Picker.exe
[2015.05.24 18:18:35 | 002,610,736 | ---- | C] (ExKode Co. Ltd.) -- C:\Windows\SysNative\DxtoryCodec.dll
[2015.05.24 18:18:35 | 002,508,336 | ---- | C] (ExKode Co. Ltd.) -- C:\Windows\SysWow64\DxtoryCodec.dll
[2015.05.24 18:18:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dxtory2.0
[2015.05.24 18:10:17 | 000,000,000 | ---D | C] -- D:\DATEN\David\Desktop\Dxtory 2.0.127[A4]
[2015.05.22 17:13:59 | 000,000,000 | ---D | C] -- D:\DATEN\David\Desktop\ChromeEP
[2015.05.22 16:30:43 | 000,000,000 | ---D | C] -- C:\Users\David\AppData\Roaming\Dojotech Software
[2015.05.22 16:30:31 | 000,000,000 | ---D | C] -- C:\Users\David\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dojotech Software
[2015.05.22 16:24:53 | 000,000,000 | ---D | C] -- C:\Users\David\AppData\Local\Spotify
[2015.05.18 18:30:20 | 001,632,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dwmcore.dll
[2015.05.18 18:30:20 | 001,372,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\dwmcore.dll
[2015.05.18 18:30:20 | 000,082,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dwmapi.dll
[2015.05.14 16:51:06 | 000,000,000 | ---D | C] -- D:\DATEN\David\Desktop\Programming-2
[2015.05.13 23:04:20 | 000,124,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\PresentationCFFRasterizerNative_v0300.dll
[2015.05.13 23:04:20 | 000,102,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\PresentationCFFRasterizerNative_v0300.dll
[2015.05.13 12:48:56 | 000,000,000 | ---D | C] -- C:\Users\David\AppData\Roaming\Nico Mak Computing
[2015.05.13 12:48:45 | 000,077,824 | ---- | C] (Fox Magic Software) -- C:\Windows\SysWow64\fmcodec.DLL
[2015.05.13 11:15:13 | 000,040,760 | ---- | C] (TuneUp Software) -- C:\Windows\SysNative\TURegOpt.exe
[2015.05.13 11:15:13 | 000,029,496 | ---- | C] (TuneUp Software) -- C:\Windows\SysNative\authuitu.dll
[2015.05.13 11:15:12 | 000,025,400 | ---- | C] (TuneUp Software) -- C:\Windows\SysWow64\authuitu.dll
[2015.05.13 11:14:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\TuneUp Utilities 2014
[2015.05.13 11:13:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
[2015.05.13 11:12:48 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\DVDVideoSoft
[2015.05.13 11:12:41 | 000,000,000 | ---D | C] -- C:\Users\David\AppData\Roaming\RHEng
[2015.05.13 10:44:53 | 000,000,000 | ---D | C] -- C:\Users\David\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\JDownloader
[2015.05.13 10:28:53 | 000,000,000 | ---D | C] -- D:\DATEN\David\Desktop\GamingCD
[2015.05.13 10:23:11 | 000,460,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\certcli.dll
[2015.05.13 10:23:11 | 000,342,016 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\certcli.dll
[2015.05.13 10:23:07 | 000,114,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwcollector.exe
[2015.05.13 10:23:07 | 000,076,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2015.05.13 10:23:07 | 000,064,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MshtmlDac.dll
[2015.05.13 10:23:07 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwproxystub.dll
[2015.05.13 10:23:07 | 000,047,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieetwproxystub.dll
[2015.05.13 10:23:07 | 000,030,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll
[2015.05.13 10:23:06 | 000,720,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe
[2015.05.13 10:23:06 | 000,077,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\JavaScriptCollectionAgent.dll
[2015.05.13 10:23:06 | 000,060,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\JavaScriptCollectionAgent.dll
[2015.05.13 10:23:06 | 000,034,304 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll
[2015.05.13 10:23:05 | 002,052,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2015.05.13 10:23:05 | 000,710,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dll
[2015.05.13 10:23:05 | 000,664,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2015.05.13 10:23:05 | 000,620,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript9diag.dll
[2015.05.13 10:23:05 | 000,062,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll
[2015.05.13 10:23:05 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwcollectorres.dll
[2015.05.13 10:23:04 | 000,968,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MsSpellCheckingFacility.exe
[2015.05.13 10:23:04 | 000,801,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2015.05.13 10:23:04 | 000,800,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dll
[2015.05.13 10:23:04 | 000,478,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2015.05.13 10:23:04 | 000,316,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dxtrans.dll
[2015.05.13 10:23:04 | 000,115,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
[2015.05.13 10:23:04 | 000,066,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll
[2015.05.13 10:23:03 | 002,125,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
[2015.05.13 10:23:03 | 001,155,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmlmedia.dll
[2015.05.13 10:23:03 | 000,584,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll
[2015.05.13 10:23:02 | 000,633,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2015.05.13 10:23:02 | 000,490,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dxtmsft.dll
[2015.05.13 10:23:02 | 000,341,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\html.iec
[2015.05.13 10:23:02 | 000,168,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msrating.dll
[2015.05.13 10:23:02 | 000,144,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe
[2015.05.13 10:23:01 | 006,025,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2015.05.13 10:23:01 | 001,359,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmlmedia.dll
[2015.05.13 10:23:01 | 000,816,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2015.05.13 10:23:01 | 000,814,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9diag.dll
[2015.05.13 10:23:01 | 000,092,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2015.05.13 10:23:00 | 000,417,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\html.iec
[2015.05.13 10:23:00 | 000,199,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msrating.dll
[2015.05.13 10:23:00 | 000,088,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MshtmlDac.dll
[2015.05.13 10:20:57 | 000,328,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\services.exe
[2015.05.13 10:20:54 | 005,569,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe
[2015.05.13 10:20:54 | 001,728,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntdll.dll
[2015.05.13 10:20:54 | 001,254,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\diagtrack.dll
[2015.05.13 10:20:54 | 000,036,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\UtcResources.dll
[2015.05.13 10:20:53 | 003,989,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe
[2015.05.13 10:20:53 | 003,934,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe
[2015.05.13 10:20:53 | 001,162,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\kernel32.dll
[2015.05.13 10:20:53 | 000,879,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\tdh.dll
[2015.05.13 10:20:53 | 000,879,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\advapi32.dll
[2015.05.13 10:20:53 | 000,635,392 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\tdh.dll
[2015.05.13 10:20:52 | 001,461,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\lsasrv.dll
[2015.05.13 10:20:52 | 000,503,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\srcore.dll
[2015.05.13 10:20:52 | 000,424,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\KernelBase.dll
[2015.05.13 10:20:52 | 000,404,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\tracerpt.exe
[2015.05.13 10:20:52 | 000,364,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\tracerpt.exe
[2015.05.13 10:20:52 | 000,243,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64.dll
[2015.05.13 10:20:52 | 000,215,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winsrv.dll
[2015.05.13 10:20:52 | 000,113,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\sechost.dll
[2015.05.13 10:20:52 | 000,104,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\logman.exe
[2015.05.13 10:20:51 | 000,338,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\conhost.exe
[2015.05.13 10:20:51 | 000,309,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ncrypt.dll
[2015.05.13 10:20:51 | 000,296,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rstrui.exe
[2015.05.13 10:20:51 | 000,136,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\sspicli.dll
[2015.05.13 10:20:51 | 000,112,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\smss.exe
[2015.05.13 10:20:51 | 000,082,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\logman.exe
[2015.05.13 10:20:51 | 000,064,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\auditpol.exe
[2015.05.13 10:20:51 | 000,047,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\typeperf.exe
[2015.05.13 10:20:51 | 000,043,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\relog.exe
[2015.05.13 10:20:51 | 000,040,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\typeperf.exe
[2015.05.13 10:20:51 | 000,037,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\relog.exe
[2015.05.13 10:20:50 | 000,362,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64win.dll
[2015.05.13 10:20:50 | 000,050,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\srclient.dll
[2015.05.13 10:20:50 | 000,050,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\auditpol.exe
[2015.05.13 10:20:50 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\csrsrv.dll
[2015.05.13 10:20:50 | 000,029,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\sspisrv.dll
[2015.05.13 10:20:50 | 000,028,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\secur32.dll
[2015.05.13 10:20:50 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\setup16.exe
[2015.05.13 10:20:50 | 000,019,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\diskperf.exe
[2015.05.13 10:20:50 | 000,017,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\diskperf.exe
[2015.05.13 10:20:50 | 000,016,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntvdm64.dll
[2015.05.13 10:20:50 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntvdm64.dll
[2015.05.13 10:20:50 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64cpu.dll
[2015.05.13 10:20:50 | 000,005,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wow32.dll
[2015.05.13 10:20:50 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-threadpool-l1-1-0.dll
[2015.05.13 10:20:50 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll
[2015.05.13 10:20:50 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processthreads-l1-1-0.dll
[2015.05.13 10:20:50 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll
[2015.05.13 10:20:50 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-sysinfo-l1-1-0.dll
[2015.05.13 10:20:50 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll
[2015.05.13 10:20:50 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-synch-l1-1-0.dll
[2015.05.13 10:20:50 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll
[2015.05.13 10:20:50 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-namedpipe-l1-1-0.dll
[2015.05.13 10:20:50 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-misc-l1-1-0.dll
[2015.05.13 10:20:49 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
[2015.05.13 10:20:49 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-security-base-l1-1-0.dll
[2015.05.13 10:20:49 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-file-l1-1-0.dll
[2015.05.13 10:20:49 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-file-l1-1-0.dll
[2015.05.13 10:20:49 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
[2015.05.13 10:20:49 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll
[2015.05.13 10:20:49 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localregistry-l1-1-0.dll
[2015.05.13 10:20:49 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
[2015.05.13 10:20:49 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-rtlsupport-l1-1-0.dll
[2015.05.13 10:20:49 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll
[2015.05.13 10:20:49 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processenvironment-l1-1-0.dll
[2015.05.13 10:20:49 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll
[2015.05.13 10:20:49 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll
[2015.05.13 10:20:49 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-memory-l1-1-0.dll
[2015.05.13 10:20:49 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll
[2015.05.13 10:20:49 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-libraryloader-l1-1-0.dll
[2015.05.13 10:20:49 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll
[2015.05.13 10:20:49 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll
[2015.05.13 10:20:49 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-heap-l1-1-0.dll
[2015.05.13 10:20:49 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-xstate-l1-1-0.dll
[2015.05.13 10:20:49 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
[2015.05.13 10:20:49 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-util-l1-1-0.dll
[2015.05.13 10:20:49 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-string-l1-1-0.dll
[2015.05.13 10:20:49 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-string-l1-1-0.dll
[2015.05.13 10:20:49 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll
[2015.05.13 10:20:49 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll
[2015.05.13 10:20:49 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-profile-l1-1-0.dll
[2015.05.13 10:20:49 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-io-l1-1-0.dll
[2015.05.13 10:20:49 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-io-l1-1-0.dll
[2015.05.13 10:20:49 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-interlocked-l1-1-0.dll
[2015.05.13 10:20:49 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll
[2015.05.13 10:20:49 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-handle-l1-1-0.dll
[2015.05.13 10:20:49 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll
[2015.05.13 10:20:49 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-fibers-l1-1-0.dll
[2015.05.13 10:20:49 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll
[2015.05.13 10:20:49 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-errorhandling-l1-1-0.dll
[2015.05.13 10:20:49 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll
[2015.05.13 10:20:49 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-delayload-l1-1-0.dll
[2015.05.13 10:20:49 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll
[2015.05.13 10:20:49 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-debug-l1-1-0.dll
[2015.05.13 10:20:49 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll
[2015.05.13 10:20:49 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-datetime-l1-1-0.dll
[2015.05.13 10:20:48 | 000,686,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\adtschema.dll
[2015.05.13 10:20:48 | 000,686,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\adtschema.dll
[2015.05.13 10:20:48 | 000,146,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msaudite.dll
[2015.05.13 10:20:48 | 000,146,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msaudite.dll
[2015.05.13 10:20:48 | 000,060,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msobjs.dll
[2015.05.13 10:20:48 | 000,060,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msobjs.dll
[2015.05.13 10:20:48 | 000,007,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\instnm.exe
[2015.05.13 10:20:48 | 000,006,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\apisetschema.dll
[2015.05.13 10:20:48 | 000,006,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\apisetschema.dll
[2015.05.13 10:20:48 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll
[2015.05.13 10:20:48 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localization-l1-1-0.dll
[2015.05.13 10:20:48 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-console-l1-1-0.dll
[2015.05.13 10:20:48 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-console-l1-1-0.dll
[2015.05.13 10:20:48 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\user.exe
[2015.05.13 10:20:40 | 001,647,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\DWrite.dll
[2015.05.13 10:20:38 | 000,275,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\InkEd.dll
[2015.05.13 10:20:38 | 000,216,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\InkEd.dll
[2015.05.13 10:20:38 | 000,024,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jnwmon.dll
[2015.05.13 10:20:37 | 002,543,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wpdshext.dll
[2015.05.13 10:20:34 | 000,142,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\poqexec.exe
[2015.05.13 10:20:34 | 000,123,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\poqexec.exe
[2015.05.13 10:20:32 | 000,342,016 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\apphelp.dll
[2015.05.13 10:20:32 | 000,023,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\sdbinst.exe
[2015.05.13 10:20:32 | 000,020,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\sdbinst.exe
[2015.05.13 10:20:32 | 000,006,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\shimeng.dll
[2015.05.10 19:26:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Landwirtschafts Simulator 2011
[2015.05.08 14:25:00 | 000,000,000 | ---D | C] -- D:\DATEN\David\Desktop\RealizedGames
[2014.02.08 22:23:24 | 000,148,856 | ---- | C] (Sysinternals - www.sysinternals.com) -- C:\Program Files\Autologon.exe
[4 C:\Users\David\AppData\Local\*.tmp files -> C:\Users\David\AppData\Local\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
File not found -- D:\DATEN\David\Desktop\sie0.
[2015.06.07 12:04:57 | 012,026,804 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2015.06.07 12:04:57 | 003,996,602 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2015.06.07 12:04:57 | 003,697,818 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2015.06.07 12:04:57 | 003,314,980 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2015.06.07 12:04:57 | 000,006,438 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2015.06.07 12:02:29 | 000,602,112 | ---- | M] (OldTimer Tools) -- D:\DATEN\David\Desktop\OTL.exe
[2015.06.07 11:57:59 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2015.06.07 11:57:58 | 000,001,684 | ---- | M] () -- C:\Windows\tasks\ASXUZJO.job
[2015.06.07 11:57:58 | 000,001,338 | ---- | M] () -- C:\Windows\tasks\JFQJPI.job
[2015.06.07 11:57:58 | 000,001,338 | ---- | M] () -- C:\Windows\tasks\IMJGXG.job
[2015.06.07 11:57:58 | 000,001,338 | ---- | M] () -- C:\Windows\tasks\APDHYH.job
[2015.06.07 11:57:58 | 000,001,334 | ---- | M] () -- C:\Windows\tasks\LKQU.job
[2015.06.07 11:57:58 | 000,001,334 | ---- | M] () -- C:\Windows\tasks\HMVN.job
[2015.06.07 11:57:41 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2015.06.06 23:33:00 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2015.06.06 23:32:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2015.06.06 17:30:48 | 000,040,528 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2015.06.06 17:30:48 | 000,040,528 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2015.06.06 16:30:40 | 000,000,414 | ---- | M] () -- C:\Windows\tasks\Defraggler Volume D Task.job
[2015.06.06 11:08:17 | 000,000,600 | ---- | M] () -- C:\Users\David\AppData\Roaming\winscp.rnd
[2015.05.29 14:05:26 | 005,628,678 | ---- | M] (Swearware) -- D:\DATEN\David\Desktop\ComboFix.exe
[2015.05.29 13:38:38 | 000,000,118 | ---- | M] () -- C:\Windows\SysNative\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
[2015.05.28 21:52:08 | 1273,719,510 | ---- | M] () -- D:\DATEN\David\Desktop\VARO.mp4
[2015.05.28 19:32:58 | 000,351,744 | ---- | M] (TeamSpeak Systems GmbH) -- C:\Windows\SysWow64\clientsvr.exe
[2015.05.27 18:04:59 | 000,000,756 | ---- | M] () -- D:\DATEN\David\Desktop\TeamSpeak 3 Client.lnk
[2015.05.27 17:58:58 | 000,000,006 | RHS- | M] () -- C:\ProgramData\f942dcbc2674993a62ccf3d43ef56a5beb44e9a7
[2015.05.26 16:35:13 | 000,002,185 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2015.05.25 15:38:48 | 000,030,280 | ---- | M] () -- D:\DATEN\David\Desktop\Hub.jar
[2015.05.25 14:22:24 | 000,000,600 | ---- | M] () -- C:\Users\David\AppData\Local\PUTTY.RND
[2015.05.24 18:23:46 | 000,003,442 | ---- | M] () -- C:\Windows\unins000.dat
[2015.05.24 18:23:42 | 000,715,038 | ---- | M] () -- C:\Windows\unins000.exe
[2015.05.24 18:18:35 | 000,000,786 | ---- | M] () -- D:\DATEN\David\Desktop\Dxtory.lnk
[2015.05.24 16:40:55 | 012,777,472 | ---- | M] () -- D:\DATEN\David\Desktop\Spektrem - Shine.mp3
[2015.05.23 22:44:53 | 000,000,484 | RHS- | M] () -- C:\Users\David\ntuser.pol
[2015.05.22 16:04:43 | 000,007,605 | ---- | M] () -- C:\Users\David\AppData\Local\Resmon.ResmonCfg
[2015.05.17 11:31:17 | 000,778,416 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2015.05.17 11:31:17 | 000,142,512 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2015.05.15 19:01:37 | 005,074,600 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2015.05.13 23:09:33 | 000,001,912 | ---- | M] () -- C:\Windows\epplauncher.mif
[4 C:\Users\David\AppData\Local\*.tmp files -> C:\Users\David\AppData\Local\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
File not found -- D:\DATEN\David\Desktop\sie0.
[2015.05.29 13:38:38 | 000,000,118 | ---- | C] () -- C:\Windows\SysNative\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
[2015.05.28 21:51:36 | 1273,719,510 | ---- | C] () -- D:\DATEN\David\Desktop\VARO.mp4
[2015.05.27 17:58:58 | 000,000,006 | RHS- | C] () -- C:\ProgramData\f942dcbc2674993a62ccf3d43ef56a5beb44e9a7
[2015.05.25 23:54:37 | 000,030,280 | ---- | C] () -- D:\DATEN\David\Desktop\Hub.jar
[2015.05.24 18:23:46 | 000,715,038 | ---- | C] () -- C:\Windows\unins000.exe
[2015.05.24 18:18:35 | 000,000,786 | ---- | C] () -- D:\DATEN\David\Desktop\Dxtory.lnk
[2015.05.24 16:41:02 | 012,777,472 | ---- | C] () -- D:\DATEN\David\Desktop\Spektrem - Shine.mp3
[2015.05.23 22:44:53 | 000,000,484 | RHS- | C] () -- C:\Users\David\ntuser.pol
[2015.05.22 16:24:52 | 000,001,806 | ---- | C] () -- C:\Users\David\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk
[2015.05.13 11:15:11 | 000,002,211 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2014.lnk
[2015.04.05 13:04:06 | 000,000,066 | ---- | C] () -- C:\Users\David\.gitconfig
[2015.03.26 21:14:08 | 000,004,185 | ---- | C] () -- C:\Users\David\AppData\Roaming\JFQJPI
[2015.03.22 16:24:40 | 000,000,202 | ---- | C] () -- C:\Windows\MSUTIL.INI
[2015.03.19 21:01:54 | 000,187,904 | ---- | C] () -- C:\Windows\SysWow64\igdde32.dll
[2015.03.19 21:01:48 | 017,289,048 | ---- | C] () -- C:\Windows\SysWow64\igd11dxva32.dll
[2014.12.21 13:15:10 | 000,000,600 | ---- | C] () -- C:\Users\David\AppData\Local\PUTTY.RND
[2014.12.19 21:17:48 | 000,000,600 | ---- | C] () -- C:\Users\David\AppData\Roaming\winscp.rnd
[2014.12.18 18:18:24 | 000,007,605 | ---- | C] () -- C:\Users\David\AppData\Local\Resmon.ResmonCfg
[2014.12.13 18:12:49 | 000,006,732 | ---- | C] () -- C:\Users\David\AppData\Local\recently-used.xbel
[2014.11.23 20:48:17 | 000,000,193 | ---- | C] () -- C:\Windows\WORDPAD.INI
[2014.11.22 17:44:19 | 000,023,120 | ---- | C] () -- C:\Users\David\ts3_recording_14_11_22_16_44_17.wav
[2014.11.20 18:59:54 | 001,063,760 | ---- | C] () -- C:\Users\David\ts3_recording_14_11_20_17_59_52.wav
[2014.09.19 17:49:42 | 000,281,288 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2014.09.19 17:49:41 | 000,076,888 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2014.08.12 17:16:08 | 000,001,369 | ---- | C] () -- C:\Users\David\o,,,,,,,,g7btzb66z.aup
[2014.08.12 10:09:54 | 000,001,456 | ---- | C] () -- C:\Users\David\AppData\Local\Adobe Für Web speichern 13.0 Prefs
[2014.08.05 14:12:03 | 006,556,719 | ---- | C] () -- C:\Users\David\Ungespielt Intro Song Bass Boosted.mp3
[2014.07.25 17:30:57 | 000,451,072 | ---- | C] () -- C:\Windows\SysWow64\ISSRemoveSP.exe
[2014.07.17 18:48:55 | 000,000,442 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2014.07.17 12:46:06 | 000,216,064 | ---- | C] ( ) -- C:\Windows\SysWow64\lagarith.dll
[2014.07.17 12:46:05 | 000,003,442 | ---- | C] () -- C:\Windows\unins000.dat
[2014.06.01 12:01:41 | 000,641,024 | ---- | C] () -- C:\Windows\SysWow64\ficvdec_x86.dll
[2014.02.23 19:17:44 | 000,003,976 | ---- | C] () -- C:\Windows\SysWow64\PCProtect.ini
[2014.02.23 17:44:45 | 000,181,248 | ---- | C] () -- C:\Windows\hpoins32.dat
[2014.02.23 17:44:45 | 000,000,850 | ---- | C] () -- C:\Windows\hpomdl32.dat
[2014.02.09 03:45:38 | 001,596,050 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2014.02.09 03:43:04 | 000,000,010 | ---- | C] () -- C:\Windows\GSetup.ini
 
========== ZeroAccess Check ==========
 
[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2015.02.13 07:22:33 | 014,177,280 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2015.02.13 07:26:18 | 012,875,264 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2013.09.27 04:52:49 | 000,843,264 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2013.09.27 03:14:40 | 000,634,880 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2013.09.27 04:50:16 | 000,435,200 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

< End of report >

--- --- ---

FSS-File:

PHP-Code:

  Farbar Service Scanner Version: 17-01-2015
Ran by David (administrator) on 07-06-2015 at 12:09:46
Running from "D:\DATEN\David\Desktop"
Microsoft Windows 7 Professional  Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy: 
==================


System Restore:
============
SDRSVC Service is not running. Checking service configuration:
The start type of SDRSVC service is set to Disabled. The default start type is 3.
The ImagePath of SDRSVC service is OK.
The ServiceDll of SDRSVC service is OK.


System Restore Policy: 
========================


Action Center:
============


Windows Update:
============

Windows Autoupdate Disabled Policy: 
============================


Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is set to Demand. The default start type is Auto.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend service is OK.


Windows Defender Disabled Policy: 
==========================
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware"=DWORD:1


Other Services:
==============


File Check:
========
C:\Windows\System32\nsisvc.dll => File is digitally signed
C:\Windows\System32\drivers\nsiproxy.sys => File is digitally signed
C:\Windows\System32\dhcpcore.dll => File is digitally signed
C:\Windows\System32\drivers\afd.sys => File is digitally signed
C:\Windows\System32\drivers\tdx.sys => File is digitally signed
C:\Windows\System32\Drivers\tcpip.sys => File is digitally signed
C:\Windows\System32\dnsrslvr.dll => File is digitally signed
C:\Windows\System32\mpssvc.dll => File is digitally signed
C:\Windows\System32\bfe.dll => File is digitally signed
C:\Windows\System32\drivers\mpsdrv.sys => File is digitally signed
C:\Windows\System32\SDRSVC.dll => File is digitally signed
C:\Windows\System32\vssvc.exe => File is digitally signed
C:\Windows\System32\wscsvc.dll => File is digitally signed
C:\Windows\System32\wbem\WMIsvc.dll => File is digitally signed
C:\Windows\System32\wuaueng.dll => File is digitally signed
C:\Windows\System32\qmgr.dll => File is digitally signed
C:\Windows\System32\es.dll => File is digitally signed
C:\Windows\System32\cryptsvc.dll => File is digitally signed
C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed
C:\Windows\System32\ipnathlp.dll => File is digitally signed
C:\Windows\System32\iphlpsvc.dll => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed


**** End of log ****

Ich hoffe mir kann mir helfen!

MfG David (SynexTV)

M-K-D-B · 07.06.2015, 11:33

Mein Name ist Matthias und ich werde dir bei der Bereinigung deines Computers helfen.

Bitte beachte folgende Hinweise:

Falls wir Hinweise auf illegal erworbene Software finden, werden wir den Support unterbrechen bis jegliche Art von illegaler Software vom Rechner entfernt wurde.
Lies dir die Anleitungen sorgfältig durch. Solltest du Probleme haben, stoppe mit deiner Bearbeitung und beschreibe mir dein Problem so gut es geht.
Solltest du mir nicht innerhalb von 3 Tagen antworten, gehe ich davon aus, dass du keine Hilfe mehr benötigst. Dann lösche ich dein Thema aus meinem Abo. Solltest du einmal länger abwesend sein, so gib mir bitte Bescheid!
Während der Bereinigung bitte nichts installieren oder deinstallieren, außer ich bitte dich darum!
Bitte beachten: Download bei filepony.de: So ladet Ihr unsere Tools richtig!
Alle zu verwendenen Programme sind auf dem Desktop abzuspeichern und von dort zu starten!

Bitte arbeite alle Schritte in der vorgegebenen Reihefolge nacheinander ab und poste alle Logdateien in CODE-Tags:

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert deinem Helfer massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu groß für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke aauf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

Danke für deine Mitarbeit!

Zur ersten Analyse bitte FRST und TDSS-Killer ausführen:

Schritt 1
Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Schritt 2
Downloade dir bitte

TDSSKiller.exe und speichere diese Datei auf dem Desktop

Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
Drücke Start Scan
Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt

Poste den Inhalt bitte in jedem Fall hier in deinen Thread.

Bitte poste mit deiner nächsten Antwort

die Logdatei von TDSS-Killer,
die beiden neuen Logdateien von FRST.

SynexTV · 07.06.2015, 12:08

Hallo,

ich habe das mit den CodeTags übersehen, aber jetzt nutze ich es.

Die TDSS-Killer Datei:

-> Im Anhang: TDSS-Killer-Teil

Die FRST-Dateien:

-> Im Anhang: FRST-Teil

MfG

M-K-D-B · 07.06.2015, 12:28

Servus,

Zukünftig bitte beachten:

Zitat:

Running from D:\DATEN\David\Desktop

Leider hast du unsere Anleitung nicht richtig befolgt:
Bitte alle Tools direkt auf den Desktop downloaden bzw. dorthin verschieben und vom Desktop starten, da unsere Anleitungen daraufhin ausgelegt sind.
Zudem lassen sich dann am Ende der Bereinigung alle verwendeten Tools sehr einfach entfernen.
Alle Tools bis zum Ende der Bereinigung auf dem Desktop lassen, evtl. benötigen wir manche öfter.

"D:\DATEN\David\Desktop" ist nicht der eigentlich Ort des Desktops, der ist bei dir unter "C:\Users\David\Desktop".

Fragen dazu?

Wenn nicht, dann geht es los mit ComboFix vom Desktop:

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

SynexTV · 07.06.2015, 12:35

Hallo,

leider befindet sich nicht mein Desktop auf der C: mein Desktop befindet sich an den D: angegebenen Ort. Da bin ich mir sicher da man das leicht erkennt. (C: = SSD - D: = HDD)
=> Der Desktop ist auf der D: da er sehr viel Speicher verbraucht die die SSD nicht zur Verfügung hat.

So hier ist dann das zweite Problem: Combofix lässt sich wie im ersten Beitrag auch nicht starten. Es kommt immer die Meldung: "Auf das angegebene Gerät, bzw. den Pfad oder die Datei kann nicht zugegriffen werden. Sie verfügen eventuell nicht über ausreichende Berechtigungen, um auf das Element zugreifen zu können." Ich habe aber auch schon die Berechtigungen in dem Programm angepasst. Ich habe es auch mit Administrator gestartet, es kommt immer dieselbe Meldung.

M-K-D-B · 07.06.2015, 12:39

Servus,

ComboFix.exe in SynexTV.exe umbenennen und nochmal starten.

Bitte beachten:
Alle Tools immer mit Administratorrechten ausführen!

SynexTV · 07.06.2015, 12:54

Hallo,

nun hat es geklappt. Hatte schon Angst das mein PC Schrott geht beim neustarten.

Hier die LogDatei:

Code:

ATTFilter

ComboFix 15-05-31.01 - David 07.06.2015  13:44:11.1.4 - x64
Microsoft Windows 7 Professional   6.1.7601.1.1252.49.1031.18.8079.3939 [GMT 2:00]
ausgeführt von:: d:\daten\David\Desktop\SynexTV.exe
AV: Microsoft Security Essentials *Disabled/Updated* {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}
SP: Microsoft Security Essentials *Disabled/Updated* {0C8D1929-27B2-688D-E114-9117BD2BB1B7}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\4f0332cb-3bd9-4e7c-ba1b-5dc70a990f27\35bbc0e3-cf22-4136-8e8b-3a665bea9fe2.dll
c:\program files (x86)\AGEIA Technologies\4f0332cb-3bd9-4e7c-ba1b-5dc70a990f27.dll
c:\programdata\f942dcbc2674993a62ccf3d43ef56a5beb44e9a7
c:\programdata\ntuser.pol
c:\programdata\Tbccint
c:\programdata\Tbccint\Multi\CT1561552\configutaion.json
c:\programdata\Tbccint\Multi\CT1561552\SetupIcon.ico
c:\users\Administrator\AppData\Local\Chromatic Browser\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj
c:\users\Administrator\AppData\Local\Chromatic Browser\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\background.html
c:\users\Administrator\AppData\Local\Chromatic Browser\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\content.js
c:\users\Administrator\AppData\Local\Chromatic Browser\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\Dlxb5v.js
c:\users\Administrator\AppData\Local\Chromatic Browser\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\lsdb.js
c:\users\Administrator\AppData\Local\Chromatic Browser\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\manifest.json
c:\users\Administrator\AppData\Local\Chromatic Browser\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk
c:\users\Administrator\AppData\Local\Chromatic Browser\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\background.html
c:\users\Administrator\AppData\Local\Chromatic Browser\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\content.js
c:\users\Administrator\AppData\Local\Chromatic Browser\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\erOYOS8.js
c:\users\Administrator\AppData\Local\Chromatic Browser\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\lsdb.js
c:\users\Administrator\AppData\Local\Chromatic Browser\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\manifest.json
c:\users\Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj
c:\users\Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\background.html
c:\users\Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\content.js
c:\users\Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\Dlxb5v.js
c:\users\Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\lsdb.js
c:\users\Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\manifest.json
c:\users\Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk
c:\users\Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\background.html
c:\users\Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\content.js
c:\users\Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\erOYOS8.js
c:\users\Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\lsdb.js
c:\users\Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\manifest.json
c:\users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj
c:\users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\background.html
c:\users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\content.js
c:\users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\Dlxb5v.js
c:\users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\lsdb.js
c:\users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\manifest.json
c:\users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk
c:\users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\background.html
c:\users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\content.js
c:\users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\erOYOS8.js
c:\users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\lsdb.js
c:\users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\manifest.json
c:\users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj
c:\users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\background.html
c:\users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\content.js
c:\users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\Dlxb5v.js
c:\users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\lsdb.js
c:\users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\manifest.json
c:\users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk
c:\users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\background.html
c:\users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\content.js
c:\users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\erOYOS8.js
c:\users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\lsdb.js
c:\users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\manifest.json
c:\users\Administrator\AppData\Local\Torch\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj
c:\users\Administrator\AppData\Local\Torch\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\background.html
c:\users\Administrator\AppData\Local\Torch\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\content.js
c:\users\Administrator\AppData\Local\Torch\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\Dlxb5v.js
c:\users\Administrator\AppData\Local\Torch\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\lsdb.js
c:\users\Administrator\AppData\Local\Torch\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\manifest.json
c:\users\Administrator\AppData\Local\Torch\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk
c:\users\Administrator\AppData\Local\Torch\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\background.html
c:\users\Administrator\AppData\Local\Torch\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\content.js
c:\users\Administrator\AppData\Local\Torch\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\erOYOS8.js
c:\users\Administrator\AppData\Local\Torch\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\lsdb.js
c:\users\Administrator\AppData\Local\Torch\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\manifest.json
c:\users\David\AppData\Local\Chromatic Browser\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj
c:\users\David\AppData\Local\Chromatic Browser\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\background.html
c:\users\David\AppData\Local\Chromatic Browser\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\content.js
c:\users\David\AppData\Local\Chromatic Browser\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\Dlxb5v.js
c:\users\David\AppData\Local\Chromatic Browser\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\lsdb.js
c:\users\David\AppData\Local\Chromatic Browser\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\manifest.json
c:\users\David\AppData\Local\Chromatic Browser\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk
c:\users\David\AppData\Local\Chromatic Browser\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\background.html
c:\users\David\AppData\Local\Chromatic Browser\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\content.js
c:\users\David\AppData\Local\Chromatic Browser\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\erOYOS8.js
c:\users\David\AppData\Local\Chromatic Browser\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\lsdb.js
c:\users\David\AppData\Local\Chromatic Browser\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\manifest.json
c:\users\David\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj
c:\users\David\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\background.html
c:\users\David\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\content.js
c:\users\David\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\Dlxb5v.js
c:\users\David\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\lsdb.js
c:\users\David\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\manifest.json
c:\users\David\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk
c:\users\David\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\background.html
c:\users\David\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\content.js
c:\users\David\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\erOYOS8.js
c:\users\David\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\lsdb.js
c:\users\David\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\manifest.json
c:\users\David\AppData\Local\Comodo\Dragon\User Data\Default\Preferences
c:\users\David\AppData\Local\ContextFree
c:\users\David\AppData\Local\ContextFree\Context2pro_Uninstaller.exe
c:\users\David\AppData\Local\ContextFree\framei.exe
c:\users\David\AppData\Local\ContextFree\navigation.exe
c:\users\David\AppData\Local\ContextFree\notifications.exe
c:\users\David\AppData\Local\ContextFree\windoclib.exe
c:\users\David\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj
c:\users\David\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\background.html
c:\users\David\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\content.js
c:\users\David\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\Dlxb5v.js
c:\users\David\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\lsdb.js
c:\users\David\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\manifest.json
c:\users\David\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk
c:\users\David\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\background.html
c:\users\David\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\content.js
c:\users\David\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\erOYOS8.js
c:\users\David\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\lsdb.js
c:\users\David\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\manifest.json
c:\users\David\AppData\Local\Google\Chrome\User Data\Default\Preferences
c:\users\David\AppData\Local\nsg8737.tmp
c:\users\David\AppData\Local\nspDF16.tmp
c:\users\David\AppData\Local\nsy5AC.tmp
c:\users\David\AppData\Local\nsyE96E.tmp
c:\users\David\AppData\Local\Tbccint
c:\users\Gast\AppData\Local\Chromatic Browser\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj
c:\users\Gast\AppData\Local\Chromatic Browser\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\background.html
c:\users\Gast\AppData\Local\Chromatic Browser\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\content.js
c:\users\Gast\AppData\Local\Chromatic Browser\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\Dlxb5v.js
c:\users\Gast\AppData\Local\Chromatic Browser\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\lsdb.js
c:\users\Gast\AppData\Local\Chromatic Browser\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\manifest.json
c:\users\Gast\AppData\Local\Chromatic Browser\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk
c:\users\Gast\AppData\Local\Chromatic Browser\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\background.html
c:\users\Gast\AppData\Local\Chromatic Browser\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\content.js
c:\users\Gast\AppData\Local\Chromatic Browser\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\erOYOS8.js
c:\users\Gast\AppData\Local\Chromatic Browser\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\lsdb.js
c:\users\Gast\AppData\Local\Chromatic Browser\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\manifest.json
c:\users\Gast\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj
c:\users\Gast\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\background.html
c:\users\Gast\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\content.js
c:\users\Gast\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\Dlxb5v.js
c:\users\Gast\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\lsdb.js
c:\users\Gast\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\manifest.json
c:\users\Gast\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk
c:\users\Gast\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\background.html
c:\users\Gast\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\content.js
c:\users\Gast\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\erOYOS8.js
c:\users\Gast\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\lsdb.js
c:\users\Gast\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\manifest.json
c:\users\Gast\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj
c:\users\Gast\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\background.html
c:\users\Gast\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\content.js
c:\users\Gast\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\Dlxb5v.js
c:\users\Gast\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\lsdb.js
c:\users\Gast\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\manifest.json
c:\users\Gast\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk
c:\users\Gast\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\background.html
c:\users\Gast\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\content.js
c:\users\Gast\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\erOYOS8.js
c:\users\Gast\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\lsdb.js
c:\users\Gast\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\manifest.json
c:\users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj
c:\users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\background.html
c:\users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\content.js
c:\users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\Dlxb5v.js
c:\users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\lsdb.js
c:\users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\manifest.json
c:\users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk
c:\users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\background.html
c:\users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\content.js
c:\users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\erOYOS8.js
c:\users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\lsdb.js
c:\users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\manifest.json
c:\users\Gast\AppData\Local\Torch\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj
c:\users\Gast\AppData\Local\Torch\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\background.html
c:\users\Gast\AppData\Local\Torch\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\content.js
c:\users\Gast\AppData\Local\Torch\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\Dlxb5v.js
c:\users\Gast\AppData\Local\Torch\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\lsdb.js
c:\users\Gast\AppData\Local\Torch\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\manifest.json
c:\users\Gast\AppData\Local\Torch\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk
c:\users\Gast\AppData\Local\Torch\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\background.html
c:\users\Gast\AppData\Local\Torch\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\content.js
c:\users\Gast\AppData\Local\Torch\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\erOYOS8.js
c:\users\Gast\AppData\Local\Torch\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\lsdb.js
c:\users\Gast\AppData\Local\Torch\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\manifest.json
c:\users\HomeGroupUser$\AppData\Local\Chromatic Browser\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj
c:\users\HomeGroupUser$\AppData\Local\Chromatic Browser\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\background.html
c:\users\HomeGroupUser$\AppData\Local\Chromatic Browser\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\content.js
c:\users\HomeGroupUser$\AppData\Local\Chromatic Browser\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\Dlxb5v.js
c:\users\HomeGroupUser$\AppData\Local\Chromatic Browser\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\lsdb.js
c:\users\HomeGroupUser$\AppData\Local\Chromatic Browser\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\manifest.json
c:\users\HomeGroupUser$\AppData\Local\Chromatic Browser\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk
c:\users\HomeGroupUser$\AppData\Local\Chromatic Browser\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\background.html
c:\users\HomeGroupUser$\AppData\Local\Chromatic Browser\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\content.js
c:\users\HomeGroupUser$\AppData\Local\Chromatic Browser\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\erOYOS8.js
c:\users\HomeGroupUser$\AppData\Local\Chromatic Browser\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\lsdb.js
c:\users\HomeGroupUser$\AppData\Local\Chromatic Browser\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\manifest.json
c:\users\HomeGroupUser$\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj
c:\users\HomeGroupUser$\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\background.html
c:\users\HomeGroupUser$\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\content.js
c:\users\HomeGroupUser$\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\Dlxb5v.js
c:\users\HomeGroupUser$\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\lsdb.js
c:\users\HomeGroupUser$\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\manifest.json
c:\users\HomeGroupUser$\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk
c:\users\HomeGroupUser$\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\background.html
c:\users\HomeGroupUser$\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\content.js
c:\users\HomeGroupUser$\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\erOYOS8.js
c:\users\HomeGroupUser$\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\lsdb.js
c:\users\HomeGroupUser$\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\manifest.json
c:\users\HomeGroupUser$\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj
c:\users\HomeGroupUser$\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\background.html
c:\users\HomeGroupUser$\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\content.js
c:\users\HomeGroupUser$\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\Dlxb5v.js
c:\users\HomeGroupUser$\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\lsdb.js
c:\users\HomeGroupUser$\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\manifest.json
c:\users\HomeGroupUser$\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk
c:\users\HomeGroupUser$\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\background.html
c:\users\HomeGroupUser$\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\content.js
c:\users\HomeGroupUser$\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\erOYOS8.js
c:\users\HomeGroupUser$\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\lsdb.js
c:\users\HomeGroupUser$\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\manifest.json
c:\users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj
c:\users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\background.html
c:\users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\content.js
c:\users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\Dlxb5v.js
c:\users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\lsdb.js
c:\users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\manifest.json
c:\users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk
c:\users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\background.html
c:\users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\content.js
c:\users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\erOYOS8.js
c:\users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\lsdb.js
c:\users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\manifest.json
c:\users\HomeGroupUser$\AppData\Local\Torch\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj
c:\users\HomeGroupUser$\AppData\Local\Torch\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\background.html
c:\users\HomeGroupUser$\AppData\Local\Torch\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\content.js
c:\users\HomeGroupUser$\AppData\Local\Torch\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\Dlxb5v.js
c:\users\HomeGroupUser$\AppData\Local\Torch\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\lsdb.js
c:\users\HomeGroupUser$\AppData\Local\Torch\User Data\Default\Extensions\hljnlfolmbmibdjaikiaepgepgnldclj\183\manifest.json
c:\users\HomeGroupUser$\AppData\Local\Torch\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk
c:\users\HomeGroupUser$\AppData\Local\Torch\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\background.html
c:\users\HomeGroupUser$\AppData\Local\Torch\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\content.js
c:\users\HomeGroupUser$\AppData\Local\Torch\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\erOYOS8.js
c:\users\HomeGroupUser$\AppData\Local\Torch\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\lsdb.js
c:\users\HomeGroupUser$\AppData\Local\Torch\User Data\Default\Extensions\lkmpjlgphgbfbkoegphedjjblnhjeadk\3.9\manifest.json
c:\windows\SysWow64\DEBUG.log
c:\windows\SysWow64\server.log
D:\install.exe
.
.
(((((((((((((((((((((((((((((((((((((((   Treiber/Dienste   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_NETHFDRV
-------\Service_AdobeUpdateService
.
.
(((((((((((((((((((((((   Dateien erstellt von 2015-05-07 bis 2015-06-07  ))))))))))))))))))))))))))))))
.
.
2015-06-07 11:48 . 2015-06-07 11:48	--------	d-----w-	c:\users\Papa\AppData\Local\temp
2015-06-07 11:48 . 2015-06-07 11:48	--------	d-----w-	c:\users\Default\AppData\Local\temp
2015-06-07 10:47 . 2015-06-07 10:48	--------	d-----w-	C:\FRST
2015-06-07 10:09 . 2015-03-27 13:04	1187344	----a-w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E15DC520-41A5-4928-99B4-8C75959133C2}\gapaengine.dll
2015-06-07 10:09 . 2015-05-03 03:16	12214312	----a-w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{EEDD5E7D-88A5-40AB-ACA3-FAC3AC1DBEB8}\mpengine.dll
2015-06-05 11:27 . 2015-05-03 03:16	12214312	----a-w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2015-06-05 11:25 . 2015-06-05 11:32	--------	d-----w-	c:\programdata\MFAData
2015-06-05 11:25 . 2015-06-05 11:25	--------	d-----w-	c:\users\David\AppData\Local\MFAData
2015-06-02 11:28 . 2015-06-02 11:28	--------	d-----w-	c:\users\David\AppData\Local\GWX
2015-05-29 14:49 . 2015-04-14 07:37	63704	----a-w-	c:\windows\system32\drivers\mwac.sys
2015-05-29 14:49 . 2015-04-14 07:37	107736	----a-w-	c:\windows\system32\drivers\mbamchameleon.sys
2015-05-29 14:49 . 2015-04-14 07:37	25816	----a-w-	c:\windows\system32\drivers\mbam.sys
2015-05-29 11:38 . 2015-05-29 11:38	118	----a-w-	c:\windows\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
2015-05-28 17:33 . 2015-05-28 17:32	351744	----a-w-	c:\windows\SysWow64\clientsvr.exe
2015-05-27 15:59 . 2015-05-27 15:59	--------	d-----w-	c:\users\David\AppData\Roaming\Imminent
2015-05-27 15:58 . 2015-05-28 17:33	--------	d-sh--w-	c:\programdata\760039
2015-05-27 15:58 . 2015-05-27 15:58	--------	d-sh--w-	c:\programdata\760139
2015-05-24 16:23 . 2015-05-24 16:23	715038	----a-w-	c:\windows\unins000.exe
2015-05-24 16:18 . 2014-06-08 20:14	2508336	----a-w-	c:\windows\SysWow64\DxtoryCodec.dll
2015-05-24 16:18 . 2014-06-08 20:14	2610736	----a-w-	c:\windows\system32\DxtoryCodec.dll
2015-05-22 14:30 . 2015-05-22 14:30	--------	d-----w-	c:\users\David\AppData\Roaming\Dojotech Software
2015-05-22 14:24 . 2015-05-27 17:16	--------	d-----w-	c:\users\David\AppData\Local\Spotify
2015-05-18 16:30 . 2015-03-14 03:21	82944	----a-w-	c:\windows\system32\dwmapi.dll
2015-05-18 16:30 . 2015-03-14 03:21	1632768	----a-w-	c:\windows\system32\dwmcore.dll
2015-05-18 16:30 . 2015-03-14 03:04	67584	----a-w-	c:\windows\SysWow64\dwmapi.dll
2015-05-18 16:30 . 2015-03-14 03:04	1372160	----a-w-	c:\windows\SysWow64\dwmcore.dll
2015-05-13 21:04 . 2015-05-01 13:17	124112	----a-w-	c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 21:04 . 2015-05-01 13:16	102608	----a-w-	c:\windows\SysWow64\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 10:48 . 2015-05-13 10:50	--------	d-----w-	c:\users\David\AppData\Roaming\Nico Mak Computing
2015-05-13 10:48 . 2008-08-18 16:18	77824	----a-w-	c:\windows\SysWow64\fmcodec.DLL
2015-05-13 09:15 . 2014-07-16 08:24	40760	----a-w-	c:\windows\system32\TURegOpt.exe
2015-05-13 09:15 . 2014-07-16 08:24	29496	----a-w-	c:\windows\system32\authuitu.dll
2015-05-13 09:15 . 2014-07-16 08:24	25400	----a-w-	c:\windows\SysWow64\authuitu.dll
2015-05-13 09:14 . 2015-05-14 08:58	--------	d-----w-	c:\program files (x86)\TuneUp Utilities 2014
2015-05-13 09:12 . 2015-05-13 09:12	--------	d-----w-	c:\program files (x86)\Common Files\DVDVideoSoft
2015-05-13 09:12 . 2015-05-13 09:12	--------	d-----w-	c:\users\David\AppData\Roaming\RHEng
2015-05-13 08:22 . 2015-04-21 17:14	24971776	----a-w-	c:\windows\system32\mshtml.dll
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-05-17 09:31 . 2014-02-08 21:16	778416	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2015-05-17 09:31 . 2014-02-08 21:16	142512	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2015-05-13 21:05 . 2014-02-08 20:43	140425016	----a-w-	c:\windows\system32\MRT.exe
2015-04-27 19:04 . 2015-05-13 08:20	44032	----a-w-	c:\windows\apppatch\acwow64.dll
2015-04-25 11:21 . 2015-04-25 11:21	129752	----a-w-	c:\windows\system32\drivers\2D0F36FE.sys
2015-04-05 11:00 . 2015-04-05 11:00	111016	----a-w-	c:\windows\system32\WindowsAccessBridge-64.dll
2015-04-05 11:00 . 2015-04-05 11:00	320424	----a-w-	c:\windows\system32\javaws.exe
2015-04-05 11:00 . 2015-04-05 11:00	189352	----a-w-	c:\windows\system32\javaw.exe
2015-04-05 11:00 . 2015-04-05 11:00	189352	----a-w-	c:\windows\system32\java.exe
2015-04-01 13:17 . 2015-04-01 13:17	135800	----a-w-	c:\windows\system32\drivers\epp64.sys
2015-03-28 03:44 . 2015-02-20 13:54	1316000	----a-w-	c:\windows\SysWow64\nvspcap.dll
2015-03-28 03:44 . 2015-02-20 13:54	1316000	----a-w-	c:\windows\SysWow64\nvspbridge.dll
2015-03-28 03:43 . 2015-02-20 13:54	1756424	----a-w-	c:\windows\system32\nvspbridge64.dll
2015-03-28 03:43 . 2015-02-20 13:54	1570672	----a-w-	c:\windows\system32\nvspcap64.dll
2015-03-27 13:04 . 2014-02-23 15:26	1187344	----a-w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2015-03-25 03:24 . 2015-04-15 14:01	98304	----a-w-	c:\windows\system32\wudriver.dll
2015-03-25 03:24 . 2015-04-15 14:01	37376	----a-w-	c:\windows\system32\wups2.dll
2015-03-25 03:24 . 2015-04-15 14:01	35328	----a-w-	c:\windows\system32\wups.dll
2015-03-25 03:24 . 2015-04-15 14:01	3298816	----a-w-	c:\windows\system32\wucltux.dll
2015-03-25 03:24 . 2015-04-15 14:01	2553856	----a-w-	c:\windows\system32\wuaueng.dll
2015-03-25 03:24 . 2015-04-15 14:01	191488	----a-w-	c:\windows\system32\wuwebv.dll
2015-03-25 03:24 . 2015-04-15 14:01	696320	----a-w-	c:\windows\system32\wuapi.dll
2015-03-25 03:24 . 2015-04-15 14:01	60416	----a-w-	c:\windows\system32\WinSetupUI.dll
2015-03-25 03:23 . 2015-04-15 14:01	12288	----a-w-	c:\windows\system32\wu.upgrade.ps.dll
2015-03-25 03:23 . 2015-04-15 14:01	36864	----a-w-	c:\windows\system32\wuapp.exe
2015-03-25 03:23 . 2015-04-15 14:01	135168	----a-w-	c:\windows\system32\wuauclt.exe
2015-03-25 03:00 . 2015-04-15 14:01	92672	----a-w-	c:\windows\SysWow64\wudriver.dll
2015-03-25 03:00 . 2015-04-15 14:01	566784	----a-w-	c:\windows\SysWow64\wuapi.dll
2015-03-25 03:00 . 2015-04-15 14:01	29696	----a-w-	c:\windows\SysWow64\wups.dll
2015-03-25 03:00 . 2015-04-15 14:01	173056	----a-w-	c:\windows\SysWow64\wuwebv.dll
2015-03-25 03:00 . 2015-04-15 14:01	33792	----a-w-	c:\windows\SysWow64\wuapp.exe
2015-03-23 03:25 . 2015-04-15 14:01	726528	----a-w-	c:\windows\system32\generaltel.dll
2015-03-23 03:25 . 2015-04-15 14:01	769536	----a-w-	c:\windows\system32\invagent.dll
2015-03-23 03:24 . 2015-04-15 14:01	419840	----a-w-	c:\windows\system32\devinv.dll
2015-03-23 03:24 . 2015-04-15 14:01	957952	----a-w-	c:\windows\system32\appraiser.dll
2015-03-23 03:24 . 2015-04-15 14:01	30720	----a-w-	c:\windows\system32\acmigration.dll
2015-03-23 03:24 . 2015-04-15 14:01	192000	----a-w-	c:\windows\system32\aepic.dll
2015-03-23 03:24 . 2015-04-15 14:01	227328	----a-w-	c:\windows\system32\aepdu.dll
2015-03-23 03:17 . 2015-04-15 14:01	1111552	----a-w-	c:\windows\system32\aeinv.dll
2015-03-19 19:02 . 2015-03-19 19:02	372224	----a-w-	c:\windows\system32\IntelOpenCL64.dll
2015-03-19 19:02 . 2015-03-19 19:02	304128	----a-w-	c:\windows\SysWow64\IntelOpenCL32.dll
2015-03-19 19:02 . 2015-03-19 19:02	280840	----a-w-	c:\windows\SysWow64\IntelCpHeciSvc.exe
2015-03-19 19:02 . 2015-03-19 19:02	183296	----a-w-	c:\windows\system32\igfxCoIn_v4170.dll
2015-03-19 19:02 . 2015-03-19 19:02	5120	----a-w-	c:\windows\system32\igfxLHMLibv2_0.dll
2015-03-19 19:02 . 2015-03-19 19:02	5120	----a-w-	c:\windows\system32\igfxLHMLib.dll
2015-03-19 19:02 . 2015-03-19 19:02	385024	----a-w-	c:\windows\system32\igfxOSP.dll
2015-03-19 19:02 . 2014-10-03 16:36	2024960	----a-w-	c:\windows\system32\igfxLHM.dll
2015-03-19 19:02 . 2014-05-28 14:21	393480	----a-w-	c:\windows\system32\igfxTray.exe
2015-03-19 19:02 . 2015-03-19 19:02	86528	----a-w-	c:\windows\system32\igfxCUIServicePS.dll
2015-03-19 19:02 . 2015-03-19 19:02	69632	----a-w-	c:\windows\system32\igfxDHLibv2_0.dll
2015-03-19 19:02 . 2015-03-19 19:02	60416	----a-w-	c:\windows\system32\igfxDHLib.dll
2015-03-19 19:02 . 2015-03-19 19:02	36616	----a-w-	c:\windows\system32\igfxexps.dll
2015-03-19 19:02 . 2015-03-19 19:02	35328	----a-w-	c:\windows\SysWow64\igfxexps32.dll
2015-03-19 19:02 . 2015-03-19 19:02	255488	----a-w-	c:\windows\system32\igfxCPL.cpl
2015-03-19 19:02 . 2015-03-19 19:02	229888	----a-w-	c:\windows\system32\igfxDTCM.dll
2015-03-19 19:02 . 2015-03-19 19:02	219400	----a-w-	c:\windows\system32\igfxext.exe
2015-03-19 19:02 . 2015-03-19 19:02	10752	----a-w-	c:\windows\system32\igfxDILibv2_0.dll
2015-03-19 19:02 . 2015-03-19 19:02	10752	----a-w-	c:\windows\system32\igfxDILib.dll
2015-03-19 19:02 . 2015-03-19 19:02	10240	----a-w-	c:\windows\system32\igfxEMLibv2_0.dll
2015-03-19 19:02 . 2015-03-19 19:02	10240	----a-w-	c:\windows\system32\igfxEMLib.dll
2015-03-19 19:02 . 2014-10-03 16:36	315144	----a-w-	c:\windows\system32\igfxEM.exe
2015-03-19 19:02 . 2014-10-03 16:36	250120	----a-w-	c:\windows\system32\igfxHK.exe
2015-03-19 19:02 . 2014-10-03 16:36	696832	----a-w-	c:\windows\system32\igfxDH.dll
2015-03-19 19:02 . 2014-10-03 16:36	345864	----a-w-	c:\windows\system32\igfxCUIService.exe
2015-03-19 19:02 . 2014-10-03 16:36	279040	----a-w-	c:\windows\system32\igfxDI.dll
2015-03-19 19:02 . 2014-02-09 01:47	6080608	----a-w-	c:\windows\system32\igdusc64.dll
2015-03-19 19:02 . 2014-05-28 14:21	24806000	----a-w-	c:\windows\system32\igdumdim64.dll
2015-03-19 19:02 . 2014-02-09 01:47	4788464	----a-w-	c:\windows\SysWow64\igdusc32.dll
2015-03-19 19:02 . 2014-02-09 01:47	24007768	----a-w-	c:\windows\SysWow64\igdumdim32.dll
2015-03-19 19:02 . 2015-03-19 19:02	3583488	----a-w-	c:\windows\system32\igdrcl64.dll
2015-03-19 19:02 . 2015-03-19 19:02	3318272	----a-w-	c:\windows\SysWow64\igdrcl32.dll
2015-03-19 19:02 . 2015-03-19 19:02	1637200	----a-w-	c:\windows\system32\igdmd64.dll
2015-03-19 19:02 . 2015-03-19 19:02	1269960	----a-w-	c:\windows\SysWow64\igdmd32.dll
2015-03-19 19:01 . 2015-03-19 19:01	4888368	----a-w-	c:\windows\system32\drivers\igdkmd64.sys
2015-03-19 19:01 . 2015-03-19 19:01	15980032	----a-w-	c:\windows\system32\igdfcl64.dll
2015-03-19 19:01 . 2015-03-19 19:01	6710542	----a-w-	c:\windows\system32\igdclbif.bin
2015-03-19 19:01 . 2015-03-19 19:01	227328	----a-w-	c:\windows\system32\igdde64.dll
2015-03-19 19:01 . 2015-03-19 19:01	187904	----a-w-	c:\windows\SysWow64\igdde32.dll
2015-03-19 19:01 . 2015-03-19 19:01	10850816	----a-w-	c:\windows\SysWow64\igdfcl32.dll
2015-03-19 19:01 . 2015-03-19 19:01	398848	----a-w-	c:\windows\system32\igdbcl64.dll
2015-03-19 19:01 . 2015-03-19 19:01	350720	----a-w-	c:\windows\SysWow64\igdbcl32.dll
2015-03-19 19:01 . 2015-03-19 19:01	17765456	----a-w-	c:\windows\system32\igd11dxva64.dll
2015-03-19 19:01 . 2015-03-19 19:01	169984	----a-w-	c:\windows\system32\igdail64.dll
2015-03-19 19:01 . 2015-03-19 19:01	152064	----a-w-	c:\windows\SysWow64\igdail32.dll
2015-03-19 19:01 . 2015-03-19 19:01	17289048	----a-w-	c:\windows\SysWow64\igd11dxva32.dll
2015-03-19 19:01 . 2014-02-09 01:47	9414176	----a-w-	c:\windows\system32\igd10iumd64.dll
2015-03-19 19:01 . 2015-03-19 19:01	8622624	----a-w-	c:\windows\SysWow64\igd10iumd32.dll
2015-03-19 19:01 . 2015-03-19 19:01	282696	----a-w-	c:\windows\system32\igd10idpp64.dll
2015-03-19 19:01 . 2015-03-19 19:01	263120	----a-w-	c:\windows\SysWow64\igd10idpp32.dll
2015-03-19 19:01 . 2015-03-06 01:16	9505280	----a-w-	c:\windows\system32\ig75icd64.dll
2015-03-19 19:01 . 2015-03-19 19:01	7481344	----a-w-	c:\windows\SysWow64\ig75icd32.dll
2015-03-19 19:01 . 2015-03-19 19:01	449800	----a-w-	c:\windows\system32\GfxUIEx.exe
2015-03-19 19:01 . 2015-03-19 19:01	1131008	----a-w-	c:\windows\system32\GfxResources.dll
2015-03-19 19:01 . 2015-03-19 19:01	1031432	----a-w-	c:\windows\system32\Gfxv4_0.exe
2015-03-19 19:01 . 2015-03-19 19:01	1027848	----a-w-	c:\windows\system32\Gfxv2_0.exe
2015-03-19 19:01 . 2015-03-19 19:01	340232	----a-w-	c:\windows\system32\DPTopologyApp.exe
2015-03-19 19:01 . 2015-03-19 19:01	339720	----a-w-	c:\windows\system32\DPTopologyAppv2_0.exe
2015-03-19 19:01 . 2015-03-19 19:01	157960	----a-w-	c:\windows\system32\difx64.exe
2015-03-10 03:25 . 2015-04-15 14:01	1882624	----a-w-	c:\windows\system32\msxml3.dll
2015-03-10 03:21 . 2015-04-15 14:01	2048	----a-w-	c:\windows\system32\msxml3r.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"System Monitor"="c:\programdata\760039\sysmon.exe" [2015-05-28 0]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
p6_19_erinnerung.lnk - c:\program files (x86)\phase6\phase6_19\WinStart\p6erinnerung.exe [2007-2-11 49152]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux8"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R1 UsbCharger;UsbCharger;c:\windows\system32\DRIVERS\UsbCharger.sys;c:\windows\SYSNATIVE\DRIVERS\UsbCharger.sys [x]
R2 BstHdAndroidSvc;BlueStacks Android Service;c:\program files (x86)\BlueStacks\HD-Service.exe BstHdAndroidSvc Android;c:\program files (x86)\BlueStacks\HD-Service.exe BstHdAndroidSvc Android [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 f8794fcc;Optimizer Pro Crash Monitor;c:\windows\system32\rundll32.exe;c:\windows\SYSNATIVE\rundll32.exe [x]
R2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;d:\daten\David\Desktop\hamachi-2.exe;d:\daten\David\Desktop\hamachi-2.exe [x]
R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
R2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [x]
R2 MBAMService;MBAMService; [x]
R2 Razer Game Scanner Service;Razer Game Scanner;c:\program files (x86)\Razer\Razer Services\GSS\GameScannerService.exe;c:\program files (x86)\Razer\Razer Services\GSS\GameScannerService.exe [x]
R3 AppleChargerSrv;AppleChargerSrv;c:\windows\system32\AppleChargerSrv.exe;c:\windows\SYSNATIVE\AppleChargerSrv.exe [x]
R3 avmeject;AVM Eject;c:\windows\system32\drivers\avmeject.sys;c:\windows\SYSNATIVE\drivers\avmeject.sys [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys;c:\windows\SYSNATIVE\drivers\EagleX64.sys [x]
R3 FWLANUSB;AVM FRITZ!WLAN;c:\windows\system32\DRIVERS\fwlanusb.sys;c:\windows\SYSNATIVE\DRIVERS\fwlanusb.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 IntcDAud;Intel(R) Display-Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
R3 Intel(R) Capability Licensing Service TCP IP Interface;Intel(R) Capability Licensing Service TCP IP Interface;c:\program files\Intel\iCLS Client\SocketHeciServer.exe;c:\program files\Intel\iCLS Client\SocketHeciServer.exe [x]
R3 KovaPlusFltr;ROCCAT Kova[+] Mouse;c:\windows\system32\drivers\KovaPlusFltr.sys;c:\windows\SYSNATIVE\drivers\KovaPlusFltr.sys [x]
R3 LGVirHid;Logitech Gamepanel Virtual HID Device Driver;c:\windows\system32\drivers\LGVirHid.sys;c:\windows\SYSNATIVE\drivers\LGVirHid.sys [x]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\;c:\windows\SYSNATIVE\drivers\ [x]
R3 MWAC;MWAC;c:\windows\system32\drivers\;c:\windows\SYSNATIVE\drivers\ [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 ScreamBAudioSvc;ScreamBee Audio;c:\windows\system32\drivers\ScreamingBAudio64.sys;c:\windows\SYSNATIVE\drivers\ScreamingBAudio64.sys [x]
R3 taphss6;Anchorfree HSS VPN Adapter;c:\windows\system32\DRIVERS\taphss6.sys;c:\windows\SYSNATIVE\DRIVERS\taphss6.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesDriver64.sys;c:\program files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesDriver64.sys [x]
R3 usbrndis6;USB-RNDIS6-Adapter;c:\windows\system32\DRIVERS\usb80236.sys;c:\windows\SYSNATIVE\DRIVERS\usb80236.sys [x]
R3 X6va022;X6va022;c:\windows\SysWOW64\Drivers\X6va022;c:\windows\SysWOW64\Drivers\X6va022 [x]
R3 X6va029;X6va029;c:\windows\SysWOW64\Drivers\X6va029;c:\windows\SysWOW64\Drivers\X6va029 [x]
S0 iaStorA;iaStorA;c:\windows\system32\DRIVERS\iaStorA.sys;c:\windows\SYSNATIVE\DRIVERS\iaStorA.sys [x]
S0 iaStorF;iaStorF;c:\windows\system32\DRIVERS\iaStorF.sys;c:\windows\SYSNATIVE\DRIVERS\iaStorF.sys [x]
S0 iusb3hcs;Intel(R) USB 3.0 Hostcontroller-Switchtreiber;c:\windows\system32\DRIVERS\iusb3hcs.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hcs.sys [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys;c:\windows\SYSNATIVE\Drivers\PxHlpa64.sys [x]
S1 AppleCharger;AppleCharger;c:\windows\system32\DRIVERS\AppleCharger.sys;c:\windows\SYSNATIVE\DRIVERS\AppleCharger.sys [x]
S1 epp64;epp64;c:\windows\system32\DRIVERS\epp64.sys;c:\windows\SYSNATIVE\DRIVERS\epp64.sys [x]
S1 netfilter64;netfilter64;c:\windows\system32\drivers\netfilter64.sys;c:\windows\SYSNATIVE\drivers\netfilter64.sys [x]
S2 Apache2.4;Apache2.4;d:\xampp\apache\bin\httpd.exe;d:\xampp\apache\bin\httpd.exe [x]
S2 BstHdDrv;BlueStacks Hypervisor;c:\program files (x86)\BlueStacks\HD-Hypervisor-amd64.sys;c:\program files (x86)\BlueStacks\HD-Hypervisor-amd64.sys [x]
S2 BstHdLogRotatorSvc;BlueStacks Log Rotator Service;c:\program files (x86)\BlueStacks\HD-LogRotatorService.exe;c:\program files (x86)\BlueStacks\HD-LogRotatorService.exe [x]
S2 BstHdUpdaterSvc;BlueStacks Updater Service;c:\program files (x86)\BlueStacks\HD-UpdaterService.exe;c:\program files (x86)\BlueStacks\HD-UpdaterService.exe [x]
S2 c2cautoupdatesvc;Skype Click to Call Updater;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [x]
S2 c2cpnrsvc;Skype Click to Call PNR Service;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [x]
S2 CGVPNCliService;CyberGhost 5 Client Service;c:\program files\CyberGhost 5\Service.exe;c:\program files\CyberGhost 5\Service.exe [x]
S2 DiagTrack;Diagnostics Tracking Service;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
S2 GfExperienceService;NVIDIA GeForce Experience Service;c:\program files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe;c:\program files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [x]
S2 igfxCUIService1.0.0.0;Intel(R) HD Graphics Control Panel Service;c:\windows\system32\igfxCUIService.exe;c:\windows\SYSNATIVE\igfxCUIService.exe [x]
S2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe;c:\program files\Intel\iCLS Client\HeciServer.exe [x]
S2 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]
S2 NvNetworkService;NVIDIA Network Service;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [x]
S2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [x]
S2 Realtek11nCU;Realtek11nCU;c:\program files (x86)\Hama\Wireless LAN RTL8188CU\RtlService.exe;c:\program files (x86)\Hama\Wireless LAN RTL8188CU\RtlService.exe [x]
S2 RzKLService;RzKLService;d:\daten\Razer Cortex\RzKLService.exe;d:\daten\Razer Cortex\RzKLService.exe [x]
S2 rzpmgrk;rzpmgrk;c:\windows\system32\drivers\rzpmgrk.sys;c:\windows\SYSNATIVE\drivers\rzpmgrk.sys [x]
S2 rzpnk;rzpnk;c:\windows\system32\drivers\rzpnk.sys;c:\windows\SYSNATIVE\drivers\rzpnk.sys [x]
S2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
S2 ss_conn_service;SAMSUNG Mobile Connectivity Service;c:\users\David\usbdriver\25_escape\conn\ss_conn_service.exe;c:\users\David\usbdriver\25_escape\conn\ss_conn_service.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x]
S3 EuMusDesignVirtualAudioCableWdm;Virtual Audio Cable (WDM);c:\windows\system32\DRIVERS\vrtaucbl.sys;c:\windows\SYSNATIVE\DRIVERS\vrtaucbl.sys [x]
S3 iusb3hub;Intel(R) USB 3.0-Hubtreiber;c:\windows\system32\DRIVERS\iusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hub.sys [x]
S3 iusb3xhc;Intel(R) USB 3.0 eXtensible-Hostcontrollertreiber;c:\windows\system32\DRIVERS\iusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3xhc.sys [x]
S3 LADF_CaptureOnly;LADF Capture Filter Driver;c:\windows\system32\DRIVERS\ladfGSCamd64.sys;c:\windows\SYSNATIVE\DRIVERS\ladfGSCamd64.sys [x]
S3 LADF_RenderOnly;LADF Render Filter Driver;c:\windows\system32\DRIVERS\ladfGSRamd64.sys;c:\windows\SYSNATIVE\DRIVERS\ladfGSRamd64.sys [x]
S3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver;c:\windows\system32\drivers\LGBusEnum.sys;c:\windows\SYSNATIVE\drivers\LGBusEnum.sys [x]
S3 NisSrv;Microsoft-Netzwerkinspektion;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x]
S3 NvStreamKms;NvStreamKms;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [x]
S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad64v.sys;c:\windows\SYSNATIVE\drivers\nvvad64v.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 RTL8192cu;Realtek RTL8192CU Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8192cu.sys;c:\windows\SYSNATIVE\DRIVERS\RTL8192cu.sys [x]
S3 rzendpt;rzendpt;c:\windows\system32\DRIVERS\rzendpt.sys;c:\windows\SYSNATIVE\DRIVERS\rzendpt.sys [x]
S3 rzudd;Razer Keyboard Driver;c:\windows\system32\DRIVERS\rzudd.sys;c:\windows\SYSNATIVE\DRIVERS\rzudd.sys [x]
S3 ssudmdm;SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x]
S3 XSplit_Dummy;XSplit  Stream  Audio  Renderer;c:\windows\system32\drivers\xspltspk.sys;c:\windows\SYSNATIVE\drivers\xspltspk.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt	REG_MULTI_SZ   	hpqcxs08 hpqddsvc
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2015-05-26 14:33	986440	----a-w-	c:\program files (x86)\Google\Chrome\Application\43.0.2357.81\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2015-06-07 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-02-08 09:31]
.
2015-06-06 c:\windows\Tasks\Defraggler Volume D Task.job
- c:\program files\Defraggler\df64.exe [2013-10-14 15:05]
.
2015-06-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2015-04-01 13:18]
.
2015-06-07 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2015-04-01 13:18]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ AccExtIco1]
@="{AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47}"
[HKEY_CLASSES_ROOT\CLSID\{AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47}]
2015-04-16 15:42	997536	----a-w-	c:\program files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ AccExtIco2]
@="{853B7E05-C47D-4985-909A-D0DC5C6D7303}"
[HKEY_CLASSES_ROOT\CLSID\{853B7E05-C47D-4985-909A-D0DC5C6D7303}]
2015-04-16 15:42	997536	----a-w-	c:\program files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ AccExtIco3]
@="{42D38F2E-98E9-4382-B546-E24E4D6D04BB}"
[HKEY_CLASSES_ROOT\CLSID\{42D38F2E-98E9-4382-B546-E24E4D6D04BB}]
2015-04-16 15:42	997536	----a-w-	c:\program files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2014-12-11 13776088]
"IAStorIcon"="c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe" [2013-04-30 36352]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2015-04-29 1337000]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2015-03-19 393480]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2015-03-30 500936]
"Launch LCore"="c:\program files\Logitech Gaming Software\LCore.exe" [2014-07-28 10801944]
"NvBackend"="c:\program files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe" [2015-03-28 2673296]
"ShadowPlay"="c:\windows\system32\nvspcap64.dll" [2015-03-28 1570672]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uDefault_Search_URL = www.google.com
uStart Page = www.google.com
mDefault_Search_URL = www.google.com
mDefault_Page_URL = www.google.com
mStart Page = www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
mSearch Page = www.google.com
uInternet Settings,ProxyOverride = <-loopback>
uSearchAssistant = www.google.com
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
TCP: DhcpNameServer = 192.168.178.1
TCP: Interfaces\{45604D2E-909F-44D3-9DE8-DFA256A48B5F}: NameServer = 192.168.1.1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk - c:\program files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
SafeBoot-CleanHlp
SafeBoot-CleanHlp.sys
HKLM_Wow6432Node-ActiveSetup-installed components - c:\program files (x86)\Crossbrowse\Crossbrowse\Application\39.4.2171.95\Installer\chrmstp.exe
Toolbar-Locked - (no file)
AddRemove-ContextFree - c:\users\David\AppData\Local\ContextFree\Context2pro_Uninstaller.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\MBAMProtector]
"ImagePath"="\??\c:\windows\system32\drivers\"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\MBAMService]
"ImagePath"="\"\\""
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\MWAC]
"ImagePath"="\??\c:\windows\system32\drivers\"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\X6va022]
"ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va022"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\X6va029]
"ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va029"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-914325664-1482865349-517734357-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{4DEC1838-553E-CA58-8EAA-D2297088DCDD}*]
"laaggnapaccocgmnacngniel"=hex:64,62,62,6c,6d,66,6a,68,61,6c,6f,67,61,64,62,68,
   68,66,67,63,6b,68,6e,6f,62,6b,69,67,64,6f,6a,6e,6f,63,62,6e,6b,65,6b,62,00,\
"lakgpahjpobfmebdglmfaocc"=hex:64,62,62,6c,6d,66,6a,68,61,6c,6f,67,61,64,62,68,
   68,66,67,63,6b,68,6e,6f,62,6b,69,67,64,6f,6a,6e,6f,63,62,6e,6b,65,6b,62,00,\
.
[HKEY_USERS\S-1-5-21-914325664-1482865349-517734357-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:90,64,86,aa,86,20,d5,76,85,ea,6d,27,42,ca,93,d3,2d,86,1e,23,6c,79,0d,
   58,be,f9,79,44,16,bf,23,f5,c3,eb,37,f2,25,8a,3d,fb,dc,e9,a8,a0,e0,1b,34,d4,\
"??"=hex:bf,b9,89,cd,1b,55,e9,56,c2,d7,3a,1f,76,cc,68,b1
.
[HKEY_LOCAL_MACHINE\software\BlueStacks]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
   00,5c,00,4d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_17_0_0_169_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_17_0_0_169_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_17_0_0_169_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_17_0_0_169_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_17_0_0_169.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.17"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_17_0_0_169.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_17_0_0_169.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_17_0_0_169.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*]
@="?????????????????? v1"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*\CLSID]
@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*]
@="?????????????????? v2"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*\CLSID]
@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Google\Update\1.3.27.5\GoogleCrashHandler.exe
c:\program files (x86)\avmwlanstick\WlanNetService.exe
d:\xampp\filezillaftp\filezillaserver.exe
c:\users\David\AppData\Local\NVIDIA\NvBackend\ApplicationOntology\NvOAWrapperCache.exe
d:\xampp\mysql\bin\mysqld.exe
c:\windows\SysWOW64\PnkBstrA.exe
c:\program files (x86)\Hama\Wireless LAN RTL8188CU\RtWlan.exe
c:\program files (x86)\TeamViewer\TeamViewer_Service.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2015-06-07  13:52:14 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2015-06-07 11:52
.
Vor Suchlauf: 6.138.482.688 Bytes frei
Nach Suchlauf: 6.080.671.744 Bytes frei
.
- - End Of File - - A8AD8286FB60C310D4A3A442B3F5AA6E
A36C5E4F47E84449FF07ED3517B43A31

M-K-D-B · 07.06.2015, 13:16

Servus,

naja, du hast da eine ziemlich heftige Malware-Infektion, aber bisher läuft alles gut.

Schritt 1
Combofix-Skript

WARNUNG für die MITLESER:
Folgendes ComboFix Skript ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!
Lösche die vorhandene Combofix.exe von deinem Desktop und lade das Programm von folgenden Download-Spiegel neu herunter: Link

Speichere es erneut auf dem Desktop (nicht woanders hin, das ist wichtig)!

Drücke die Windows + R Taste --> notepad (hinein schreiben) --> OK
Kopiere nun den Text aus der folgenden Codebox komplett in das leere Textdokument.
Code:
ATTFilter
Folder::
c:\programdata\760139
c:\programdata\760039

Registry::
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"System Monitor"=-
         
Speichere dies als CFScript.txt auf deinem Desktop.

Wichtig: Stelle deine Anti Viren Software temporär ab. Dies kann ComboFix nämlich bei der Arbeit behindern.
Danach wieder anstellen nicht vergessen!

Schließe alle laufenden Programme damit ComboFix ungehindert arbeiten kann.

Ziehe CFScript.txt in die ComboFix.exe wie in diesem Bild:

Mache nichts am Computer, bewege nicht die Maus über das ComboFix-Fenster oder klicke in dieses hinein. Dies kann dazu führen, dass ComboFix sich aufhängt.

Wenn ComboFix fertig ist wird es ein Log erstellen: C:\ComboFix.txt
Bitte füge es hier als Antwort (in CODE-Tags mit dem #-Button des Editors) ein.
Hinweis:
Suspect:: und Collect::
Falls im Skript diese Anweisungen enthalten sind, sollen Dateien zur Analyse eingeschickt werden. Es erscheint eine Message-Box, nachdem Combofix fertig ist. Klicke OK und folge den Aufforderungen/Anweisungen, um die Dateien hochzuladen. Teile mir unbedingt mit, ob der Upload geklappt hat!

Schritt 2
Downloade dir bitte

Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.

Starte bitte die mbar.exe.
Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
Klicke auf den CleanUp Button und erlaube den Neustart.
Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
Nach dem Neustart starte die mbar.exe erneut.
Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.

Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers

Schritt 3

Starte die FRST.exe erneut. Setze einen Haken vor Addition.txt und drücke auf Scan.
FRST erstellt wieder zwei Logdateien (FRST.txt und Addition.txt).
Poste mir beide Logdateien mit deiner nächsten Antwort.

Bitte poste mit deiner nächsten Antwort

die Logdatei von ComboFix
die Logdatei von MBAR,
die beiden neuen Logdateien von FRST.

SynexTV · 07.06.2015, 16:17

Servus,

hier die LogDatei von ComboFix die anderen sind unten:

Code:

ATTFilter

ComboFix 15-05-31.01 - David 07.06.2015  15:25:03.3.4 - x64
Microsoft Windows 7 Professional   6.1.7601.1.1252.49.1031.18.8079.4600 [GMT 2:00]
ausgeführt von:: d:\daten\David\Desktop\ComboFix.exe
Benutzte Befehlsschalter :: d:\daten\David\Desktop\CFScript.txt
AV: Microsoft Security Essentials *Disabled/Updated* {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}
SP: Microsoft Security Essentials *Disabled/Updated* {0C8D1929-27B2-688D-E114-9117BD2BB1B7}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Vorheriger Suchlauf -------
.
c:\programdata\760039
c:\programdata\760039\sysmon.exe
c:\programdata\760139
c:\programdata\760139\760040\05-27-2015.txt
c:\programdata\760139\760040\05-28-2015.txt
c:\programdata\760139\760040\05-29-2015.txt
c:\programdata\760139\760040\05-30-2015.txt
c:\programdata\760139\760040\05-31-2015.txt
c:\programdata\760139\760040\06-01-2015.txt
c:\programdata\760139\760040\06-02-2015.txt
c:\programdata\760139\760040\06-03-2015.txt
c:\programdata\760139\760041\Account.log.txt
c:\programdata\760139\760042\1
c:\programdata\760139\760042\17598.ENC
c:\programdata\760139\760042\54994.ENC
c:\programdata\760139\760042\760139P
c:\programdata\760139\760042\760139WE
c:\programdata\760139\760042\86725.ENC
.
.
(((((((((((((((((((((((   Dateien erstellt von 2015-05-07 bis 2015-06-07  ))))))))))))))))))))))))))))))
.
.
2015-06-07 13:38 . 2015-06-07 13:38	--------	d-----w-	c:\users\Papa\AppData\Local\temp
2015-06-07 13:38 . 2015-06-07 13:38	--------	d-----w-	c:\users\Noah\AppData\Local\temp
2015-06-07 13:38 . 2015-06-07 13:38	--------	d-----w-	c:\users\HomeGroupUser$\AppData\Local\temp
2015-06-07 13:38 . 2015-06-07 13:38	--------	d-----w-	c:\users\Gast\AppData\Local\temp
2015-06-07 13:38 . 2015-06-07 13:38	--------	d-----w-	c:\users\Default\AppData\Local\temp
2015-06-07 13:38 . 2015-06-07 13:38	--------	d-----w-	c:\users\Administrator\AppData\Local\temp
2015-06-07 10:47 . 2015-06-07 10:48	--------	d-----w-	C:\FRST
2015-06-07 10:09 . 2015-03-27 13:04	1187344	----a-w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E15DC520-41A5-4928-99B4-8C75959133C2}\gapaengine.dll
2015-06-07 10:09 . 2015-05-03 03:16	12214312	----a-w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{EEDD5E7D-88A5-40AB-ACA3-FAC3AC1DBEB8}\mpengine.dll
2015-06-05 11:27 . 2015-05-03 03:16	12214312	----a-w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2015-06-05 11:25 . 2015-06-05 11:32	--------	d-----w-	c:\programdata\MFAData
2015-06-05 11:25 . 2015-06-05 11:25	--------	d-----w-	c:\users\David\AppData\Local\MFAData
2015-06-02 11:28 . 2015-06-02 11:28	--------	d-----w-	c:\users\David\AppData\Local\GWX
2015-05-29 14:49 . 2015-04-14 07:37	63704	----a-w-	c:\windows\system32\drivers\mwac.sys
2015-05-29 14:49 . 2015-04-14 07:37	107736	----a-w-	c:\windows\system32\drivers\mbamchameleon.sys
2015-05-29 14:49 . 2015-04-14 07:37	25816	----a-w-	c:\windows\system32\drivers\mbam.sys
2015-05-29 11:38 . 2015-05-29 11:38	118	----a-w-	c:\windows\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
2015-05-28 17:33 . 2015-05-28 17:32	351744	----a-w-	c:\windows\SysWow64\clientsvr.exe
2015-05-27 15:59 . 2015-05-27 15:59	--------	d-----w-	c:\users\David\AppData\Roaming\Imminent
2015-05-24 16:23 . 2015-05-24 16:23	715038	----a-w-	c:\windows\unins000.exe
2015-05-24 16:18 . 2014-06-08 20:14	2508336	----a-w-	c:\windows\SysWow64\DxtoryCodec.dll
2015-05-24 16:18 . 2014-06-08 20:14	2610736	----a-w-	c:\windows\system32\DxtoryCodec.dll
2015-05-22 14:30 . 2015-05-22 14:30	--------	d-----w-	c:\users\David\AppData\Roaming\Dojotech Software
2015-05-22 14:24 . 2015-05-27 17:16	--------	d-----w-	c:\users\David\AppData\Local\Spotify
2015-05-18 16:30 . 2015-03-14 03:21	82944	----a-w-	c:\windows\system32\dwmapi.dll
2015-05-18 16:30 . 2015-03-14 03:21	1632768	----a-w-	c:\windows\system32\dwmcore.dll
2015-05-18 16:30 . 2015-03-14 03:04	67584	----a-w-	c:\windows\SysWow64\dwmapi.dll
2015-05-18 16:30 . 2015-03-14 03:04	1372160	----a-w-	c:\windows\SysWow64\dwmcore.dll
2015-05-13 21:04 . 2015-05-01 13:17	124112	----a-w-	c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 21:04 . 2015-05-01 13:16	102608	----a-w-	c:\windows\SysWow64\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 10:48 . 2015-05-13 10:50	--------	d-----w-	c:\users\David\AppData\Roaming\Nico Mak Computing
2015-05-13 10:48 . 2008-08-18 16:18	77824	----a-w-	c:\windows\SysWow64\fmcodec.DLL
2015-05-13 09:15 . 2014-07-16 08:24	40760	----a-w-	c:\windows\system32\TURegOpt.exe
2015-05-13 09:15 . 2014-07-16 08:24	29496	----a-w-	c:\windows\system32\authuitu.dll
2015-05-13 09:15 . 2014-07-16 08:24	25400	----a-w-	c:\windows\SysWow64\authuitu.dll
2015-05-13 09:14 . 2015-05-14 08:58	--------	d-----w-	c:\program files (x86)\TuneUp Utilities 2014
2015-05-13 09:12 . 2015-05-13 09:12	--------	d-----w-	c:\program files (x86)\Common Files\DVDVideoSoft
2015-05-13 09:12 . 2015-05-13 09:12	--------	d-----w-	c:\users\David\AppData\Roaming\RHEng
2015-05-13 08:22 . 2015-04-21 17:14	24971776	----a-w-	c:\windows\system32\mshtml.dll
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-05-17 09:31 . 2014-02-08 21:16	778416	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2015-05-17 09:31 . 2014-02-08 21:16	142512	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2015-05-13 21:05 . 2014-02-08 20:43	140425016	----a-w-	c:\windows\system32\MRT.exe
2015-04-27 19:04 . 2015-05-13 08:20	44032	----a-w-	c:\windows\apppatch\acwow64.dll
2015-04-25 11:21 . 2015-04-25 11:21	129752	----a-w-	c:\windows\system32\drivers\2D0F36FE.sys
2015-04-05 11:00 . 2015-04-05 11:00	111016	----a-w-	c:\windows\system32\WindowsAccessBridge-64.dll
2015-04-05 11:00 . 2015-04-05 11:00	320424	----a-w-	c:\windows\system32\javaws.exe
2015-04-05 11:00 . 2015-04-05 11:00	189352	----a-w-	c:\windows\system32\javaw.exe
2015-04-05 11:00 . 2015-04-05 11:00	189352	----a-w-	c:\windows\system32\java.exe
2015-04-01 13:17 . 2015-04-01 13:17	135800	----a-w-	c:\windows\system32\drivers\epp64.sys
2015-03-28 03:44 . 2015-02-20 13:54	1316000	----a-w-	c:\windows\SysWow64\nvspcap.dll
2015-03-28 03:44 . 2015-02-20 13:54	1316000	----a-w-	c:\windows\SysWow64\nvspbridge.dll
2015-03-28 03:43 . 2015-02-20 13:54	1756424	----a-w-	c:\windows\system32\nvspbridge64.dll
2015-03-28 03:43 . 2015-02-20 13:54	1570672	----a-w-	c:\windows\system32\nvspcap64.dll
2015-03-27 13:04 . 2014-02-23 15:26	1187344	----a-w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2015-03-25 03:24 . 2015-04-15 14:01	98304	----a-w-	c:\windows\system32\wudriver.dll
2015-03-25 03:24 . 2015-04-15 14:01	37376	----a-w-	c:\windows\system32\wups2.dll
2015-03-25 03:24 . 2015-04-15 14:01	35328	----a-w-	c:\windows\system32\wups.dll
2015-03-25 03:24 . 2015-04-15 14:01	3298816	----a-w-	c:\windows\system32\wucltux.dll
2015-03-25 03:24 . 2015-04-15 14:01	2553856	----a-w-	c:\windows\system32\wuaueng.dll
2015-03-25 03:24 . 2015-04-15 14:01	191488	----a-w-	c:\windows\system32\wuwebv.dll
2015-03-25 03:24 . 2015-04-15 14:01	696320	----a-w-	c:\windows\system32\wuapi.dll
2015-03-25 03:24 . 2015-04-15 14:01	60416	----a-w-	c:\windows\system32\WinSetupUI.dll
2015-03-25 03:23 . 2015-04-15 14:01	12288	----a-w-	c:\windows\system32\wu.upgrade.ps.dll
2015-03-25 03:23 . 2015-04-15 14:01	36864	----a-w-	c:\windows\system32\wuapp.exe
2015-03-25 03:23 . 2015-04-15 14:01	135168	----a-w-	c:\windows\system32\wuauclt.exe
2015-03-25 03:00 . 2015-04-15 14:01	92672	----a-w-	c:\windows\SysWow64\wudriver.dll
2015-03-25 03:00 . 2015-04-15 14:01	566784	----a-w-	c:\windows\SysWow64\wuapi.dll
2015-03-25 03:00 . 2015-04-15 14:01	29696	----a-w-	c:\windows\SysWow64\wups.dll
2015-03-25 03:00 . 2015-04-15 14:01	173056	----a-w-	c:\windows\SysWow64\wuwebv.dll
2015-03-25 03:00 . 2015-04-15 14:01	33792	----a-w-	c:\windows\SysWow64\wuapp.exe
2015-03-23 03:25 . 2015-04-15 14:01	726528	----a-w-	c:\windows\system32\generaltel.dll
2015-03-23 03:25 . 2015-04-15 14:01	769536	----a-w-	c:\windows\system32\invagent.dll
2015-03-23 03:24 . 2015-04-15 14:01	419840	----a-w-	c:\windows\system32\devinv.dll
2015-03-23 03:24 . 2015-04-15 14:01	957952	----a-w-	c:\windows\system32\appraiser.dll
2015-03-23 03:24 . 2015-04-15 14:01	30720	----a-w-	c:\windows\system32\acmigration.dll
2015-03-23 03:24 . 2015-04-15 14:01	192000	----a-w-	c:\windows\system32\aepic.dll
2015-03-23 03:24 . 2015-04-15 14:01	227328	----a-w-	c:\windows\system32\aepdu.dll
2015-03-23 03:17 . 2015-04-15 14:01	1111552	----a-w-	c:\windows\system32\aeinv.dll
2015-03-19 19:02 . 2015-03-19 19:02	372224	----a-w-	c:\windows\system32\IntelOpenCL64.dll
2015-03-19 19:02 . 2015-03-19 19:02	304128	----a-w-	c:\windows\SysWow64\IntelOpenCL32.dll
2015-03-19 19:02 . 2015-03-19 19:02	280840	----a-w-	c:\windows\SysWow64\IntelCpHeciSvc.exe
2015-03-19 19:02 . 2015-03-19 19:02	183296	----a-w-	c:\windows\system32\igfxCoIn_v4170.dll
2015-03-19 19:02 . 2015-03-19 19:02	5120	----a-w-	c:\windows\system32\igfxLHMLibv2_0.dll
2015-03-19 19:02 . 2015-03-19 19:02	5120	----a-w-	c:\windows\system32\igfxLHMLib.dll
2015-03-19 19:02 . 2015-03-19 19:02	385024	----a-w-	c:\windows\system32\igfxOSP.dll
2015-03-19 19:02 . 2014-10-03 16:36	2024960	----a-w-	c:\windows\system32\igfxLHM.dll
2015-03-19 19:02 . 2014-05-28 14:21	393480	----a-w-	c:\windows\system32\igfxTray.exe
2015-03-19 19:02 . 2015-03-19 19:02	86528	----a-w-	c:\windows\system32\igfxCUIServicePS.dll
2015-03-19 19:02 . 2015-03-19 19:02	69632	----a-w-	c:\windows\system32\igfxDHLibv2_0.dll
2015-03-19 19:02 . 2015-03-19 19:02	60416	----a-w-	c:\windows\system32\igfxDHLib.dll
2015-03-19 19:02 . 2015-03-19 19:02	36616	----a-w-	c:\windows\system32\igfxexps.dll
2015-03-19 19:02 . 2015-03-19 19:02	35328	----a-w-	c:\windows\SysWow64\igfxexps32.dll
2015-03-19 19:02 . 2015-03-19 19:02	255488	----a-w-	c:\windows\system32\igfxCPL.cpl
2015-03-19 19:02 . 2015-03-19 19:02	229888	----a-w-	c:\windows\system32\igfxDTCM.dll
2015-03-19 19:02 . 2015-03-19 19:02	219400	----a-w-	c:\windows\system32\igfxext.exe
2015-03-19 19:02 . 2015-03-19 19:02	10752	----a-w-	c:\windows\system32\igfxDILibv2_0.dll
2015-03-19 19:02 . 2015-03-19 19:02	10752	----a-w-	c:\windows\system32\igfxDILib.dll
2015-03-19 19:02 . 2015-03-19 19:02	10240	----a-w-	c:\windows\system32\igfxEMLibv2_0.dll
2015-03-19 19:02 . 2015-03-19 19:02	10240	----a-w-	c:\windows\system32\igfxEMLib.dll
2015-03-19 19:02 . 2014-10-03 16:36	315144	----a-w-	c:\windows\system32\igfxEM.exe
2015-03-19 19:02 . 2014-10-03 16:36	250120	----a-w-	c:\windows\system32\igfxHK.exe
2015-03-19 19:02 . 2014-10-03 16:36	696832	----a-w-	c:\windows\system32\igfxDH.dll
2015-03-19 19:02 . 2014-10-03 16:36	345864	----a-w-	c:\windows\system32\igfxCUIService.exe
2015-03-19 19:02 . 2014-10-03 16:36	279040	----a-w-	c:\windows\system32\igfxDI.dll
2015-03-19 19:02 . 2014-02-09 01:47	6080608	----a-w-	c:\windows\system32\igdusc64.dll
2015-03-19 19:02 . 2014-05-28 14:21	24806000	----a-w-	c:\windows\system32\igdumdim64.dll
2015-03-19 19:02 . 2014-02-09 01:47	4788464	----a-w-	c:\windows\SysWow64\igdusc32.dll
2015-03-19 19:02 . 2014-02-09 01:47	24007768	----a-w-	c:\windows\SysWow64\igdumdim32.dll
2015-03-19 19:02 . 2015-03-19 19:02	3583488	----a-w-	c:\windows\system32\igdrcl64.dll
2015-03-19 19:02 . 2015-03-19 19:02	3318272	----a-w-	c:\windows\SysWow64\igdrcl32.dll
2015-03-19 19:02 . 2015-03-19 19:02	1637200	----a-w-	c:\windows\system32\igdmd64.dll
2015-03-19 19:02 . 2015-03-19 19:02	1269960	----a-w-	c:\windows\SysWow64\igdmd32.dll
2015-03-19 19:01 . 2015-03-19 19:01	4888368	----a-w-	c:\windows\system32\drivers\igdkmd64.sys
2015-03-19 19:01 . 2015-03-19 19:01	15980032	----a-w-	c:\windows\system32\igdfcl64.dll
2015-03-19 19:01 . 2015-03-19 19:01	6710542	----a-w-	c:\windows\system32\igdclbif.bin
2015-03-19 19:01 . 2015-03-19 19:01	227328	----a-w-	c:\windows\system32\igdde64.dll
2015-03-19 19:01 . 2015-03-19 19:01	187904	----a-w-	c:\windows\SysWow64\igdde32.dll
2015-03-19 19:01 . 2015-03-19 19:01	10850816	----a-w-	c:\windows\SysWow64\igdfcl32.dll
2015-03-19 19:01 . 2015-03-19 19:01	398848	----a-w-	c:\windows\system32\igdbcl64.dll
2015-03-19 19:01 . 2015-03-19 19:01	350720	----a-w-	c:\windows\SysWow64\igdbcl32.dll
2015-03-19 19:01 . 2015-03-19 19:01	17765456	----a-w-	c:\windows\system32\igd11dxva64.dll
2015-03-19 19:01 . 2015-03-19 19:01	169984	----a-w-	c:\windows\system32\igdail64.dll
2015-03-19 19:01 . 2015-03-19 19:01	152064	----a-w-	c:\windows\SysWow64\igdail32.dll
2015-03-19 19:01 . 2015-03-19 19:01	17289048	----a-w-	c:\windows\SysWow64\igd11dxva32.dll
2015-03-19 19:01 . 2014-02-09 01:47	9414176	----a-w-	c:\windows\system32\igd10iumd64.dll
2015-03-19 19:01 . 2015-03-19 19:01	8622624	----a-w-	c:\windows\SysWow64\igd10iumd32.dll
2015-03-19 19:01 . 2015-03-19 19:01	282696	----a-w-	c:\windows\system32\igd10idpp64.dll
2015-03-19 19:01 . 2015-03-19 19:01	263120	----a-w-	c:\windows\SysWow64\igd10idpp32.dll
2015-03-19 19:01 . 2015-03-06 01:16	9505280	----a-w-	c:\windows\system32\ig75icd64.dll
2015-03-19 19:01 . 2015-03-19 19:01	7481344	----a-w-	c:\windows\SysWow64\ig75icd32.dll
2015-03-19 19:01 . 2015-03-19 19:01	449800	----a-w-	c:\windows\system32\GfxUIEx.exe
2015-03-19 19:01 . 2015-03-19 19:01	1131008	----a-w-	c:\windows\system32\GfxResources.dll
2015-03-19 19:01 . 2015-03-19 19:01	1031432	----a-w-	c:\windows\system32\Gfxv4_0.exe
2015-03-19 19:01 . 2015-03-19 19:01	1027848	----a-w-	c:\windows\system32\Gfxv2_0.exe
2015-03-19 19:01 . 2015-03-19 19:01	340232	----a-w-	c:\windows\system32\DPTopologyApp.exe
2015-03-19 19:01 . 2015-03-19 19:01	339720	----a-w-	c:\windows\system32\DPTopologyAppv2_0.exe
2015-03-19 19:01 . 2015-03-19 19:01	157960	----a-w-	c:\windows\system32\difx64.exe
2015-03-10 03:25 . 2015-04-15 14:01	1882624	----a-w-	c:\windows\system32\msxml3.dll
2015-03-10 03:21 . 2015-04-15 14:01	2048	----a-w-	c:\windows\system32\msxml3r.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
p6_19_erinnerung.lnk - c:\program files (x86)\phase6\phase6_19\WinStart\p6erinnerung.exe [2007-2-11 49152]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux8"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R1 UsbCharger;UsbCharger;c:\windows\system32\DRIVERS\UsbCharger.sys;c:\windows\SYSNATIVE\DRIVERS\UsbCharger.sys [x]
R2 BstHdAndroidSvc;BlueStacks Android Service;c:\program files (x86)\BlueStacks\HD-Service.exe BstHdAndroidSvc Android;c:\program files (x86)\BlueStacks\HD-Service.exe BstHdAndroidSvc Android [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 f8794fcc;Optimizer Pro Crash Monitor;c:\windows\system32\rundll32.exe;c:\windows\SYSNATIVE\rundll32.exe [x]
R2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;d:\daten\David\Desktop\hamachi-2.exe;d:\daten\David\Desktop\hamachi-2.exe [x]
R2 MBAMService;MBAMService; [x]
R2 Razer Game Scanner Service;Razer Game Scanner;c:\program files (x86)\Razer\Razer Services\GSS\GameScannerService.exe;c:\program files (x86)\Razer\Razer Services\GSS\GameScannerService.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R2 ss_conn_service;SAMSUNG Mobile Connectivity Service;c:\users\David\usbdriver\25_escape\conn\ss_conn_service.exe;c:\users\David\usbdriver\25_escape\conn\ss_conn_service.exe [x]
R3 AppleChargerSrv;AppleChargerSrv;c:\windows\system32\AppleChargerSrv.exe;c:\windows\SYSNATIVE\AppleChargerSrv.exe [x]
R3 avmeject;AVM Eject;c:\windows\system32\drivers\avmeject.sys;c:\windows\SYSNATIVE\drivers\avmeject.sys [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys;c:\windows\SYSNATIVE\drivers\EagleX64.sys [x]
R3 FWLANUSB;AVM FRITZ!WLAN;c:\windows\system32\DRIVERS\fwlanusb.sys;c:\windows\SYSNATIVE\DRIVERS\fwlanusb.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 IntcDAud;Intel(R) Display-Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
R3 Intel(R) Capability Licensing Service TCP IP Interface;Intel(R) Capability Licensing Service TCP IP Interface;c:\program files\Intel\iCLS Client\SocketHeciServer.exe;c:\program files\Intel\iCLS Client\SocketHeciServer.exe [x]
R3 KovaPlusFltr;ROCCAT Kova[+] Mouse;c:\windows\system32\drivers\KovaPlusFltr.sys;c:\windows\SYSNATIVE\drivers\KovaPlusFltr.sys [x]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\;c:\windows\SYSNATIVE\drivers\ [x]
R3 MWAC;MWAC;c:\windows\system32\drivers\;c:\windows\SYSNATIVE\drivers\ [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 ScreamBAudioSvc;ScreamBee Audio;c:\windows\system32\drivers\ScreamingBAudio64.sys;c:\windows\SYSNATIVE\drivers\ScreamingBAudio64.sys [x]
R3 taphss6;Anchorfree HSS VPN Adapter;c:\windows\system32\DRIVERS\taphss6.sys;c:\windows\SYSNATIVE\DRIVERS\taphss6.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesDriver64.sys;c:\program files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesDriver64.sys [x]
R3 usbrndis6;USB-RNDIS6-Adapter;c:\windows\system32\DRIVERS\usb80236.sys;c:\windows\SYSNATIVE\DRIVERS\usb80236.sys [x]
R3 X6va022;X6va022;c:\windows\SysWOW64\Drivers\X6va022;c:\windows\SysWOW64\Drivers\X6va022 [x]
R3 X6va029;X6va029;c:\windows\SysWOW64\Drivers\X6va029;c:\windows\SysWOW64\Drivers\X6va029 [x]
S0 iaStorA;iaStorA;c:\windows\system32\DRIVERS\iaStorA.sys;c:\windows\SYSNATIVE\DRIVERS\iaStorA.sys [x]
S0 iaStorF;iaStorF;c:\windows\system32\DRIVERS\iaStorF.sys;c:\windows\SYSNATIVE\DRIVERS\iaStorF.sys [x]
S0 iusb3hcs;Intel(R) USB 3.0 Hostcontroller-Switchtreiber;c:\windows\system32\DRIVERS\iusb3hcs.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hcs.sys [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys;c:\windows\SYSNATIVE\Drivers\PxHlpa64.sys [x]
S1 AppleCharger;AppleCharger;c:\windows\system32\DRIVERS\AppleCharger.sys;c:\windows\SYSNATIVE\DRIVERS\AppleCharger.sys [x]
S1 epp64;epp64;c:\windows\system32\DRIVERS\epp64.sys;c:\windows\SYSNATIVE\DRIVERS\epp64.sys [x]
S1 netfilter64;netfilter64;c:\windows\system32\drivers\netfilter64.sys;c:\windows\SYSNATIVE\drivers\netfilter64.sys [x]
S2 Apache2.4;Apache2.4;d:\xampp\apache\bin\httpd.exe;d:\xampp\apache\bin\httpd.exe [x]
S2 BstHdDrv;BlueStacks Hypervisor;c:\program files (x86)\BlueStacks\HD-Hypervisor-amd64.sys;c:\program files (x86)\BlueStacks\HD-Hypervisor-amd64.sys [x]
S2 BstHdLogRotatorSvc;BlueStacks Log Rotator Service;c:\program files (x86)\BlueStacks\HD-LogRotatorService.exe;c:\program files (x86)\BlueStacks\HD-LogRotatorService.exe [x]
S2 BstHdUpdaterSvc;BlueStacks Updater Service;c:\program files (x86)\BlueStacks\HD-UpdaterService.exe;c:\program files (x86)\BlueStacks\HD-UpdaterService.exe [x]
S2 c2cautoupdatesvc;Skype Click to Call Updater;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [x]
S2 c2cpnrsvc;Skype Click to Call PNR Service;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [x]
S2 CGVPNCliService;CyberGhost 5 Client Service;c:\program files\CyberGhost 5\Service.exe;c:\program files\CyberGhost 5\Service.exe [x]
S2 DiagTrack;Diagnostics Tracking Service;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
S2 GfExperienceService;NVIDIA GeForce Experience Service;c:\program files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe;c:\program files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 igfxCUIService1.0.0.0;Intel(R) HD Graphics Control Panel Service;c:\windows\system32\igfxCUIService.exe;c:\windows\SYSNATIVE\igfxCUIService.exe [x]
S2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe;c:\program files\Intel\iCLS Client\HeciServer.exe [x]
S2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [x]
S2 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]
S2 NvNetworkService;NVIDIA Network Service;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [x]
S2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [x]
S2 Realtek11nCU;Realtek11nCU;c:\program files (x86)\Hama\Wireless LAN RTL8188CU\RtlService.exe;c:\program files (x86)\Hama\Wireless LAN RTL8188CU\RtlService.exe [x]
S2 RzKLService;RzKLService;d:\daten\Razer Cortex\RzKLService.exe;d:\daten\Razer Cortex\RzKLService.exe [x]
S2 rzpmgrk;rzpmgrk;c:\windows\system32\drivers\rzpmgrk.sys;c:\windows\SYSNATIVE\drivers\rzpmgrk.sys [x]
S2 rzpnk;rzpnk;c:\windows\system32\drivers\rzpnk.sys;c:\windows\SYSNATIVE\drivers\rzpnk.sys [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x]
S3 EuMusDesignVirtualAudioCableWdm;Virtual Audio Cable (WDM);c:\windows\system32\DRIVERS\vrtaucbl.sys;c:\windows\SYSNATIVE\DRIVERS\vrtaucbl.sys [x]
S3 iusb3hub;Intel(R) USB 3.0-Hubtreiber;c:\windows\system32\DRIVERS\iusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hub.sys [x]
S3 iusb3xhc;Intel(R) USB 3.0 eXtensible-Hostcontrollertreiber;c:\windows\system32\DRIVERS\iusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3xhc.sys [x]
S3 LADF_CaptureOnly;LADF Capture Filter Driver;c:\windows\system32\DRIVERS\ladfGSCamd64.sys;c:\windows\SYSNATIVE\DRIVERS\ladfGSCamd64.sys [x]
S3 LADF_RenderOnly;LADF Render Filter Driver;c:\windows\system32\DRIVERS\ladfGSRamd64.sys;c:\windows\SYSNATIVE\DRIVERS\ladfGSRamd64.sys [x]
S3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver;c:\windows\system32\drivers\LGBusEnum.sys;c:\windows\SYSNATIVE\drivers\LGBusEnum.sys [x]
S3 LGVirHid;Logitech Gamepanel Virtual HID Device Driver;c:\windows\system32\drivers\LGVirHid.sys;c:\windows\SYSNATIVE\drivers\LGVirHid.sys [x]
S3 NisSrv;Microsoft-Netzwerkinspektion;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x]
S3 NvStreamKms;NvStreamKms;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [x]
S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad64v.sys;c:\windows\SYSNATIVE\drivers\nvvad64v.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 RTL8192cu;Realtek RTL8192CU Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8192cu.sys;c:\windows\SYSNATIVE\DRIVERS\RTL8192cu.sys [x]
S3 rzendpt;rzendpt;c:\windows\system32\DRIVERS\rzendpt.sys;c:\windows\SYSNATIVE\DRIVERS\rzendpt.sys [x]
S3 rzudd;Razer Keyboard Driver;c:\windows\system32\DRIVERS\rzudd.sys;c:\windows\SYSNATIVE\DRIVERS\rzudd.sys [x]
S3 ssudmdm;SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x]
S3 XSplit_Dummy;XSplit  Stream  Audio  Renderer;c:\windows\system32\drivers\xspltspk.sys;c:\windows\SYSNATIVE\drivers\xspltspk.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt	REG_MULTI_SZ   	hpqcxs08 hpqddsvc
.
Inhalt des "geplante Tasks" Ordners
.
2015-06-07 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-02-08 09:31]
.
2015-06-06 c:\windows\Tasks\Defraggler Volume D Task.job
- c:\program files\Defraggler\df64.exe [2013-10-14 15:05]
.
2015-06-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2015-04-01 13:18]
.
2015-06-07 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2015-04-01 13:18]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ AccExtIco1]
@="{AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47}"
[HKEY_CLASSES_ROOT\CLSID\{AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47}]
2015-04-16 15:42	997536	----a-w-	c:\program files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ AccExtIco2]
@="{853B7E05-C47D-4985-909A-D0DC5C6D7303}"
[HKEY_CLASSES_ROOT\CLSID\{853B7E05-C47D-4985-909A-D0DC5C6D7303}]
2015-04-16 15:42	997536	----a-w-	c:\program files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ AccExtIco3]
@="{42D38F2E-98E9-4382-B546-E24E4D6D04BB}"
[HKEY_CLASSES_ROOT\CLSID\{42D38F2E-98E9-4382-B546-E24E4D6D04BB}]
2015-04-16 15:42	997536	----a-w-	c:\program files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2014-12-11 13776088]
"IAStorIcon"="c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe" [2013-04-30 36352]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2015-04-29 1337000]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2015-03-19 393480]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2015-03-30 500936]
"Launch LCore"="c:\program files\Logitech Gaming Software\LCore.exe" [2014-07-28 10801944]
"NvBackend"="c:\program files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe" [2015-03-28 2673296]
"ShadowPlay"="c:\windows\system32\nvspcap64.dll" [2015-03-28 1570672]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uDefault_Search_URL = www.google.com
uStart Page = www.google.com
mDefault_Search_URL = www.google.com
mDefault_Page_URL = www.google.com
mStart Page = www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
mSearch Page = www.google.com
uInternet Settings,ProxyOverride = <-loopback>
uSearchAssistant = www.google.com
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
TCP: DhcpNameServer = 192.168.178.1
TCP: Interfaces\{45604D2E-909F-44D3-9DE8-DFA256A48B5F}: NameServer = 192.168.1.1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\MBAMProtector]
"ImagePath"="\??\c:\windows\system32\drivers\"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\MBAMService]
"ImagePath"="\"\\""
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\MWAC]
"ImagePath"="\??\c:\windows\system32\drivers\"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\X6va022]
"ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va022"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\X6va029]
"ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va029"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-914325664-1482865349-517734357-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{4DEC1838-553E-CA58-8EAA-D2297088DCDD}*]
"laaggnapaccocgmnacngniel"=hex:64,62,62,6c,6d,66,6a,68,61,6c,6f,67,61,64,62,68,
   68,66,67,63,6b,68,6e,6f,62,6b,69,67,64,6f,6a,6e,6f,63,62,6e,6b,65,6b,62,00,\
"lakgpahjpobfmebdglmfaocc"=hex:64,62,62,6c,6d,66,6a,68,61,6c,6f,67,61,64,62,68,
   68,66,67,63,6b,68,6e,6f,62,6b,69,67,64,6f,6a,6e,6f,63,62,6e,6b,65,6b,62,00,\
.
[HKEY_USERS\S-1-5-21-914325664-1482865349-517734357-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:90,64,86,aa,86,20,d5,76,85,ea,6d,27,42,ca,93,d3,2d,86,1e,23,6c,79,0d,
   58,be,f9,79,44,16,bf,23,f5,c3,eb,37,f2,25,8a,3d,fb,dc,e9,a8,a0,e0,1b,34,d4,\
"??"=hex:bf,b9,89,cd,1b,55,e9,56,c2,d7,3a,1f,76,cc,68,b1
.
[HKEY_LOCAL_MACHINE\software\BlueStacks]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
   00,5c,00,4d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_17_0_0_169_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_17_0_0_169_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_17_0_0_169_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_17_0_0_169_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_17_0_0_169.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.17"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_17_0_0_169.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_17_0_0_169.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_17_0_0_169.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*]
@="?????????????????? v1"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*\CLSID]
@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*]
@="?????????????????? v2"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*\CLSID]
@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2015-06-07  16:15:48
ComboFix-quarantined-files.txt  2015-06-07 14:15
ComboFix2.txt  2015-06-07 11:52
.
Vor Suchlauf: 6.003.920.896 Bytes frei
Nach Suchlauf: 5.675.479.040 Bytes frei
.
- - End Of File - - 65676A6EC017596D63FBE6DD87CD6E84
A36C5E4F47E84449FF07ED3517B43A31

hier die LogDatei von MBAR:

Code:

ATTFilter

Malwarebytes Anti-Rootkit BETA 1.09.1.1004
www.malwarebytes.org

Database version:
  main:    v2015.06.07.03
  rootkit: v2015.06.02.01

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.17801
David :: BLACKMATRIX [administrator]

07.06.2015 16:23:29
mbar-log-2015-06-07 (16-23-29).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled: 
Objects scanned: 545932
Time elapsed: 15 minute(s), 35 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 1
C:\Users\David\AppData\Roaming\Imminent\Logs (Stolen.Data) -> Delete on reboot. [b728d5e239519a9c69248f8d29dbab55]

Files Detected: 11
C:\WINDOWS\SYSTEM32\drivers\netfilter64.sys (PUP.Optional.AdPeak.A) -> Delete on reboot. [9e34bf0784e087f7366dbd2bda01c8eb]
C:\Windows\SysWOW64\clientsvr.exe (Backdoor.Agent.MSCGen) -> Delete on reboot. [03dc5c5b325860d6240c5e76c04115eb]
D:\DATEN\David\Desktop\Desktop\Universial Patcher Adobe\adobe.snr.patch-painter.exe (RiskWare.Tool.HCK) -> Delete on reboot. [4b9461561179261055d51452778b4bb5]
C:\Users\David\AppData\Roaming\Imminent\Logs\01-06-2015 (Stolen.Data) -> Delete on reboot. [b728d5e239519a9c69248f8d29dbab55]
C:\Users\David\AppData\Roaming\Imminent\Logs\02-06-2015 (Stolen.Data) -> Delete on reboot. [b728d5e239519a9c69248f8d29dbab55]
C:\Users\David\AppData\Roaming\Imminent\Logs\03-06-2015 (Stolen.Data) -> Delete on reboot. [b728d5e239519a9c69248f8d29dbab55]
C:\Users\David\AppData\Roaming\Imminent\Logs\27-05-2015 (Stolen.Data) -> Delete on reboot. [b728d5e239519a9c69248f8d29dbab55]
C:\Users\David\AppData\Roaming\Imminent\Logs\28-05-2015 (Stolen.Data) -> Delete on reboot. [b728d5e239519a9c69248f8d29dbab55]
C:\Users\David\AppData\Roaming\Imminent\Logs\29-05-2015 (Stolen.Data) -> Delete on reboot. [b728d5e239519a9c69248f8d29dbab55]
C:\Users\David\AppData\Roaming\Imminent\Logs\30-05-2015 (Stolen.Data) -> Delete on reboot. [b728d5e239519a9c69248f8d29dbab55]
C:\Users\David\AppData\Roaming\Imminent\Logs\31-05-2015 (Stolen.Data) -> Delete on reboot. [b728d5e239519a9c69248f8d29dbab55]

Physical Sectors Detected: 0
(No malicious items detected)

(end)

hier ist die LogDatei von FRST.txt und Addition.txt (Im nächsten Beitrag):

FRST.txt:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:06-06-2015
Ran by David (administrator) on BLACKMATRIX on 07-06-2015 17:06:00
Running from D:\DATEN\David\Desktop
Loaded Profiles: David (Available Profiles: David & Papa)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Apache Software Foundation) D:\XAMPP\apache\bin\httpd.exe
(AVM Berlin) C:\Program Files (x86)\avmwlanstick\WLanNetService.exe
(BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe
(BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-UpdaterService.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.27.5\GoogleCrashHandler.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.27.5\GoogleCrashHandler64.exe
(Apache Software Foundation) D:\XAMPP\apache\bin\httpd.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(FileZilla Project) D:\XAMPP\FileZillaFTP\FileZillaServer.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
() D:\XAMPP\mysql\bin\mysqld.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Realtek) C:\Program Files (x86)\Hama\Wireless LAN RTL8188CU\RtlService.exe
(Razer Inc.) D:\DATEN\Razer Cortex\RzKLService.exe
(Realtek Semiconductor Corp.) C:\Program Files (x86)\Hama\Wireless LAN RTL8188CU\RtWLan.exe
(DEVGURU Co., LTD.) C:\Users\David\usbdriver\25_escape\conn\ss_conn_service.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(CyberGhost S.R.L) C:\Program Files\CyberGhost 5\Service.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
() C:\Windows\System32\igfxTray.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\LCore.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\ShadowPlay\nvspcaps64.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Valve Corporation) D:\DATEN\Steam\Steam.exe
(Valve Corporation) D:\DATEN\Steam\bin\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Valve Corporation) D:\DATEN\Steam\bin\steamwebhelper.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13776088 2014-12-11] (Realtek Semiconductor)
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [286704 2013-04-30] (Intel Corporation)
HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1337000 2015-04-30] (Microsoft Corporation)
HKLM\...\Run: [IgfxTray] => C:\Windows\system32\igfxtray.exe [393480 2015-03-19] ()
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [500936 2015-03-30] (Adobe Systems Incorporated)
HKLM\...\Run: [Launch LCore] => C:\Program Files\Logitech Gaming Software\LCore.exe [10801944 2014-07-28] (Logitech Inc.)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2673296 2015-03-28] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
Winlogon\Notify\igfxcui: igfxdev.dll [X]
HKU\S-1-5-21-914325664-1482865349-517734357-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\Mystify.scr [242688 2010-11-21] (Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\p6_19_erinnerung.lnk [2014-06-20]
ShortcutTarget: p6_19_erinnerung.lnk -> C:\Program Files (x86)\phase6\phase6_19\WinStart\p6erinnerung.exe (phase6)
ShellIconOverlayIdentifiers: [ AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2015-04-16] ()
ShellIconOverlayIdentifiers: [ AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2015-04-16] ()
ShellIconOverlayIdentifiers: [ AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2015-04-16] ()
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
CHR HKU\S-1-5-21-914325664-1482865349-517734357-1000\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-914325664-1482865349-517734357-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-914325664-1482865349-517734357-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKU\S-1-5-21-914325664-1482865349-517734357-1000 -> DefaultScope {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = 
SearchScopes: HKU\S-1-5-21-914325664-1482865349-517734357-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=SamsungXSSDX840XEVOX120GB_S1D5NSAF121893F&ts=1427816371&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-914325664-1482865349-517734357-1000 -> {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=SamsungXSSDX840XEVOX120GB_S1D5NSAF121893F&ts=1427816371&type=default&q={searchTerms}
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll [2015-04-05] (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-05-01] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll [2015-04-05] (Oracle Corporation)
BHO-x32: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll [2009-09-20] (Hewlett-Packard Co.)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-05-01] (Microsoft Corporation)
BHO-x32: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll [2009-09-20] (Hewlett-Packard Co.)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-05-01] (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-05-01] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{45604D2E-909F-44D3-9DE8-DFA256A48B5F}: [NameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default
FF SelectedSearchEngine: mystartsearch
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_188.dll [2015-05-17] ()
FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll [2012-07-17] (Tracker Software Products (Canada) Ltd.)
FF Plugin: @java.com/DTPlugin,version=10.75.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll [2015-04-05] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.75.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll [2015-04-05] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll [2015-04-20] (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_188.dll [2015-05-17] ()
FF Plugin-x32: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll [2012-07-17] (Tracker Software Products (Canada) Ltd.)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=3.0.72 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-04-11] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-04-11] (Intel Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2013-02-05] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2013-02-05] (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2015-02-05] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2015-02-05] (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-16] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-16] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-02-05] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-02-05] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-05-01] (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll [2015-04-20] (Adobe Systems)
FF Plugin HKU\S-1-5-21-914325664-1482865349-517734357-1000: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll [2012-07-17] (Tracker Software Products (Canada) Ltd.)
FF Plugin HKU\S-1-5-21-914325664-1482865349-517734357-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\David\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll No File
FF user.js: detected! => C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\user.js [2015-03-31]
FF Extension: No Name - C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\Extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com [2015-03-31]
FF Extension: Hotspot Shield  - C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\Extensions\{c95a4e8e-816d-4655-8c79-d736da1adb6d} [2015-02-16]
FF Extension: SQLite Manager - C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\Extensions\SQLiteManager@mrinalkant.blogspot.com.xpi [2015-02-02]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-07-14]
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2014-02-23]
FF HKU\S-1-5-21-914325664-1482865349-517734357-1000\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [not found]
StartMenuInternet: FIREFOX.EXE - firefox.exe

Chrome: 
=======
CHR Profile: C:\Users\David\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-06-07]
CHR Extension: (Google Docs) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-04-01]
CHR Extension: (Google Drive) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-04-01]
CHR Extension: (YouTube) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-04-01]
CHR Extension: (Google Search) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-04-01]
CHR Extension: (Google Sheets) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-06-07]
CHR Extension: (Bookmark Manager) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik [2015-04-22]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-04-01]
CHR Extension: (Amazon-Icon) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkcedibhemacmilmkpndpkoidlnmgngg [2015-04-01]
CHR Extension: (Google Wallet) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-04-01]
CHR Extension: (Gmail) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-04-01]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2015-05-01]
CHR HKLM-x32\...\Chrome\Extension: [mkcedibhemacmilmkpndpkoidlnmgngg] - C:\Users\David\ChromeExtensions\mkcedibhemacmilmkpndpkoidlnmgngg\amazon.crx [2014-05-01]

Opera: 
=======
OPR Extension: (CinemaP-1.4cV01.03) - C:\Users\David\AppData\Roaming\Opera Software\Opera Stable\Extensions\eagomcfjiefffhpaejnlpjccikpipdoe [2015-03-01]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 Apache2.4; D:\xampp\apache\bin\httpd.exe [22016 2014-07-17] (Apache Software Foundation) [File not signed]
S3 AppleChargerSrv; C:\Windows\System32\AppleChargerSrv.exe [31272 2010-04-06] ()
R2 AVM WLAN Connection Service; C:\Program Files (x86)\avmwlanstick\WlanNetService.exe [376832 2010-10-22] (AVM Berlin) [File not signed]
S2 BstHdAndroidSvc; C:\Program Files (x86)\BlueStacks\HD-Service.exe [405208 2014-07-15] (BlueStack Systems, Inc.)
R2 BstHdLogRotatorSvc; C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe [384728 2014-07-15] (BlueStack Systems, Inc.)
R2 BstHdUpdaterSvc; C:\Program Files (x86)\BlueStacks\HD-UpdaterService.exe [773848 2014-07-15] (BlueStack Systems, Inc.)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1394816 2015-05-01] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1772672 2015-05-01] (Microsoft Corporation)
R2 CGVPNCliService; C:\Program Files\CyberGhost 5\Service.exe [64616 2014-11-03] (CyberGhost S.R.L)
R2 FileZilla Server; D:\xampp\filezillaftp\filezillaserver.exe [632320 2012-02-26] (FileZilla Project) [File not signed]
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1152144 2015-03-28] (NVIDIA Corporation)
R3 hpqcxs08; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll [249344 2009-09-20] (Hewlett-Packard Co.) [File not signed]
R2 hpqddsvc; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqddsvc.dll [133120 2009-09-20] (Hewlett-Packard Co.) [File not signed]
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15344 2013-04-30] (Intel Corporation)
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [345864 2015-03-19] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [731648 2013-02-13] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [820184 2013-02-13] (Intel(R) Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-04-11] (Intel Corporation)
S2 MBAMService; \ [0 ] () <==== ATTENTION (zero byte File/Folder)
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23816 2015-04-30] (Microsoft Corporation)
R2 mysql; D:\xampp\mysql\bin\mysqld.exe [11021824 2014-09-11] () [File not signed]
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2008-12-03] (Hewlett-Packard) [File not signed]
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [366544 2015-04-30] (Microsoft Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1878672 2015-03-28] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [22995600 2015-03-28] (NVIDIA Corporation)
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2008-12-03] (Hewlett-Packard) [File not signed]
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2014-09-20] ()
S2 Razer Game Scanner Service; C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe [0 2015-05-27] () <==== ATTENTION (zero byte File/Folder)
R2 Realtek11nCU; C:\Program Files (x86)\Hama\Wireless LAN RTL8188CU\RtlService.exe [36864 2010-04-16] (Realtek) [File not signed]
R2 RzKLService; D:\DATEN\Razer Cortex\RzKLService.exe [129168 2015-01-26] (Razer Inc.)
R2 ss_conn_service; C:\Users\David\usbdriver\25_escape\conn\ss_conn_service.exe [741640 2014-06-16] (DEVGURU Co., LTD.)
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5448976 2015-04-17] (TeamViewer GmbH)
R2 Themes; C:\Windows\system32\themeservice.dll [44544 2014-07-19] (Microsoft Corporation) [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2014-02-08] (Microsoft Corporation)
S2 f8794fcc; "C:\Windows\system32\rundll32.exe" "c:\Program Files (x86)\Optimizer Pro 3.52\OptProMon.dll",ENT <==== ATTENTION
S2 Hamachi2Svc; D:\DATEN\David\Desktop\hamachi-2.exe -s [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R1 AppleCharger; C:\Windows\System32\DRIVERS\AppleCharger.sys [21584 2013-02-19] ()
S3 avmeject; C:\Windows\System32\drivers\avmeject.sys [14120 2010-10-22] (AVM Berlin)
R2 BstHdDrv; C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys [122072 2014-07-15] (BlueStack Systems)
R1 epp64; C:\Windows\System32\DRIVERS\epp64.sys [135800 2015-04-01] (Emsisoft GmbH)
S3 FWLANUSB; C:\Windows\System32\DRIVERS\fwlanusb.sys [460800 2010-10-22] (AVM GmbH)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28656 2013-04-30] (Intel Corporation)
S3 KovaPlusFltr; C:\Windows\System32\drivers\KovaPlusFltr.sys [15104 2010-01-25] (ROCCAT Development, Inc.)
S3 MBAMProtector; \??\C:\Windows\system32\drivers\ [0 ] () <==== ATTENTION (zero byte File/Folder)
S3 MBAMProtector; \??\C:\Windows\SysWOW64\drivers\ [0 ] () <==== ATTENTION (zero byte File/Folder)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [280376 2015-03-04] (Microsoft Corporation)
S3 MWAC; \??\C:\Windows\system32\drivers\ [0 ] () <==== ATTENTION (zero byte File/Folder)
S3 MWAC; \??\C:\Windows\SysWOW64\drivers\ [0 ] () <==== ATTENTION (zero byte File/Folder)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [124568 2015-03-04] (Microsoft Corporation)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19600 2015-03-28] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38032 2014-11-22] (NVIDIA Corporation)
R0 PxHlpa64; C:\Windows\System32\Drivers\PxHlpa64.sys [56336 2012-06-22] (Corel Corporation)
R3 RTL8192cu; C:\Windows\System32\DRIVERS\RTL8192cu.sys [748648 2010-08-12] (Realtek Semiconductor Corporation                           )
R3 rzendpt; C:\Windows\System32\DRIVERS\rzendpt.sys [39592 2014-12-30] (Razer Inc)
R2 rzpmgrk; C:\Windows\system32\drivers\rzpmgrk.sys [37184 2015-01-31] (Razer, Inc.)
R2 rzpnk; C:\Windows\system32\drivers\rzpnk.sys [129600 2014-12-10] (Razer, Inc.)
S3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [42184 2014-05-17] (Anchorfree Inc.)
S1 UsbCharger; C:\Windows\System32\DRIVERS\UsbCharger.sys [21584 2013-05-06] ()
S3 usbrndis6; C:\Windows\System32\DRIVERS\usb80236.sys [19968 2014-02-08] (Microsoft Corporation)
R3 XSplit_Dummy; C:\Windows\System32\drivers\xspltspk.sys [26200 2014-07-02] (SplitmediaLabs Limited)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
S3 gdrv; \??\C:\Windows\gdrv.sys [X]
S1 netfilter64; system32\drivers\netfilter64.sys [X]
S3 TuneUpUtilitiesDrv; \??\C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesDriver64.sys [X]
S3 X6va022; \??\C:\Windows\SysWOW64\Drivers\X6va022 [X]
S3 X6va029; \??\C:\Windows\SysWOW64\Drivers\X6va029 [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-06-07 16:23 - 2015-06-07 17:02 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-06-07 16:23 - 2015-06-07 16:44 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-06-07 16:16 - 2015-06-07 16:16 - 00036821 _____ C:\ComboFix.txt
2015-06-07 13:42 - 2015-06-07 16:18 - 00000000 ____D C:\Qoobox
2015-06-07 13:42 - 2015-06-07 13:51 - 00000000 ____D C:\Windows\erdnt
2015-06-07 13:42 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2015-06-07 13:42 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2015-06-07 13:42 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-06-07 13:42 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-06-07 13:42 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-06-07 13:42 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2015-06-07 13:42 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2015-06-07 13:42 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2015-06-07 12:47 - 2015-06-07 17:06 - 00000000 ____D C:\FRST
2015-06-05 13:25 - 2015-06-05 13:32 - 00000000 ____D C:\ProgramData\MFAData
2015-06-05 13:25 - 2015-06-05 13:25 - 00000000 ____D C:\Users\David\AppData\Local\MFAData
2015-06-02 13:28 - 2015-06-02 13:28 - 00000000 ____D C:\Users\David\AppData\Local\GWX
2015-06-01 17:21 - 2015-06-01 17:21 - 00018473 _____ C:\Windows\DirectX.log
2015-06-01 16:50 - 2015-06-01 16:50 - 00000000 ____D C:\Users\David\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Counter-Strike
2015-05-30 09:09 - 2015-06-07 16:39 - 00007270 _____ C:\Windows\PFRO.log
2015-05-29 23:04 - 2015-06-07 16:40 - 00003192 _____ C:\Windows\setupact.log
2015-05-29 23:04 - 2015-05-29 23:04 - 00000000 _____ C:\Windows\setuperr.log
2015-05-29 16:50 - 2015-05-29 16:50 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-05-29 16:49 - 2015-06-07 16:43 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-05-29 16:49 - 2015-04-14 09:37 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-05-29 16:49 - 2015-04-14 09:37 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-05-29 13:38 - 2015-05-29 13:38 - 00000118 _____ C:\Windows\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
2015-05-27 17:59 - 2015-06-07 16:39 - 00000000 ____D C:\Users\David\AppData\Roaming\Imminent
2015-05-24 18:23 - 2015-05-24 18:23 - 00715038 _____ C:\Windows\unins000.exe
2015-05-24 18:18 - 2015-05-24 18:18 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dxtory2.0
2015-05-24 18:18 - 2014-06-08 22:14 - 02610736 _____ (ExKode Co. Ltd.) C:\Windows\system32\DxtoryCodec.dll
2015-05-24 18:18 - 2014-06-08 22:14 - 02508336 _____ (ExKode Co. Ltd.) C:\Windows\SysWOW64\DxtoryCodec.dll
2015-05-23 22:44 - 2015-05-23 22:44 - 00000484 __RSH C:\Users\David\ntuser.pol
2015-05-22 16:30 - 2015-05-22 16:30 - 00000000 ____D C:\Users\David\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dojotech Software
2015-05-22 16:30 - 2015-05-22 16:30 - 00000000 ____D C:\Users\David\AppData\Roaming\Dojotech Software
2015-05-22 16:24 - 2015-05-27 19:16 - 00000000 ____D C:\Users\David\AppData\Local\Spotify
2015-05-22 16:24 - 2015-05-22 16:41 - 00001806 _____ C:\Users\David\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk
2015-05-18 18:30 - 2015-03-14 05:21 - 01632768 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll
2015-05-18 18:30 - 2015-03-14 05:21 - 00082944 _____ (Microsoft Corporation) C:\Windows\system32\dwmapi.dll
2015-05-18 18:30 - 2015-03-14 05:04 - 01372160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll
2015-05-18 18:30 - 2015-03-14 05:04 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmapi.dll
2015-05-13 23:04 - 2015-05-01 15:17 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 23:04 - 2015-05-01 15:16 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 12:48 - 2015-05-13 12:50 - 00000000 ____D C:\Users\David\AppData\Roaming\Nico Mak Computing
2015-05-13 12:48 - 2008-08-18 18:18 - 00077824 _____ (Fox Magic Software) C:\Windows\SysWOW64\fmcodec.DLL
2015-05-13 12:28 - 2015-05-13 12:28 - 00000000 ____D C:\Users\David\Downloads\Es tut mir leid DayZ Song by Execute
2015-05-13 11:15 - 2015-05-13 11:15 - 00002211 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2014.lnk
2015-05-13 11:15 - 2014-07-16 10:24 - 00040760 _____ (TuneUp Software) C:\Windows\system32\TURegOpt.exe
2015-05-13 11:15 - 2014-07-16 10:24 - 00029496 _____ (TuneUp Software) C:\Windows\system32\authuitu.dll
2015-05-13 11:15 - 2014-07-16 10:24 - 00025400 _____ (TuneUp Software) C:\Windows\SysWOW64\authuitu.dll
2015-05-13 11:14 - 2015-05-14 10:58 - 00000000 ____D C:\Program Files (x86)\TuneUp Utilities 2014
2015-05-13 11:13 - 2015-05-13 11:13 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
2015-05-13 11:12 - 2015-05-13 11:12 - 00000000 ____D C:\Users\David\AppData\Roaming\RHEng
2015-05-13 10:44 - 2015-05-13 10:44 - 00000000 ____D C:\Users\David\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\JDownloader
2015-05-13 10:23 - 2015-05-05 03:29 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-05-13 10:23 - 2015-05-05 03:12 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-05-13 10:23 - 2015-04-22 04:28 - 00389840 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-05-13 10:23 - 2015-04-22 03:48 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-05-13 10:23 - 2015-04-21 19:08 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-05-13 10:23 - 2015-04-21 19:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-05-13 10:23 - 2015-04-21 18:51 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-05-13 10:23 - 2015-04-21 18:50 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-05-13 10:23 - 2015-04-21 18:50 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-05-13 10:23 - 2015-04-21 18:50 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-05-13 10:23 - 2015-04-21 18:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-05-13 10:23 - 2015-04-21 18:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-05-13 10:23 - 2015-04-21 18:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-05-13 10:23 - 2015-04-21 18:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-05-13 10:23 - 2015-04-21 18:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-05-13 10:23 - 2015-04-21 18:35 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-05-13 10:23 - 2015-04-21 18:35 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-05-13 10:23 - 2015-04-21 18:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-05-13 10:23 - 2015-04-21 18:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-05-13 10:23 - 2015-04-21 18:31 - 06025728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-05-13 10:23 - 2015-04-21 18:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-05-13 10:23 - 2015-04-21 18:25 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-05-13 10:23 - 2015-04-21 18:24 - 19691008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-05-13 10:23 - 2015-04-21 18:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-05-13 10:23 - 2015-04-21 18:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-05-13 10:23 - 2015-04-21 18:11 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-05-13 10:23 - 2015-04-21 18:11 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-05-13 10:23 - 2015-04-21 18:10 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-05-13 10:23 - 2015-04-21 18:09 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-05-13 10:23 - 2015-04-21 18:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-05-13 10:23 - 2015-04-21 18:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-05-13 10:23 - 2015-04-21 18:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-05-13 10:23 - 2015-04-21 18:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-05-13 10:23 - 2015-04-21 18:04 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-05-13 10:23 - 2015-04-21 18:03 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-05-13 10:23 - 2015-04-21 18:02 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-05-13 10:23 - 2015-04-21 18:00 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-05-13 10:23 - 2015-04-21 17:58 - 00664576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-05-13 10:23 - 2015-04-21 17:58 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-05-13 10:23 - 2015-04-21 17:57 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-05-13 10:23 - 2015-04-21 17:49 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-05-13 10:23 - 2015-04-21 17:49 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-05-13 10:23 - 2015-04-21 17:48 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-05-13 10:23 - 2015-04-21 17:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-05-13 10:23 - 2015-04-21 17:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-05-13 10:23 - 2015-04-21 17:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-05-13 10:23 - 2015-04-21 17:40 - 14401536 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-05-13 10:23 - 2015-04-21 17:39 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-05-13 10:23 - 2015-04-21 17:38 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-05-13 10:23 - 2015-04-21 17:36 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-05-13 10:23 - 2015-04-21 17:31 - 04305920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-05-13 10:23 - 2015-04-21 17:27 - 02352128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-05-13 10:23 - 2015-04-21 17:26 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-05-13 10:23 - 2015-04-21 17:25 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-05-13 10:23 - 2015-04-21 17:24 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-05-13 10:23 - 2015-04-21 17:17 - 12828672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-05-13 10:23 - 2015-04-21 17:15 - 01547264 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-05-13 10:23 - 2015-04-21 17:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-05-13 10:23 - 2015-04-21 17:02 - 01882112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-05-13 10:23 - 2015-04-21 16:58 - 01310208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-05-13 10:23 - 2015-04-21 16:56 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-05-13 10:23 - 2015-04-18 05:10 - 00460800 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-05-13 10:23 - 2015-04-18 04:56 - 00342016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2015-05-13 10:22 - 2015-04-21 19:14 - 24971776 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-05-13 10:20 - 2015-04-27 21:28 - 05569984 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-05-13 10:20 - 2015-04-27 21:28 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-05-13 10:20 - 2015-04-27 21:28 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-05-13 10:20 - 2015-04-27 21:26 - 01728960 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-05-13 10:20 - 2015-04-27 21:23 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-05-13 10:20 - 2015-04-27 21:23 - 01254400 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2015-05-13 10:20 - 2015-04-27 21:23 - 01162752 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-05-13 10:20 - 2015-04-27 21:23 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2015-05-13 10:20 - 2015-04-27 21:23 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2015-05-13 10:20 - 2015-04-27 21:23 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-05-13 10:20 - 2015-04-27 21:23 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-05-13 10:20 - 2015-04-27 21:23 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-05-13 10:20 - 2015-04-27 21:23 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-05-13 10:20 - 2015-04-27 21:23 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-05-13 10:20 - 2015-04-27 21:23 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-05-13 10:20 - 2015-04-27 21:23 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-05-13 10:20 - 2015-04-27 21:23 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-05-13 10:20 - 2015-04-27 21:23 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-05-13 10:20 - 2015-04-27 21:23 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-05-13 10:20 - 2015-04-27 21:23 - 00113664 _____ (Microsoft Corporation) C:\Windows\system32\sechost.dll
2015-05-13 10:20 - 2015-04-27 21:23 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-05-13 10:20 - 2015-04-27 21:23 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-05-13 10:20 - 2015-04-27 21:23 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-05-13 10:20 - 2015-04-27 21:23 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-05-13 10:20 - 2015-04-27 21:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-05-13 10:20 - 2015-04-27 21:23 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-05-13 10:20 - 2015-04-27 21:23 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-05-13 10:20 - 2015-04-27 21:23 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-05-13 10:20 - 2015-04-27 21:22 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\tracerpt.exe
2015-05-13 10:20 - 2015-04-27 21:22 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-05-13 10:20 - 2015-04-27 21:22 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-05-13 10:20 - 2015-04-27 21:22 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-05-13 10:20 - 2015-04-27 21:22 - 00104448 _____ (Microsoft Corporation) C:\Windows\system32\logman.exe
2015-05-13 10:20 - 2015-04-27 21:22 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\typeperf.exe
2015-05-13 10:20 - 2015-04-27 21:22 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\relog.exe
2015-05-13 10:20 - 2015-04-27 21:22 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-05-13 10:20 - 2015-04-27 21:22 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\diskperf.exe
2015-05-13 10:20 - 2015-04-27 21:21 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-05-13 10:20 - 2015-04-27 21:18 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-05-13 10:20 - 2015-04-27 21:18 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-05-13 10:20 - 2015-04-27 21:16 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-05-13 10:20 - 2015-04-27 21:16 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-05-13 10:20 - 2015-04-27 21:16 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 21:16 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 21:16 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 21:16 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 21:11 - 03989440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-05-13 10:20 - 2015-04-27 21:11 - 03934144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-05-13 10:20 - 2015-04-27 21:08 - 01310744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-05-13 10:20 - 2015-04-27 21:05 - 00635392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2015-05-13 10:20 - 2015-04-27 21:05 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-05-13 10:20 - 2015-04-27 21:05 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-05-13 10:20 - 2015-04-27 21:05 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-05-13 10:20 - 2015-04-27 21:05 - 00092160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sechost.dll
2015-05-13 10:20 - 2015-04-27 21:05 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-05-13 10:20 - 2015-04-27 21:05 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-05-13 10:20 - 2015-04-27 21:05 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-05-13 10:20 - 2015-04-27 21:05 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-05-13 10:20 - 2015-04-27 21:04 - 00641536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2015-05-13 10:20 - 2015-04-27 21:04 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-05-13 10:20 - 2015-04-27 21:04 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tracerpt.exe
2015-05-13 10:20 - 2015-04-27 21:04 - 00082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\logman.exe
2015-05-13 10:20 - 2015-04-27 21:04 - 00040448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\typeperf.exe
2015-05-13 10:20 - 2015-04-27 21:04 - 00037888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\relog.exe
2015-05-13 10:20 - 2015-04-27 21:04 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-05-13 10:20 - 2015-04-27 21:04 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-05-13 10:20 - 2015-04-27 21:03 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-05-13 10:20 - 2015-04-27 21:03 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-05-13 10:20 - 2015-04-27 21:03 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-05-13 10:20 - 2015-04-27 21:03 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-05-13 10:20 - 2015-04-27 21:03 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\diskperf.exe
2015-05-13 10:20 - 2015-04-27 21:03 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-05-13 10:20 - 2015-04-27 21:01 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-05-13 10:20 - 2015-04-27 21:01 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-05-13 10:20 - 2015-04-27 20:59 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-05-13 10:20 - 2015-04-27 20:59 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-05-13 10:20 - 2015-04-27 20:59 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 20:59 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 20:06 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2015-05-13 10:20 - 2015-04-27 19:57 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-05-13 10:20 - 2015-04-27 19:57 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-05-13 10:20 - 2015-04-27 19:55 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 19:55 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-05-13 10:20 - 2015-04-20 05:17 - 01647104 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-05-13 10:20 - 2015-04-20 05:17 - 01179136 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-05-13 10:20 - 2015-04-20 04:56 - 01250816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2015-05-13 10:20 - 2015-04-20 04:11 - 03204608 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-05-13 10:20 - 2015-04-13 05:28 - 00328704 _____ (Microsoft Corporation) C:\Windows\system32\services.exe
2015-05-13 10:20 - 2015-04-08 05:29 - 00275456 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2015-05-13 10:20 - 2015-04-08 05:29 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll
2015-05-13 10:20 - 2015-04-08 05:14 - 00216064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InkEd.dll
2015-05-13 10:20 - 2015-03-04 06:41 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll
2015-05-13 10:20 - 2015-03-04 06:41 - 00072192 _____ (Microsoft Corporation) C:\Windows\system32\aelupsvc.dll
2015-05-13 10:20 - 2015-03-04 06:41 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\sdbinst.exe
2015-05-13 10:20 - 2015-03-04 06:41 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\shimeng.dll
2015-05-13 10:20 - 2015-03-04 06:11 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shimeng.dll
2015-05-13 10:20 - 2015-03-04 06:10 - 00295936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apphelp.dll
2015-05-13 10:20 - 2015-03-04 06:10 - 00020992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sdbinst.exe
2015-05-13 10:20 - 2015-02-18 09:06 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe
2015-05-13 10:20 - 2015-02-18 09:04 - 00142336 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe
2015-05-13 10:20 - 2015-01-29 05:19 - 02543104 _____ (Microsoft Corporation) C:\Windows\system32\wpdshext.dll
2015-05-13 10:20 - 2015-01-29 05:02 - 02311168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wpdshext.dll
2015-05-10 19:26 - 2015-05-10 19:26 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Landwirtschafts Simulator 2011

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-06-07 16:57 - 2014-02-23 19:19 - 00000000 ____D C:\Users\David\AppData\Roaming\Skype
2015-06-07 16:48 - 2009-07-14 06:45 - 00040528 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-06-07 16:48 - 2009-07-14 06:45 - 00040528 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-06-07 16:45 - 2010-11-21 08:50 - 12070934 _____ C:\Windows\system32\perfh007.dat
2015-06-07 16:45 - 2010-11-21 08:50 - 03711876 _____ C:\Windows\system32\perfc007.dat
2015-06-07 16:45 - 2009-07-14 07:13 - 00006438 _____ C:\Windows\system32\PerfStringBackup.INI
2015-06-07 16:43 - 2015-03-04 16:52 - 01468928 _____ C:\Windows\WindowsUpdate.log
2015-06-07 16:40 - 2015-04-01 15:18 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-06-07 16:40 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-06-07 16:39 - 2014-02-08 21:38 - 00000000 ____D C:\ProgramData\NVIDIA
2015-06-07 16:33 - 2015-04-01 15:18 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-06-07 16:32 - 2014-02-08 23:16 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-06-07 16:31 - 2014-02-08 22:29 - 00000414 _____ C:\Windows\Tasks\Defraggler Volume D Task.job
2015-06-07 16:23 - 2014-10-06 12:27 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-06-07 15:39 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini
2015-06-07 13:59 - 2014-02-08 23:15 - 00000000 ____D C:\Users\David\AppData\Local\Adobe
2015-06-07 13:52 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Default
2015-06-07 13:49 - 2009-07-14 04:34 - 79429632 _____ C:\Windows\system32\config\software.bak
2015-06-07 13:49 - 2009-07-14 04:34 - 44302336 _____ C:\Windows\system32\config\components.bak
2015-06-07 13:49 - 2009-07-14 04:34 - 24903680 _____ C:\Windows\system32\config\system.bak
2015-06-07 13:49 - 2009-07-14 04:34 - 00524288 _____ C:\Windows\system32\config\default.bak
2015-06-07 13:49 - 2009-07-14 04:34 - 00262144 _____ C:\Windows\system32\config\security.bak
2015-06-07 13:49 - 2009-07-14 04:34 - 00262144 _____ C:\Windows\system32\config\sam.bak
2015-06-07 13:48 - 2015-03-31 17:47 - 00000000 ____D C:\Program Files (x86)\4f0332cb-3bd9-4e7c-ba1b-5dc70a990f27
2015-06-07 13:48 - 2015-01-22 17:33 - 00000000 ____D C:\Program Files (x86)\AGEIA Technologies
2015-06-07 13:09 - 2015-04-01 14:21 - 00000000 ____D C:\Users\David\AppData\Roaming\TS3Client
2015-06-07 11:58 - 2014-04-19 15:29 - 00000000 ____D C:\Users\David\.gimp-2.8
2015-06-07 00:16 - 2014-02-08 22:33 - 00000000 ____D C:\Users\David\AppData\Roaming\vlc
2015-06-06 11:08 - 2014-12-19 21:17 - 00000600 _____ C:\Users\David\AppData\Roaming\winscp.rnd
2015-06-05 13:44 - 2015-04-01 14:48 - 00000000 ____D C:\ProgramData\Avira
2015-06-05 13:44 - 2014-07-18 11:37 - 00000000 ____D C:\ProgramData\Package Cache
2015-06-05 13:29 - 2015-05-07 14:27 - 00000000 ____D C:\Users\David\AppData\Roaming\TuneUp Software
2015-06-03 22:29 - 2015-03-18 19:22 - 00000000 ____D C:\Users\David\AppData\Roaming\24A06051-46EF-480A-977E-CFB658017DC9
2015-06-02 19:29 - 2014-07-11 16:01 - 00000000 ____D C:\Users\David\AppData\Roaming\.minecraft
2015-05-29 23:02 - 2014-07-19 10:22 - 00000000 ____D C:\Users\David\AppData\Local\CrashDumps
2015-05-29 20:30 - 2014-07-17 12:02 - 00000000 ____D C:\Users\David\AppData\Roaming\Audacity
2015-05-29 19:39 - 2014-12-28 20:41 - 00000000 ____D C:\Users\David\AppData\Local\Eclipse
2015-05-29 13:38 - 2014-02-09 03:11 - 00000000 ____D C:\Users\David\AppData\Local\VirtualStore
2015-05-28 21:56 - 2014-04-19 11:52 - 00000000 ____D C:\Users\David\AppData\Roaming\HandBrake
2015-05-28 21:39 - 2014-12-19 19:03 - 00000000 ____D C:\ProgramData\boost_interprocess
2015-05-28 15:40 - 2015-03-31 17:19 - 00000000 ____D C:\Users\David\AppData\Roaming\03DE0294-1427815156-05D9-3D06-790700080009
2015-05-27 19:03 - 2014-07-23 09:42 - 00000000 ___RD C:\Program Files (x86)\Skype
2015-05-27 18:32 - 2014-09-17 17:44 - 00000000 ____D C:\Users\David\AppData\Roaming\Spotify
2015-05-27 15:56 - 2015-04-01 10:49 - 00000000 ____D C:\Program Files (x86)\Emsisoft Anti-Malware
2015-05-26 16:35 - 2015-04-01 15:19 - 00002185 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-05-25 14:22 - 2014-12-21 13:15 - 00000600 _____ C:\Users\David\AppData\Local\PUTTY.RND
2015-05-25 13:48 - 2014-07-17 12:48 - 00000000 ____D C:\Users\David\AppData\Local\Dxtory Software
2015-05-24 18:23 - 2014-07-17 12:46 - 00003442 _____ C:\Windows\unins000.dat
2015-05-23 22:44 - 2014-02-09 03:11 - 00000000 ____D C:\Users\David
2015-05-22 16:04 - 2014-12-18 18:18 - 00007605 _____ C:\Users\David\AppData\Local\Resmon.ResmonCfg
2015-05-22 14:54 - 2014-07-31 17:08 - 00000000 ____D C:\Users\David\AppData\Roaming\OBS
2015-05-22 14:52 - 2014-07-31 17:08 - 00000000 ____D C:\Program Files (x86)\OBS
2015-05-20 22:03 - 2015-04-04 11:35 - 00000000 ___SD C:\Windows\SysWOW64\GWX
2015-05-20 22:03 - 2015-04-04 11:35 - 00000000 ___SD C:\Windows\system32\GWX
2015-05-17 11:31 - 2014-02-08 23:16 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-05-17 11:31 - 2014-02-08 23:16 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-05-17 11:31 - 2014-02-08 23:16 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-05-16 19:28 - 2015-04-01 15:18 - 00004106 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-05-16 19:28 - 2015-04-01 15:18 - 00003854 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-05-16 10:15 - 2014-04-19 18:03 - 00000000 ____D C:\Users\David\AppData\Local\Windows Live
2015-05-15 19:01 - 2009-07-14 06:45 - 05074600 _____ C:\Windows\system32\FNTCACHE.DAT
2015-05-15 14:07 - 2014-02-09 03:50 - 00085240 _____ C:\Users\David\AppData\Local\GDIPFONTCACHEV1.DAT
2015-05-14 11:52 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2015-05-14 11:01 - 2010-11-21 09:01 - 00000000 ____D C:\Program Files\Windows Journal
2015-05-14 11:01 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\AdvancedInstallers
2015-05-13 23:09 - 2014-02-08 22:12 - 00002127 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
2015-05-13 23:09 - 2014-02-08 22:12 - 00001912 _____ C:\Windows\epplauncher.mif
2015-05-13 23:09 - 2014-02-08 22:12 - 00000000 ____D C:\Program Files\Microsoft Security Client
2015-05-13 23:09 - 2014-02-08 22:12 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client
2015-05-13 23:08 - 2014-02-08 22:43 - 00000000 ____D C:\Windows\system32\MRT
2015-05-13 23:05 - 2014-02-08 22:43 - 140425016 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-05-13 23:04 - 2015-04-04 11:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-05-13 23:03 - 2015-04-04 11:36 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2015-05-13 23:03 - 2015-04-04 11:36 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2015-05-13 18:12 - 2014-07-17 12:13 - 00000000 ____D C:\ProgramData\TechSmith
2015-05-13 12:48 - 2014-07-31 11:13 - 00000049 _____ C:\Windows\SysWOW64\ScrRecX.log
2015-05-13 12:48 - 2014-07-31 11:13 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\aTube Catcher
2015-05-13 12:31 - 2014-02-08 22:22 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-05-13 11:14 - 2015-05-07 14:27 - 00000000 __SHD C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2015-05-13 11:13 - 2014-07-18 10:53 - 00000000 ____D C:\Users\David\AppData\Roaming\DVDVideoSoft
2015-05-10 19:26 - 2009-07-14 07:32 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2015-05-08 17:22 - 2015-03-15 18:24 - 00000981 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 10.lnk
2015-05-08 17:22 - 2015-03-15 18:24 - 00000000 ____D C:\Program Files (x86)\TeamViewer

==================== Files in the root of some directories =======

2014-02-08 22:23 - 2011-02-22 15:18 - 0148856 _____ (Sysinternals - www.sysinternals.com) C:\Program Files\Autologon.exe
2014-02-08 22:23 - 2006-07-28 09:32 - 0007005 _____ () C:\Program Files\Eula.txt
2015-03-26 21:14 - 2015-03-26 21:14 - 0004185 _____ () C:\Users\David\AppData\Roaming\JFQJPI
2014-12-19 21:17 - 2015-06-06 11:08 - 0000600 _____ () C:\Users\David\AppData\Roaming\winscp.rnd
2014-08-12 10:09 - 2014-08-12 10:09 - 0001456 _____ () C:\Users\David\AppData\Local\Adobe Für Web speichern 13.0 Prefs
2014-12-21 13:15 - 2015-05-25 14:22 - 0000600 _____ () C:\Users\David\AppData\Local\PUTTY.RND
2014-12-13 18:12 - 2014-12-13 18:12 - 0006732 _____ () C:\Users\David\AppData\Local\recently-used.xbel
2014-12-18 18:18 - 2015-05-22 16:04 - 0007605 _____ () C:\Users\David\AppData\Local\Resmon.ResmonCfg
2014-02-23 17:44 - 2014-02-23 17:47 - 0000823 _____ () C:\ProgramData\hpzinstall.log

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


testsigning: ==> testsigning is on. Check for possible unsigned rootkit driver <===== ATTENTION!


LastRegBack: 2015-06-06 12:56

==================== End of log ============================

MfG SynexTV

SynexTV · 07.06.2015, 16:18

Servus,

hier ist die letzte LogDatei (Addition.txt):

[CODE]Additional
FRST Logfile:

Code:

ATTFilter

scan result of Farbar Recovery Scan Tool (x64) Version:06-06-2015
Ran by David at 2015-06-07 17:06:20
Running from D:\DATEN\David\Desktop
Boot Mode: Normal
========================================


================ Accounts: =============

Administrator (S-1-5-21-914325664-1482865349-517734357-500 - Administrator - Disabled)
David (S-1-5-21-914325664-1482865349-517734357-1000 - Administrator - Enabled) => C:\Users\David
Gast (S-1-5-21-914325664-1482865349-517734357-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-914325664-1482865349-517734357-1005 - Limited - Enabled)
Papa (S-1-5-21-914325664-1482865349-517734357-1006 - Administrator - Enabled) => C:\Users\Papa

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Disabled - Up to date) {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}
AS: Microsoft Security Essentials (Disabled - Up to date) {0C8D1929-27B2-688D-E114-9117BD2BB1B7}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

64 Bit HP CIO Components Installer (Version: 6.2.1 - Hewlett-Packard) Hidden
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Creative Cloud (HKLM-x32\...\Adobe Creative Cloud) (Version: 3.0.0.74 - Adobe Systems Incorporated)
Adobe Dreamweaver CC 2014 (HKLM-x32\...\{7F823F8E-4348-11E4-8BF8-81763C49AA32}) (Version: 15.1.0 - Adobe Systems Incorporated)
Adobe Flash Player 17 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.188 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.11) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.11 - Adobe Systems Incorporated)
AdVenture Capitalist (HKLM-x32\...\Steam App 346900) (Version:  - Hyper Hippo Games)
allday savings (HKLM\...\FF822B94-D02A-4A2C-BF00-D6D6A858F456) (Version: 2.0.1 - allday savings)
Apple Application Support (HKLM-x32\...\{A83279FD-CA4B-4206-9535-90974DE76654}) (Version: 2.1.5 - Apple Inc.)
aTube Catcher Version 3.8 (HKLM-x32\...\{D43B360E-722D-421B-BC77-20B9E0F8B6CD}_is1) (Version: 3.8 - DsNET Corp)
AVM FRITZ!WLAN (HKLM-x32\...\AVMWLANCLI) (Version:  - AVM Berlin)
bl (x32 Version: 1.0.0 - Your Company Name) Hidden
Blender (HKLM\...\Blender) (Version: 2.73a - Blender Foundation)
BlueStacks App Player (HKLM-x32\...\BlueStacks App Player) (Version: 0.8.12.3702 - BlueStack Systems, Inc.)
BlueStacks Notification Center (HKLM-x32\...\{D7680C52-5C13-435F-BC1B-BF8F512C71F4}) (Version: 0.8.12.3702 - BlueStack Systems, Inc.)
BufferChm (x32 Version: 130.0.331.000 - Hewlett-Packard) Hidden
C5300 (x32 Version: 130.0.365.000 - Hewlett-Packard) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 4.08 - Piriform)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.2.4291 - CDBurnerXP)
Cheat Engine 6.4 (HKLM-x32\...\Cheat Engine 6.4_is1) (Version:  - Cheat Engine)
Cinema 4D version R12 (HKLM-x32\...\{7D9D8134-9FA3-4FFF-ADA1-BF609F29997A}_is1) (Version: R12 - Salat Production) <==== ATTENTION
Cisco PEAP Module (HKLM-x32\...\{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}) (Version: 1.1.6 - Cisco Systems, Inc.)
CS16RBLv1 (HKLM-x32\...\CS16RBLv1v33) (Version: v33 - REBEL UPRISING)
CyberGhost 5 (HKLM\...\CyberGhost 5_is1) (Version:  - CyberGhost S.R.L.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Defraggler (HKLM\...\Defraggler) (Version: 2.16 - Piriform)
Destinations (x32 Version: 140.0.77.000 - Hewlett-Packard) Hidden
DeviceDiscovery (x32 Version: 130.0.465.000 - Hewlett-Packard) Hidden
Die Sims™ 3 (HKLM-x32\...\{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}) (Version: 1.42.130 - Electronic Arts)
Die Sims™ 3 Jahreszeiten (HKLM-x32\...\{3DE92282-CB49-434F-81BF-94E5B380E889}) (Version: 16.0.136 - Electronic Arts)
Dojotech Spotify Recorder (HKLM-x32\...\{461179FC-E2AC-4CC8-AA95-82D35FB3E7EA}) (Version: 3.3 - Dojotech Software)
Dxtory version 2.0.127 (HKLM-x32\...\Dxtory2.0_is1) (Version: 2.0.127 - ExKode Co. Ltd.)
FileZilla Client 3.10.3 (HKU\S-1-5-21-914325664-1482865349-517734357-1000\...\FileZilla Client) (Version: 3.10.3 - Tim Kosse)
Fotogalerie (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Fraps (remove only) (HKLM-x32\...\Fraps) (Version:  - )
Free Video to MP3 Converter version 5.0.58.415 (HKLM-x32\...\Free Video to MP3 Converter_is1) (Version: 5.0.58.415 - DVDVideoSoft Ltd.)
FreePDF (Remove only) (HKLM-x32\...\FreePDF_XP) (Version:  - )
GeForce Experience NvStream Client Components (Version: 1.6.28 - NVIDIA Corporation) Hidden
GIMP 2.8.14 (HKLM\...\GIMP-2_is1) (Version: 2.8.14 - The GIMP Team)
Git version 1.9.5-preview20150319 (HKLM-x32\...\Git_is1) (Version: 1.9.5-preview20150319 - The Git Development Community)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 43.0.2357.81 - Google Inc.)
Google Update Helper (x32 Version: 1.3.27.5 - Google Inc.) Hidden
GPBaseService2 (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
GPL Ghostscript (HKLM\...\GPL Ghostscript 9.10) (Version: 9.10 - Artifex Software Inc.)
Hama Wireless LAN Adapter (HKLM-x32\...\{9C049499-055C-4a0c-A916-1D12314F45EB}) (Version: 1.00.0159 - Hama GmbH & Co KG)
HP Customer Participation Program 13.0 (HKLM\...\HPExtendedCapabilities) (Version: 13.0 - HP)
HP Imaging Device Functions 13.0 (HKLM\...\HP Imaging Device Functions) (Version: 13.0 - HP)
HP Photosmart C5300 All-In-One Driver Software 13.0 Rel. 4 (HKLM\...\{6FA29B87-FED3-45A1-8A95-2FDEE0F6DD18}) (Version: 13.0 - HP)
HP Photosmart Essential 3.5 (HKLM\...\HP Photosmart Essential) (Version: 3.5 - HP)
HP Smart Web Printing 4.51 (HKLM\...\HP Smart Web Printing) (Version: 4.51 - HP)
HP Solution Center 13.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 13.0 - HP)
HPPhotoGadget (x32 Version: 130.0.282.000 - Hewlett-Packard) Hidden
HPPhotoSmartDiscLabel_PaperLabel (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden
HPPhotoSmartDiscLabel_PrintOnDisc (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden
HPPhotoSmartDiscLabelContent1 (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden
hpphotosmartdisclabelplugin (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden
HPPhotosmartEssential (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden
HPProductAssistant (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
HPSSupply (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
ImgBurn (HKLM-x32\...\ImgBurn) (Version: 2.5.8.0 - LIGHTNING UK!)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.0.0.1323 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.14.4170 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.6.0.1033 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 3.0.0.66956 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 2.5.0.19 - Intel Corporation)
Java 7 Update 75 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F06417075FF}) (Version: 7.0.750 - Oracle)
Java SE Development Kit 7 Update 75 (64-bit) (HKLM\...\{64A3A4F4-B792-11D6-A78A-00B0D0170750}) (Version: 1.7.0.750 - Oracle)
JDownloader 2 (HKLM\...\jdownloader2) (Version: 2.0 - AppWork GmbH)
Lagarith Lossless Codec (1.3.27) (HKLM-x32\...\{F59AC46C-10C3-4023-882C-4212A92283B3}_is1) (Version:  - )
Landwirtschafts Simulator 2011 (HKLM-x32\...\FarmingSimulator2011DE_is1) (Version: 1.0 - GIANTS Software)
League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games )
League of Legends (x32 Version: 3.0.1 - Riot Games ) Hidden
LibreOffice 4.2.0.4 (HKLM-x32\...\{E043231F-34F2-4AF5-9400-0961CC15AAAE}) (Version: 4.2.0.4 - The Document Foundation)
Logitech Gaming Software 8.55 (HKLM\...\Logitech Gaming Software) (Version: 8.55.137 - Logitech Inc.)
LogMeIn Hamachi (HKLM-x32\...\LogMeIn Hamachi) (Version: 2.2.0.193 - LogMeIn, Inc.)
LogMeIn Hamachi (x32 Version: 2.2.0.193 - LogMeIn, Inc.) Hidden
LoiLo Game Recorder (HKLM\...\{89E4163C-BD19-45A9-BCEB-980741786799}_is1) (Version: 1.1.0.1 - LoiLo inc.)
MarketResearch (x32 Version: 130.0.374.000 - Hewlett-Packard) Hidden
Microsoft .NET Framework 4.5.2 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft ASP.NET MVC 4 Runtime (HKLM-x32\...\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 - Microsoft Corporation)
Microsoft Location Finder (HKLM-x32\...\{EC637522-73A5-4428-8B46-65A621529CC7}) (Version: 3.0 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.8.204.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft WSE 3.0 Runtime (HKLM-x32\...\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}) (Version: 3.0.5305.0 - Microsoft Corp.)
Microsoft-Maus- und Tastatur-Center (HKLM\...\Microsoft Mouse and Keyboard Center) (Version: 2.2.173.0 - Microsoft Corporation)
Minecraft (HKLM-x32\...\{1C16BCA3-EBC1-49F6-8623-8FBFB9CCC872}) (Version: 1.0.3.0 - Mojang)
Movie Maker (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Notepad++ (HKLM-x32\...\Notepad++) (Version: 5.9 - )
NVIDIA 3D Vision Controller-Treiber 347.09 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 347.09 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 347.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 347.52 - NVIDIA Corporation)
NVIDIA GeForce Experience 2.4.1.21 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.4.1.21 - NVIDIA Corporation)
NVIDIA Grafiktreiber 347.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 347.52 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.33.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.33.0 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.14.0702 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.14.0702 - NVIDIA Corporation)
ON_OFF Charge 2 B13.0506.1 (HKLM-x32\...\InstallShield_{6B4ED6F7-BB88-4945-B0C6-01410E1BAC3A}) (Version: 1.00.0000 - GIGABYTE)
ON_OFF Charge 2 B13.0506.1 (x32 Version: 1.00.0000 - GIGABYTE) Hidden
Open Broadcaster Software (HKLM-x32\...\Open Broadcaster Software) (Version:  - )
PDF-Viewer (HKLM\...\{A278382D-4F1B-4D47-9885-8523F7261E8D}_is1) (Version: 2.5.204.0 - Tracker Software Products Ltd)
ph (x32 Version: 1.0.0 - Your Company Name) Hidden
phase6_19 (HKLM-x32\...\{65D70656-D248-4C83-B594-E3029C43B37A}) (Version: 1.90.0000 - phase6)
PS_AIO_04_C5300_Software_Min (x32 Version: 130.0.365.000 - Hewlett-Packard) Hidden
PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.993 - Even Balance, Inc.)
Razer Cortex (HKLM-x32\...\Razer Cortex_is1) (Version: 5.3.25.0 - Razer Inc.)
Razer Synapse (HKLM-x32\...\{0D78BEE2-F8FF-4498-AF1A-3FF81CED8AC6}) (Version: 1.18.19.23944 - Razer Inc.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.65.1025.2012 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7404 - Realtek Semiconductor Corp.)
Recuva (HKLM\...\Recuva) (Version: 1.49 - Piriform)
RedMon - Redirection Port Monitor (HKLM\...\Redirection Port Monitor) (Version:  - )
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
ROCCAT Isku Keyboard Driver (HKLM-x32\...\{4ABAF918-A6BD-43D8-AE0B-5292034B14CB}) (Version:  - Roccat GmbH)
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.45.0 - SAMSUNG Electronics Co., Ltd.)
Scan (x32 Version: 140.0.80.000 - Hewlett-Packard) Hidden
SHIELD Streaming (Version: 4.1.1000 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 2.4.1.21 - NVIDIA Corporation) Hidden
Shop for HP Supplies (HKLM\...\Shop for HP Supplies) (Version: 13.0 - HP)
Shotcut (HKLM-x32\...\Shotcut) (Version:  - )
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.4.0.9058 - Microsoft Corporation)
Skype™ 7.4 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.4.102 - Skype Technologies S.A.)
SmartWebPrinting (x32 Version: 130.0.457.000 - Hewlett-Packard) Hidden
SolutionCenter (x32 Version: 130.0.373.000 - Hewlett-Packard) Hidden
Speccy (HKLM\...\Speccy) (Version: 1.24 - Piriform)
Spotify (HKU\S-1-5-21-914325664-1482865349-517734357-1000\...\Spotify) (Version: 1.0.5.186.ga9c24d6a - Spotify AB)
Status (x32 Version: 130.0.469.000 - Hewlett-Packard) Hidden
TAP-Windows 9.9.2 (HKLM\...\TAP-Windows) (Version: 9.9.2 - )
TeamSpeak 3 Client (HKU\S-1-5-21-914325664-1482865349-517734357-1000\...\TeamSpeak 3 Client) (Version: 3.0.16 - TeamSpeak Systems GmbH)
TeamViewer 10 (HKLM-x32\...\TeamViewer) (Version: 10.0.41459 - TeamViewer)
Toolbox (x32 Version: 130.0.648.000 - Hewlett-Packard) Hidden
TrayApp (x32 Version: 130.0.422.000 - Hewlett-Packard) Hidden
TreeSize Free V2.5 (HKLM-x32\...\TreeSize Free_is1) (Version: 2.5 - JAM Software)
TuneUp Utilities 2014 (de-DE) (x32 Version: 14.0.1000.340 - TuneUp Software) Hidden
UnloadSupport (x32 Version: 11.0.0 - Hewlett-Packard) Hidden
Unturned (HKLM-x32\...\Steam App 304930) (Version:  - Nelson Sexton)
VirtualCloneDrive (HKLM-x32\...\VirtualCloneDrive) (Version: 5.4.7.0 - Elaborate Bytes)
Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
VLC media player 2.1.3 (HKLM-x32\...\VLC media player) (Version: 2.1.3 - VideoLAN)
WebReg (x32 Version: 130.0.132.017 - Hewlett-Packard) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3508.0205 - Microsoft Corporation)
WinSCP 5.6.5 RC (HKLM-x32\...\winscp3_is1) (Version: 5.6.5 RC - Martin Prikryl)
XAMPP (HKLM-x32\...\xampp) (Version: 5.5.19-0 - Bitnami)
XMind 2013 (v3.4.0) (HKLM-x32\...\XMind_is1) (Version: 3.4.0.201311050558 - XMind Ltd.)
XSplit Broadcaster (HKLM-x32\...\{9ACDB4FF-FF71-4525-89F5-B33B6DBDA864}) (Version: 2.0.1411.2714 - SplitmediaLabs)
Zeta Producer 12 12.2.0 (nur entfernen) (HKU\S-1-5-21-914325664-1482865349-517734357-1000\...\ZetaProducer12) (Version: 12.2.0 - Zeta Software GmbH)
Zeta Producer 12.5 12.5.4 (nur entfernen) (HKU\S-1-5-21-914325664-1482865349-517734357-1000\...\ZetaProducer12.5) (Version: 12.5.4 - Zeta Software GmbH)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-914325664-1482865349-517734357-1000_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\Windows\system32\igfxEM.exe (Intel Corporation)
CustomCLSID: HKU\S-1-5-21-914325664-1482865349-517734357-1000_Classes\CLSID\{ca586c80-7c84-4b88-8537-726724df6929}\InprocServer32 -> D:\DATEN\Git\git-cheetah\git_shell_ext64.dll ()
CustomCLSID: HKU\S-1-5-21-914325664-1482865349-517734357-1000_Classes\CLSID\{D45F043D-F17F-4e8a-8435-70971D9FA46D}\InprocServer32 -> D:\Blender\BlendThumb64.dll ()

==================== Restore Points =========================

31-05-2015 14:49:12 Windows Update
01-06-2015 17:20:55 DirectX wurde installiert
03-06-2015 16:14:25 Windows Update
05-06-2015 13:28:36 Installed AVG 2015
05-06-2015 13:28:44 Installed AVG 2015
05-06-2015 13:29:05 Removed AVG 2015
07-06-2015 12:09:25 Windows Update
07-06-2015 16:39:07 Malwarebytes Anti-Rootkit Restore Point

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2015-06-07 14:42 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {091EDD22-5644-408D-A909-081047BBA431} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-05-17] (Adobe Systems Incorporated)
Task: {0D9D4E49-048C-4500-A479-106833DC583D} - System32\Tasks\LaunchSignup => C:\Program Files (x86)\MyPC Backup\Signup Wizard.exe <==== ATTENTION
Task: {1657126D-4509-4F22-9533-AE6783F4F714} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2013-05-13] (Microsoft Corporation)
Task: {17AB5812-7129-41C2-8459-52B29451666A} - System32\Tasks\Defraggler Volume D Task => C:\Program Files\Defraggler\df64.exe [2013-10-14] (Piriform Ltd)
Task: {290CDC53-3305-4A01-B4D0-9229EC8C2C46} - System32\Tasks\fsupdate => C:\PROGRA~2\Flowsurf\fsupd.exe <==== ATTENTION
Task: {2B4AA7E0-5A8E-4BDE-B3BA-1D912657CA45} - \avayvaxvaa No Task File <==== ATTENTION
Task: {306C219D-FB01-4EC5-9381-B9A0F48546E9} - System32\Tasks\{EEA407A3-B540-4733-A3B3-15AB6C7DE8EC} => pcalua.exe -a C:\Users\David\AppData\Roaming\mystartsearch\UninstallManager.exe -c  -ptid=ima
Task: {5645A82A-BBB7-477F-A785-E91E296DC9A3} - System32\Tasks\{545DFFF2-FADA-4128-BC0A-DE15D43FAF46} => pcalua.exe -a D:\DATEN\David\Installer.exe
Task: {58E2C4AD-0EE6-460D-8E79-1F9F14436064} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-04-01] (Google Inc.)
Task: {593430E5-D633-43B8-9277-B86F6C554781} - \SmartWeb Upgrade Trigger Task No Task File <==== ATTENTION
Task: {5BF6A6BF-4321-4D50-83D0-EBEF31F35338} - System32\Tasks\{B9206D9F-BA0A-4099-A727-564461C49183} => pcalua.exe -a C:\Users\David\AppData\Roaming\sweet-page\UninstallManager.exe -c  -ptid=cor
Task: {6161246D-2802-4E4A-BFF7-322157201FFA} - System32\Tasks\{53560204-8FF3-4A71-8383-982BE86DBEFE} => pcalua.exe -a "D:\DATEN\David\Desktop\Virtual Audio Cable 4.10 (Full)\setup.exe" -d "D:\DATEN\David\Desktop\Virtual Audio Cable 4.10 (Full)"
Task: {6C363165-26FB-427B-9A5A-F6DE842C2B87} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\mousekeyboardcenter.exe [2013-05-13] (Microsoft)
Task: {6CDEE4B1-3B74-48EA-A584-28DBFF06CF5F} - System32\Tasks\{265C9DD4-FCC1-4CC6-B81F-21458569E72C} => Chrome.exe hxxp://ui.skype.com/ui/0/7.2.0.103/de/abandoninstall?page=tsProgressBar
Task: {746AD197-74BB-4A86-BAFF-EB4B4DF159CF} - System32\Tasks\Optimizer Pro Schedule => C:\Program Files (x86)\Optimizer Pro 3.52\OptProLauncher.exe <==== ATTENTION
Task: {77C4FBE2-C0C3-4246-A847-672A93C08E72} - System32\Tasks\{7788BC70-EEF0-4018-AA42-D3C89710A3CB} => pcalua.exe -a D:\DATEN\David\Desktop\Mac\Installer.exe -d D:\DATEN\David\Desktop\Mac
Task: {7AFFC2BD-05DA-439D-BD75-932839420D0F} - System32\Tasks\{25A53BC5-78FF-4725-835C-C36FC3FF6C2D} => pcalua.exe -a D:\DATEN\David\Downloads\forge-1.7.10-10.13.0.1160-installer-win.exe -d D:\DATEN\David\Downloads
Task: {7B9123DD-301B-414B-B175-448B5CC1839F} - System32\Tasks\{8E189E97-B036-417F-B1D8-737596F920CE} => Chrome.exe hxxp://ui.skype.com/ui/0/6.20.0.104/de/abandoninstall?page=tsMain
Task: {7C6C8F24-28AB-4616-91E2-8C2B79B99328} - System32\Tasks\AdobeAAMUpdater-1.0-BlackMatrix-David => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2015-03-30] (Adobe Systems Incorporated)
Task: {7CB2762C-A3DA-440E-A43E-63985CC4FAA0} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-11-22] (Piriform Ltd)
Task: {9235BF12-D18F-4137-B0A6-4CB09E6DEAEF} - System32\Tasks\Microsoft_MKC_Logon_Task_itype.exe => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2013-05-13] (Microsoft Corporation)
Task: {94ACAEC7-C589-4651-B1F6-9582D32A6FCB} - System32\Tasks\Games\UpdateCheck_S-1-5-21-914325664-1482865349-517734357-1001
Task: {959C47BD-6EF1-4652-9E99-CF73300493EE} - \OVTKNWZWQO No Task File <==== ATTENTION
Task: {9D610492-E5EA-48D0-ADA8-2323B5AC55A4} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\Logon => C:\Windows\system32\GWX\GWX.exe [2015-05-07] (Microsoft Corporation)
Task: {AA3B90B7-9B20-425D-B176-D3DB3031F799} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-05-07] (Microsoft Corporation)
Task: {ABF05F74-E9A0-445B-9E3D-FE5CF550EE22} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-04-01] (Google Inc.)
Task: {BE387634-B48B-4A1A-BB43-EDEF67D2D8C1} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\OutOfIdle => C:\Windows\system32\GWX\GWX.exe [2015-05-07] (Microsoft Corporation)
Task: {C01A093C-4001-45FA-ACAC-897CB64762CD} - System32\Tasks\Microsoft_MKC_Logon_Task_ipoint.exe => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2013-05-13] (Microsoft Corporation)
Task: {C490FFB2-F623-41B7-8497-0E3FFB986ADB} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2013-05-13] (Microsoft Corporation)
Task: {CB8D4882-A7EC-4F96-9ACD-45FB26C6F57B} - System32\Tasks\Red Giant Link => C:\Program Files (x86)\Red Giant Link\Red Giant Link.exe
Task: {DCC1A6A8-1BEE-4723-9993-B476149790C0} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-05-07] (Microsoft Corporation)
Task: {E2B89083-E8E5-4EDD-BABB-9B7B2384B332} - System32\Tasks\{77B53B3D-C4A3-45F9-9002-CA834CA36F4F} => pcalua.exe -a "D:\DATEN\Revo Uninstaller\Revouninstaller.exe" -d "D:\DATEN\Revo Uninstaller"
Task: {F08DF0A8-1851-4F7F-9959-73EC6B16C57E} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B => schtasks
Task: {F1FFA640-9B54-43A6-BA62-04592C1492A3} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {F25A320C-4DA1-4D5A-9481-C10AC7E300B0} - System32\Tasks\{561A89FD-6EE0-421D-BAD9-5CE676C5FACF} => pcalua.exe -a "D:\DATEN\David\Desktop\forge-1.7.2-10.12.1.1112-installer-win (1).exe" -d D:\DATEN\David\Desktop
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\Defraggler Volume D Task.job => C:\Program Files\Defraggler\df64.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (Whitelisted) ==============

2014-02-08 22:25 - 2010-06-17 21:56 - 00087040 _____ () C:\Windows\System32\redmonnt.dll
2014-06-15 11:58 - 2015-02-05 21:07 - 00117576 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2015-04-16 17:42 - 2015-04-16 17:42 - 00997536 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll
2011-02-09 02:56 - 2011-02-09 02:56 - 00301568 _____ () C:\Program Files (x86)\Notepad++\NppShell_04.dll
2015-04-05 12:28 - 2015-03-19 23:33 - 00736962 _____ () D:\DATEN\Git\git-cheetah\git_shell_ext64.dll
2015-04-21 15:00 - 2014-09-11 16:13 - 11021824 _____ () D:\xampp\mysql\bin\mysqld.exe
2014-09-19 17:49 - 2014-09-20 15:32 - 00076888 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2014-05-28 16:21 - 2015-03-19 21:02 - 00393480 _____ () C:\Windows\system32\igfxTray.exe
2014-07-28 20:29 - 2014-07-28 20:29 - 00866584 _____ () C:\Program Files\Logitech Gaming Software\libGLESv2.dll
2014-07-28 20:32 - 2014-07-28 20:32 - 01050904 _____ () C:\Program Files\Logitech Gaming Software\platforms\qwindows.dll
2014-07-28 20:29 - 2014-07-28 20:29 - 00059160 _____ () C:\Program Files\Logitech Gaming Software\libEGL.dll
2014-07-28 20:31 - 2014-07-28 20:31 - 00242456 _____ () C:\Program Files\Logitech Gaming Software\imageformats\qjpeg.dll
2015-02-20 15:54 - 2015-03-28 05:45 - 00721552 _____ () C:\Program Files\NVIDIA Corporation\ShadowPlay\gamecaster64.dll
2015-02-20 15:54 - 2015-03-28 05:45 - 00854160 _____ () C:\Program Files\NVIDIA Corporation\ShadowPlay\twitchsdk64.dll
2015-04-21 15:00 - 2014-07-17 13:18 - 00219648 _____ () D:\xampp\apache\bin\pcre.dll
2015-04-21 15:02 - 2014-11-12 22:58 - 00128512 _____ () D:\XAMPP\php\libpq.dll
2015-04-21 15:00 - 2014-11-12 22:58 - 00117760 _____ () D:\xampp\apache\bin\libssh2.dll
2015-04-13 15:50 - 2015-03-28 05:45 - 00011920 _____ () C:\Program Files (x86)\NVIDIA Corporation\Update Core\detoured.dll
2014-08-16 15:52 - 2009-12-09 21:20 - 00126976 _____ () C:\Program Files (x86)\Hama\Wireless LAN RTL8188CU\EnumDevLib.dll
2015-05-26 16:35 - 2015-05-22 22:22 - 01281864 _____ () C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.81\libglesv2.dll
2015-05-26 16:35 - 2015-05-22 22:22 - 00080712 _____ () C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.81\libegl.dll
2015-05-26 16:35 - 2015-05-22 22:22 - 14982472 _____ () C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.81\PepperFlash\pepflashplayer.dll
2014-07-31 20:00 - 2015-04-16 19:40 - 00776192 _____ () D:\DATEN\Steam\SDL2.dll
2015-01-23 17:40 - 2015-04-23 04:16 - 04962816 _____ () D:\DATEN\Steam\v8.dll
2015-01-23 17:40 - 2015-04-23 04:16 - 01556992 _____ () D:\DATEN\Steam\icui18n.dll
2015-01-23 17:40 - 2015-04-23 04:16 - 01187840 _____ () D:\DATEN\Steam\icuuc.dll
2014-07-31 20:00 - 2015-06-04 20:56 - 02407104 _____ () D:\DATEN\Steam\video.dll
2014-08-29 14:48 - 2014-12-01 23:31 - 02396672 _____ () D:\DATEN\Steam\libavcodec-56.dll
2014-08-29 14:48 - 2014-12-01 23:31 - 00442880 _____ () D:\DATEN\Steam\libavutil-54.dll
2014-08-29 14:48 - 2014-12-01 23:31 - 00479744 _____ () D:\DATEN\Steam\libavformat-56.dll
2014-08-29 14:48 - 2014-12-01 23:31 - 00332800 _____ () D:\DATEN\Steam\libavresample-2.dll
2014-08-29 14:48 - 2014-12-01 23:31 - 00485888 _____ () D:\DATEN\Steam\libswscale-3.dll
2014-07-31 20:00 - 2015-06-04 20:56 - 00703168 _____ () D:\DATEN\Steam\bin\chromehtml.DLL
2014-07-31 20:00 - 2015-05-11 21:01 - 36302728 _____ () D:\DATEN\Steam\bin\libcef.dll
2015-05-14 13:49 - 2015-05-11 21:01 - 08958344 _____ () D:\DATEN\Steam\bin\pdf.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Hamachi2Svc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\VCL => ""="service"

==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE trusted site: HKU\.DEFAULT\...\clonewarsadventures.com -> clonewarsadventures.com
IE trusted site: HKU\.DEFAULT\...\freerealms.com -> freerealms.com
IE trusted site: HKU\.DEFAULT\...\soe.com -> soe.com
IE trusted site: HKU\.DEFAULT\...\sony.com -> sony.com


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-914325664-1482865349-517734357-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\David\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.178.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [{8EC0FAC8-4464-45F2-8E38-6987307E6B2A}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{9D2132DA-7F27-4715-9B45-3BE8877104F2}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{A4888B13-39F2-426D-9A97-298F5840B033}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
FirewallRules: [{A4636FA1-9AA2-41EC-8852-84E3631CC016}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
FirewallRules: [{571C606A-CE69-4BAA-94F5-E947E1CF0668}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{8215F901-2384-4B17-BFA5-3F4EBDBFD9C7}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{F38BCE00-0423-451C-A998-503DD23165CA}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqste08.exe
FirewallRules: [{455941B9-57CD-441E-B8B2-510DB034F855}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hposid01.exe
FirewallRules: [{B57280A0-DE11-4581-A415-F11364DAB18D}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqkygrp.exe
FirewallRules: [{0624C12C-6106-496E-9EFF-D3C784D57717}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpfccopy.exe
FirewallRules: [{7AE04244-8039-4173-ADE5-1B9AB08CE8B4}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpoews01.exe
FirewallRules: [{4C67392A-ECC3-4417-9AF7-612A7DE542B3}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpiscnapp.exe
FirewallRules: [{E468DA28-6695-4F53-BF51-1682772EA455}] => (Allow) C:\Program Files (x86)\common files\hp\digital imaging\bin\hpqphotocrm.exe
FirewallRules: [{D9B06325-CBE6-4B67-9DC7-A2ADD83DD9A7}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqsudi.exe
FirewallRules: [{6ADCA352-F609-4375-AC1F-C2D67A8580BA}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqpsapp.exe
FirewallRules: [{7F3E3EC3-C459-451E-AA80-9113DB2F32C8}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqpse.exe
FirewallRules: [{82AD007C-23FE-4854-A5A7-7F03DA9B76D7}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgplgtupl.exe
FirewallRules: [{4969E6D3-B511-459F-99AC-3C6B272927EA}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
FirewallRules: [{AC95B937-3573-4BA5-B5C0-7B0832B4CD85}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqusgm.exe
FirewallRules: [{E4A46C63-DE67-47F1-9D0F-06452B35E567}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqusgh.exe
FirewallRules: [{A604E5BF-F4F1-4F25-8C79-2CF0680F9098}] => (Allow) C:\Program Files (x86)\HP\digital imaging\smart web printing\smartwebprintexe.exe
FirewallRules: [{7403EFAD-F8B5-424E-BF08-560BF11A908C}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{1E26802E-E2DE-4DE3-96CD-9B4BCFE3F1D6}] => (Allow) LPort=2869
FirewallRules: [{CC697664-E63E-4087-84AC-1635AD44802A}] => (Allow) LPort=1900
FirewallRules: [{6FDFAC88-2360-48CE-AB72-08D82350D464}] => (Allow) C:\Program Files (x86)\Hama\Wireless LAN RTL8188CU\RtWLan.exe
FirewallRules: [{B6DCE097-7F29-4BDB-B076-B2305DC572EC}] => (Allow) C:\Program Files (x86)\Hama\Wireless LAN RTL8188CU\RtWLan.exe
FirewallRules: [{24A0BE35-FC58-4669-AA49-477777A1706F}] => (Allow) LPort=1542
FirewallRules: [{2BA0FEEC-8B22-46D6-A6B5-3AD00ACFBBCF}] => (Allow) LPort=1542
FirewallRules: [{F75056FE-C078-4DE5-80F9-EC23C773D556}] => (Allow) LPort=53
FirewallRules: [{2154A4A3-0D12-42B9-A02B-26D51CEF7B28}] => (Allow) D:\DATEN\Steam\Steam.exe
FirewallRules: [{DB65D7CF-065B-4360-BA25-59EAA3D428A6}] => (Allow) D:\DATEN\Steam\Steam.exe
FirewallRules: [TCP Query User{AA56E669-7814-4C0D-94BA-AC013A307F70}C:\program files\adobe\adobe after effects cc 2014\support files\afterfx.exe] => (Allow) C:\program files\adobe\adobe after effects cc 2014\support files\afterfx.exe
FirewallRules: [UDP Query User{A8846713-7C43-4313-AB95-8C573E42789E}C:\program files\adobe\adobe after effects cc 2014\support files\afterfx.exe] => (Allow) C:\program files\adobe\adobe after effects cc 2014\support files\afterfx.exe
FirewallRules: [TCP Query User{1C317F3D-CC90-4F04-A510-18CE01DCB85C}C:\program files\java\jre7\bin\javaw.exe] => (Allow) C:\program files\java\jre7\bin\javaw.exe
FirewallRules: [UDP Query User{EA75D276-1F6A-4602-96EE-573B2BA09819}C:\program files\java\jre7\bin\javaw.exe] => (Allow) C:\program files\java\jre7\bin\javaw.exe
FirewallRules: [TCP Query User{6431BCF8-046F-488A-8117-7BECE16C06BC}C:\windows\system32\java.exe] => (Allow) C:\windows\system32\java.exe
FirewallRules: [UDP Query User{3A55A963-37D1-4D08-BF40-C3302BEDDB6A}C:\windows\system32\java.exe] => (Allow) C:\windows\system32\java.exe
FirewallRules: [TCP Query User{4C8E7A79-F900-496B-985A-41891082AE71}C:\program files\java\jre7\bin\javaw.exe] => (Allow) C:\program files\java\jre7\bin\javaw.exe
FirewallRules: [UDP Query User{472B6E80-E584-4E63-9216-4F802E5BD643}C:\program files\java\jre7\bin\javaw.exe] => (Allow) C:\program files\java\jre7\bin\javaw.exe
FirewallRules: [{E4CD8F67-9180-40D5-B12A-1B2599304EBA}] => (Allow) D:\DATEN\Steam\bin\steamwebhelper.exe
FirewallRules: [{5042F4DC-5B69-4ECF-9C4D-A8622C03F368}] => (Allow) D:\DATEN\Steam\bin\steamwebhelper.exe
FirewallRules: [{91C1B945-7968-4C8D-929A-EDF4049907FD}] => (Allow) D:\DATEN\Steam\SteamApps\common\GarrysMod\hl2.exe
FirewallRules: [{C280DC8B-D59A-4366-8AA0-19EB13A6415E}] => (Allow) D:\DATEN\Steam\SteamApps\common\GarrysMod\hl2.exe
FirewallRules: [TCP Query User{4D779CDE-8212-4ED1-A734-1321F76F53B9}C:\program files (x86)\libreoffice 4\program\soffice.bin] => (Allow) C:\program files (x86)\libreoffice 4\program\soffice.bin
FirewallRules: [UDP Query User{8C333861-2864-4813-A006-836623623362}C:\program files (x86)\libreoffice 4\program\soffice.bin] => (Allow) C:\program files (x86)\libreoffice 4\program\soffice.bin
FirewallRules: [{4503FF80-3370-41D8-A6B4-6FC3F23B0DC4}] => (Allow) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe
FirewallRules: [{E7572CE2-5F1A-4675-953F-30E534D86422}] => (Allow) C:\Users\David\AppData\Roaming\Spotify\spotify.exe
FirewallRules: [{8BA51049-99AD-4D2E-951D-20BC2170D3F5}] => (Allow) C:\Users\David\AppData\Roaming\Spotify\spotify.exe
FirewallRules: [{05DB57BD-C430-41E6-B06D-0B575888B052}] => (Allow) C:\Users\David\AppData\Roaming\Spotify\spotify.exe
FirewallRules: [{DE6B1D28-82E2-403F-A128-AB4739F1B23C}] => (Allow) C:\Users\David\AppData\Roaming\Spotify\spotify.exe
FirewallRules: [{FCDFFB7C-97CC-4A2A-A8DC-8546CF4DCCCF}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{EF18AEE7-959E-4E93-85DF-1B22F7138137}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{7E60DF83-FB85-4465-A65F-A3683896680A}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [{A91ADFAB-9B11-461D-85D0-718D5A9F32BF}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [TCP Query User{4F4C201C-ADC7-4A9D-92EC-A4467132D627}C:\program files\java\jre7\bin\java.exe] => (Allow) C:\program files\java\jre7\bin\java.exe
FirewallRules: [UDP Query User{524B3147-8614-4FDE-A00F-608BC0514AB9}C:\program files\java\jre7\bin\java.exe] => (Allow) C:\program files\java\jre7\bin\java.exe
FirewallRules: [TCP Query User{C84F70AD-007C-4EF1-985E-02E864972309}C:\program files\java\jre7\bin\java.exe] => (Allow) C:\program files\java\jre7\bin\java.exe
FirewallRules: [UDP Query User{A995A5FE-D64E-4CD5-BB50-FDEA5436E455}C:\program files\java\jre7\bin\java.exe] => (Allow) C:\program files\java\jre7\bin\java.exe
FirewallRules: [{179C837B-D99C-48C1-A2C1-36633BD9D2A2}] => (Allow) D:\DATEN\Steam\SteamApps\common\Unturned\Unturned.exe
FirewallRules: [{8F7F9166-2307-4C72-BD0E-E56B6ADE13D9}] => (Allow) D:\DATEN\Steam\SteamApps\common\Unturned\Unturned.exe
FirewallRules: [TCP Query User{5C790938-8C95-41CD-A97C-2F5B30E615CF}C:\windows\system32\java.exe] => (Allow) C:\windows\system32\java.exe
FirewallRules: [UDP Query User{FD8081DE-A087-4346-9C85-E2C295FC1DA7}C:\windows\system32\java.exe] => (Allow) C:\windows\system32\java.exe
FirewallRules: [TCP Query User{0CC622D6-821D-4F71-9586-9089DA722C0B}D:\games\cs\hl.exe] => (Allow) D:\games\cs\hl.exe
FirewallRules: [UDP Query User{F15B135D-EC03-4CD3-B5A2-CB0D77932881}D:\games\cs\hl.exe] => (Allow) D:\games\cs\hl.exe
FirewallRules: [TCP Query User{FC47855F-47C2-4547-8B27-EF3B146EBCA4}C:\windows\system32\javaw.exe] => (Allow) C:\windows\system32\javaw.exe
FirewallRules: [UDP Query User{1418532D-03C8-4B0C-9B49-928B8E1F6B4A}C:\windows\system32\javaw.exe] => (Allow) C:\windows\system32\javaw.exe
FirewallRules: [{6E002B17-3165-4BFF-ADBA-A037653C4176}] => (Allow) D:\DATEN\Steam\SteamApps\common\Brick-Force ROW\InfernumLogin.exe
FirewallRules: [{2AEC7734-4689-40EB-ACF4-4539F5E3C8B6}] => (Allow) D:\DATEN\Steam\SteamApps\common\Brick-Force ROW\InfernumLogin.exe
FirewallRules: [TCP Query User{EDAC0C69-C5DF-45F9-B2A2-A44713BA527B}D:\daten\steam\steamapps\common\brick-force row\brickforce.exe] => (Allow) D:\daten\steam\steamapps\common\brick-force row\brickforce.exe
FirewallRules: [UDP Query User{608F7E38-CA94-4CEC-8131-04C496700818}D:\daten\steam\steamapps\common\brick-force row\brickforce.exe] => (Allow) D:\daten\steam\steamapps\common\brick-force row\brickforce.exe
FirewallRules: [TCP Query User{C39072A7-DBE6-41F4-9BCB-0EABEA89939D}C:\windows\system32\javaw.exe] => (Allow) C:\windows\system32\javaw.exe
FirewallRules: [UDP Query User{4F800811-E61C-47AB-85B2-7CEFFC9B3EEE}C:\windows\system32\javaw.exe] => (Allow) C:\windows\system32\javaw.exe
FirewallRules: [TCP Query User{B330513C-7AEF-4C2E-8817-5AD89632682E}D:\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) D:\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [UDP Query User{459077B9-3DFA-452C-8553-63B27CBDEFF8}D:\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) D:\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [TCP Query User{65BA1488-BC8B-4A99-8BFC-F35F34ACD0F8}D:\daten\david\desktop\programmieren\new minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) D:\daten\david\desktop\programmieren\new minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [UDP Query User{D9B99DB4-89B3-4543-8B61-5B8B1210240B}D:\daten\david\desktop\programmieren\new minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) D:\daten\david\desktop\programmieren\new minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [{1D869324-2690-4B0E-B46D-C8353AF2FED9}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [TCP Query User{62F82345-F342-4B99-A8D3-F3B88A7840BF}D:\daten\david\desktop\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) D:\daten\david\desktop\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [UDP Query User{25C60441-E06F-404D-81DF-18CFE1E0CE56}D:\daten\david\desktop\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) D:\daten\david\desktop\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [TCP Query User{01B0A0D4-9E2C-4A99-9A54-E228615BC628}D:\daten\david\desktop\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) D:\daten\david\desktop\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [UDP Query User{13D95A60-852F-4DAD-976E-7ADB8F5D5251}D:\daten\david\desktop\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) D:\daten\david\desktop\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [TCP Query User{D40DE300-F144-46EA-905F-2E0330A8B498}D:\xampp\apache\bin\httpd.exe] => (Allow) D:\xampp\apache\bin\httpd.exe
FirewallRules: [UDP Query User{95D309B1-0330-4655-9464-0E14FBF752D8}D:\xampp\apache\bin\httpd.exe] => (Allow) D:\xampp\apache\bin\httpd.exe
FirewallRules: [{B9BCD593-EFEB-4125-8C60-406007DCCF6D}] => (Block) D:\xampp\apache\bin\httpd.exe
FirewallRules: [{E627F060-B00F-415B-9E90-456904B456B1}] => (Block) D:\xampp\apache\bin\httpd.exe
FirewallRules: [TCP Query User{5731B421-9EAF-4C47-A583-95817026B584}D:\xampp\filezillaftp\filezillaserver.exe] => (Allow) D:\xampp\filezillaftp\filezillaserver.exe
FirewallRules: [UDP Query User{66FE70FA-9EF7-4A1E-AC1F-62238112B788}D:\xampp\filezillaftp\filezillaserver.exe] => (Allow) D:\xampp\filezillaftp\filezillaserver.exe
FirewallRules: [{B49A1AC9-DECE-4CBE-9436-49CF8D4A9A45}] => (Block) D:\xampp\filezillaftp\filezillaserver.exe
FirewallRules: [{BFFE6C0C-B3BD-4C5A-8205-98A48E37D9AE}] => (Block) D:\xampp\filezillaftp\filezillaserver.exe
FirewallRules: [TCP Query User{DF75E35C-9C24-42BC-8737-967E61B02E6A}D:\xampp\mysql\bin\mysqld.exe] => (Allow) D:\xampp\mysql\bin\mysqld.exe
FirewallRules: [UDP Query User{12072A01-B0EC-4394-A6EC-94F14CEB0209}D:\xampp\mysql\bin\mysqld.exe] => (Allow) D:\xampp\mysql\bin\mysqld.exe
FirewallRules: [{8CA80871-D701-453C-B07E-12C5140CF7BD}] => (Block) D:\xampp\mysql\bin\mysqld.exe
FirewallRules: [{01856593-0F0F-4559-BD35-A9977956CDD5}] => (Block) D:\xampp\mysql\bin\mysqld.exe
FirewallRules: [TCP Query User{47585B0C-72C3-4EBF-B097-43CE0770A18F}D:\xampp\mercurymail\mercury.exe] => (Allow) D:\xampp\mercurymail\mercury.exe
FirewallRules: [UDP Query User{F2D7BE76-CFCD-47FB-A511-6637A8B062BF}D:\xampp\mercurymail\mercury.exe] => (Allow) D:\xampp\mercurymail\mercury.exe
FirewallRules: [{04FE52D2-A2D3-4E7F-B752-A6294756B317}] => (Block) D:\xampp\mercurymail\mercury.exe
FirewallRules: [{DF4D1FBE-E699-4612-B751-A32A64187EBE}] => (Block) D:\xampp\mercurymail\mercury.exe
FirewallRules: [{10070794-2AA9-4E57-87E4-C148B8757EE0}] => (Allow) D:\DATEN\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo.exe
FirewallRules: [{EA7A74B6-1082-4C98-B56A-C7E52326433F}] => (Allow) D:\DATEN\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo.exe
FirewallRules: [TCP Query User{0907764F-319B-4A69-8E5F-17D66AAC659D}D:\daten\java\bin\jmc.exe] => (Block) D:\daten\java\bin\jmc.exe
FirewallRules: [UDP Query User{69677A45-7490-43CE-B690-E6002A977C8F}D:\daten\java\bin\jmc.exe] => (Block) D:\daten\java\bin\jmc.exe
FirewallRules: [{E4EA7DF7-885E-4CEE-803F-1E5488DED0BE}] => (Allow) D:\DATEN\Steam\SteamApps\common\AdVenture Capitalist\adventure-capitalist.exe
FirewallRules: [{2CF755F6-5831-4D70-8568-D1D7F782B957}] => (Allow) D:\DATEN\Steam\SteamApps\common\AdVenture Capitalist\adventure-capitalist.exe
FirewallRules: [{99C339EC-F403-488F-82EF-EB1E80DEFA8B}] => (Allow) D:\DATEN\Steam\SteamApps\common\Call of Duty Black Ops II\t6mp.exe
FirewallRules: [{4A579AD9-DDA9-4AA4-8A9F-1C97A63D2514}] => (Allow) D:\DATEN\Steam\SteamApps\common\Call of Duty Black Ops II\t6mp.exe
FirewallRules: [{FC098E22-E20B-4145-93F8-748C89AEA0C0}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{D58D173C-92B4-406E-95FB-BC27A2F57679}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{AA2AC5CA-079E-4FF8-9C24-746A1682B76A}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{37ABEFA9-E01D-4229-9DBF-E5FAA2939B92}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{A3D4F672-EE5F-448C-BD81-2EA8C8D9376F}] => (Allow) D:\DATEN\Steam\SteamApps\common\Call of Duty Modern Warfare 3\iw5mp.exe
FirewallRules: [{30F1B9F8-6A94-465D-9D4D-82ABA3A4B248}] => (Allow) D:\DATEN\Steam\SteamApps\common\Call of Duty Modern Warfare 3\iw5mp.exe
FirewallRules: [{047976DB-3459-4473-B4D4-87209FD47071}] => (Allow) D:\DATEN\Landwirtschafts Simulator 2011\FarmingSimulator2011.exe
FirewallRules: [{967D6039-5092-410D-BD60-D4C84FA01D3B}] => (Allow) D:\DATEN\Landwirtschafts Simulator 2011\FarmingSimulator2011.exe
FirewallRules: [{358BA3D5-B46F-4C4C-A6BA-255DB33DEB32}] => (Allow) D:\DATEN\Landwirtschafts Simulator 2011\game.exe
FirewallRules: [{8C54A0EC-E854-4089-8FB2-3089F879C45D}] => (Allow) D:\DATEN\Landwirtschafts Simulator 2011\game.exe
FirewallRules: [{8323E2A3-3D23-4EBF-84B5-9F4DDD1F17A1}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [TCP Query User{DAB43F43-29DA-45B5-AD39-9D3F898A61AC}D:\cs\hl.exe] => (Allow) D:\cs\hl.exe
FirewallRules: [UDP Query User{3EBCA4FF-1A56-403F-B3D6-0AAC31D22BDF}D:\cs\hl.exe] => (Allow) D:\cs\hl.exe
FirewallRules: [{BCCDB1EE-1A87-437B-83D9-DE7B07387A19}] => (Block) D:\cs\hl.exe
FirewallRules: [{AC7AE9A0-96C8-47F9-B3DD-9CA124A0C58D}] => (Block) D:\cs\hl.exe

==================== Faulty Device Manager Devices =============

Name: Hamachi Network Interface
Description: Hamachi Network Interface
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: LogMeIn, Inc.
Service: hamachi
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: David
Description: GT-I9301I
Class Guid: {eec5ad98-8080-425f-922a-dabf3de3f69a}
Manufacturer: Samsung Electronics Co., Ltd.
Service: WUDFRd
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: netfilter64
Description: netfilter64
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer: 
Service: netfilter64
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.


==================== Event log errors: =========================

Application errors:
==================
Error: (06/07/2015 04:45:01 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.

Error: (06/07/2015 04:45:01 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (06/07/2015 04:45:01 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (06/07/2015 04:40:45 PM) (Source: Microsoft-Windows-WMI) (EventID: 10) (User: NT-AUTORITÄT)
Description: Der Ereignisfilter mit der Abfrage "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" konnte im Namespace "//./root/CIMV2" aufgrund des Fehlers "0x80041003" nicht reaktiviert werden. Solange dieses Problem besteht, können mit diesem Filter keine Ereignisse übermittelt werden.

Error: (06/07/2015 04:40:44 PM) (Source: BstHdAndroidSvc) (EventID: 0) (User: )
Description: Der Dienst kann nicht gestartet werden. System.ApplicationException: Cannot start service.  Service did not stop gracefully the last time it was run.
   bei BlueStacks.hyperDroid.Service.Service.OnStart(String[] args)
   bei System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)

Error: (06/07/2015 03:27:39 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.

Error: (06/07/2015 03:27:39 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (06/07/2015 03:27:39 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (06/07/2015 03:20:50 PM) (Source: Microsoft-Windows-WMI) (EventID: 10) (User: NT-AUTORITÄT)
Description: Der Ereignisfilter mit der Abfrage "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" konnte im Namespace "//./root/CIMV2" aufgrund des Fehlers "0x80041003" nicht reaktiviert werden. Solange dieses Problem besteht, können mit diesem Filter keine Ereignisse übermittelt werden.

Error: (06/07/2015 03:20:50 PM) (Source: BstHdAndroidSvc) (EventID: 0) (User: )
Description: Der Dienst kann nicht gestartet werden. System.ApplicationException: Cannot start service.  Service did not stop gracefully the last time it was run.
   bei BlueStacks.hyperDroid.Service.Service.OnStart(String[] args)
   bei System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)


System errors:
=============
Error: (06/07/2015 04:40:44 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
netfilter64
UsbCharger

Error: (06/07/2015 04:40:44 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "BlueStacks Android Service" wurde mit folgendem Fehler beendet: 
%%1064

Error: (06/07/2015 04:40:42 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "LogMeIn Hamachi Tunneling Engine" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (06/07/2015 04:40:41 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Razer Game Scanner" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%5

Error: (06/07/2015 04:40:38 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "MBAMService" ist vom Dienst "MBAMProtector" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%193

Error: (06/07/2015 04:40:38 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Optimizer Pro Crash Monitor erreicht.

Error: (06/07/2015 04:39:57 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "MBAMProtector" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%193

Error: (06/07/2015 03:39:04 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (06/07/2015 03:26:54 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (06/07/2015 03:23:29 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "HP CUE DeviceDiscovery Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.


Microsoft Office:
=========================
Error: (06/07/2015 04:45:01 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000

Error: (06/07/2015 04:45:01 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (06/07/2015 04:45:01 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (06/07/2015 04:40:45 PM) (Source: Microsoft-Windows-WMI) (EventID: 10) (User: NT-AUTORITÄT)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/07/2015 04:40:44 PM) (Source: BstHdAndroidSvc) (EventID: 0) (User: )
Description: Der Dienst kann nicht gestartet werden. System.ApplicationException: Cannot start service.  Service did not stop gracefully the last time it was run.
   bei BlueStacks.hyperDroid.Service.Service.OnStart(String[] args)
   bei System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)

Error: (06/07/2015 03:27:39 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000

Error: (06/07/2015 03:27:39 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (06/07/2015 03:27:39 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (06/07/2015 03:20:50 PM) (Source: Microsoft-Windows-WMI) (EventID: 10) (User: NT-AUTORITÄT)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/07/2015 03:20:50 PM) (Source: BstHdAndroidSvc) (EventID: 0) (User: )
Description: Der Dienst kann nicht gestartet werden. System.ApplicationException: Cannot start service.  Service did not stop gracefully the last time it was run.
   bei BlueStacks.hyperDroid.Service.Service.OnStart(String[] args)
   bei System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)


CodeIntegrity Errors:
===================================
  Date: 2015-06-07 14:29:59.863
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-06-07 14:29:59.847
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-06-07 13:48:20.031
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\SynexTV\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-06-07 13:48:20.008
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\SynexTV\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-04-01 13:58:50.052
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files (x86)\Web Protect\pcwtc64f.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-04-01 13:58:50.011
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files (x86)\Web Protect\pcwtc64f.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-04-01 13:58:49.968
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files (x86)\Web Protect\pcwtc64f.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-04-01 11:59:26.837
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files (x86)\Web Protect\pcwtc64f.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-04-01 11:59:26.782
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files (x86)\Web Protect\pcwtc64f.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-04-01 11:59:26.740
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files (x86)\Web Protect\pcwtc64f.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i5-4570 CPU @ 3.20GHz
Percentage of memory in use: 53%
Total physical RAM: 8079.25 MB
Available physical RAM: 3793.34 MB
Total Pagefile: 16269.45 MB
Available Pagefile: 11873.99 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: (SSD-Second) (Fixed) (Total:107.32 GB) (Free:5.33 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (HDD-First) (Fixed) (Total:931.51 GB) (Free:137.03 GB) NTFS
Drive e: (FAST_FIVE) (CDROM) (Total:7.55 GB) (Free:0 GB) UDF

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 111.8 GB) (Disk ID: 75B73B21)
Partition 1: (Active) - (Size=107.3 GB) - (Type=07 NTFS)

============================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 2819512B)
Partition 1: (Not Active) - (Size=931.5 GB) - (Type=07 NTFS)

=============== End of log ======================

--- --- ---

MfG SynexTV

M-K-D-B · 08.06.2015, 13:24

Servus,

zuerst bitte MBAM-clean ausführen und Rechner anschließend neu starten.

dann geht es so weiter:

Schritt 1
Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Schritt 2
Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Schritt 3

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

Schritt 4
Downloade dir bitte Shortcut Cleaner (by Grinler) auf deinen Desktop.

Starte die sc-cleaner.exe mit einem Doppelclick.
Bestätige die Meldung Shortcut Cleaner Finished am Ende des Suchlaufs mit Ok.
Eine Logdatei wird sich öffnen (sc-cleaner.txt).
Poste mir den Inhalt mit deiner nächsten Antwort.

Schritt 5

Starte die FRST.exe erneut. Setze einen Haken vor Addition.txt und drücke auf Scan.
FRST erstellt wieder zwei Logdateien (FRST.txt und Addition.txt).
Poste mir beide Logdateien mit deiner nächsten Antwort.

Bitte poste mit deiner nächsten Antwort

die Logdatei von AdwCleaner,
die Logdatei von MBAM,
die Logdatei von JRT,
die Logdatei von Shortcut-Cleaner,
die beiden neuen Logdateien von FRST.

SynexTV · 08.06.2015, 18:15

Hallo,

hier sind alle Log-Dateien die Sie haben wollten.

AdwCleaner.txt:

Code:

ATTFilter

# AdwCleaner v4.206 - Bericht erstellt 08/06/2015 um 18:06:33
# Aktualisiert 01/06/2015 von Xplode
# Datenbank : 2015-06-05.1 [Server]
# Betriebssystem : Windows 7 Professional Service Pack 1 (x64)
# Benutzername : David - BLACKMATRIX
# Gestarted von : D:\DATEN\David\Desktop\AdwCleaner_4.206.exe
# Option : Löschen

***** [ Dienste ] *****

[#] Dienst Gelöscht : netfilter64
[#] Dienst Gelöscht : f8794fcc

***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\Registry Helper
Ordner Gelöscht : C:\ProgramData\Trusted Publisher
Ordner Gelöscht : C:\ProgramData\CouPExxtensiONo
Ordner Gelöscht : C:\ProgramData\ISaveru
Ordner Gelöscht : C:\ProgramData\6e5016470a548f00
Ordner Gelöscht : C:\ProgramData\{46c36bb8-25fe-b6a7-46c3-36bb825faee0}
Ordner Gelöscht : C:\ProgramData\{6f437cd7-2723-f944-6f43-37cd7272f35c}
Ordner Gelöscht : C:\Program Files (x86)\predm
Ordner Gelöscht : C:\Program Files (x86)\Tbccint
Ordner Gelöscht : C:\Program Files (x86)\igs
Ordner Gelöscht : C:\Program Files (x86)\download Manager
Ordner Gelöscht : C:\Program Files (x86)\CouPExxtensiONo
Ordner Gelöscht : C:\Program Files (x86)\ISaveru
Ordner Gelöscht : C:\Windows\SysWOW64\config\systemprofile\AppData\Local\VCL
Ordner Gelöscht : C:\Users\Administrator\AppData\Local\Chromatic Browser
Ordner Gelöscht : C:\Users\Administrator\AppData\Local\torch
Ordner Gelöscht : C:\Users\David\AppData\Local\Chromatic Browser
Ordner Gelöscht : C:\Users\David\AppData\Local\Genesis
Ordner Gelöscht : C:\Users\David\AppData\Local\globalUpdate
Ordner Gelöscht : C:\Users\David\AppData\Local\03DE0294-1425219446-05D9-3D06-790700080009
Ordner Gelöscht : C:\Users\David\AppData\Local\03DE0294-1427822652-05D9-3D06-790700080009
Ordner Gelöscht : C:\Users\David\AppData\Local\03DE0294-1427822676-05D9-3D06-790700080009
Ordner Gelöscht : C:\Users\David\AppData\LocalLow\Tbccint
Ordner Gelöscht : C:\Users\David\AppData\LocalLow\SmartWeb
Ordner Gelöscht : C:\Users\David\AppData\LocalLow\{D2020D47-707D-4E26-B4D9-739C4F4C2E9A}
Ordner Gelöscht : C:\Users\David\AppData\Roaming\Activeris
Ordner Gelöscht : C:\Users\David\AppData\Roaming\RHEng
Ordner Gelöscht : C:\Users\David\AppData\Roaming\IHlpr
Ordner Gelöscht : D:\DATEN\David\Desktop\ftb
Ordner Gelöscht : C:\Users\Gast\AppData\Local\Chromatic Browser
Ordner Gelöscht : C:\Users\Gast\AppData\Local\torch
Ordner Gelöscht : C:\Users\HomeGroupUser$\AppData\Local\Chromatic Browser
Ordner Gelöscht : C:\Users\HomeGroupUser$\AppData\Local\torch
Ordner Gelöscht : C:\Users\Papa\AppData\LocalLow\HPAppData
Ordner Gelöscht : C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\Extensions\{c95a4e8e-816d-4655-8c79-d736da1adb6d}
Ordner Gelöscht : C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkcedibhemacmilmkpndpkoidlnmgngg
Ordner Gelöscht : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\bponfhkpfhlnmkhloadlhgaecehhmfoh
Ordner Gelöscht : C:\Users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\bponfhkpfhlnmkhloadlhgaecehhmfoh
[/!\] Nicht Gelöscht ( Junction ) : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\bponfhkpfhlnmkhloadlhgaecehhmfoh
[/!\] Nicht Gelöscht ( Junction ) : C:\Users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\bponfhkpfhlnmkhloadlhgaecehhmfoh
Ordner Gelöscht : C:\Users\David\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\dmgpbjjcdccinnndjdgmegndbmhbgglb
Ordner Gelöscht : C:\Users\David\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\cmaiofennmphjldldcpphcechfnnohja
Ordner Gelöscht : C:\Users\David\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\aaaalipaokhkccgmgkdglfinfnfhflko
Ordner Gelöscht : C:\Users\David\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\eagomcfjiefffhpaejnlpjccikpipdoe
Ordner Gelöscht : C:\Users\Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bponfhkpfhlnmkhloadlhgaecehhmfoh
Ordner Gelöscht : C:\Users\David\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bponfhkpfhlnmkhloadlhgaecehhmfoh
Ordner Gelöscht : C:\Users\Gast\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bponfhkpfhlnmkhloadlhgaecehhmfoh
Ordner Gelöscht : C:\Users\David\AppData\Roaming\Opera Software\Opera Stable\Extensions\eagomcfjiefffhpaejnlpjccikpipdoe
Ordner Gelöscht : C:\Users\David\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\dmgpbjjcdccinnndjdgmegndbmhbgglb
Ordner Gelöscht : C:\Users\David\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\eagomcfjiefffhpaejnlpjccikpipdoe
Ordner Gelöscht : C:\Users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\bponfhkpfhlnmkhloadlhgaecehhmfoh
Ordner Gelöscht : C:\Users\David\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\bponfhkpfhlnmkhloadlhgaecehhmfoh
Ordner Gelöscht : C:\Users\Gast\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\bponfhkpfhlnmkhloadlhgaecehhmfoh
Datei Gelöscht : C:\Users\David\AppData\Local\Comodo\Dragon\User Data\Default\Local Storage\chrome-extension_cmaiofennmphjldldcpphcechfnnohja_0.localstorage
Datei Gelöscht : C:\Users\David\AppData\Local\Comodo\Dragon\User Data\Default\Local Storage\chrome-extension_aaaalipaokhkccgmgkdglfinfnfhflko_0.localstorage
Datei Gelöscht : C:\Windows\AppPatch\Custom\{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb
Datei Gelöscht : C:\Windows\SysWOW64\RegistryHelperLM.ocx
Datei Gelöscht : C:\Windows\System32\roboot64.exe
Datei Gelöscht : C:\Windows\System32\VCL.dll
Datei Gelöscht : C:\Users\David\AppData\Roaming\JFQJPI
Datei Gelöscht : C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\invalidprefs.js
Datei Gelöscht : C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\user.js

***** [ Geplante Tasks ] *****

Task Gelöscht : avayvaxvaa
Task Gelöscht : fsupdate
Task Gelöscht : LaunchSignup
Task Gelöscht : Optimizer Pro Schedule
Task Gelöscht : SmartWeb Upgrade Trigger Task

***** [ Verknüpfungen ] *****

Verknüpfung Desinfiziert : C:\Users\David\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
Verknüpfung Desinfiziert : C:\Users\David\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk
Verknüpfung Desinfiziert : C:\Users\David\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk

***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\mkcedibhemacmilmkpndpkoidlnmgngg
Schlüssel Gelöscht : HKCU\Software\Classes\keepmysearch
Schlüssel Gelöscht : HKCU\Software\Classes\Applications\inetstat.exe
Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\VCL
Schlüssel Gelöscht : HKLM\SOFTWARE\78ca46d0-2bc7-447c-8f4f-32c6a01514d9
Schlüssel Gelöscht : HKLM\SOFTWARE\a6b046f9-6ecd-b6c1-ab72-38baab409415
Schlüssel Gelöscht : HKLM\SOFTWARE\dd7ab955-8024-4fe3-baf0-7c1b87724639
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\S-493389286
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT1561552
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{425F4ABF-B8E4-402D-9E49-06E494EB8DBF}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{00B11DA2-75ED-4364-ABA5-9A95B1F5E946}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{87EAB409-97D7-4889-ACFA-C548FC6F3ECF}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{459DD0F7-0D55-D3DC-67BC-E6BE37E9D762}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{6EC77D09-02CB-4E1F-E3C4-FB141B2610B3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A9582D7B-F24A-441D-9D26-450D58F3CD17}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EE0D8859-2ED4-4B0D-9812-16865B9AFD65}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{B5C4833B-847B-49CD-8EBE-CDD9B43C882F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{14EF423E-3EE8-44AE-9337-07AC3F27B744}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{5645E0E7-FC12-43BF-A6E4-F9751942B298}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{0BDDE35F-64F7-49C3-99B2-404E899C49F7}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{24236608-609C-42C5-B13C-A8A3EC921850}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{28B1A706-4B97-4EB1-8B32-125042685AD9}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{33575A26-D9CF-40C6-8A3E-116F17201C7F}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{4BDFD19F-93D7-49CE-B554-5C215FDC0136}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{7307CF0F-7173-4FBF-8649-B149916DD322}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{80A5E38C-5F6B-485F-BD97-0B5BE991FAD5}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{9544D727-A26F-4D57-AF38-4496088640EA}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{AC4C30BF-7D5F-4EAB-9C2A-454178F079AA}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{BC6F9C26-93EA-4C6D-A4A7-C1FA333B4BBE}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E975527B-ABE7-40B3-B5C1-385016913E3B}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{EFA4B5B1-6C76-4B20-BCDB-D41A93E79053}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{A9582D7B-F24A-441D-9D26-450D58F3CD17}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{EE0D8859-2ED4-4B0D-9812-16865B9AFD65}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}
Schlüssel Gelöscht : HKCU\Software\ContextFree
Schlüssel Gelöscht : HKCU\Software\genesis
Schlüssel Gelöscht : HKCU\Software\GlobalUpdate
Schlüssel Gelöscht : HKCU\Software\InetStat
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\powerpack
Schlüssel Gelöscht : HKCU\Software\RegisteredApplicationsEx
Schlüssel Gelöscht : HKCU\Software\Tbccint
Schlüssel Gelöscht : HKCU\Software\Tbccint_HKLM
Schlüssel Gelöscht : HKCU\Software\WebProtect
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\SmartWeb
Schlüssel Gelöscht : HKLM\SOFTWARE\Registry Helper
Schlüssel Gelöscht : HKLM\SOFTWARE\SPPDCOM
Schlüssel Gelöscht : HKLM\SOFTWARE\IGS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{F1422DAA-0829-09A1-7536-73936CAB8FFA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Linkey
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\AllDaySavings 
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3152E1F19977892449DC968802CE8964
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\649A52D257CA5DB4EAAE8BA9EB23E467
Daten Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - <-loopback>

***** [ Internetbrowser ] *****

-\\ Internet Explorer v11.0.9600.17801


-\\ Mozilla Firefox v

[3e36n754.default\prefs.js] - Zeile Gelöscht : user_pref("browser.search.searchengine.alias", "mystartsearch");
[3e36n754.default\prefs.js] - Zeile Gelöscht : user_pref("browser.search.searchengine.iconURL", "hxxp://www.mystartsearch.com/favicon.ico");
[3e36n754.default\prefs.js] - Zeile Gelöscht : user_pref("browser.search.searchengine.name", "mystartsearch");
[3e36n754.default\prefs.js] - Zeile Gelöscht : user_pref("browser.search.searchengine.url", "hxxp://www.mystartsearch.com/web/?type=ds&ts=1427816256&from=cmi&uid=SamsungXSSDX840XEVOX120GB_S1D5NSAF121893F&q={searchTerms}");
[3e36n754.default\prefs.js] - Zeile Gelöscht : user_pref("browser.search.selectedEngine", "mystartsearch");
[3e36n754.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.ad4db60df25f14dae9dd18185c395f9e794c9ab86be3ebcom72893.72893.internaldb.monetization_plugin_bundledUrls.value", "%7B%22dealply_s%22%3A%7B%22urls%22%3A%5B%22ssfiles.com%22%5D%7D%2[...]
[3e36n754.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.quick_start.enable_search1", false);
[3e36n754.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.quick_start.sd.closeWindowWithLastTab_prev_state", false);
[3e36n754.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.xpiState", "{\"app-profile\":{\"d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\":{\"d\":\"C:\\\\Users\\\\David\\\\AppData\\\\Roaming\\\\Mozilla\\\\Firefox\\\\Profiles\\\\3e36[...]
[3e36n754.default\prefs.js] - Zeile Gelöscht : user_pref("smartbar.machineId", "YE4WPXNUSSQ6UP4VKZ39Z349YZRPIY6CLX7DQHFFZSRDPZDCP5/TCA/G8XQ1YCJX5R7QEH9DWR1UZ95HGAHRYW");

-\\ Google Chrome v43.0.2357.81

[C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=SamsungXSSDX840XEVOX120GB_S1D5NSAF121893F&ts=1427816371&type=default&q={searchTerms}
[C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://en.softonic.com/s/{searchTerms}

-\\ Comodo Dragon v

[C:\Users\David\AppData\Local\Comodo\Dragon\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://search.ask.com/web?o=APN10257&doi=2014-07-31&apn_dtid=%5ECMD011%5EYY%5EUS&apn_ptnrs=%5EAGO&q={searchTerms}

-\\ Opera v0.0.0.0

[C:\Users\David\AppData\Roaming\Opera Software\Opera Stable\Preferences] - Gelöscht [Extension] : eagomcfjiefffhpaejnlpjccikpipdoe

-\\ Chrome Canary v


*************************

AdwCleaner[R0].txt - [325 Bytes] - [08/06/2015 18:05:24]
AdwCleaner[R1].txt - [15939 Bytes] - [08/06/2015 18:05:53]
AdwCleaner[S0].txt - [14382 Bytes] - [08/06/2015 18:06:33]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [14442  Bytes] ##########

MBAM.txt:

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 08.06.2015
Suchlauf-Zeit: 18:18:27
Logdatei: MBAM.txt
Administrator: Ja

Version: 2.01.6.1022
Malware Datenbank: v2015.06.08.03
Rootkit Datenbank: v2015.06.02.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: David

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 532722
Verstrichene Zeit: 17 Min, 37 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(Keine schädliche Elemente gefunden)

Module: 0
(Keine schädliche Elemente gefunden)

Registrierungsschlüssel: 5
PUP.Optional.Trovi.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\LAYERS\VC32LDR, In Quarantäne, [c2818b2dfc8ece687a15582d0afbe11f], 
PUM.Security.Hijack.DisableChromeUpdates, HKLM\SOFTWARE\POLICIES\GOOGLE\UPDATE, In Quarantäne, [251e4474c3c7b1857eb48df8d2336a96], 
PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{1146AC44-2F03-4431-B4FD-889BC837521F}{f8794fcc}, In Quarantäne, [7fc4ad0b7f0b3006dfa84e3557ae3bc5], 
PUM.Security.Hijack.DisableChromeUpdates, HKLM\SOFTWARE\WOW6432NODE\POLICIES\GOOGLE\UPDATE, In Quarantäne, [d66d3b7d206a9d99d260147137ce49b7], 
PUP.Optional.CrossRider.A, HKU\S-1-5-21-914325664-1482865349-517734357-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{2D4D3B4F-87C4-4667-844A-FBC8AB82CB5B}, In Quarantäne, [5ae9694f1f6b0234bc91e59d65a0ea16], 

Registrierungswerte: 17
PUP.Optional.Trovi.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\chrome.exe|{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb, 130696890624853586, In Quarantäne, [3013d8e0c3c71a1c88063055ba4bf808]
PUP.Optional.Trovi.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\explorer.xxx|{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb, 130696890624853586, In Quarantäne, [024143753753d0669ef0b2d3f70e7789]
PUP.Optional.Trovi.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\firefox.exe|{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb, 130696890624853586, In Quarantäne, [c77c7642107a5fd7850988fddd2845bb]
PUP.Optional.Trovi.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\iexplore.exe|{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb, 130696890624853586, In Quarantäne, [c57effb9bbcf11253d518ff6da2b10f0]
PUP.Optional.Trovi.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\msiexec.exe|{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb, 130696890624853586, In Quarantäne, [21224177bfcbaa8c96f89aeb15f047b9]
PUP.Optional.Trovi.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\SearchProtectionSetup.exe|{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb, 130696890624853586, In Quarantäne, [e16210a80c7e8aacfb931a6b22e3f907]
PUP.Optional.Trovi.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\SearchProtectionStub.exe|{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb, 130696890624853586, In Quarantäne, [77cc4a6e1c6eae88c9c589fc26df669a]
PUP.Optional.Trovi.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\SettingsManagerSetup.exe|{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb, 130696890624853586, In Quarantäne, [1c271e9a1c6eaa8cb5d97510df2615eb]
PUP.Optional.Trovi.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\SetupDataMg.exe|{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb, 130696890624853586, In Quarantäne, [9aa957616e1c072f0d810580bf46ad53]
PUP.Optional.Trovi.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\SetupDataMngr_iLivid.exe|{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb, 130696890624853586, In Quarantäne, [78cb694ff595f34309856f16996c9769]
PUP.Optional.Trovi.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\SetupDataMngr_iMesh.exe|{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb, 130696890624853586, In Quarantäne, [ba8941775733a3930886aed7d13420e0]
PUP.Optional.Trovi.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\software_removal_tool.exe|{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb, 130696890624853586, In Quarantäne, [83c0308813774ee8f19d592cb74efb05]
PUP.Optional.Trovi.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\software_reporter_tool.exe|{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb, 130696890624853586, In Quarantäne, [97acf7c1bad067cf9df1780d17eeb947]
PUP.Optional.Trovi.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\LAYERS\VC32Ldr|{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb, 130696890624853586, In Quarantäne, [c2818b2dfc8ece687a15582d0afbe11f]
PUM.Security.Hijack.DisableChromeUpdates, HKLM\SOFTWARE\POLICIES\GOOGLE\UPDATE|DisableAutoUpdateChecksCheckboxValue, 1, In Quarantäne, [251e4474c3c7b1857eb48df8d2336a96]
PUM.Security.Hijack.DisableChromeUpdates, HKLM\SOFTWARE\WOW6432NODE\POLICIES\GOOGLE\UPDATE|DisableAutoUpdateChecksCheckboxValue, 1, In Quarantäne, [d66d3b7d206a9d99d260147137ce49b7]
PUP.Optional.CrossRider.A, HKU\S-1-5-21-914325664-1482865349-517734357-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{2D4D3B4F-87C4-4667-844A-FBC8AB82CB5B}|AppName, 396a931f-cee7-452b-9e97-17f0a91e645a-2.exe-codedownloader.exe, In Quarantäne, [5ae9694f1f6b0234bc91e59d65a0ea16]

Registrierungsdaten: 0
(Keine schädliche Elemente gefunden)

Ordner: 15
PUP.Optional.MultiPlug.Gen, C:\Users\David\AppData\Roaming\03DE0294-1425219388-05D9-3D06-790700080009, In Quarantäne, [8bb803b5cac068cebaff5d1f6d980cf4], 
PUP.Optional.MultiPlug.Gen, C:\Users\David\AppData\Roaming\03DE0294-1427815156-05D9-3D06-790700080009, In Quarantäne, [64dffeba226816209e1b1c601ee76d93], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\skin, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\chrome, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\chrome\content, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\chrome\content\api, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\chrome\content\core, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\defaults, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\defaults\preferences, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\userCode, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\locale, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\locale\en-US, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 

Dateien: 112
PUP.Optional.APNToolBar.A, C:\ProgramData\Avira\Antivirus\TEMP\AVSCAN-20150527-175947-79E8C24B\00000007-DB70DB26, In Quarantäne, [78cbfdbbb6d47bbb89cc283c5ba7bc44], 
PUP.Optional.APNToolBar.A, C:\ProgramData\Avira\Antivirus\TEMP\AVSCAN-20150527-175947-79E8C24B\00000007-F064DF4A, In Quarantäne, [58eb6f494e3c78be064f570d06fc3dc3], 
PUP.Optional.MultiPlug.Gen, C:\Users\David\AppData\Roaming\03DE0294-1425219388-05D9-3D06-790700080009\vnss29EF.tmp, In Quarantäne, [8bb803b5cac068cebaff5d1f6d980cf4], 
PUP.Optional.MultiPlug.Gen, C:\Users\David\AppData\Roaming\03DE0294-1425219388-05D9-3D06-790700080009\Uninstall.exe, In Quarantäne, [8bb803b5cac068cebaff5d1f6d980cf4], 
PUP.Optional.MultiPlug.Gen, C:\Users\David\AppData\Roaming\03DE0294-1427815156-05D9-3D06-790700080009\vnsr5B91.tmp, In Quarantäne, [64dffeba226816209e1b1c601ee76d93], 
PUP.Optional.MultiPlug.Gen, C:\Users\David\AppData\Roaming\03DE0294-1427815156-05D9-3D06-790700080009\Uninstall.exe, In Quarantäne, [64dffeba226816209e1b1c601ee76d93], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\skin\crossrider_statusbar.png, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\skin\button1.png, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\skin\button2.png, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\skin\button3.png, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\skin\button4.png, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\skin\button5.png, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\skin\icon128.png, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\skin\icon16.png, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\skin\icon24.png, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\skin\icon48.png, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\skin\panelarrow-up.png, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\skin\popup.html, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\skin\skin.css, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\skin\update.css, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\chrome.manifest, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\chrome\content\68dc85ed513397c249c54f033bb5975a.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\chrome\content\79b027ff29a469baf68182c9610890e7.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\chrome\content\a0a55954be8297bdf53f9f83dc2b5f9f.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\chrome\content\a3896e565b8847842ad965fe79f7fa39.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\chrome\content\b29740afa00b41f566e56c3ce2016f24.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\chrome\content\background.html, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\chrome\content\browser.xul, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\chrome\content\cb80e67ebf5b646391e806fed670e3a9.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\chrome\content\dialog.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\chrome\content\ffCoreFilesIndex.txt, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\chrome\content\options.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\chrome\content\options.xul, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\chrome\content\search_dialog.xul, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\chrome\content\api\b52f4b943d4a8a351dcf0184b088edde.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\chrome\content\api\327313cc420b909d4fe2e6d167be2126.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\chrome\content\api\343d7d887dfb3ec60a21086959a6338a.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\chrome\content\api\36a442a350aa5341247b5e77bc6fe2c3.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\chrome\content\api\44ca9005bf1215d67df471419a9e08f5.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\chrome\content\api\486b79de5d8f603c2319666e22b7048a.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\chrome\content\api\49fecf6fd593387c76e423e9d9fac9ac.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\chrome\content\api\7f6a316bc0a8b5c7894a08a49bac1cf8.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\chrome\content\api\93230e84eaf59e34647460a6eefc5b28.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\chrome\content\api\bf454a85d0a4567611c6456286546ca4.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\chrome\content\api\dc600bf3e56862e4291cdfa86adfe83f.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\chrome\content\api\dc8cdf1d041f889a0fc652bc8f2802c4.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\chrome\content\api\e2e9877a11be64006d9710fb8a5dc40a.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\chrome\content\api\f7825a78f9b261b9d26e822d0c5e28f6.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\chrome\content\api\f81195c34696f7471a9fc36e3b4f9364.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\chrome\content\api\f87aaf112114df5ff455bcda76bf8f7b.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\chrome\content\core\b8123144513494cbd542d7f4d33e2462.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\chrome\content\core\0656834bdddc9178a6a461c4c44efbe2.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\chrome\content\core\0d5396251eec0f1e3c7c8f5365c91830.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\chrome\content\core\21c569c3a58e619276f2c1e82aa41300.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\chrome\content\core\38a3bb96c30c3973093fb78272c09e48.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\chrome\content\core\3c040d25de84efb9eecf2b3a0db5c469.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\chrome\content\core\451c781c41804d4a574e40a36acdfd35.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\chrome\content\core\4ca9faf7998071b4263cd6f14eeee277.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\chrome\content\core\525ef53e6d191704d406177020b39bce.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\chrome\content\core\5661ddcfa7099d1d974d2e10f3d39047.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\chrome\content\core\653b7e69415a675bd22aa150d0ce8777.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\chrome\content\core\8ab0b06a35e9a476b5e5923be3aa3ffc.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\chrome\content\core\9e662e558e6db9fe4b91ea2421bb1e9e.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\chrome\content\core\beb99c8df09c375181af71fba1a3f9e0.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\chrome\content\core\dbc2010a92763dc23724a38204ecc7d1.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\chrome\content\core\e97d45a97729a5f086f076179676e5e5.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\chrome\content\core\f411bd3b6b39849807d94662439e40c5.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\chrome\content\core\f4b1761b39db3191f0df3e25469191ef.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\chrome\content\core\f4b97b3414a9130c305cd6925e21e87f.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\chrome\content\core\fe7177ec998e886f212f22a46e24ad46.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\chrome\content\core\installer.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\defaults\preferences\prefs.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\manifest.xml, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins.json, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\273.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\119.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\13.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\14.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\17.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\178.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\179.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\220.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\231.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\232.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\234.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\242.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\246.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\260.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\264.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\281.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\288.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\289.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\335.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\345.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\354.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\375.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\376.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\385.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\389.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\390.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\391.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\4.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\47.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\64.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\7.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\78.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\9.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\91.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\93.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\userCode\background.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\userCode\extension.js, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 
PUP.Optional.CrossRider.A, C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\locale\en-US\translations.dtd, In Quarantäne, [0e35bdfbdeac5fd72d8ecbb14eb7c13f], 

Physische Sektoren: 0
(Keine schädliche Elemente gefunden)


(end)

JRT.txt:

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.9.0 (06.07.2015:1)
OS: Windows 7 Professional x64
Ran by David on 08.06.2015 at 19:04:51,64
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Tasks



~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search\\SearchAssistant



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog\Application\registry helper service



~~~ Files

Successfully deleted: [File] C:\Users\David\appdata\local\google\chrome\user data\default\local storage\https_static.olark.com_0.localstorage
Successfully deleted: [File] C:\Users\David\appdata\local\google\chrome\user data\default\local storage\https_static.olark.com_0.localstorage-journal



~~~ Folders

Successfully deleted: [Empty Folder] C:\Users\David\appdata\local\{448CE38E-6D6F-4AC5-8E8C-519B4001E0D2}
Successfully deleted: [Folder] C:\Users\David\appdata\locallow\company
Successfully deleted: [Folder] C:\Windows\syswow64\ai_recyclebin
Successfully deleted: [Folder] C:\ProgramData\21421c3c759d49f5b9f0cda1c5d07cad
Successfully deleted: [Folder] C:\ProgramData\c81724e310f848a9aa45fde173af1b3c



~~~ Chrome


[C:\Users\David\appdata\local\Google\Chrome\User Data\Default\Preferences] - default search provider reset

[C:\Users\David\appdata\local\Google\Chrome\User Data\Default\Preferences] - Extensions Deleted:

[C:\Users\David\appdata\local\Google\Chrome\User Data\Default\Secure Preferences] - default search provider reset

[C:\Users\David\appdata\local\Google\Chrome\User Data\Default\Secure Preferences] - Extensions Deleted:
[]





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 08.06.2015 at 19:08:05,48
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

ShortCut-Cleaner - sc-cleaner.txt:

Code:

ATTFilter

Shortcut Cleaner 1.3.8 by Lawrence Abrams (Grinler)
hxxp://www.bleepingcomputer.com/
Copyright 2008-2015 BleepingComputer.com
More Information about Shortcut Cleaner can be found at this link:
 hxxp://www.bleepingcomputer.com/download/shortcut-cleaner/

Windows Version: Windows 7 Professional Service Pack 1
Program started at: 06/08/2015 07:09:04 PM.

Scanning for registry hijacks:

 * No issues found in the Registry.

Searching for Hijacked Shortcuts:

Searching C:\Users\David\AppData\Roaming\Microsoft\Windows\Start Menu\

Searching C:\ProgramData\Microsoft\Windows\Start Menu\

Searching C:\Users\David\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\

Searching C:\Users\Public\Desktop\

Searching D:\DATEN\David\Desktop\

Searching C:\Users\Public\Desktop\


0 bad shortcuts found.

Program finished at: 06/08/2015 07:09:06 PM
Execution time: 0 hours(s), 0 minute(s), and 2 seconds(s)

FRST TEIL

Addition.txt:

[CODE]Additional
FRST Logfile:

Code:

ATTFilter

scan result of Farbar Recovery Scan Tool (x64) Version:06-06-2015
Ran by David at 2015-06-08 19:10:21
Running from D:\DATEN\David\Desktop
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-914325664-1482865349-517734357-500 - Administrator - Disabled)
David (S-1-5-21-914325664-1482865349-517734357-1000 - Administrator - Enabled) => C:\Users\David
Gast (S-1-5-21-914325664-1482865349-517734357-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-914325664-1482865349-517734357-1005 - Limited - Enabled)
Papa (S-1-5-21-914325664-1482865349-517734357-1006 - Administrator - Enabled) => C:\Users\Papa

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Disabled - Up to date) {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}
AS: Microsoft Security Essentials (Disabled - Up to date) {0C8D1929-27B2-688D-E114-9117BD2BB1B7}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

64 Bit HP CIO Components Installer (Version: 6.2.1 - Hewlett-Packard) Hidden
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Creative Cloud (HKLM-x32\...\Adobe Creative Cloud) (Version: 3.0.0.74 - Adobe Systems Incorporated)
Adobe Dreamweaver CC 2014 (HKLM-x32\...\{7F823F8E-4348-11E4-8BF8-81763C49AA32}) (Version: 15.1.0 - Adobe Systems Incorporated)
Adobe Flash Player 17 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.188 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.11) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.11 - Adobe Systems Incorporated)
AdVenture Capitalist (HKLM-x32\...\Steam App 346900) (Version:  - Hyper Hippo Games)
allday savings (HKLM\...\FF822B94-D02A-4A2C-BF00-D6D6A858F456) (Version: 2.0.1 - allday savings)
Apple Application Support (HKLM-x32\...\{A83279FD-CA4B-4206-9535-90974DE76654}) (Version: 2.1.5 - Apple Inc.)
aTube Catcher Version 3.8 (HKLM-x32\...\{D43B360E-722D-421B-BC77-20B9E0F8B6CD}_is1) (Version: 3.8 - DsNET Corp)
AVM FRITZ!WLAN (HKLM-x32\...\AVMWLANCLI) (Version:  - AVM Berlin)
bl (x32 Version: 1.0.0 - Your Company Name) Hidden
Blender (HKLM\...\Blender) (Version: 2.73a - Blender Foundation)
BlueStacks App Player (HKLM-x32\...\BlueStacks App Player) (Version: 0.8.12.3702 - BlueStack Systems, Inc.)
BlueStacks Notification Center (HKLM-x32\...\{D7680C52-5C13-435F-BC1B-BF8F512C71F4}) (Version: 0.8.12.3702 - BlueStack Systems, Inc.)
BufferChm (x32 Version: 130.0.331.000 - Hewlett-Packard) Hidden
C5300 (x32 Version: 130.0.365.000 - Hewlett-Packard) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 4.08 - Piriform)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.2.4291 - CDBurnerXP)
Cheat Engine 6.4 (HKLM-x32\...\Cheat Engine 6.4_is1) (Version:  - Cheat Engine)
Cinema 4D version R12 (HKLM-x32\...\{7D9D8134-9FA3-4FFF-ADA1-BF609F29997A}_is1) (Version: R12 - Salat Production) <==== ATTENTION
Cisco PEAP Module (HKLM-x32\...\{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}) (Version: 1.1.6 - Cisco Systems, Inc.)
CS16RBLv1 (HKLM-x32\...\CS16RBLv1v33) (Version: v33 - REBEL UPRISING)
CyberGhost 5 (HKLM\...\CyberGhost 5_is1) (Version:  - CyberGhost S.R.L.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Defraggler (HKLM\...\Defraggler) (Version: 2.16 - Piriform)
Destinations (x32 Version: 140.0.77.000 - Hewlett-Packard) Hidden
DeviceDiscovery (x32 Version: 130.0.465.000 - Hewlett-Packard) Hidden
Die Sims™ 3 (HKLM-x32\...\{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}) (Version: 1.42.130 - Electronic Arts)
Die Sims™ 3 Jahreszeiten (HKLM-x32\...\{3DE92282-CB49-434F-81BF-94E5B380E889}) (Version: 16.0.136 - Electronic Arts)
Dojotech Spotify Recorder (HKLM-x32\...\{461179FC-E2AC-4CC8-AA95-82D35FB3E7EA}) (Version: 3.3 - Dojotech Software)
Dxtory version 2.0.127 (HKLM-x32\...\Dxtory2.0_is1) (Version: 2.0.127 - ExKode Co. Ltd.)
FileZilla Client 3.10.3 (HKU\S-1-5-21-914325664-1482865349-517734357-1000\...\FileZilla Client) (Version: 3.10.3 - Tim Kosse)
Fotogalerie (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Fraps (remove only) (HKLM-x32\...\Fraps) (Version:  - )
Free Video to MP3 Converter version 5.0.58.415 (HKLM-x32\...\Free Video to MP3 Converter_is1) (Version: 5.0.58.415 - DVDVideoSoft Ltd.)
FreePDF (Remove only) (HKLM-x32\...\FreePDF_XP) (Version:  - )
GeForce Experience NvStream Client Components (Version: 1.6.28 - NVIDIA Corporation) Hidden
GIMP 2.8.14 (HKLM\...\GIMP-2_is1) (Version: 2.8.14 - The GIMP Team)
Git version 1.9.5-preview20150319 (HKLM-x32\...\Git_is1) (Version: 1.9.5-preview20150319 - The Git Development Community)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 43.0.2357.81 - Google Inc.)
Google Update Helper (x32 Version: 1.3.27.5 - Google Inc.) Hidden
GPBaseService2 (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
GPL Ghostscript (HKLM\...\GPL Ghostscript 9.10) (Version: 9.10 - Artifex Software Inc.)
Hama Wireless LAN Adapter (HKLM-x32\...\{9C049499-055C-4a0c-A916-1D12314F45EB}) (Version: 1.00.0159 - Hama GmbH & Co KG)
HP Customer Participation Program 13.0 (HKLM\...\HPExtendedCapabilities) (Version: 13.0 - HP)
HP Imaging Device Functions 13.0 (HKLM\...\HP Imaging Device Functions) (Version: 13.0 - HP)
HP Photosmart C5300 All-In-One Driver Software 13.0 Rel. 4 (HKLM\...\{6FA29B87-FED3-45A1-8A95-2FDEE0F6DD18}) (Version: 13.0 - HP)
HP Photosmart Essential 3.5 (HKLM\...\HP Photosmart Essential) (Version: 3.5 - HP)
HP Smart Web Printing 4.51 (HKLM\...\HP Smart Web Printing) (Version: 4.51 - HP)
HP Solution Center 13.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 13.0 - HP)
HPPhotoGadget (x32 Version: 130.0.282.000 - Hewlett-Packard) Hidden
HPPhotoSmartDiscLabel_PaperLabel (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden
HPPhotoSmartDiscLabel_PrintOnDisc (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden
HPPhotoSmartDiscLabelContent1 (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden
hpphotosmartdisclabelplugin (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden
HPPhotosmartEssential (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden
HPProductAssistant (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
HPSSupply (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
ImgBurn (HKLM-x32\...\ImgBurn) (Version: 2.5.8.0 - LIGHTNING UK!)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.0.0.1323 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.14.4170 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.6.0.1033 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 3.0.0.66956 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 2.5.0.19 - Intel Corporation)
Java 7 Update 75 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F06417075FF}) (Version: 7.0.750 - Oracle)
Java SE Development Kit 7 Update 75 (64-bit) (HKLM\...\{64A3A4F4-B792-11D6-A78A-00B0D0170750}) (Version: 1.7.0.750 - Oracle)
JDownloader 2 (HKLM\...\jdownloader2) (Version: 2.0 - AppWork GmbH)
Lagarith Lossless Codec (1.3.27) (HKLM-x32\...\{F59AC46C-10C3-4023-882C-4212A92283B3}_is1) (Version:  - )
Landwirtschafts Simulator 2011 (HKLM-x32\...\FarmingSimulator2011DE_is1) (Version: 1.0 - GIANTS Software)
League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games )
League of Legends (x32 Version: 3.0.1 - Riot Games ) Hidden
LibreOffice 4.2.0.4 (HKLM-x32\...\{E043231F-34F2-4AF5-9400-0961CC15AAAE}) (Version: 4.2.0.4 - The Document Foundation)
Logitech Gaming Software 8.55 (HKLM\...\Logitech Gaming Software) (Version: 8.55.137 - Logitech Inc.)
LogMeIn Hamachi (HKLM-x32\...\LogMeIn Hamachi) (Version: 2.2.0.193 - LogMeIn, Inc.)
LogMeIn Hamachi (x32 Version: 2.2.0.193 - LogMeIn, Inc.) Hidden
LoiLo Game Recorder (HKLM\...\{89E4163C-BD19-45A9-BCEB-980741786799}_is1) (Version: 1.1.0.1 - LoiLo inc.)
Malwarebytes Anti-Malware Version 2.1.6.1022 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)
MarketResearch (x32 Version: 130.0.374.000 - Hewlett-Packard) Hidden
Microsoft .NET Framework 4.5.2 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft ASP.NET MVC 4 Runtime (HKLM-x32\...\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 - Microsoft Corporation)
Microsoft Location Finder (HKLM-x32\...\{EC637522-73A5-4428-8B46-65A621529CC7}) (Version: 3.0 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.8.204.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft WSE 3.0 Runtime (HKLM-x32\...\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}) (Version: 3.0.5305.0 - Microsoft Corp.)
Microsoft-Maus- und Tastatur-Center (HKLM\...\Microsoft Mouse and Keyboard Center) (Version: 2.2.173.0 - Microsoft Corporation)
Minecraft (HKLM-x32\...\{1C16BCA3-EBC1-49F6-8623-8FBFB9CCC872}) (Version: 1.0.3.0 - Mojang)
Movie Maker (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Notepad++ (HKLM-x32\...\Notepad++) (Version: 5.9 - )
NVIDIA 3D Vision Controller-Treiber 347.09 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 347.09 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 347.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 347.52 - NVIDIA Corporation)
NVIDIA GeForce Experience 2.4.1.21 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.4.1.21 - NVIDIA Corporation)
NVIDIA Grafiktreiber 347.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 347.52 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.33.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.33.0 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.14.0702 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.14.0702 - NVIDIA Corporation)
ON_OFF Charge 2 B13.0506.1 (HKLM-x32\...\InstallShield_{6B4ED6F7-BB88-4945-B0C6-01410E1BAC3A}) (Version: 1.00.0000 - GIGABYTE)
ON_OFF Charge 2 B13.0506.1 (x32 Version: 1.00.0000 - GIGABYTE) Hidden
Open Broadcaster Software (HKLM-x32\...\Open Broadcaster Software) (Version:  - )
PDF-Viewer (HKLM\...\{A278382D-4F1B-4D47-9885-8523F7261E8D}_is1) (Version: 2.5.204.0 - Tracker Software Products Ltd)
ph (x32 Version: 1.0.0 - Your Company Name) Hidden
phase6_19 (HKLM-x32\...\{65D70656-D248-4C83-B594-E3029C43B37A}) (Version: 1.90.0000 - phase6)
PS_AIO_04_C5300_Software_Min (x32 Version: 130.0.365.000 - Hewlett-Packard) Hidden
PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.993 - Even Balance, Inc.)
Razer Cortex (HKLM-x32\...\Razer Cortex_is1) (Version: 5.3.25.0 - Razer Inc.)
Razer Synapse (HKLM-x32\...\{0D78BEE2-F8FF-4498-AF1A-3FF81CED8AC6}) (Version: 1.18.19.23944 - Razer Inc.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.65.1025.2012 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7404 - Realtek Semiconductor Corp.)
Recuva (HKLM\...\Recuva) (Version: 1.49 - Piriform)
RedMon - Redirection Port Monitor (HKLM\...\Redirection Port Monitor) (Version:  - )
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
ROCCAT Isku Keyboard Driver (HKLM-x32\...\{4ABAF918-A6BD-43D8-AE0B-5292034B14CB}) (Version:  - Roccat GmbH)
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.45.0 - SAMSUNG Electronics Co., Ltd.)
Scan (x32 Version: 140.0.80.000 - Hewlett-Packard) Hidden
SHIELD Streaming (Version: 4.1.1000 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 2.4.1.21 - NVIDIA Corporation) Hidden
Shop for HP Supplies (HKLM\...\Shop for HP Supplies) (Version: 13.0 - HP)
Shotcut (HKLM-x32\...\Shotcut) (Version:  - )
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.4.0.9058 - Microsoft Corporation)
Skype™ 7.4 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.4.102 - Skype Technologies S.A.)
SmartWebPrinting (x32 Version: 130.0.457.000 - Hewlett-Packard) Hidden
SolutionCenter (x32 Version: 130.0.373.000 - Hewlett-Packard) Hidden
Speccy (HKLM\...\Speccy) (Version: 1.24 - Piriform)
Spotify (HKU\S-1-5-21-914325664-1482865349-517734357-1000\...\Spotify) (Version: 1.0.5.186.ga9c24d6a - Spotify AB)
Status (x32 Version: 130.0.469.000 - Hewlett-Packard) Hidden
TAP-Windows 9.9.2 (HKLM\...\TAP-Windows) (Version: 9.9.2 - )
TeamSpeak 3 Client (HKU\S-1-5-21-914325664-1482865349-517734357-1000\...\TeamSpeak 3 Client) (Version: 3.0.16 - TeamSpeak Systems GmbH)
TeamViewer 10 (HKLM-x32\...\TeamViewer) (Version: 10.0.41459 - TeamViewer)
Toolbox (x32 Version: 130.0.648.000 - Hewlett-Packard) Hidden
TrayApp (x32 Version: 130.0.422.000 - Hewlett-Packard) Hidden
TreeSize Free V2.5 (HKLM-x32\...\TreeSize Free_is1) (Version: 2.5 - JAM Software)
TuneUp Utilities 2014 (de-DE) (x32 Version: 14.0.1000.340 - TuneUp Software) Hidden
UnloadSupport (x32 Version: 11.0.0 - Hewlett-Packard) Hidden
Unturned (HKLM-x32\...\Steam App 304930) (Version:  - Nelson Sexton)
VirtualCloneDrive (HKLM-x32\...\VirtualCloneDrive) (Version: 5.4.7.0 - Elaborate Bytes)
Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
VLC media player 2.1.3 (HKLM-x32\...\VLC media player) (Version: 2.1.3 - VideoLAN)
WebReg (x32 Version: 130.0.132.017 - Hewlett-Packard) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3508.0205 - Microsoft Corporation)
WinSCP 5.6.5 RC (HKLM-x32\...\winscp3_is1) (Version: 5.6.5 RC - Martin Prikryl)
XAMPP (HKLM-x32\...\xampp) (Version: 5.5.19-0 - Bitnami)
XMind 2013 (v3.4.0) (HKLM-x32\...\XMind_is1) (Version: 3.4.0.201311050558 - XMind Ltd.)
XSplit Broadcaster (HKLM-x32\...\{9ACDB4FF-FF71-4525-89F5-B33B6DBDA864}) (Version: 2.0.1411.2714 - SplitmediaLabs)
Zeta Producer 12 12.2.0 (nur entfernen) (HKU\S-1-5-21-914325664-1482865349-517734357-1000\...\ZetaProducer12) (Version: 12.2.0 - Zeta Software GmbH)
Zeta Producer 12.5 12.5.4 (nur entfernen) (HKU\S-1-5-21-914325664-1482865349-517734357-1000\...\ZetaProducer12.5) (Version: 12.5.4 - Zeta Software GmbH)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-914325664-1482865349-517734357-1000_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\Windows\system32\igfxEM.exe (Intel Corporation)
CustomCLSID: HKU\S-1-5-21-914325664-1482865349-517734357-1000_Classes\CLSID\{ca586c80-7c84-4b88-8537-726724df6929}\InprocServer32 -> D:\DATEN\Git\git-cheetah\git_shell_ext64.dll ()
CustomCLSID: HKU\S-1-5-21-914325664-1482865349-517734357-1000_Classes\CLSID\{D45F043D-F17F-4e8a-8435-70971D9FA46D}\InprocServer32 -> D:\Blender\BlendThumb64.dll ()

==================== Restore Points =========================

31-05-2015 14:49:12 Windows Update
01-06-2015 17:20:55 DirectX wurde installiert
03-06-2015 16:14:25 Windows Update
05-06-2015 13:28:36 Installed AVG 2015
05-06-2015 13:28:44 Installed AVG 2015
05-06-2015 13:29:05 Removed AVG 2015
07-06-2015 12:09:25 Windows Update
07-06-2015 16:39:07 Malwarebytes Anti-Rootkit Restore Point

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2015-06-07 14:42 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {091EDD22-5644-408D-A909-081047BBA431} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-05-17] (Adobe Systems Incorporated)
Task: {1657126D-4509-4F22-9533-AE6783F4F714} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2013-05-13] (Microsoft Corporation)
Task: {17AB5812-7129-41C2-8459-52B29451666A} - System32\Tasks\Defraggler Volume D Task => C:\Program Files\Defraggler\df64.exe [2013-10-14] (Piriform Ltd)
Task: {306C219D-FB01-4EC5-9381-B9A0F48546E9} - System32\Tasks\{EEA407A3-B540-4733-A3B3-15AB6C7DE8EC} => pcalua.exe -a C:\Users\David\AppData\Roaming\mystartsearch\UninstallManager.exe -c  -ptid=ima
Task: {5645A82A-BBB7-477F-A785-E91E296DC9A3} - System32\Tasks\{545DFFF2-FADA-4128-BC0A-DE15D43FAF46} => pcalua.exe -a D:\DATEN\David\Installer.exe
Task: {58E2C4AD-0EE6-460D-8E79-1F9F14436064} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-04-01] (Google Inc.)
Task: {5BF6A6BF-4321-4D50-83D0-EBEF31F35338} - System32\Tasks\{B9206D9F-BA0A-4099-A727-564461C49183} => pcalua.exe -a C:\Users\David\AppData\Roaming\sweet-page\UninstallManager.exe -c  -ptid=cor
Task: {6161246D-2802-4E4A-BFF7-322157201FFA} - System32\Tasks\{53560204-8FF3-4A71-8383-982BE86DBEFE} => pcalua.exe -a "D:\DATEN\David\Desktop\Virtual Audio Cable 4.10 (Full)\setup.exe" -d "D:\DATEN\David\Desktop\Virtual Audio Cable 4.10 (Full)"
Task: {6C363165-26FB-427B-9A5A-F6DE842C2B87} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\mousekeyboardcenter.exe [2013-05-13] (Microsoft)
Task: {6CDEE4B1-3B74-48EA-A584-28DBFF06CF5F} - System32\Tasks\{265C9DD4-FCC1-4CC6-B81F-21458569E72C} => Chrome.exe hxxp://ui.skype.com/ui/0/7.2.0.103/de/abandoninstall?page=tsProgressBar
Task: {77C4FBE2-C0C3-4246-A847-672A93C08E72} - System32\Tasks\{7788BC70-EEF0-4018-AA42-D3C89710A3CB} => pcalua.exe -a D:\DATEN\David\Desktop\Mac\Installer.exe -d D:\DATEN\David\Desktop\Mac
Task: {7AFFC2BD-05DA-439D-BD75-932839420D0F} - System32\Tasks\{25A53BC5-78FF-4725-835C-C36FC3FF6C2D} => pcalua.exe -a D:\DATEN\David\Downloads\forge-1.7.10-10.13.0.1160-installer-win.exe -d D:\DATEN\David\Downloads
Task: {7B9123DD-301B-414B-B175-448B5CC1839F} - System32\Tasks\{8E189E97-B036-417F-B1D8-737596F920CE} => Chrome.exe hxxp://ui.skype.com/ui/0/6.20.0.104/de/abandoninstall?page=tsMain
Task: {7C6C8F24-28AB-4616-91E2-8C2B79B99328} - System32\Tasks\AdobeAAMUpdater-1.0-BlackMatrix-David => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2015-03-30] (Adobe Systems Incorporated)
Task: {7CB2762C-A3DA-440E-A43E-63985CC4FAA0} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-11-22] (Piriform Ltd)
Task: {9235BF12-D18F-4137-B0A6-4CB09E6DEAEF} - System32\Tasks\Microsoft_MKC_Logon_Task_itype.exe => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2013-05-13] (Microsoft Corporation)
Task: {94ACAEC7-C589-4651-B1F6-9582D32A6FCB} - System32\Tasks\Games\UpdateCheck_S-1-5-21-914325664-1482865349-517734357-1001
Task: {959C47BD-6EF1-4652-9E99-CF73300493EE} - \OVTKNWZWQO No Task File <==== ATTENTION
Task: {9D610492-E5EA-48D0-ADA8-2323B5AC55A4} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\Logon => C:\Windows\system32\GWX\GWX.exe [2015-05-07] (Microsoft Corporation)
Task: {AA3B90B7-9B20-425D-B176-D3DB3031F799} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-05-07] (Microsoft Corporation)
Task: {ABF05F74-E9A0-445B-9E3D-FE5CF550EE22} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-04-01] (Google Inc.)
Task: {BE387634-B48B-4A1A-BB43-EDEF67D2D8C1} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\OutOfIdle => C:\Windows\system32\GWX\GWX.exe [2015-05-07] (Microsoft Corporation)
Task: {C01A093C-4001-45FA-ACAC-897CB64762CD} - System32\Tasks\Microsoft_MKC_Logon_Task_ipoint.exe => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2013-05-13] (Microsoft Corporation)
Task: {C490FFB2-F623-41B7-8497-0E3FFB986ADB} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2013-05-13] (Microsoft Corporation)
Task: {CB8D4882-A7EC-4F96-9ACD-45FB26C6F57B} - System32\Tasks\Red Giant Link => C:\Program Files (x86)\Red Giant Link\Red Giant Link.exe
Task: {DCC1A6A8-1BEE-4723-9993-B476149790C0} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-05-07] (Microsoft Corporation)
Task: {E2B89083-E8E5-4EDD-BABB-9B7B2384B332} - System32\Tasks\{77B53B3D-C4A3-45F9-9002-CA834CA36F4F} => pcalua.exe -a "D:\DATEN\Revo Uninstaller\Revouninstaller.exe" -d "D:\DATEN\Revo Uninstaller"
Task: {F08DF0A8-1851-4F7F-9959-73EC6B16C57E} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B => schtasks
Task: {F1FFA640-9B54-43A6-BA62-04592C1492A3} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {F25A320C-4DA1-4D5A-9481-C10AC7E300B0} - System32\Tasks\{561A89FD-6EE0-421D-BAD9-5CE676C5FACF} => pcalua.exe -a "D:\DATEN\David\Desktop\forge-1.7.2-10.12.1.1112-installer-win (1).exe" -d D:\DATEN\David\Desktop
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\Defraggler Volume D Task.job => C:\Program Files\Defraggler\df64.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (Whitelisted) ==============

2015-04-16 17:42 - 2015-04-16 17:42 - 00997536 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll
2011-02-09 02:56 - 2011-02-09 02:56 - 00301568 _____ () C:\Program Files (x86)\Notepad++\NppShell_04.dll
2015-04-05 12:28 - 2015-03-19 23:33 - 00736962 _____ () D:\DATEN\Git\git-cheetah\git_shell_ext64.dll
2014-02-08 22:25 - 2010-06-17 21:56 - 00087040 _____ () C:\Windows\System32\redmonnt.dll
2015-05-26 16:35 - 2015-05-22 22:22 - 01281864 _____ () C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.81\libglesv2.dll
2015-05-26 16:35 - 2015-05-22 22:22 - 00080712 _____ () C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.81\libegl.dll
2015-05-26 16:35 - 2015-05-22 22:22 - 14982472 _____ () C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.81\PepperFlash\pepflashplayer.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Hamachi2Svc => ""="Service"

==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE trusted site: HKU\.DEFAULT\...\clonewarsadventures.com -> clonewarsadventures.com
IE trusted site: HKU\.DEFAULT\...\freerealms.com -> freerealms.com
IE trusted site: HKU\.DEFAULT\...\soe.com -> soe.com
IE trusted site: HKU\.DEFAULT\...\sony.com -> sony.com


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-914325664-1482865349-517734357-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\David\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.178.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [{8EC0FAC8-4464-45F2-8E38-6987307E6B2A}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{9D2132DA-7F27-4715-9B45-3BE8877104F2}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{A4888B13-39F2-426D-9A97-298F5840B033}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
FirewallRules: [{A4636FA1-9AA2-41EC-8852-84E3631CC016}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
FirewallRules: [{571C606A-CE69-4BAA-94F5-E947E1CF0668}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{8215F901-2384-4B17-BFA5-3F4EBDBFD9C7}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{F38BCE00-0423-451C-A998-503DD23165CA}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqste08.exe
FirewallRules: [{455941B9-57CD-441E-B8B2-510DB034F855}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hposid01.exe
FirewallRules: [{B57280A0-DE11-4581-A415-F11364DAB18D}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqkygrp.exe
FirewallRules: [{0624C12C-6106-496E-9EFF-D3C784D57717}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpfccopy.exe
FirewallRules: [{7AE04244-8039-4173-ADE5-1B9AB08CE8B4}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpoews01.exe
FirewallRules: [{4C67392A-ECC3-4417-9AF7-612A7DE542B3}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpiscnapp.exe
FirewallRules: [{E468DA28-6695-4F53-BF51-1682772EA455}] => (Allow) C:\Program Files (x86)\common files\hp\digital imaging\bin\hpqphotocrm.exe
FirewallRules: [{D9B06325-CBE6-4B67-9DC7-A2ADD83DD9A7}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqsudi.exe
FirewallRules: [{6ADCA352-F609-4375-AC1F-C2D67A8580BA}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqpsapp.exe
FirewallRules: [{7F3E3EC3-C459-451E-AA80-9113DB2F32C8}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqpse.exe
FirewallRules: [{82AD007C-23FE-4854-A5A7-7F03DA9B76D7}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgplgtupl.exe
FirewallRules: [{4969E6D3-B511-459F-99AC-3C6B272927EA}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
FirewallRules: [{AC95B937-3573-4BA5-B5C0-7B0832B4CD85}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqusgm.exe
FirewallRules: [{E4A46C63-DE67-47F1-9D0F-06452B35E567}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqusgh.exe
FirewallRules: [{A604E5BF-F4F1-4F25-8C79-2CF0680F9098}] => (Allow) C:\Program Files (x86)\HP\digital imaging\smart web printing\smartwebprintexe.exe
FirewallRules: [{7403EFAD-F8B5-424E-BF08-560BF11A908C}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{1E26802E-E2DE-4DE3-96CD-9B4BCFE3F1D6}] => (Allow) LPort=2869
FirewallRules: [{CC697664-E63E-4087-84AC-1635AD44802A}] => (Allow) LPort=1900
FirewallRules: [{6FDFAC88-2360-48CE-AB72-08D82350D464}] => (Allow) C:\Program Files (x86)\Hama\Wireless LAN RTL8188CU\RtWLan.exe
FirewallRules: [{B6DCE097-7F29-4BDB-B076-B2305DC572EC}] => (Allow) C:\Program Files (x86)\Hama\Wireless LAN RTL8188CU\RtWLan.exe
FirewallRules: [{24A0BE35-FC58-4669-AA49-477777A1706F}] => (Allow) LPort=1542
FirewallRules: [{2BA0FEEC-8B22-46D6-A6B5-3AD00ACFBBCF}] => (Allow) LPort=1542
FirewallRules: [{F75056FE-C078-4DE5-80F9-EC23C773D556}] => (Allow) LPort=53
FirewallRules: [{2154A4A3-0D12-42B9-A02B-26D51CEF7B28}] => (Allow) D:\DATEN\Steam\Steam.exe
FirewallRules: [{DB65D7CF-065B-4360-BA25-59EAA3D428A6}] => (Allow) D:\DATEN\Steam\Steam.exe
FirewallRules: [TCP Query User{AA56E669-7814-4C0D-94BA-AC013A307F70}C:\program files\adobe\adobe after effects cc 2014\support files\afterfx.exe] => (Allow) C:\program files\adobe\adobe after effects cc 2014\support files\afterfx.exe
FirewallRules: [UDP Query User{A8846713-7C43-4313-AB95-8C573E42789E}C:\program files\adobe\adobe after effects cc 2014\support files\afterfx.exe] => (Allow) C:\program files\adobe\adobe after effects cc 2014\support files\afterfx.exe
FirewallRules: [TCP Query User{1C317F3D-CC90-4F04-A510-18CE01DCB85C}C:\program files\java\jre7\bin\javaw.exe] => (Allow) C:\program files\java\jre7\bin\javaw.exe
FirewallRules: [UDP Query User{EA75D276-1F6A-4602-96EE-573B2BA09819}C:\program files\java\jre7\bin\javaw.exe] => (Allow) C:\program files\java\jre7\bin\javaw.exe
FirewallRules: [TCP Query User{6431BCF8-046F-488A-8117-7BECE16C06BC}C:\windows\system32\java.exe] => (Allow) C:\windows\system32\java.exe
FirewallRules: [UDP Query User{3A55A963-37D1-4D08-BF40-C3302BEDDB6A}C:\windows\system32\java.exe] => (Allow) C:\windows\system32\java.exe
FirewallRules: [TCP Query User{4C8E7A79-F900-496B-985A-41891082AE71}C:\program files\java\jre7\bin\javaw.exe] => (Allow) C:\program files\java\jre7\bin\javaw.exe
FirewallRules: [UDP Query User{472B6E80-E584-4E63-9216-4F802E5BD643}C:\program files\java\jre7\bin\javaw.exe] => (Allow) C:\program files\java\jre7\bin\javaw.exe
FirewallRules: [{E4CD8F67-9180-40D5-B12A-1B2599304EBA}] => (Allow) D:\DATEN\Steam\bin\steamwebhelper.exe
FirewallRules: [{5042F4DC-5B69-4ECF-9C4D-A8622C03F368}] => (Allow) D:\DATEN\Steam\bin\steamwebhelper.exe
FirewallRules: [{91C1B945-7968-4C8D-929A-EDF4049907FD}] => (Allow) D:\DATEN\Steam\SteamApps\common\GarrysMod\hl2.exe
FirewallRules: [{C280DC8B-D59A-4366-8AA0-19EB13A6415E}] => (Allow) D:\DATEN\Steam\SteamApps\common\GarrysMod\hl2.exe
FirewallRules: [TCP Query User{4D779CDE-8212-4ED1-A734-1321F76F53B9}C:\program files (x86)\libreoffice 4\program\soffice.bin] => (Allow) C:\program files (x86)\libreoffice 4\program\soffice.bin
FirewallRules: [UDP Query User{8C333861-2864-4813-A006-836623623362}C:\program files (x86)\libreoffice 4\program\soffice.bin] => (Allow) C:\program files (x86)\libreoffice 4\program\soffice.bin
FirewallRules: [{4503FF80-3370-41D8-A6B4-6FC3F23B0DC4}] => (Allow) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe
FirewallRules: [{E7572CE2-5F1A-4675-953F-30E534D86422}] => (Allow) C:\Users\David\AppData\Roaming\Spotify\spotify.exe
FirewallRules: [{8BA51049-99AD-4D2E-951D-20BC2170D3F5}] => (Allow) C:\Users\David\AppData\Roaming\Spotify\spotify.exe
FirewallRules: [{05DB57BD-C430-41E6-B06D-0B575888B052}] => (Allow) C:\Users\David\AppData\Roaming\Spotify\spotify.exe
FirewallRules: [{DE6B1D28-82E2-403F-A128-AB4739F1B23C}] => (Allow) C:\Users\David\AppData\Roaming\Spotify\spotify.exe
FirewallRules: [{FCDFFB7C-97CC-4A2A-A8DC-8546CF4DCCCF}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{EF18AEE7-959E-4E93-85DF-1B22F7138137}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{7E60DF83-FB85-4465-A65F-A3683896680A}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [{A91ADFAB-9B11-461D-85D0-718D5A9F32BF}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [TCP Query User{4F4C201C-ADC7-4A9D-92EC-A4467132D627}C:\program files\java\jre7\bin\java.exe] => (Allow) C:\program files\java\jre7\bin\java.exe
FirewallRules: [UDP Query User{524B3147-8614-4FDE-A00F-608BC0514AB9}C:\program files\java\jre7\bin\java.exe] => (Allow) C:\program files\java\jre7\bin\java.exe
FirewallRules: [TCP Query User{C84F70AD-007C-4EF1-985E-02E864972309}C:\program files\java\jre7\bin\java.exe] => (Allow) C:\program files\java\jre7\bin\java.exe
FirewallRules: [UDP Query User{A995A5FE-D64E-4CD5-BB50-FDEA5436E455}C:\program files\java\jre7\bin\java.exe] => (Allow) C:\program files\java\jre7\bin\java.exe
FirewallRules: [{179C837B-D99C-48C1-A2C1-36633BD9D2A2}] => (Allow) D:\DATEN\Steam\SteamApps\common\Unturned\Unturned.exe
FirewallRules: [{8F7F9166-2307-4C72-BD0E-E56B6ADE13D9}] => (Allow) D:\DATEN\Steam\SteamApps\common\Unturned\Unturned.exe
FirewallRules: [TCP Query User{5C790938-8C95-41CD-A97C-2F5B30E615CF}C:\windows\system32\java.exe] => (Allow) C:\windows\system32\java.exe
FirewallRules: [UDP Query User{FD8081DE-A087-4346-9C85-E2C295FC1DA7}C:\windows\system32\java.exe] => (Allow) C:\windows\system32\java.exe
FirewallRules: [TCP Query User{0CC622D6-821D-4F71-9586-9089DA722C0B}D:\games\cs\hl.exe] => (Allow) D:\games\cs\hl.exe
FirewallRules: [UDP Query User{F15B135D-EC03-4CD3-B5A2-CB0D77932881}D:\games\cs\hl.exe] => (Allow) D:\games\cs\hl.exe
FirewallRules: [TCP Query User{FC47855F-47C2-4547-8B27-EF3B146EBCA4}C:\windows\system32\javaw.exe] => (Allow) C:\windows\system32\javaw.exe
FirewallRules: [UDP Query User{1418532D-03C8-4B0C-9B49-928B8E1F6B4A}C:\windows\system32\javaw.exe] => (Allow) C:\windows\system32\javaw.exe
FirewallRules: [{6E002B17-3165-4BFF-ADBA-A037653C4176}] => (Allow) D:\DATEN\Steam\SteamApps\common\Brick-Force ROW\InfernumLogin.exe
FirewallRules: [{2AEC7734-4689-40EB-ACF4-4539F5E3C8B6}] => (Allow) D:\DATEN\Steam\SteamApps\common\Brick-Force ROW\InfernumLogin.exe
FirewallRules: [TCP Query User{EDAC0C69-C5DF-45F9-B2A2-A44713BA527B}D:\daten\steam\steamapps\common\brick-force row\brickforce.exe] => (Allow) D:\daten\steam\steamapps\common\brick-force row\brickforce.exe
FirewallRules: [UDP Query User{608F7E38-CA94-4CEC-8131-04C496700818}D:\daten\steam\steamapps\common\brick-force row\brickforce.exe] => (Allow) D:\daten\steam\steamapps\common\brick-force row\brickforce.exe
FirewallRules: [TCP Query User{C39072A7-DBE6-41F4-9BCB-0EABEA89939D}C:\windows\system32\javaw.exe] => (Allow) C:\windows\system32\javaw.exe
FirewallRules: [UDP Query User{4F800811-E61C-47AB-85B2-7CEFFC9B3EEE}C:\windows\system32\javaw.exe] => (Allow) C:\windows\system32\javaw.exe
FirewallRules: [TCP Query User{B330513C-7AEF-4C2E-8817-5AD89632682E}D:\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) D:\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [UDP Query User{459077B9-3DFA-452C-8553-63B27CBDEFF8}D:\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) D:\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [TCP Query User{65BA1488-BC8B-4A99-8BFC-F35F34ACD0F8}D:\daten\david\desktop\programmieren\new minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) D:\daten\david\desktop\programmieren\new minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [UDP Query User{D9B99DB4-89B3-4543-8B61-5B8B1210240B}D:\daten\david\desktop\programmieren\new minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) D:\daten\david\desktop\programmieren\new minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [{1D869324-2690-4B0E-B46D-C8353AF2FED9}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [TCP Query User{62F82345-F342-4B99-A8D3-F3B88A7840BF}D:\daten\david\desktop\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) D:\daten\david\desktop\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [UDP Query User{25C60441-E06F-404D-81DF-18CFE1E0CE56}D:\daten\david\desktop\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) D:\daten\david\desktop\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [TCP Query User{01B0A0D4-9E2C-4A99-9A54-E228615BC628}D:\daten\david\desktop\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) D:\daten\david\desktop\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [UDP Query User{13D95A60-852F-4DAD-976E-7ADB8F5D5251}D:\daten\david\desktop\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) D:\daten\david\desktop\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [TCP Query User{D40DE300-F144-46EA-905F-2E0330A8B498}D:\xampp\apache\bin\httpd.exe] => (Allow) D:\xampp\apache\bin\httpd.exe
FirewallRules: [UDP Query User{95D309B1-0330-4655-9464-0E14FBF752D8}D:\xampp\apache\bin\httpd.exe] => (Allow) D:\xampp\apache\bin\httpd.exe
FirewallRules: [{B9BCD593-EFEB-4125-8C60-406007DCCF6D}] => (Block) D:\xampp\apache\bin\httpd.exe
FirewallRules: [{E627F060-B00F-415B-9E90-456904B456B1}] => (Block) D:\xampp\apache\bin\httpd.exe
FirewallRules: [TCP Query User{5731B421-9EAF-4C47-A583-95817026B584}D:\xampp\filezillaftp\filezillaserver.exe] => (Allow) D:\xampp\filezillaftp\filezillaserver.exe
FirewallRules: [UDP Query User{66FE70FA-9EF7-4A1E-AC1F-62238112B788}D:\xampp\filezillaftp\filezillaserver.exe] => (Allow) D:\xampp\filezillaftp\filezillaserver.exe
FirewallRules: [{B49A1AC9-DECE-4CBE-9436-49CF8D4A9A45}] => (Block) D:\xampp\filezillaftp\filezillaserver.exe
FirewallRules: [{BFFE6C0C-B3BD-4C5A-8205-98A48E37D9AE}] => (Block) D:\xampp\filezillaftp\filezillaserver.exe
FirewallRules: [TCP Query User{DF75E35C-9C24-42BC-8737-967E61B02E6A}D:\xampp\mysql\bin\mysqld.exe] => (Allow) D:\xampp\mysql\bin\mysqld.exe
FirewallRules: [UDP Query User{12072A01-B0EC-4394-A6EC-94F14CEB0209}D:\xampp\mysql\bin\mysqld.exe] => (Allow) D:\xampp\mysql\bin\mysqld.exe
FirewallRules: [{8CA80871-D701-453C-B07E-12C5140CF7BD}] => (Block) D:\xampp\mysql\bin\mysqld.exe
FirewallRules: [{01856593-0F0F-4559-BD35-A9977956CDD5}] => (Block) D:\xampp\mysql\bin\mysqld.exe
FirewallRules: [TCP Query User{47585B0C-72C3-4EBF-B097-43CE0770A18F}D:\xampp\mercurymail\mercury.exe] => (Allow) D:\xampp\mercurymail\mercury.exe
FirewallRules: [UDP Query User{F2D7BE76-CFCD-47FB-A511-6637A8B062BF}D:\xampp\mercurymail\mercury.exe] => (Allow) D:\xampp\mercurymail\mercury.exe
FirewallRules: [{04FE52D2-A2D3-4E7F-B752-A6294756B317}] => (Block) D:\xampp\mercurymail\mercury.exe
FirewallRules: [{DF4D1FBE-E699-4612-B751-A32A64187EBE}] => (Block) D:\xampp\mercurymail\mercury.exe
FirewallRules: [{10070794-2AA9-4E57-87E4-C148B8757EE0}] => (Allow) D:\DATEN\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo.exe
FirewallRules: [{EA7A74B6-1082-4C98-B56A-C7E52326433F}] => (Allow) D:\DATEN\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo.exe
FirewallRules: [TCP Query User{0907764F-319B-4A69-8E5F-17D66AAC659D}D:\daten\java\bin\jmc.exe] => (Block) D:\daten\java\bin\jmc.exe
FirewallRules: [UDP Query User{69677A45-7490-43CE-B690-E6002A977C8F}D:\daten\java\bin\jmc.exe] => (Block) D:\daten\java\bin\jmc.exe
FirewallRules: [{E4EA7DF7-885E-4CEE-803F-1E5488DED0BE}] => (Allow) D:\DATEN\Steam\SteamApps\common\AdVenture Capitalist\adventure-capitalist.exe
FirewallRules: [{2CF755F6-5831-4D70-8568-D1D7F782B957}] => (Allow) D:\DATEN\Steam\SteamApps\common\AdVenture Capitalist\adventure-capitalist.exe
FirewallRules: [{99C339EC-F403-488F-82EF-EB1E80DEFA8B}] => (Allow) D:\DATEN\Steam\SteamApps\common\Call of Duty Black Ops II\t6mp.exe
FirewallRules: [{4A579AD9-DDA9-4AA4-8A9F-1C97A63D2514}] => (Allow) D:\DATEN\Steam\SteamApps\common\Call of Duty Black Ops II\t6mp.exe
FirewallRules: [{FC098E22-E20B-4145-93F8-748C89AEA0C0}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{D58D173C-92B4-406E-95FB-BC27A2F57679}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{AA2AC5CA-079E-4FF8-9C24-746A1682B76A}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{37ABEFA9-E01D-4229-9DBF-E5FAA2939B92}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{A3D4F672-EE5F-448C-BD81-2EA8C8D9376F}] => (Allow) D:\DATEN\Steam\SteamApps\common\Call of Duty Modern Warfare 3\iw5mp.exe
FirewallRules: [{30F1B9F8-6A94-465D-9D4D-82ABA3A4B248}] => (Allow) D:\DATEN\Steam\SteamApps\common\Call of Duty Modern Warfare 3\iw5mp.exe
FirewallRules: [{047976DB-3459-4473-B4D4-87209FD47071}] => (Allow) D:\DATEN\Landwirtschafts Simulator 2011\FarmingSimulator2011.exe
FirewallRules: [{967D6039-5092-410D-BD60-D4C84FA01D3B}] => (Allow) D:\DATEN\Landwirtschafts Simulator 2011\FarmingSimulator2011.exe
FirewallRules: [{358BA3D5-B46F-4C4C-A6BA-255DB33DEB32}] => (Allow) D:\DATEN\Landwirtschafts Simulator 2011\game.exe
FirewallRules: [{8C54A0EC-E854-4089-8FB2-3089F879C45D}] => (Allow) D:\DATEN\Landwirtschafts Simulator 2011\game.exe
FirewallRules: [{8323E2A3-3D23-4EBF-84B5-9F4DDD1F17A1}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [TCP Query User{DAB43F43-29DA-45B5-AD39-9D3F898A61AC}D:\cs\hl.exe] => (Allow) D:\cs\hl.exe
FirewallRules: [UDP Query User{3EBCA4FF-1A56-403F-B3D6-0AAC31D22BDF}D:\cs\hl.exe] => (Allow) D:\cs\hl.exe
FirewallRules: [{BCCDB1EE-1A87-437B-83D9-DE7B07387A19}] => (Block) D:\cs\hl.exe
FirewallRules: [{AC7AE9A0-96C8-47F9-B3DD-9CA124A0C58D}] => (Block) D:\cs\hl.exe

==================== Faulty Device Manager Devices =============

Name: Hamachi Network Interface
Description: Hamachi Network Interface
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: LogMeIn, Inc.
Service: hamachi
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (06/08/2015 07:07:23 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.

Error: (06/08/2015 07:07:23 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (06/08/2015 07:07:23 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (06/08/2015 07:01:52 PM) (Source: Microsoft-Windows-WMI) (EventID: 10) (User: NT-AUTORITÄT)
Description: Der Ereignisfilter mit der Abfrage "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" konnte im Namespace "//./root/CIMV2" aufgrund des Fehlers "0x80041003" nicht reaktiviert werden. Solange dieses Problem besteht, können mit diesem Filter keine Ereignisse übermittelt werden.

Error: (06/08/2015 07:01:32 PM) (Source: BstHdAndroidSvc) (EventID: 0) (User: )
Description: Der Dienst kann nicht gestartet werden. System.ApplicationException: Cannot start service.  Service did not stop gracefully the last time it was run.
   bei BlueStacks.hyperDroid.Service.Service.OnStart(String[] args)
   bei System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)

Error: (06/08/2015 06:14:49 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.

Error: (06/08/2015 06:14:49 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (06/08/2015 06:14:49 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (06/08/2015 06:11:11 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: mbam.exe, Version: 1.0.2.929, Zeitstempel: 0x552d3ec4
Name des fehlerhaften Moduls: MSVCR100.dll, Version: 10.0.40219.325, Zeitstempel: 0x4df2be1e
Ausnahmecode: 0x40000015
Fehleroffset: 0x0008d6fd
ID des fehlerhaften Prozesses: 0x1b54
Startzeit der fehlerhaften Anwendung: 0xmbam.exe0
Pfad der fehlerhaften Anwendung: mbam.exe1
Pfad des fehlerhaften Moduls: mbam.exe2
Berichtskennung: mbam.exe3

Error: (06/08/2015 06:10:58 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: mbam.exe, Version: 1.0.2.929, Zeitstempel: 0x552d3ec4
Name des fehlerhaften Moduls: MSVCR100.dll, Version: 10.0.40219.325, Zeitstempel: 0x4df2be1e
Ausnahmecode: 0x40000015
Fehleroffset: 0x0008d6fd
ID des fehlerhaften Prozesses: 0x190c
Startzeit der fehlerhaften Anwendung: 0xmbam.exe0
Pfad der fehlerhaften Anwendung: mbam.exe1
Pfad des fehlerhaften Moduls: mbam.exe2
Berichtskennung: mbam.exe3


System errors:
=============
Error: (06/08/2015 07:05:15 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Modules Installer" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (06/08/2015 07:05:15 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Intel(R) Dynamic Application Loader Host Interface Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (06/08/2015 07:05:15 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Intel(R) Rapid Storage Technology" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (06/08/2015 07:05:14 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Software Protection" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (06/08/2015 07:05:14 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Media Player-Netzwerkfreigabedienst" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (06/08/2015 07:05:13 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Presentation Foundation-Schriftartcache 3.0.0.0" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 0 Millisekunden durchgeführt: Neustart des Diensts.

Error: (06/08/2015 07:05:13 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "CyberGhost 5 Client Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (06/08/2015 07:05:13 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "SAMSUNG Mobile Connectivity Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (06/08/2015 07:05:13 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "mysql" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (06/08/2015 07:05:13 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "RzKLService" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.


Microsoft Office:
=========================
Error: (06/08/2015 07:07:23 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000

Error: (06/08/2015 07:07:23 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (06/08/2015 07:07:23 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (06/08/2015 07:01:52 PM) (Source: Microsoft-Windows-WMI) (EventID: 10) (User: NT-AUTORITÄT)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/08/2015 07:01:32 PM) (Source: BstHdAndroidSvc) (EventID: 0) (User: )
Description: Der Dienst kann nicht gestartet werden. System.ApplicationException: Cannot start service.  Service did not stop gracefully the last time it was run.
   bei BlueStacks.hyperDroid.Service.Service.OnStart(String[] args)
   bei System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)

Error: (06/08/2015 06:14:49 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000

Error: (06/08/2015 06:14:49 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (06/08/2015 06:14:49 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (06/08/2015 06:11:11 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: mbam.exe1.0.2.929552d3ec4MSVCR100.dll10.0.40219.3254df2be1e400000150008d6fd1b5401d0a205bc631e68D:\DATEN\ Malwarebytes Anti-Malware \mbam.exeD:\DATEN\ Malwarebytes Anti-Malware \MSVCR100.dllfa1bedf3-0df8-11e5-850f-94de80d93d79

Error: (06/08/2015 06:10:58 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: mbam.exe1.0.2.929552d3ec4MSVCR100.dll10.0.40219.3254df2be1e400000150008d6fd190c01d0a205b356e321D:\DATEN\ Malwarebytes Anti-Malware \mbam.exeD:\DATEN\ Malwarebytes Anti-Malware \MSVCR100.dllf2401d1b-0df8-11e5-850f-94de80d93d79


CodeIntegrity Errors:
===================================
  Date: 2015-06-07 14:29:59.863
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-06-07 14:29:59.847
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-06-07 13:48:20.031
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\SynexTV\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-06-07 13:48:20.008
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\SynexTV\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-04-01 13:58:50.052
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files (x86)\Web Protect\pcwtc64f.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-04-01 13:58:50.011
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files (x86)\Web Protect\pcwtc64f.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-04-01 13:58:49.968
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files (x86)\Web Protect\pcwtc64f.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-04-01 11:59:26.837
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files (x86)\Web Protect\pcwtc64f.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-04-01 11:59:26.782
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files (x86)\Web Protect\pcwtc64f.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-04-01 11:59:26.740
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files (x86)\Web Protect\pcwtc64f.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i5-4570 CPU @ 3.20GHz
Percentage of memory in use: 26%
Total physical RAM: 8079.25 MB
Available physical RAM: 5900.72 MB
Total Pagefile: 16269.45 MB
Available Pagefile: 14059.57 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: (SSD-Second) (Fixed) (Total:107.32 GB) (Free:4.04 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (HDD-First) (Fixed) (Total:931.51 GB) (Free:137.24 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 111.8 GB) (Disk ID: 75B73B21)
Partition 1: (Active) - (Size=107.3 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 2819512B)
Partition 1: (Not Active) - (Size=931.5 GB) - (Type=07 NTFS)

==================== End of log ============================

--- --- ---

SynexTV · 08.06.2015, 18:21

Ich hatte die FRST.txt vergessen also hier ist sie:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:06-06-2015
Ran by David (administrator) on BLACKMATRIX on 08-06-2015 19:10:00
Running from D:\DATEN\David\Desktop
Loaded Profiles: David (Available Profiles: David & Papa)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13776088 2014-12-11] (Realtek Semiconductor)
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [286704 2013-04-30] (Intel Corporation)
HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1337000 2015-04-30] (Microsoft Corporation)
HKLM\...\Run: [IgfxTray] => C:\Windows\system32\igfxtray.exe [393480 2015-03-19] ()
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [500936 2015-03-30] (Adobe Systems Incorporated)
HKLM\...\Run: [Launch LCore] => C:\Program Files\Logitech Gaming Software\LCore.exe [10801944 2014-07-28] (Logitech Inc.)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2673296 2015-03-28] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
Winlogon\Notify\igfxcui: igfxdev.dll [X]
HKU\S-1-5-21-914325664-1482865349-517734357-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\Mystify.scr [242688 2010-11-21] (Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\p6_19_erinnerung.lnk [2014-06-20]
ShortcutTarget: p6_19_erinnerung.lnk -> C:\Program Files (x86)\phase6\phase6_19\WinStart\p6erinnerung.exe (phase6)
ShellIconOverlayIdentifiers: [ AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2015-04-16] ()
ShellIconOverlayIdentifiers: [ AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2015-04-16] ()
ShellIconOverlayIdentifiers: [ AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2015-04-16] ()
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
CHR HKU\S-1-5-21-914325664-1482865349-517734357-1000\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-914325664-1482865349-517734357-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-914325664-1482865349-517734357-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll [2015-04-05] (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-05-01] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll [2015-04-05] (Oracle Corporation)
BHO-x32: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll [2009-09-20] (Hewlett-Packard Co.)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-05-01] (Microsoft Corporation)
BHO-x32: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll [2009-09-20] (Hewlett-Packard Co.)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-05-01] (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-05-01] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{45604D2E-909F-44D3-9DE8-DFA256A48B5F}: [NameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_188.dll [2015-05-17] ()
FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll [2012-07-17] (Tracker Software Products (Canada) Ltd.)
FF Plugin: @java.com/DTPlugin,version=10.75.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll [2015-04-05] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.75.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll [2015-04-05] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll [2015-04-20] (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_188.dll [2015-05-17] ()
FF Plugin-x32: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll [2012-07-17] (Tracker Software Products (Canada) Ltd.)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=3.0.72 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-04-11] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-04-11] (Intel Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2013-02-05] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2013-02-05] (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2015-02-05] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2015-02-05] (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-16] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-16] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-02-05] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-02-05] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-05-01] (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll [2015-04-20] (Adobe Systems)
FF Plugin HKU\S-1-5-21-914325664-1482865349-517734357-1000: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll [2012-07-17] (Tracker Software Products (Canada) Ltd.)
FF Plugin HKU\S-1-5-21-914325664-1482865349-517734357-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\David\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll No File
FF Extension: SQLite Manager - C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\Extensions\SQLiteManager@mrinalkant.blogspot.com.xpi [2015-02-02]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-07-14]
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2014-02-23]
FF HKU\S-1-5-21-914325664-1482865349-517734357-1000\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: No Name - C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\3e36n754.default\extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com [not found]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [not found]
StartMenuInternet: FIREFOX.EXE - firefox.exe

Chrome: 
=======
CHR Profile: C:\Users\David\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-06-07]
CHR Extension: (Google Docs) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-04-01]
CHR Extension: (Google Drive) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-04-01]
CHR Extension: (YouTube) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-04-01]
CHR Extension: (Google Search) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-04-01]
CHR Extension: (Google Sheets) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-06-07]
CHR Extension: (Bookmark Manager) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik [2015-04-22]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-04-01]
CHR Extension: (Google Wallet) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-04-01]
CHR Extension: (Gmail) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-04-01]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2015-05-01]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S2 Apache2.4; D:\xampp\apache\bin\httpd.exe [22016 2014-07-17] (Apache Software Foundation) [File not signed]
S3 AppleChargerSrv; C:\Windows\System32\AppleChargerSrv.exe [31272 2010-04-06] ()
S2 AVM WLAN Connection Service; C:\Program Files (x86)\avmwlanstick\WlanNetService.exe [376832 2010-10-22] (AVM Berlin) [File not signed]
S2 BstHdAndroidSvc; C:\Program Files (x86)\BlueStacks\HD-Service.exe [405208 2014-07-15] (BlueStack Systems, Inc.)
S2 BstHdLogRotatorSvc; C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe [384728 2014-07-15] (BlueStack Systems, Inc.)
S2 BstHdUpdaterSvc; C:\Program Files (x86)\BlueStacks\HD-UpdaterService.exe [773848 2014-07-15] (BlueStack Systems, Inc.)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1394816 2015-05-01] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1772672 2015-05-01] (Microsoft Corporation)
S2 CGVPNCliService; C:\Program Files\CyberGhost 5\Service.exe [64616 2014-11-03] (CyberGhost S.R.L)
S2 FileZilla Server; D:\xampp\filezillaftp\filezillaserver.exe [632320 2012-02-26] (FileZilla Project) [File not signed]
S2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1152144 2015-03-28] (NVIDIA Corporation)
R3 hpqcxs08; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll [249344 2009-09-20] (Hewlett-Packard Co.) [File not signed]
R2 hpqddsvc; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqddsvc.dll [133120 2009-09-20] (Hewlett-Packard Co.) [File not signed]
S2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15344 2013-04-30] (Intel Corporation)
S2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [345864 2015-03-19] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [731648 2013-02-13] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [820184 2013-02-13] (Intel(R) Corporation)
S2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-04-11] (Intel Corporation)
S2 MBAMService; D:\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23816 2015-04-30] (Microsoft Corporation)
S2 mysql; D:\xampp\mysql\bin\mysqld.exe [11021824 2014-09-11] () [File not signed]
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2008-12-03] (Hewlett-Packard) [File not signed]
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [366544 2015-04-30] (Microsoft Corporation)
S2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1878672 2015-03-28] (NVIDIA Corporation)
S2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [22995600 2015-03-28] (NVIDIA Corporation)
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2008-12-03] (Hewlett-Packard) [File not signed]
S2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2014-09-20] ()
S2 Razer Game Scanner Service; C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe [0 2015-05-27] () <==== ATTENTION (zero byte File/Folder)
S2 Realtek11nCU; C:\Program Files (x86)\Hama\Wireless LAN RTL8188CU\RtlService.exe [36864 2010-04-16] (Realtek) [File not signed]
S2 RzKLService; D:\DATEN\Razer Cortex\RzKLService.exe [129168 2015-01-26] (Razer Inc.)
S2 ss_conn_service; C:\Users\David\usbdriver\25_escape\conn\ss_conn_service.exe [741640 2014-06-16] (DEVGURU Co., LTD.)
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5448976 2015-04-17] (TeamViewer GmbH)
R2 Themes; C:\Windows\system32\themeservice.dll [44544 2014-07-19] (Microsoft Corporation) [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2014-02-08] (Microsoft Corporation)
S2 Hamachi2Svc; D:\DATEN\David\Desktop\hamachi-2.exe -s [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R1 AppleCharger; C:\Windows\System32\DRIVERS\AppleCharger.sys [21584 2013-02-19] ()
S3 avmeject; C:\Windows\System32\drivers\avmeject.sys [14120 2010-10-22] (AVM Berlin)
R2 BstHdDrv; C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys [122072 2014-07-15] (BlueStack Systems)
R1 epp64; C:\Windows\System32\DRIVERS\epp64.sys [135800 2015-04-01] (Emsisoft GmbH)
S3 FWLANUSB; C:\Windows\System32\DRIVERS\fwlanusb.sys [460800 2010-10-22] (AVM GmbH)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28656 2013-04-30] (Intel Corporation)
S3 KovaPlusFltr; C:\Windows\System32\drivers\KovaPlusFltr.sys [15104 2010-01-25] (ROCCAT Development, Inc.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-04-14] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [280376 2015-03-04] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [124568 2015-03-04] (Microsoft Corporation)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19600 2015-03-28] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38032 2014-11-22] (NVIDIA Corporation)
R0 PxHlpa64; C:\Windows\System32\Drivers\PxHlpa64.sys [56336 2012-06-22] (Corel Corporation)
R3 RTL8192cu; C:\Windows\System32\DRIVERS\RTL8192cu.sys [748648 2010-08-12] (Realtek Semiconductor Corporation                           )
R3 rzendpt; C:\Windows\System32\DRIVERS\rzendpt.sys [39592 2014-12-30] (Razer Inc)
R2 rzpmgrk; C:\Windows\system32\drivers\rzpmgrk.sys [37184 2015-01-31] (Razer, Inc.)
R2 rzpnk; C:\Windows\system32\drivers\rzpnk.sys [129600 2014-12-10] (Razer, Inc.)
S3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [42184 2014-05-17] (Anchorfree Inc.)
S1 UsbCharger; C:\Windows\System32\DRIVERS\UsbCharger.sys [21584 2013-05-06] ()
S3 usbrndis6; C:\Windows\System32\DRIVERS\usb80236.sys [19968 2014-02-08] (Microsoft Corporation)
R3 XSplit_Dummy; C:\Windows\System32\drivers\xspltspk.sys [26200 2014-07-02] (SplitmediaLabs Limited)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
S3 gdrv; \??\C:\Windows\gdrv.sys [X]
S3 TuneUpUtilitiesDrv; \??\C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesDriver64.sys [X]
S3 X6va022; \??\C:\Windows\SysWOW64\Drivers\X6va022 [X]
S3 X6va029; \??\C:\Windows\SysWOW64\Drivers\X6va029 [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-06-08 19:08 - 2015-06-08 19:08 - 00002020 _____ C:\Users\David\Desktop\JRT.txt
2015-06-08 19:04 - 2015-06-08 19:04 - 00000207 _____ C:\Windows\tweaking.com-regbackup-BLACKMATRIX-Windows-7-Professional-(64-bit).dat
2015-06-08 19:04 - 2015-06-08 19:04 - 00000000 ____D C:\RegBackup
2015-06-08 18:17 - 2015-06-08 19:02 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-06-08 18:17 - 2015-06-08 18:17 - 00000622 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-06-08 18:17 - 2015-06-08 18:17 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-06-08 18:17 - 2015-06-08 18:17 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-06-08 18:17 - 2015-04-14 09:37 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-06-08 18:17 - 2015-04-14 09:37 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-06-08 18:17 - 2015-04-14 09:37 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-06-08 18:05 - 2015-06-08 18:07 - 00000000 ____D C:\AdwCleaner
2015-06-07 16:16 - 2015-06-07 16:16 - 00036821 _____ C:\ComboFix.txt
2015-06-07 13:42 - 2015-06-07 16:18 - 00000000 ____D C:\Qoobox
2015-06-07 13:42 - 2015-06-07 13:51 - 00000000 ____D C:\Windows\erdnt
2015-06-07 13:42 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2015-06-07 13:42 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2015-06-07 13:42 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-06-07 13:42 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-06-07 13:42 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-06-07 13:42 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2015-06-07 13:42 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2015-06-07 13:42 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2015-06-07 12:47 - 2015-06-08 19:10 - 00000000 ____D C:\FRST
2015-06-05 13:25 - 2015-06-05 13:32 - 00000000 ____D C:\ProgramData\MFAData
2015-06-05 13:25 - 2015-06-05 13:25 - 00000000 ____D C:\Users\David\AppData\Local\MFAData
2015-06-02 13:28 - 2015-06-02 13:28 - 00000000 ____D C:\Users\David\AppData\Local\GWX
2015-06-01 17:21 - 2015-06-01 17:21 - 00018473 _____ C:\Windows\DirectX.log
2015-06-01 16:50 - 2015-06-01 16:50 - 00000000 ____D C:\Users\David\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Counter-Strike
2015-05-30 09:09 - 2015-06-08 19:01 - 00071050 _____ C:\Windows\PFRO.log
2015-05-29 23:04 - 2015-06-08 19:01 - 00004200 _____ C:\Windows\setupact.log
2015-05-29 23:04 - 2015-05-29 23:04 - 00000000 _____ C:\Windows\setuperr.log
2015-05-29 13:38 - 2015-05-29 13:38 - 00000118 _____ C:\Windows\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
2015-05-27 17:59 - 2015-06-07 16:39 - 00000000 ____D C:\Users\David\AppData\Roaming\Imminent
2015-05-24 18:23 - 2015-05-24 18:23 - 00715038 _____ C:\Windows\unins000.exe
2015-05-24 18:18 - 2015-05-24 18:18 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dxtory2.0
2015-05-24 18:18 - 2014-06-08 22:14 - 02610736 _____ (ExKode Co. Ltd.) C:\Windows\system32\DxtoryCodec.dll
2015-05-24 18:18 - 2014-06-08 22:14 - 02508336 _____ (ExKode Co. Ltd.) C:\Windows\SysWOW64\DxtoryCodec.dll
2015-05-23 22:44 - 2015-05-23 22:44 - 00000484 __RSH C:\Users\David\ntuser.pol
2015-05-22 16:30 - 2015-05-22 16:30 - 00000000 ____D C:\Users\David\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dojotech Software
2015-05-22 16:30 - 2015-05-22 16:30 - 00000000 ____D C:\Users\David\AppData\Roaming\Dojotech Software
2015-05-22 16:24 - 2015-05-27 19:16 - 00000000 ____D C:\Users\David\AppData\Local\Spotify
2015-05-22 16:24 - 2015-05-22 16:41 - 00001806 _____ C:\Users\David\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk
2015-05-18 18:30 - 2015-03-14 05:21 - 01632768 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll
2015-05-18 18:30 - 2015-03-14 05:21 - 00082944 _____ (Microsoft Corporation) C:\Windows\system32\dwmapi.dll
2015-05-18 18:30 - 2015-03-14 05:04 - 01372160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll
2015-05-18 18:30 - 2015-03-14 05:04 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmapi.dll
2015-05-13 23:04 - 2015-05-01 15:17 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 23:04 - 2015-05-01 15:16 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 12:48 - 2015-05-13 12:50 - 00000000 ____D C:\Users\David\AppData\Roaming\Nico Mak Computing
2015-05-13 12:48 - 2008-08-18 18:18 - 00077824 _____ (Fox Magic Software) C:\Windows\SysWOW64\fmcodec.DLL
2015-05-13 12:28 - 2015-05-13 12:28 - 00000000 ____D C:\Users\David\Downloads\Es tut mir leid DayZ Song by Execute
2015-05-13 11:15 - 2015-05-13 11:15 - 00002211 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2014.lnk
2015-05-13 11:15 - 2014-07-16 10:24 - 00040760 _____ (TuneUp Software) C:\Windows\system32\TURegOpt.exe
2015-05-13 11:15 - 2014-07-16 10:24 - 00029496 _____ (TuneUp Software) C:\Windows\system32\authuitu.dll
2015-05-13 11:15 - 2014-07-16 10:24 - 00025400 _____ (TuneUp Software) C:\Windows\SysWOW64\authuitu.dll
2015-05-13 11:14 - 2015-05-14 10:58 - 00000000 ____D C:\Program Files (x86)\TuneUp Utilities 2014
2015-05-13 11:13 - 2015-05-13 11:13 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
2015-05-13 10:44 - 2015-05-13 10:44 - 00000000 ____D C:\Users\David\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\JDownloader
2015-05-13 10:23 - 2015-05-05 03:29 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-05-13 10:23 - 2015-05-05 03:12 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-05-13 10:23 - 2015-04-22 04:28 - 00389840 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-05-13 10:23 - 2015-04-22 03:48 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-05-13 10:23 - 2015-04-21 19:08 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-05-13 10:23 - 2015-04-21 19:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-05-13 10:23 - 2015-04-21 18:51 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-05-13 10:23 - 2015-04-21 18:50 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-05-13 10:23 - 2015-04-21 18:50 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-05-13 10:23 - 2015-04-21 18:50 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-05-13 10:23 - 2015-04-21 18:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-05-13 10:23 - 2015-04-21 18:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-05-13 10:23 - 2015-04-21 18:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-05-13 10:23 - 2015-04-21 18:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-05-13 10:23 - 2015-04-21 18:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-05-13 10:23 - 2015-04-21 18:35 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-05-13 10:23 - 2015-04-21 18:35 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-05-13 10:23 - 2015-04-21 18:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-05-13 10:23 - 2015-04-21 18:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-05-13 10:23 - 2015-04-21 18:31 - 06025728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-05-13 10:23 - 2015-04-21 18:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-05-13 10:23 - 2015-04-21 18:25 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-05-13 10:23 - 2015-04-21 18:24 - 19691008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-05-13 10:23 - 2015-04-21 18:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-05-13 10:23 - 2015-04-21 18:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-05-13 10:23 - 2015-04-21 18:11 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-05-13 10:23 - 2015-04-21 18:11 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-05-13 10:23 - 2015-04-21 18:10 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-05-13 10:23 - 2015-04-21 18:09 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-05-13 10:23 - 2015-04-21 18:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-05-13 10:23 - 2015-04-21 18:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-05-13 10:23 - 2015-04-21 18:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-05-13 10:23 - 2015-04-21 18:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-05-13 10:23 - 2015-04-21 18:04 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-05-13 10:23 - 2015-04-21 18:03 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-05-13 10:23 - 2015-04-21 18:02 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-05-13 10:23 - 2015-04-21 18:00 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-05-13 10:23 - 2015-04-21 17:58 - 00664576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-05-13 10:23 - 2015-04-21 17:58 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-05-13 10:23 - 2015-04-21 17:57 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-05-13 10:23 - 2015-04-21 17:49 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-05-13 10:23 - 2015-04-21 17:49 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-05-13 10:23 - 2015-04-21 17:48 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-05-13 10:23 - 2015-04-21 17:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-05-13 10:23 - 2015-04-21 17:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-05-13 10:23 - 2015-04-21 17:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-05-13 10:23 - 2015-04-21 17:40 - 14401536 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-05-13 10:23 - 2015-04-21 17:39 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-05-13 10:23 - 2015-04-21 17:38 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-05-13 10:23 - 2015-04-21 17:36 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-05-13 10:23 - 2015-04-21 17:31 - 04305920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-05-13 10:23 - 2015-04-21 17:27 - 02352128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-05-13 10:23 - 2015-04-21 17:26 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-05-13 10:23 - 2015-04-21 17:25 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-05-13 10:23 - 2015-04-21 17:24 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-05-13 10:23 - 2015-04-21 17:17 - 12828672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-05-13 10:23 - 2015-04-21 17:15 - 01547264 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-05-13 10:23 - 2015-04-21 17:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-05-13 10:23 - 2015-04-21 17:02 - 01882112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-05-13 10:23 - 2015-04-21 16:58 - 01310208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-05-13 10:23 - 2015-04-21 16:56 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-05-13 10:23 - 2015-04-18 05:10 - 00460800 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-05-13 10:23 - 2015-04-18 04:56 - 00342016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2015-05-13 10:22 - 2015-04-21 19:14 - 24971776 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-05-13 10:20 - 2015-04-27 21:28 - 05569984 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-05-13 10:20 - 2015-04-27 21:28 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-05-13 10:20 - 2015-04-27 21:28 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-05-13 10:20 - 2015-04-27 21:26 - 01728960 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-05-13 10:20 - 2015-04-27 21:23 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-05-13 10:20 - 2015-04-27 21:23 - 01254400 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2015-05-13 10:20 - 2015-04-27 21:23 - 01162752 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-05-13 10:20 - 2015-04-27 21:23 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2015-05-13 10:20 - 2015-04-27 21:23 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2015-05-13 10:20 - 2015-04-27 21:23 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-05-13 10:20 - 2015-04-27 21:23 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-05-13 10:20 - 2015-04-27 21:23 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-05-13 10:20 - 2015-04-27 21:23 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-05-13 10:20 - 2015-04-27 21:23 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-05-13 10:20 - 2015-04-27 21:23 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-05-13 10:20 - 2015-04-27 21:23 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-05-13 10:20 - 2015-04-27 21:23 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-05-13 10:20 - 2015-04-27 21:23 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-05-13 10:20 - 2015-04-27 21:23 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-05-13 10:20 - 2015-04-27 21:23 - 00113664 _____ (Microsoft Corporation) C:\Windows\system32\sechost.dll
2015-05-13 10:20 - 2015-04-27 21:23 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-05-13 10:20 - 2015-04-27 21:23 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-05-13 10:20 - 2015-04-27 21:23 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-05-13 10:20 - 2015-04-27 21:23 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-05-13 10:20 - 2015-04-27 21:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-05-13 10:20 - 2015-04-27 21:23 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-05-13 10:20 - 2015-04-27 21:23 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-05-13 10:20 - 2015-04-27 21:23 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-05-13 10:20 - 2015-04-27 21:22 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\tracerpt.exe
2015-05-13 10:20 - 2015-04-27 21:22 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-05-13 10:20 - 2015-04-27 21:22 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-05-13 10:20 - 2015-04-27 21:22 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-05-13 10:20 - 2015-04-27 21:22 - 00104448 _____ (Microsoft Corporation) C:\Windows\system32\logman.exe
2015-05-13 10:20 - 2015-04-27 21:22 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\typeperf.exe
2015-05-13 10:20 - 2015-04-27 21:22 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\relog.exe
2015-05-13 10:20 - 2015-04-27 21:22 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-05-13 10:20 - 2015-04-27 21:22 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\diskperf.exe
2015-05-13 10:20 - 2015-04-27 21:21 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-05-13 10:20 - 2015-04-27 21:18 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-05-13 10:20 - 2015-04-27 21:18 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-05-13 10:20 - 2015-04-27 21:16 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-05-13 10:20 - 2015-04-27 21:16 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-05-13 10:20 - 2015-04-27 21:16 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 21:16 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 21:16 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 21:16 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 21:11 - 03989440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-05-13 10:20 - 2015-04-27 21:11 - 03934144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-05-13 10:20 - 2015-04-27 21:08 - 01310744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-05-13 10:20 - 2015-04-27 21:05 - 00635392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2015-05-13 10:20 - 2015-04-27 21:05 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-05-13 10:20 - 2015-04-27 21:05 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-05-13 10:20 - 2015-04-27 21:05 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-05-13 10:20 - 2015-04-27 21:05 - 00092160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sechost.dll
2015-05-13 10:20 - 2015-04-27 21:05 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-05-13 10:20 - 2015-04-27 21:05 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-05-13 10:20 - 2015-04-27 21:05 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-05-13 10:20 - 2015-04-27 21:05 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-05-13 10:20 - 2015-04-27 21:04 - 00641536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2015-05-13 10:20 - 2015-04-27 21:04 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-05-13 10:20 - 2015-04-27 21:04 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tracerpt.exe
2015-05-13 10:20 - 2015-04-27 21:04 - 00082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\logman.exe
2015-05-13 10:20 - 2015-04-27 21:04 - 00040448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\typeperf.exe
2015-05-13 10:20 - 2015-04-27 21:04 - 00037888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\relog.exe
2015-05-13 10:20 - 2015-04-27 21:04 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-05-13 10:20 - 2015-04-27 21:04 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-05-13 10:20 - 2015-04-27 21:03 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-05-13 10:20 - 2015-04-27 21:03 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-05-13 10:20 - 2015-04-27 21:03 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-05-13 10:20 - 2015-04-27 21:03 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-05-13 10:20 - 2015-04-27 21:03 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\diskperf.exe
2015-05-13 10:20 - 2015-04-27 21:03 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-05-13 10:20 - 2015-04-27 21:01 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-05-13 10:20 - 2015-04-27 21:01 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-05-13 10:20 - 2015-04-27 20:59 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-05-13 10:20 - 2015-04-27 20:59 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-05-13 10:20 - 2015-04-27 20:59 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 20:59 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 20:06 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2015-05-13 10:20 - 2015-04-27 19:57 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-05-13 10:20 - 2015-04-27 19:57 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-05-13 10:20 - 2015-04-27 19:55 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 19:55 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-05-13 10:20 - 2015-04-27 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-05-13 10:20 - 2015-04-20 05:17 - 01647104 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-05-13 10:20 - 2015-04-20 05:17 - 01179136 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-05-13 10:20 - 2015-04-20 04:56 - 01250816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2015-05-13 10:20 - 2015-04-20 04:11 - 03204608 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-05-13 10:20 - 2015-04-13 05:28 - 00328704 _____ (Microsoft Corporation) C:\Windows\system32\services.exe
2015-05-13 10:20 - 2015-04-08 05:29 - 00275456 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2015-05-13 10:20 - 2015-04-08 05:29 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll
2015-05-13 10:20 - 2015-04-08 05:14 - 00216064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InkEd.dll
2015-05-13 10:20 - 2015-03-04 06:41 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll
2015-05-13 10:20 - 2015-03-04 06:41 - 00072192 _____ (Microsoft Corporation) C:\Windows\system32\aelupsvc.dll
2015-05-13 10:20 - 2015-03-04 06:41 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\sdbinst.exe
2015-05-13 10:20 - 2015-03-04 06:41 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\shimeng.dll
2015-05-13 10:20 - 2015-03-04 06:11 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shimeng.dll
2015-05-13 10:20 - 2015-03-04 06:10 - 00295936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apphelp.dll
2015-05-13 10:20 - 2015-03-04 06:10 - 00020992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sdbinst.exe
2015-05-13 10:20 - 2015-02-18 09:06 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe
2015-05-13 10:20 - 2015-02-18 09:04 - 00142336 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe
2015-05-13 10:20 - 2015-01-29 05:19 - 02543104 _____ (Microsoft Corporation) C:\Windows\system32\wpdshext.dll
2015-05-13 10:20 - 2015-01-29 05:02 - 02311168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wpdshext.dll
2015-05-10 19:26 - 2015-05-10 19:26 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Landwirtschafts Simulator 2011

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-06-08 19:07 - 2010-11-21 08:50 - 12188614 _____ C:\Windows\system32\perfh007.dat
2015-06-08 19:07 - 2010-11-21 08:50 - 03749364 _____ C:\Windows\system32\perfc007.dat
2015-06-08 19:07 - 2009-07-14 07:13 - 00006438 _____ C:\Windows\system32\PerfStringBackup.INI
2015-06-08 19:06 - 2015-03-04 16:52 - 01564501 _____ C:\Windows\WindowsUpdate.log
2015-06-08 19:05 - 2009-07-14 06:45 - 00040528 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-06-08 19:05 - 2009-07-14 06:45 - 00040528 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-06-08 19:02 - 2014-12-19 21:17 - 00000600 _____ C:\Users\David\AppData\Roaming\winscp.rnd
2015-06-08 19:01 - 2015-04-01 15:18 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-06-08 19:01 - 2014-02-08 21:38 - 00000000 ____D C:\ProgramData\NVIDIA
2015-06-08 19:01 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-06-08 19:01 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2015-06-08 18:33 - 2015-04-01 15:18 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-06-08 18:32 - 2014-02-08 23:16 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-06-08 18:07 - 2014-02-09 03:11 - 00001005 _____ C:\Users\David\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-06-08 17:56 - 2014-02-08 23:15 - 00000000 ____D C:\Users\David\AppData\Local\Adobe
2015-06-08 17:55 - 2014-02-23 19:19 - 00000000 ____D C:\Users\David\AppData\Roaming\Skype
2015-06-08 16:30 - 2014-02-08 22:29 - 00000414 _____ C:\Windows\Tasks\Defraggler Volume D Task.job
2015-06-07 15:39 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini
2015-06-07 13:52 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Default
2015-06-07 13:49 - 2009-07-14 04:34 - 79429632 _____ C:\Windows\system32\config\software.bak
2015-06-07 13:49 - 2009-07-14 04:34 - 44302336 _____ C:\Windows\system32\config\components.bak
2015-06-07 13:49 - 2009-07-14 04:34 - 24903680 _____ C:\Windows\system32\config\system.bak
2015-06-07 13:49 - 2009-07-14 04:34 - 00524288 _____ C:\Windows\system32\config\default.bak
2015-06-07 13:49 - 2009-07-14 04:34 - 00262144 _____ C:\Windows\system32\config\security.bak
2015-06-07 13:49 - 2009-07-14 04:34 - 00262144 _____ C:\Windows\system32\config\sam.bak
2015-06-07 13:48 - 2015-03-31 17:47 - 00000000 ____D C:\Program Files (x86)\4f0332cb-3bd9-4e7c-ba1b-5dc70a990f27
2015-06-07 13:48 - 2015-01-22 17:33 - 00000000 ____D C:\Program Files (x86)\AGEIA Technologies
2015-06-07 13:09 - 2015-04-01 14:21 - 00000000 ____D C:\Users\David\AppData\Roaming\TS3Client
2015-06-07 11:58 - 2014-04-19 15:29 - 00000000 ____D C:\Users\David\.gimp-2.8
2015-06-07 00:16 - 2014-02-08 22:33 - 00000000 ____D C:\Users\David\AppData\Roaming\vlc
2015-06-05 13:44 - 2015-04-01 14:48 - 00000000 ____D C:\ProgramData\Avira
2015-06-05 13:44 - 2014-07-18 11:37 - 00000000 ____D C:\ProgramData\Package Cache
2015-06-05 13:29 - 2015-05-07 14:27 - 00000000 ____D C:\Users\David\AppData\Roaming\TuneUp Software
2015-06-03 22:29 - 2015-03-18 19:22 - 00000000 ____D C:\Users\David\AppData\Roaming\24A06051-46EF-480A-977E-CFB658017DC9
2015-06-02 19:29 - 2014-07-11 16:01 - 00000000 ____D C:\Users\David\AppData\Roaming\.minecraft
2015-05-29 23:02 - 2014-07-19 10:22 - 00000000 ____D C:\Users\David\AppData\Local\CrashDumps
2015-05-29 20:30 - 2014-07-17 12:02 - 00000000 ____D C:\Users\David\AppData\Roaming\Audacity
2015-05-29 19:39 - 2014-12-28 20:41 - 00000000 ____D C:\Users\David\AppData\Local\Eclipse
2015-05-29 13:38 - 2014-02-09 03:11 - 00000000 ____D C:\Users\David\AppData\Local\VirtualStore
2015-05-28 21:56 - 2014-04-19 11:52 - 00000000 ____D C:\Users\David\AppData\Roaming\HandBrake
2015-05-28 21:39 - 2014-12-19 19:03 - 00000000 ____D C:\ProgramData\boost_interprocess
2015-05-27 19:03 - 2014-07-23 09:42 - 00000000 ___RD C:\Program Files (x86)\Skype
2015-05-27 18:32 - 2014-09-17 17:44 - 00000000 ____D C:\Users\David\AppData\Roaming\Spotify
2015-05-27 15:56 - 2015-04-01 10:49 - 00000000 ____D C:\Program Files (x86)\Emsisoft Anti-Malware
2015-05-26 16:35 - 2015-04-01 15:19 - 00002185 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-05-25 14:22 - 2014-12-21 13:15 - 00000600 _____ C:\Users\David\AppData\Local\PUTTY.RND
2015-05-25 13:48 - 2014-07-17 12:48 - 00000000 ____D C:\Users\David\AppData\Local\Dxtory Software
2015-05-24 18:23 - 2014-07-17 12:46 - 00003442 _____ C:\Windows\unins000.dat
2015-05-23 22:44 - 2014-02-09 03:11 - 00000000 ____D C:\Users\David
2015-05-22 16:04 - 2014-12-18 18:18 - 00007605 _____ C:\Users\David\AppData\Local\Resmon.ResmonCfg
2015-05-22 14:54 - 2014-07-31 17:08 - 00000000 ____D C:\Users\David\AppData\Roaming\OBS
2015-05-22 14:52 - 2014-07-31 17:08 - 00000000 ____D C:\Program Files (x86)\OBS
2015-05-20 22:03 - 2015-04-04 11:35 - 00000000 ___SD C:\Windows\SysWOW64\GWX
2015-05-20 22:03 - 2015-04-04 11:35 - 00000000 ___SD C:\Windows\system32\GWX
2015-05-17 11:31 - 2014-02-08 23:16 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-05-17 11:31 - 2014-02-08 23:16 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-05-17 11:31 - 2014-02-08 23:16 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-05-16 19:28 - 2015-04-01 15:18 - 00004106 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-05-16 19:28 - 2015-04-01 15:18 - 00003854 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-05-16 10:15 - 2014-04-19 18:03 - 00000000 ____D C:\Users\David\AppData\Local\Windows Live
2015-05-15 19:01 - 2009-07-14 06:45 - 05074600 _____ C:\Windows\system32\FNTCACHE.DAT
2015-05-15 14:07 - 2014-02-09 03:50 - 00085240 _____ C:\Users\David\AppData\Local\GDIPFONTCACHEV1.DAT
2015-05-14 11:52 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2015-05-14 11:01 - 2010-11-21 09:01 - 00000000 ____D C:\Program Files\Windows Journal
2015-05-14 11:01 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\AdvancedInstallers
2015-05-13 23:09 - 2014-02-08 22:12 - 00002127 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
2015-05-13 23:09 - 2014-02-08 22:12 - 00001912 _____ C:\Windows\epplauncher.mif
2015-05-13 23:09 - 2014-02-08 22:12 - 00000000 ____D C:\Program Files\Microsoft Security Client
2015-05-13 23:09 - 2014-02-08 22:12 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client
2015-05-13 23:08 - 2014-02-08 22:43 - 00000000 ____D C:\Windows\system32\MRT
2015-05-13 23:05 - 2014-02-08 22:43 - 140425016 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-05-13 23:04 - 2015-04-04 11:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-05-13 23:03 - 2015-04-04 11:36 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2015-05-13 23:03 - 2015-04-04 11:36 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2015-05-13 18:12 - 2014-07-17 12:13 - 00000000 ____D C:\ProgramData\TechSmith
2015-05-13 12:48 - 2014-07-31 11:13 - 00000049 _____ C:\Windows\SysWOW64\ScrRecX.log
2015-05-13 12:48 - 2014-07-31 11:13 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\aTube Catcher
2015-05-13 12:31 - 2014-02-08 22:22 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-05-13 11:14 - 2015-05-07 14:27 - 00000000 __SHD C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2015-05-13 11:13 - 2014-07-18 10:53 - 00000000 ____D C:\Users\David\AppData\Roaming\DVDVideoSoft
2015-05-10 19:26 - 2009-07-14 07:32 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games

==================== Files in the root of some directories =======

2014-02-08 22:23 - 2011-02-22 15:18 - 0148856 _____ (Sysinternals - www.sysinternals.com) C:\Program Files\Autologon.exe
2014-02-08 22:23 - 2006-07-28 09:32 - 0007005 _____ () C:\Program Files\Eula.txt
2014-12-19 21:17 - 2015-06-08 19:02 - 0000600 _____ () C:\Users\David\AppData\Roaming\winscp.rnd
2014-08-12 10:09 - 2014-08-12 10:09 - 0001456 _____ () C:\Users\David\AppData\Local\Adobe Für Web speichern 13.0 Prefs
2014-12-21 13:15 - 2015-05-25 14:22 - 0000600 _____ () C:\Users\David\AppData\Local\PUTTY.RND
2014-12-13 18:12 - 2014-12-13 18:12 - 0006732 _____ () C:\Users\David\AppData\Local\recently-used.xbel
2014-12-18 18:18 - 2015-05-22 16:04 - 0007605 _____ () C:\Users\David\AppData\Local\Resmon.ResmonCfg
2014-02-23 17:44 - 2014-02-23 17:47 - 0000823 _____ () C:\ProgramData\hpzinstall.log

Some files in TEMP:
====================
C:\Users\David\AppData\Local\Temp\Quarantine.exe
C:\Users\David\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


testsigning: ==> testsigning is on. Check for possible unsigned rootkit driver <===== ATTENTION!


LastRegBack: 2015-06-06 12:56

==================== End of log ============================

M-K-D-B · 08.06.2015, 18:45

Servus,

gut gemacht.

So geht es weiter:

Starte FRST erneut. Kopiere den Inhalt der folgenden Code-Box oben in die Zeile:

Code:

ATTFilter

sweet-page;Registry Helper;Trusted Publisher;Tbccint;Genesis;Activeris;Chromatic Browser;Optimizer Pro;SmartWeb;globalUpdate;

Drücke auf Search Registry.
FRST beginnt mit dem Suchlauf. Dies kann einige Zeit dauern.
Am Ende erstellt FRST eine Textdatei Search.txt.
Poste mir deren Inhalt mit deiner nächsten Antwort.

SynexTV · 08.06.2015, 19:07

Servus,

danke für Ihre Hilfe hier ist die Search.txt:

Code:

ATTFilter

Farbar Recovery Scan Tool (x64) Version:06-06-2015
Ran by David at 2015-06-08 20:07:08
Running from D:\DATEN\David\Desktop
Boot Mode: Normal

================== Search Registry: "sweet-page;Registry Helper;Trusted Publisher;Tbccint;Genesis;Activeris;Chromatic Browser;Optimizer Pro;SmartWeb;globalUpdate" ===========


===================== Search result for "sweet-page" ==========

[HKEY_USERS\S-1-5-21-914325664-1482865349-517734357-1000\Software\Microsoft\Internet Explorer\SearchScopes]
"DoNotAskAgain"="sweet-page.com"


===================== Search result for "Registry Helper" ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{5FEA7FE3-4931-42F6-91D6-C9895DBB9D3E}\1.0]
""="Registry Helper License Manager"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{5FEA7FE3-4931-42F6-91D6-C9895DBB9D3E}\1.0]
""="Registry Helper License Manager"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{5FEA7FE3-4931-42F6-91D6-C9895DBB9D3E}\1.0]
""="Registry Helper License Manager"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\eventlog\Application\Registry Helper Service]


===================== Search result for "Tbccint" ==========

[HKEY_USERS\S-1-5-21-914325664-1482865349-517734357-1000\Software\AppDataLow\Software\Smartbar\UninstallerData\CT1561552\FF]
"ServiceMapURL"="hxxp://servicemap.tbccint.com/toolbaruninstall?dum=2"


===================== Search result for "Genesis" ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{3BAA3119-ECA1-4A32-9A08-595E71AE9DA9}\1.0]
""="Genesis Teletext Server 1.0 Type Library"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{3BAA3119-ECA1-4A32-9A08-595E71AE9DA9}\1.0]
""="Genesis Teletext Server 1.0 Type Library"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{3BAA3119-ECA1-4A32-9A08-595E71AE9DA9}\1.0]
""="Genesis Teletext Server 1.0 Type Library"


===================== Search result for "Optimizer Pro" ==========

[HKEY_USERS\S-1-5-21-914325664-1482865349-517734357-1000\Software\Microsoft\IntelliType Pro\AppSpecific\OptimizerPro.exe]
"Path"="C:\Program Files (x86)\Optimizer Pro 3.52\OptimizerPro.exe"


===================== Search result for "SmartWeb" ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\HPSmartWebPrintingBasicsBHO.dll]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\548536CD3D64B404CB1BCFA41990A1AF]
"ProductName"="SmartWebPrinting"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F8317BC3-0B5C-4E03-88F4-69EA8EE62D7B}\1.0]
""="HPSmartWebPrintingBasicsBHO 1.0 Type Library"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\AppID\HPSmartWebPrintingBasicsBHO.dll]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{F8317BC3-0B5C-4E03-88F4-69EA8EE62D7B}\1.0]
""="HPSmartWebPrintingBasicsBHO 1.0 Type Library"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E8749DBAD7C340046A552FAD143324B2]
"548536CD3D64B404CB1BCFA41990A1AF"="C?\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\SmartWebPrintExe.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\548536CD3D64B404CB1BCFA41990A1AF\InstallProperties]
"DisplayName"="SmartWebPrinting"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{569591D2-F221-4115-9A89-762956BEB3C0}]
"AppName"="SmartWebPrintExe.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\HP Smart Web Printing]
"URLUpdateInfo"="www.HP.com/go/smartwebprinting/"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Mozilla\Firefox\Extensions]
"smartwebprinting@hp.com"="C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\AppID\HPSmartWebPrintingBasicsBHO.dll]

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{F8317BC3-0B5C-4E03-88F4-69EA8EE62D7B}\1.0]
""="HPSmartWebPrintingBasicsBHO 1.0 Type Library"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{A604E5BF-F4F1-4F25-8C79-2CF0680F9098}"="v2.10|Action=Allow|Active=TRUE|Dir=In|App=C:\Program Files (x86)\HP\digital imaging\smart web printing\smartwebprintexe.exe|Name=smartwebprintexe.exe|Desc=C:\Program Files (x86)\HP\digital imaging\smart web printing\smartwebprintexe.exe|"

[HKEY_USERS\S-1-5-21-914325664-1482865349-517734357-1000\Software\Microsoft\IntelliType Pro\AppSpecific\SmartWebApp.exe]

[HKEY_USERS\S-1-5-21-914325664-1482865349-517734357-1000\Software\Microsoft\IntelliType Pro\AppSpecific\SmartWebHelper.exe]

[HKEY_USERS\S-1-5-21-914325664-1482865349-517734357-1000\Software\Mozilla\Firefox\Extensions]
"smartwebprinting@hp.com"="C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3"
====== End of Search ======

07.06.2015, 12:39	#6
M-K-D-B /// TB-Ausbilder	AntiViren Programme lassen sich nicht starten/installieren. Und beim MicrosoftSecurityCenter kann ich den EchtzeitSchutz nicht aktivieren! Servus, ComboFix.exe in SynexTV.exe umbenennen und nochmal starten. Bitte beachten: Alle Tools immer mit Administratorrechten ausführen!

AntiViren Programme lassen sich nicht starten/installieren. Und beim MicrosoftSecurityCenter kann ich den EchtzeitSchutz nicht aktivieren!

Plagegeister aller Art und deren Bekämpfung: AntiViren Programme lassen sich nicht starten/installieren. Und beim MicrosoftSecurityCenter kann ich den EchtzeitSchutz nicht aktivieren!