Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Spacekace auf c/ und JS Crossraider B (https://www.trojaner-board.de/166991-spacekace-c-js-crossraider-b.html)

Chris2128 17.05.2015 14:03
Spacekace auf c/ und JS Crossraider B
 
Hi Leute
wollte letztens ne spiel demo installieren war aber n Fake und verseucht,
dann ploppte pup up werbung auf unteranderem dummy forum und so, hab denn über emsisoft n scan gemacht und trojaner adware bzw malware gefunden, dazu hab ich noch bitdefenden jetzt installiert und zeigt mir stündlich neue ergebnisse mit adware JS. Crossraider B und bräuchte dringend eure hilfe

Bootsektor 17.05.2015 14:25
:hallo:

Mein Name ist Sandra und ich werde Dir bei Deinem Problem behilflich sein.
  • Bitte arbeite alle Schritte der Reihe nach ab.
  • Lese die Anleitungen sorgfältig durch bevor Du beginnst. Wenn es Probleme gibt oder Du etwas nicht verstehst, dann stoppe mit Deiner Ausführung und beschreibe mir das Problem
  • Führe bitte nur Scans durch zu denen Du von mir aufgefordert wirst.
  • Bitte kein Crossposting ( posten in mehreren Foren).
  • Installiere oder deinstalliere während der Bereinigung keine Software, ausser Du wurdest dazu aufgefordert.
  • Poste die Logfiles direkt in deinen Thread in Code-Tags.
  • Bedenke, dass wir hier alle während unserer Freizeit tätig sind, wenn du innerhalb von 2 Tagen nichts von mir hörst, dann schreibe mir bitte eine PM.

Hinweis: Ich kann Dir niemals eine Garantie geben, dass ich auch alles finde. Eine Formatierung ist meist der schnellere und bei einem Befall durch Malware immer der sicherste Weg. Adware lässt sich in den allermeisten Fällen problemlos entfernen.
Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis Dir jemand vom Team sagt, dass Du clean bist.

Posten in Code Tags
Bitte füge die Logs immer in Code-Tags ein. Wenn Du das nicht machst, erschwert es mir sehr das Auswerten. Danke.
Dazu:
  • Klicke über dem Antwortfenster auf die Raute #, dann steht dort in eckigen Klammern [] CODE /CODE.
  • Zwischen den beiden code-Bausteinen fügst Du dann deine Logfiles ein. Also CODE Logfile /CODE
  • Wenn die Logs zu lang sein sollten, dann teile sie bitte auf und poste sie dann hier in Deinem Thread, notfalls in mehreren Antworten.

Schritt 1
Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)


Chris2128 17.05.2015 15:01
Hi Sandra
ich weiß es sehr zu schätzen dass du mir hilfstund vielen dank schon mal :) habe schon ein wenig mit vorsicht vorgearbeitet da ich mich schon auf der seite belesen habe also hier meine log s

Emisoft anti malware

Code:
Emsisoft Anti-Malware v. 10.0.0.5366
(C) 2003-2015 Emsisoft - www.emsisoft.com

ID  Object
0    C:\Users\Christian\AppData\Local\Temp\DMR\dmr_72.exe erkannt: Schlechter Ruf
1    C:\Program Files (x86)\CinemaPlus-3.2cV07.05\108abbfd-af07-431a-8138-2dd0ce19f45d.xpi erkannt: Adware.JS.Crossrider.B (B)
2    C:\Users\Christian\AppData\Roaming\istartsurf\ erkannt: Application.Bundle (A)
3    C:\Program Files (x86)\Delta erkannt: Application.AppInstall (A)
4    C:\Users\Christian\AppData\Roaming\OpenCandy erkannt: Application.AppInstall (A)
5    C:\Users\Christian\AppData\Roaming\babylon erkannt: Application.AppInstall (A)
6    C:\Users\Christian\AppData\Roaming\dvdvideosoftiehelpers erkannt: Application.AppInstall (A)
7    C:\ProgramData\babylon erkannt: Application.AppInstall (A)
8    Value: HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM -> DISABLEREGISTRYTOOLS erkannt: Setting.DisableRegistryTools (A)
9    C:\Program Files (x86)\globalUpdate erkannt: Application.AdUpd (A)
10  Value: HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER -> NORUN erkannt: Setting.NoRun (A)
11  Value: HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM -> DISABLETASKMGR erkannt: Setting.DisableTaskMgr (A)
12  Key: HKEY_USERS\S-1-5-21-704110784-328736849-532702743-1002\SOFTWARE\DATAMNGR erkannt: Application.InstallAd (A)
13  Key: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432NODE\DATAMNGR erkannt: Application.InstallAd (A)
14  Key: HKEY_USERS\S-1-5-21-704110784-328736849-532702743-1002\SOFTWARE\DELTA erkannt: Application.InstallAd (A)
15  Key: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432NODE\DELTA erkannt: Application.InstallAd (A)
16  Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\APPID\{09C554C3-109B-483C-A06B-F14172F1A947} erkannt: Application.InstallDeal (A)
17  Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\APPID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921} erkannt: Application.InstallTool (A)
18  Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\APPID\{B12E99ED-69BD-437C-86BE-C862B9E5444D} erkannt: Application.InstallTool (A)
19  Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\APPID\ESCORTLBR.DLL erkannt: Application.Win32.WSearch (A)
20  Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\APPID\ESCORTENG.DLL erkannt: Application.Win32.WSearch (A)
21  Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\APPID\ESCORT.DLL erkannt: Application.Win32.WSearch (A)
22  Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\APPID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800} erkannt: Application.InstallTool (A)
23  Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\APPID\ESCORTAPP.DLL erkannt: Application.Win32.WSearch (A)
24  Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\APPID\ESRV.EXE erkannt: Application.Win32.WSearch (A)
25  Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\ESCORT.ESCORTIEPANE erkannt: Application.AdReg (A)
26  Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\ESCORT.ESCORTIEPANE.1 erkannt: Application.AdReg (A)
27  Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\PROD.CAP erkannt: Application.AdReg (A)
28  Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{261DD098-8A3E-43D4-87AA-63324FA897D8} erkannt: Application.AdReg (A)
29  Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4FCB4630-2A1C-4AA1-B422-345E8DC8A6DE} erkannt: Application.AdReg (A)
30  Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\TYPELIB\{D7EE8177-D51E-4F89-92B6-83EA2EC40800} erkannt: Application.AdReg (A)
31  Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\TYPELIB\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921} erkannt: Application.AdReg (A)
32  Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\DELTA.DELTAAPPCORE erkannt: Application.AdReg (A)
33  Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{E97A663B-81A6-49C5-A6D3-BCB05BA1DE26} erkannt: Application.AdReg (A)
34  Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468} erkannt: Application.AdReg (A)
35  Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{86838207-681D-469D-9511-D0DCC6F19F9B} erkannt: Application.AdReg (A)
36  Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\DELTA.DELTAHLPR erkannt: Application.AdReg (A)
37  Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\DELTA.DELTADSKBND erkannt: Application.AdReg (A)
38  Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\DELTA.DELTAAPPCORE.1 erkannt: Application.AdReg (A)
39  Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\DELTA.DELTADSKBND.1 erkannt: Application.AdReg (A)
40  Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{1231839B-064E-4788-B865-465A1B5266FD} erkannt: Application.AdReg (A)
41  Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{2DAC2231-CC35-482B-97C5-CED1D4185080} erkannt: Application.AdReg (A)
42  Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\ESRV.DELTAESRVC erkannt: Application.AdReg (A)
43  Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\ESRV.DELTAESRVC.1 erkannt: Application.AdReg (A)
44  Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\DELTA.DELTAHLPR.1 erkannt: Application.AdReg (A)
45  Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{3F1CD84C-04A3-4EA0-9EA1-7D134FD66C82} erkannt: Application.AdReg (A)
46  Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{47E520EA-CAD2-4F51-8F30-613B3A1C33EB} erkannt: Application.AdReg (A)
47  Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{3F83A9CA-B5F0-44EC-9357-35BB3E84B07F} erkannt: Application.AdReg (A)
48  Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{57C91446-8D81-4156-A70E-624551442DE9} erkannt: Application.AdReg (A)
49  Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{7AD65FD1-79E0-406D-B03C-DD7C14726D69} erkannt: Application.AdReg (A)
50  Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{B177446D-54A4-4869-BABC-8566110B4BE0} erkannt: Application.AdReg (A)
51  Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{97DD820D-2E20-40AD-B01E-6730B2FCE630} erkannt: Application.AdReg (A)
52  Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{70AFB7B2-9FB5-4A70-905B-0E9576142E1D} erkannt: Application.AdReg (A)
53  Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{E0B07188-A528-4F9E-B2F7-C7FDE8680AE4} erkannt: Application.AdReg (A)
54  Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\TYPELIB\{39CB8175-E224-4446-8746-00566302DF8D} erkannt: Application.AdReg (A)
55  Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{D9D1DFC5-502D-43E4-B1BB-4D0B7841489A} erkannt: Application.AdReg (A)
56  Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{F05B12E1-ADE8-4485-B45B-898748B53C37} erkannt: Application.AdReg (A)
57  Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\APPID\{39CB8175-E224-4446-8746-00566302DF8D} erkannt: Application.InstallTool (A)
58  Key: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{C1AF5FA5-852C-4C90-812E-A7F75E011D87} erkannt: Application.BHO (A)
59  Value: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS -> {ACAA314B-EEBA-48E4-AD47-84E31C44796C} erkannt: Application.FireExt (A)
60  Key: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432NODE\BABYLON erkannt: Application.InstallAd (A)
61  Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\APPID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3} erkannt: Application.InstallTool (A)

FRST


FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 16-05-2015 02
Ran by Christian (administrator) on CHRIS on 17-05-2015 13:52:45
Running from C:\Users\Christian\Desktop
Loaded Profiles: UpdatusUser & Christian (Available profiles: UpdatusUser & Christian)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Bitdefender) C:\Program Files\Bitdefender\Bitdefender 2015\vsserv.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Emsisoft Ltd) C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Windows (R) Win 7 DDK provider) C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\AdminService.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Dritek System INC.) C:\Windows\RfBtnSvc64.exe
(Bitdefender) C:\Program Files\Bitdefender\Bitdefender 2015\updatesrv.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(CyberGhost S.R.L) C:\Program Files\CyberGhost 5\Service.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerTray.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Intel Corporation) C:\Windows\System32\igfxTray.exe
(Atheros Communications) C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
() C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Bitdefender) C:\Program Files\Bitdefender\Bitdefender 2015\bdagent.exe
(Bitdefender) C:\Program Files\Bitdefender\Bitdefender 2015\bdwtxag.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Dolby Laboratories Inc.) C:\Dolby PCEE4\pcee4.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Emsisoft Ltd) C:\Program Files (x86)\Emsisoft Anti-Malware\a2guard.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2873744 2012-11-20] (ELAN Microelectronics Corp.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12937872 2012-07-27] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1214608 2012-07-10] (Realtek Semiconductor)
HKLM\...\Run: [Bdagent] => C:\Program Files\Bitdefender\Bitdefender 2015\bdagent.exe [1691112 2015-03-12] (Bitdefender)
HKLM-x32\...\Run: [Dolby Home Theater v4] => C:\Dolby PCEE4\pcee4.exe [508656 2012-07-25] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [amd_dc_opt] => C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe [77824 2008-07-22] (AMD)
HKLM-x32\...\Run: [KiesTrayAgent] => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311616 2015-02-24] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [emsisoft anti-malware] => c:\program files (x86)\emsisoft anti-malware\a2guard.exe [4923832 2015-05-10] (Emsisoft Ltd)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [271744 2015-04-10] (Oracle Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
HKLM\...\Policies\Explorer\Run: [BtvStack] => C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe [132736 2013-09-07] (Atheros Communications)
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKU\S-1-5-21-704110784-328736849-532702743-1001\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [516608 2014-10-29] (Microsoft Corporation)
HKU\S-1-5-21-704110784-328736849-532702743-1002\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3672640 2013-03-14] (Disc Soft Ltd)
HKU\S-1-5-21-704110784-328736849-532702743-1002\...\Run: [Bitdefender-Geldbörse-Agent] => C:\Program Files\Bitdefender\Bitdefender 2015\bdwtxag.exe [790880 2015-01-15] (Bitdefender)
HKU\S-1-5-21-704110784-328736849-532702743-1002\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8204056 2015-04-23] (Piriform Ltd)
HKU\S-1-5-21-704110784-328736849-532702743-1002\...\MountPoints2: {cbf6e073-7ec8-11e2-be69-806e6f6e6963} - "D:\setup.exe"
HKU\S-1-5-21-704110784-328736849-532702743-1002\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\Ribbons.scr [132608 2014-10-29] (Microsoft Corporation)
AppInit_DLLs: c:\windows\system32\nvinitx.dll => c:\windows\system32\nvinitx.dll [168616 2013-09-05] (NVIDIA Corporation)
AppInit_DLLs: ,C:\WINDOWS\system32\nvinitx.dll => C:\WINDOWS\system32\nvinitx.dll [168616 2013-09-05] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\WINDOWS\SysWOW64\nvinit.dll => C:\WINDOWS\SysWOW64\nvinit.dll [141336 2013-09-05] (NVIDIA Corporation)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-704110784-328736849-532702743-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://acer13.msn.com
HKU\S-1-5-21-704110784-328736849-532702743-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer13.msn.com
HKU\S-1-5-21-704110784-328736849-532702743-1002\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer13.msn.com
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\.DEFAULT -> {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Bitdefender-Geldbörse -> {1DAC0C53-7D23-4AB3-856A-B04D98CD982A} -> C:\Program Files\Bitdefender\Bitdefender 2015\pmbxie.dll [2015-01-28] (Bitdefender)
BHO-x32: Bitdefender-Geldbörse -> {1DAC0C53-7D23-4AB3-856A-B04D98CD982A} -> C:\Program Files\Bitdefender\Bitdefender 2015\Antispam32\pmbxie.dll [2015-01-28] (Bitdefender)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2015-05-11] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2015-05-11] (Oracle Corporation)
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  No File
Toolbar: HKLM - Bitdefender-Geldbörse - {1DAC0C53-7D23-4AB3-856A-B04D98CD982A} - C:\Program Files\Bitdefender\Bitdefender 2015\pmbxie.dll [2015-01-28] (Bitdefender)
Toolbar: HKLM-x32 - Bitdefender-Geldbörse - {1DAC0C53-7D23-4AB3-856A-B04D98CD982A} - C:\Program Files\Bitdefender\Bitdefender 2015\Antispam32\pmbxie.dll [2015-01-28] (Bitdefender)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Christian\AppData\Roaming\Mozilla\Firefox\Profiles\f1ovvaoh.default
FF DefaultSearchEngine: Google (avast)
FF DefaultSearchUrl: https://www.google.com/search/?trackid=sp-006
FF SearchEngineOrder.1: Google (avast)
FF SelectedSearchEngine: Google (avast)
FF Homepage: Goggle.de
FF Keyword.URL: https://www.google.com/search/?trackid=sp-006
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_17_0_0_169.dll [2015-04-14] ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-04-14] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-06-06] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-06-06] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.80.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll [2015-05-11] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.80.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2015-05-11] (Oracle Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.0 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-05-01] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-704110784-328736849-532702743-1002: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll No File
FF SearchPlugin: C:\Users\Christian\AppData\Roaming\Mozilla\Firefox\Profiles\f1ovvaoh.default\searchplugins\google-avast.xml [2015-05-08]
FF Extension: Adblock Plus Pop-up Addon - C:\Users\Christian\AppData\Roaming\Mozilla\Firefox\Profiles\f1ovvaoh.default\Extensions\adblockpopups@jessehakanen.net.xpi [2015-02-01]
FF HKLM\...\Thunderbird\Extensions: [bdThunderbird@bitdefender.com] - C:\Program Files\Bitdefender\Bitdefender 2015\bdtbext
FF Extension: Bitdefender Antispam Toolbar - C:\Program Files\Bitdefender\Bitdefender 2015\bdtbext [2015-05-13]
FF HKLM-x32\...\Firefox\Extensions: [bdwteff@bitdefender.com] - C:\Program Files\Bitdefender\Bitdefender 2015\antispam32\bdwteff
FF Extension: Bitdefender Wallet - C:\Program Files\Bitdefender\Bitdefender 2015\antispam32\bdwteff [2015-05-13]
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
FF HKLM-x32\...\Thunderbird\Extensions: [bdThunderbird@bitdefender.com] - C:\Program Files\Bitdefender\Bitdefender 2015\bdtbext

Chrome:
=======
CHR HKU\S-1-5-21-704110784-328736849-532702743-1002\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [cmaiofennmphjldldcpphcechfnnohja] - C:\Users\Christian\AppData\Local\AdTrustMedia\PrivDog\PrivDog_chrome.crx [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [fabcmochhfpldjekobfaaggijgohadih] - https://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 a2AntiMalware; C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe [5164328 2015-05-10] (Emsisoft Ltd)
R2 AtherosSvc; C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\adminservice.exe [312448 2013-09-07] (Windows (R) Win 7 DDK provider) [File not signed]
S3 BdDesktopParental; C:\Program Files\Bitdefender\Bitdefender 2015\bdparentalservice.exe [78144 2014-12-09] (Bitdefender)
S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [967040 2015-04-01] ()
S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-10-29] (Microsoft Corporation)
R2 CGVPNCliService; C:\Program Files\CyberGhost 5\Service.exe [64616 2014-11-03] (CyberGhost S.R.L)
S3 DeviceFastLaneService; C:\Program Files\Acer\Acer Device Fast-lane\DeviceFastLaneSvc.exe [469648 2012-11-17] (Acer Incorporated)
R2 DiagTrack; C:\Windows\system32\diagtrack.dll [1429504 2015-03-05] (Microsoft Corporation)
R3 ePowerSvc; C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe [658064 2012-10-23] (Acer Incorporated)
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [314696 2014-05-21] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-17] (Intel Corporation)
R2 RfButtonDriverService; C:\Windows\RfBtnSvc64.exe [93296 2013-02-24] (Dritek System INC.)
R2 UPDATESRV; C:\Program Files\Bitdefender\Bitdefender 2015\updatesrv.exe [67320 2014-10-27] (Bitdefender)
R2 VSSERV; C:\Program Files\Bitdefender\Bitdefender 2015\vsserv.exe [1547936 2015-03-16] (Bitdefender)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-04] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-04] (Microsoft Corporation)
S2 CCDMonitorService; C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe [X]
S2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R0 avc3; C:\Windows\System32\DRIVERS\avc3.sys [1306464 2015-01-14] (BitDefender)
R3 avchv; C:\Windows\system32\DRIVERS\avchv.sys [262544 2015-01-23] (BitDefender)
R3 avckf; C:\Windows\System32\DRIVERS\avckf.sys [677104 2015-01-14] (BitDefender)
S0 bdelam; C:\Windows\System32\drivers\bdelam.sys [23568 2013-09-08] (Bitdefender)
R1 BdfNdisf; C:\Program Files\Common Files\Bitdefender\Bitdefender Firewall\bdfndisf6.sys [98768 2014-12-15] (BitDefender LLC)
R1 bdfwfpf; C:\Program Files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys [107008 2013-07-29] (BitDefender LLC)
S3 bdfwfpf_pc; C:\Program Files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf_pc.sys [121928 2013-07-02] (Bitdefender SRL)
S3 BDSandBox; C:\WINDOWS\system32\drivers\bdsandbox.sys [82824 2015-01-09] (BitDefender SRL)
R3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [77464 2013-09-07] (Qualcomm Atheros)
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-09-24] (Microsoft Corporation)
R3 dtsoftbus01; C:\Windows\System32\drivers\dtsoftbus01.sys [283200 2013-04-08] (DT Soft Ltd)
R1 epp64; C:\Windows\System32\DRIVERS\epp64.sys [135800 2015-03-23] (Emsisoft GmbH)
R0 gzflt; C:\Windows\System32\DRIVERS\gzflt.sys [160544 2015-02-24] (BitDefender LLC)
S3 Hamachi; C:\Windows\system32\DRIVERS\Hamdrv.sys [46136 2014-11-03] (LogMeIn Inc.)
R3 Ps2Kb2Hid; C:\Windows\System32\drivers\aPs2Kb2Hid.sys [26736 2013-02-24] (Dritek System Inc.)
R0 trufos; C:\Windows\System32\DRIVERS\trufos.sys [452040 2014-10-15] (BitDefender S.R.L.)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-04] (Microsoft Corporation)
S3 EagleX64; \??\C:\WINDOWS\system32\drivers\EagleX64.sys [X]
S3 xhunter1; \??\C:\WINDOWS\xhunter1.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-05-17 13:52 - 2015-05-17 13:53 - 00017041 _____ () C:\Users\Christian\Desktop\FRST.txt
2015-05-17 13:52 - 2015-05-17 13:52 - 00000000 ____D () C:\FRST
2015-05-17 13:45 - 2015-05-17 13:45 - 02107392 _____ (Farbar) C:\Users\Christian\Desktop\FRST64.exe
2015-05-17 13:42 - 2015-05-17 13:42 - 00000385 _____ () C:\Users\Christian\AppData\Roaminguser_gensett.xml
2015-05-17 13:36 - 2015-05-17 13:36 - 00001150 _____ () C:\Users\Christian\Desktop\JRT.txt
2015-05-17 13:16 - 2015-05-17 13:16 - 00000207 _____ () C:\WINDOWS\tweaking.com-regbackup-CHRIS-Windows-8.1-(64-bit).dat
2015-05-17 13:16 - 2015-05-17 13:16 - 00000000 ____D () C:\RegBackup
2015-05-17 12:55 - 2015-05-17 12:55 - 02719698 _____ (Thisisu) C:\Users\Christian\Desktop\JRT.exe
2015-05-17 12:42 - 2015-05-17 12:46 - 00000000 ____D () C:\AdwCleaner
2015-05-17 12:29 - 2015-05-17 12:29 - 02209792 _____ () C:\Users\Christian\Desktop\AdwCleaner_4.204.exe
2015-05-17 12:28 - 2015-05-17 12:28 - 00231839 _____ () C:\Users\Christian\Desktop\Neues Textdokument (2).txt
2015-05-17 12:21 - 2015-05-17 12:22 - 00000080 _____ () C:\Users\Christian\Desktop\Neues Textdokument.txt
2015-05-17 12:14 - 2015-05-17 12:14 - 04197016 _____ (Kaspersky Lab ZAO) C:\Users\Christian\Desktop\tdsskiller.exe
2015-05-16 19:18 - 2015-05-16 19:18 - 02720307 _____ (Thisisu) C:\Users\Christian\Downloads\JRT_6.7.0.exe
2015-05-16 16:41 - 2015-05-17 13:41 - 00001488 _____ () C:\WINDOWS\setupact.log
2015-05-16 16:41 - 2015-05-16 16:41 - 00000000 _____ () C:\WINDOWS\setuperr.log
2015-05-16 15:53 - 2015-05-16 15:54 - 01203488 _____ () C:\Users\Christian\Downloads\Bitdefender Rescue CD - CHIP-Installer.exe
2015-05-16 14:37 - 2015-05-16 14:38 - 00360834 _____ () C:\Users\Christian\Documents\cc_20150516_143706.reg
2015-05-16 10:14 - 2015-05-05 19:59 - 00792568 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2015-05-16 10:14 - 2015-05-05 19:59 - 00178168 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2015-05-16 07:58 - 2014-04-16 01:35 - 00028352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aspnet_counters.dll
2015-05-16 07:58 - 2014-04-16 01:34 - 00029888 _____ (Microsoft Corporation) C:\WINDOWS\system32\aspnet_counters.dll
2015-05-16 07:48 - 2015-05-16 07:48 - 00000000 ____D () C:\Users\Christian\AppData\Temp
2015-05-15 14:01 - 2015-05-15 14:02 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-05-14 09:14 - 2015-05-14 09:14 - 00002792 _____ () C:\WINDOWS\System32\Tasks\CCleanerSkipUAC
2015-05-14 09:14 - 2015-05-14 09:14 - 00000838 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2015-05-14 09:13 - 2015-05-14 09:14 - 00000000 ____D () C:\Program Files\CCleaner
2015-05-14 09:11 - 2015-05-14 09:11 - 05248848 _____ (Piriform Ltd) C:\Users\Christian\Downloads\ccsetup505_slim.exe
2015-05-14 08:40 - 2015-05-14 08:40 - 00001144 _____ () C:\Users\Christian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Emsisoft Anti-Malware Guard.lnk
2015-05-13 21:19 - 2015-04-30 22:35 - 00124112 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 21:19 - 2015-04-30 22:35 - 00102608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 21:16 - 2015-05-13 21:16 - 00079192 _____ (BitDefender) C:\WINDOWS\system32\Drivers\bdvedisk.sys
2015-05-13 20:47 - 2015-05-13 20:47 - 00622119 _____ () C:\ProgramData\1431542459.bdinstall.bin
2015-05-13 20:47 - 2015-05-13 20:47 - 00000385 _____ () C:\WINDOWS\system32\user_gensett.xml
2015-05-13 20:46 - 2015-05-14 10:32 - 00000000 ____D () C:\ProgramData\BDLogging
2015-05-13 20:46 - 2015-05-13 20:46 - 00002213 _____ () C:\Users\Public\Desktop\Bitdefender Internet Security 2015.lnk
2015-05-13 20:46 - 2015-05-13 20:46 - 00000000 ____H () C:\WINDOWS\system32\Drivers\Msft_Kernel_avchv_01009.Wdf
2015-05-13 20:46 - 2015-05-13 20:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bitdefender 2015
2015-05-13 20:46 - 2015-01-23 16:30 - 00262544 _____ (BitDefender) C:\WINDOWS\system32\Drivers\avchv.sys
2015-05-13 20:46 - 2015-01-14 13:13 - 00677104 _____ (BitDefender) C:\WINDOWS\system32\Drivers\avckf.sys
2015-05-13 20:46 - 2015-01-14 13:07 - 01306464 _____ (BitDefender) C:\WINDOWS\system32\Drivers\avc3.sys
2015-05-13 20:46 - 2015-01-09 11:59 - 00082824 _____ (BitDefender SRL) C:\WINDOWS\system32\Drivers\bdsandbox.sys
2015-05-13 20:46 - 2015-01-09 11:44 - 00074000 _____ (BitDefender SRL) C:\WINDOWS\SysWOW64\bdsandboxuiskin32.dll
2015-05-13 20:46 - 2014-12-15 18:04 - 00098768 _____ (BitDefender LLC) C:\WINDOWS\system32\Drivers\bdfndisf6.sys
2015-05-13 20:46 - 2013-09-08 20:04 - 00023568 _____ (Bitdefender) C:\WINDOWS\system32\Drivers\bdelam.sys
2015-05-13 20:46 - 2007-04-11 11:11 - 00511328 _____ (Microsoft Corporation) C:\WINDOWS\capicom.dll
2015-05-13 20:45 - 2015-05-13 20:52 - 00000000 ____D () C:\Users\Christian\AppData\Roaming\Bitdefender
2015-05-13 20:41 - 2015-05-13 21:16 - 00074000 _____ (BitDefender SRL) C:\WINDOWS\system32\bdsandboxuiskin32.dll
2015-05-13 20:41 - 2015-05-13 20:47 - 00000000 ____D () C:\ProgramData\Bitdefender
2015-05-13 20:41 - 2015-05-13 20:41 - 00000000 ____D () C:\Program Files\Bitdefender
2015-05-13 20:41 - 2015-02-24 17:52 - 00160544 _____ (BitDefender LLC) C:\WINDOWS\system32\Drivers\gzflt.sys
2015-05-13 20:41 - 2015-01-09 11:44 - 00084848 _____ (BitDefender SRL) C:\WINDOWS\system32\BDSandBoxUISkin.dll
2015-05-13 20:41 - 2015-01-09 11:44 - 00033360 _____ (BitDefender SRL) C:\WINDOWS\system32\BDSandBoxUH.dll
2015-05-13 20:41 - 2014-10-15 17:14 - 00452040 _____ (BitDefender S.R.L.) C:\WINDOWS\system32\Drivers\trufos.sys
2015-05-13 20:40 - 2015-05-13 20:41 - 00000000 ____D () C:\Program Files\Common Files\Bitdefender
2015-05-13 17:01 - 2015-04-10 02:34 - 02256896 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll
2015-05-13 17:01 - 2015-04-10 02:11 - 01943040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll
2015-05-13 17:01 - 2015-03-17 19:26 - 00467776 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBHUB3.SYS
2015-05-13 17:01 - 2015-03-09 04:02 - 00057856 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthhfenum.sys
2015-05-13 17:00 - 2015-05-01 01:05 - 00429568 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll
2015-05-13 17:00 - 2015-05-01 00:48 - 00358912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll
2015-05-13 17:00 - 2015-04-24 23:32 - 00036864 _____ (Microsoft Corporation) C:\WINDOWS\system32\UtcResources.dll
2015-05-13 17:00 - 2015-04-09 00:55 - 00410128 _____ (Microsoft Corporation) C:\WINDOWS\system32\services.exe
2015-05-13 17:00 - 2015-04-02 00:22 - 02985984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbgeng.dll
2015-05-13 17:00 - 2015-04-02 00:20 - 04417536 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbgeng.dll
2015-05-13 17:00 - 2015-04-01 05:45 - 01491456 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbghelp.dll
2015-05-13 17:00 - 2015-04-01 04:31 - 01207296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbghelp.dll
2015-05-13 17:00 - 2015-03-30 07:47 - 00561928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2015-05-13 17:00 - 2015-03-27 05:27 - 00445440 _____ (Microsoft Corporation) C:\WINDOWS\system32\certcli.dll
2015-05-13 17:00 - 2015-03-27 04:50 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certcli.dll
2015-05-13 17:00 - 2015-03-27 04:48 - 01441792 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2015-05-13 17:00 - 2015-03-20 03:56 - 00080384 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ahcache.sys
2015-05-13 17:00 - 2015-03-13 06:03 - 00239424 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdbus.sys
2015-05-13 17:00 - 2015-03-13 06:03 - 00154432 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dumpsd.sys
2015-05-13 17:00 - 2015-03-13 03:11 - 02162176 _____ (Microsoft Corporation) C:\WINDOWS\system32\SRH.dll
2015-05-13 17:00 - 2015-03-13 02:39 - 01812992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SRH.dll
2015-05-13 17:00 - 2015-03-13 02:29 - 00410017 _____ () C:\WINDOWS\system32\ApnDatabase.xml
2015-05-13 17:00 - 2015-03-11 03:49 - 00024576 _____ (Microsoft Corporation) C:\WINDOWS\system32\sdbinst.exe
2015-05-13 17:00 - 2015-03-11 03:09 - 00021504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sdbinst.exe
2015-05-13 17:00 - 2015-03-06 05:08 - 02067968 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpdshext.dll
2015-05-13 17:00 - 2015-03-06 04:47 - 01696256 _____ (Microsoft Corporation) C:\WINDOWS\system32\wevtsvc.dll
2015-05-13 17:00 - 2015-03-06 04:43 - 01969664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wpdshext.dll
2015-05-13 17:00 - 2015-03-05 01:09 - 01429504 _____ (Microsoft Corporation) C:\WINDOWS\system32\diagtrack.dll
2015-05-13 17:00 - 2015-03-04 03:32 - 00172544 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Input.Inking.dll
2015-05-13 17:00 - 2015-03-04 03:12 - 00141824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Input.Inking.dll
2015-05-13 17:00 - 2015-01-30 02:53 - 02819584 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers.dll
2015-05-13 17:00 - 2014-11-14 08:58 - 00116736 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsDatabase.dll
2015-05-13 16:59 - 2015-04-21 19:14 - 24971776 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2015-05-13 16:59 - 2015-04-21 18:50 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2015-05-13 16:59 - 2015-04-21 18:50 - 00417792 _____ (Microsoft Corporation) C:\WINDOWS\system32\html.iec
2015-05-13 16:59 - 2015-04-21 18:49 - 02885120 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2015-05-13 16:59 - 2015-04-21 18:37 - 00633856 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieui.dll
2015-05-13 16:59 - 2015-04-21 18:35 - 00816640 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2015-05-13 16:59 - 2015-04-21 18:31 - 06025728 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2015-05-13 16:59 - 2015-04-21 18:24 - 19691008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2015-05-13 16:59 - 2015-04-21 18:13 - 00107520 _____ (Microsoft Corporation) C:\WINDOWS\system32\inseng.dll
2015-05-13 16:59 - 2015-04-21 18:11 - 00504320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2015-05-13 16:59 - 2015-04-21 18:09 - 00341504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\html.iec
2015-05-13 16:59 - 2015-04-21 18:08 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2015-05-13 16:59 - 2015-04-21 18:07 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll
2015-05-13 16:59 - 2015-04-21 18:05 - 00316928 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2015-05-13 16:59 - 2015-04-21 18:04 - 02278400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2015-05-13 16:59 - 2015-04-21 17:59 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2015-05-13 16:59 - 2015-04-21 17:58 - 00664576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2015-05-13 16:59 - 2015-04-21 17:52 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
2015-05-13 16:59 - 2015-04-21 17:49 - 00801280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2015-05-13 16:59 - 2015-04-21 17:49 - 00720384 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2015-05-13 16:59 - 2015-04-21 17:49 - 00374272 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2015-05-13 16:59 - 2015-04-21 17:46 - 02125824 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2015-05-13 16:59 - 2015-04-21 17:40 - 14401536 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2015-05-13 16:59 - 2015-04-21 17:38 - 00076288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
2015-05-13 16:59 - 2015-04-21 17:37 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll
2015-05-13 16:59 - 2015-04-21 17:36 - 00285696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2015-05-13 16:59 - 2015-04-21 17:32 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2015-05-13 16:59 - 2015-04-21 17:31 - 04305920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2015-05-13 16:59 - 2015-04-21 17:28 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll
2015-05-13 16:59 - 2015-04-21 17:27 - 02352128 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2015-05-13 16:59 - 2015-04-21 17:26 - 00688640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2015-05-13 16:59 - 2015-04-21 17:26 - 00327168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2015-05-13 16:59 - 2015-04-21 17:25 - 02052608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2015-05-13 16:59 - 2015-04-21 17:17 - 12828672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2015-05-13 16:59 - 2015-04-21 17:15 - 01547264 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2015-05-13 16:59 - 2015-04-21 17:03 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2015-05-13 16:59 - 2015-04-21 17:02 - 01882112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2015-05-13 16:59 - 2015-04-21 16:58 - 01310208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2015-05-13 16:59 - 2015-04-21 16:56 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2015-05-13 16:59 - 2015-04-14 00:48 - 04180480 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2015-05-13 16:59 - 2015-04-10 03:00 - 01996800 _____ (Microsoft Corporation) C:\WINDOWS\system32\DWrite.dll
2015-05-13 16:59 - 2015-04-10 02:50 - 01387008 _____ (Microsoft Corporation) C:\WINDOWS\system32\FntCache.dll
2015-05-13 16:59 - 2015-04-10 02:26 - 01560576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DWrite.dll
2015-05-13 16:59 - 2015-04-03 02:35 - 00445440 _____ (Microsoft Corporation) C:\WINDOWS\system32\PhotoMetadataHandler.dll
2015-05-13 16:59 - 2015-04-03 02:14 - 00364544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PhotoMetadataHandler.dll
2015-05-13 16:59 - 2015-03-13 04:02 - 00316416 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\udfs.sys
2015-05-13 16:59 - 2015-02-18 01:19 - 00186368 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpapisrv.dll
2015-05-12 13:46 - 2015-05-12 14:36 - 00000000 ____D () C:\Users\Christian\AppData\Roaming\QuickScan
2015-05-11 21:17 - 2015-05-11 21:16 - 00272808 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaws.exe
2015-05-11 21:16 - 2015-05-11 21:16 - 00176040 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaw.exe
2015-05-11 21:16 - 2015-05-11 21:16 - 00176040 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\java.exe
2015-05-11 21:16 - 2015-05-11 21:16 - 00098216 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll
2015-05-11 21:16 - 2015-05-11 21:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-05-11 21:16 - 2015-05-11 21:16 - 00000000 ____D () C:\Program Files (x86)\Java
2015-05-11 20:15 - 2015-05-11 20:15 - 02867656 _____ () C:\Users\Christian\Downloads\bitdefender_isecurity_v2015.exe
2015-05-10 21:02 - 2015-05-10 21:02 - 00000000 ____D () C:\ProgramData\Emsisoft
2015-05-10 20:54 - 2015-05-10 20:54 - 00001103 _____ () C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk
2015-05-10 20:54 - 2015-05-10 20:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Emsisoft Anti-Malware
2015-05-10 20:53 - 2015-05-17 13:42 - 00000000 ____D () C:\Program Files (x86)\Emsisoft Anti-Malware
2015-05-10 20:53 - 2015-03-23 23:17 - 00135800 _____ (Emsisoft GmbH) C:\WINDOWS\system32\Drivers\epp64.sys
2015-05-10 20:50 - 2015-05-10 20:50 - 01203488 _____ () C:\Users\Christian\Downloads\Emsisoft Anti Malware - CHIP-Installer.exe
2015-05-07 19:46 - 2015-05-11 16:43 - 00000000 ____D () C:\Program Files (x86)\CinemaPlus-3.2cV07.05
2015-05-07 19:45 - 2015-05-07 20:34 - 00000000 ____D () C:\Program Files (x86)\Edu App
2015-05-07 19:32 - 2015-05-10 22:47 - 00000000 ____D () C:\Users\Christian\AppData\Roaming\EB656F00-1431019934-815C-2C4C-7054D2E15182
2015-04-23 18:39 - 2015-04-23 18:47 - 00001985 _____ () C:\Users\Public\Desktop\Samsung Kies 3.lnk
2015-04-23 13:46 - 2015-04-23 13:46 - 00000000 ____D () C:\Users\Christian\AppData\Roaming\IsolatedStorage
2015-04-23 13:46 - 2015-04-23 13:46 - 00000000 ____D () C:\ProgramData\IsolatedStorage
2015-04-23 13:41 - 2015-04-23 13:41 - 00000000 ____D () C:\Spacekace
2015-04-18 08:53 - 2015-04-18 08:53 - 00000222 _____ () C:\Users\Christian\Desktop\Rising World.url
2015-04-17 23:32 - 2015-04-17 23:32 - 00001742 _____ () C:\Users\Christian\Desktop\Counter-Strike WaRzOnE.lnk
2015-04-17 23:30 - 2015-04-17 23:30 - 00000000 ____D () C:\Games
2015-04-17 23:26 - 2015-04-17 23:26 - 00000000 ____D () C:\Program Files (x86)\Valve

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-05-17 13:52 - 2013-04-07 20:41 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2015-05-17 13:49 - 2014-10-26 16:35 - 01307010 _____ () C:\WINDOWS\WindowsUpdate.log
2015-05-17 13:41 - 2013-08-22 16:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2015-05-17 13:00 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2015-05-17 12:47 - 2013-08-22 16:44 - 00414016 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2015-05-17 12:47 - 2013-08-22 15:25 - 00262144 ___SH () C:\WINDOWS\system32\config\BBI
2015-05-17 12:13 - 2013-06-16 16:02 - 00904704 ___SH () C:\Users\Christian\Desktop\Thumbs.db
2015-05-17 11:29 - 2014-10-31 23:24 - 00003934 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{543C5195-C36C-452D-A5D5-B7493A999655}
2015-05-16 19:58 - 2013-04-08 23:30 - 00000000 ____D () C:\Users\Christian\AppData\Roaming\vlc
2015-05-16 19:46 - 2014-09-24 08:17 - 02121430 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2015-05-16 19:46 - 2014-09-24 07:43 - 01021576 _____ () C:\WINDOWS\system32\perfh007.dat
2015-05-16 19:46 - 2014-09-24 07:43 - 00243696 _____ () C:\WINDOWS\system32\perfc007.dat
2015-05-16 15:17 - 2014-10-26 16:32 - 00000000 ___DC () C:\WINDOWS\Panther
2015-05-16 15:17 - 2014-07-07 23:08 - 00000000 ____D () C:\Program Files (x86)\Steam
2015-05-16 15:17 - 2013-04-09 00:05 - 00000000 ____D () C:\Users\Christian\AppData\Local\CrashDumps
2015-05-16 15:17 - 2013-04-08 00:45 - 00000000 ____D () C:\Users\Christian\AppData\Roaming\DAEMON Tools Lite
2015-05-16 15:00 - 2012-12-20 06:30 - 00000000 ____D () C:\ProgramData\EgisTec IPS
2015-05-16 10:12 - 2014-12-21 18:41 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-05-16 10:08 - 2013-08-22 17:36 - 00000000 ___RD () C:\WINDOWS\ImmersiveControlPanel
2015-05-16 08:02 - 2012-07-26 09:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
2015-05-15 16:41 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2015-05-14 10:45 - 2013-04-06 07:54 - 00000000 ____D () C:\Users\Christian\AppData\Local\Packages
2015-05-14 10:32 - 2014-12-16 17:56 - 00000000 ____D () C:\WINDOWS\Minidump
2015-05-14 10:32 - 2013-08-22 17:36 - 00000000 ___RD () C:\WINDOWS\Offline Web Pages
2015-05-14 09:50 - 2012-12-20 06:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acer
2015-05-14 09:50 - 2012-12-20 06:28 - 00000000 ____D () C:\Program Files (x86)\Acer
2015-05-14 09:37 - 2012-12-20 06:29 - 00000000 ____D () C:\Program Files\Acer
2015-05-13 23:46 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\rescache
2015-05-13 23:24 - 2015-04-03 15:38 - 00002457 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-05-13 21:18 - 2013-08-22 15:36 - 00000000 ____D () C:\WINDOWS\system32\AdvancedInstallers
2015-05-13 20:47 - 2013-08-22 15:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM
2015-05-13 19:36 - 2014-01-08 22:07 - 00000000 ____D () C:\WINDOWS\system32\MRT
2015-05-13 19:31 - 2013-04-08 00:02 - 140425016 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2015-05-13 18:23 - 2014-09-24 08:00 - 00000000 ____D () C:\Program Files\Windows Journal
2015-05-08 17:02 - 2014-12-21 18:41 - 00001147 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-05-07 20:36 - 2014-10-26 16:42 - 00000000 ____D () C:\Users\Christian
2015-05-07 20:34 - 2015-04-04 12:21 - 00000000 ___SD () C:\WINDOWS\system32\GWX
2015-05-07 20:34 - 2014-11-15 05:11 - 00000000 ____D () C:\Users\Christian\Documents\DayZ
2015-05-07 20:15 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\registration
2015-05-02 20:14 - 2013-04-14 01:12 - 00000000 ____D () C:\Users\Christian\Documents\TmForever
2015-04-23 18:47 - 2014-06-22 15:03 - 00000000 ____D () C:\Program Files (x86)\Samsung
2015-04-23 18:39 - 2014-06-22 15:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung
2015-04-23 18:39 - 2012-12-20 06:29 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-04-23 16:53 - 2013-04-14 18:19 - 00000000 ____D () C:\Users\Christian\AppData\Local\Downloaded Installations
2015-04-17 23:21 - 2015-02-18 21:56 - 00000000 ____D () C:\Users\Christian\Desktop\The Walking Dead Staffel 5 Teil 2
2015-04-17 23:02 - 2013-04-08 19:11 - 00000000 ____D () C:\Users\Christian\Games

==================== Files in the root of some directories =======

2015-05-13 20:47 - 2015-05-13 20:47 - 0622119 _____ () C:\ProgramData\1431542459.bdinstall.bin
2013-02-24 23:58 - 2013-02-24 23:58 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

Some content of TEMP:
====================
C:\Users\Christian\AppData\Local\Temp\Quarantine.exe
C:\Users\Christian\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-05-17 13:25

==================== End Of Log ============================
--- --- ---

--- --- ---


Addition

Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 16-05-2015 02
Ran by Christian at 2015-05-17 13:54:22
Running from C:\Users\Christian\Desktop
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-704110784-328736849-532702743-500 - Administrator - Disabled)
Christian (S-1-5-21-704110784-328736849-532702743-1002 - Administrator - Enabled) => C:\Users\Christian
Gast (S-1-5-21-704110784-328736849-532702743-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-704110784-328736849-532702743-1004 - Limited - Enabled)
UpdatusUser (S-1-5-21-704110784-328736849-532702743-1001 - Limited - Enabled) => C:\Users\UpdatusUser

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Bitdefender Antivirus (Enabled - Up to date) {9A0813D8-CED6-F86B-072E-28D2AF25A83D}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Emsisoft Anti-Malware (Enabled - Up to date) {2F44E1F9-850B-1C7A-0E56-EB2E0A3E20C9}
AS: Bitdefender Spyware-Schutz (Enabled - Up to date) {2169F23C-E8EC-F7E5-3D9E-13A0D4A2E280}
AS: Emsisoft Anti-Malware (Enabled - Up to date) {9425001D-A331-13F4-34E6-D05C71B96A74}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Bitdefender Firewall (Enabled) {A23392FD-84B9-F933-2C71-81E751F6EF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.11) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.11 - Adobe Systems Incorporated)
Bitdefender Internet Security 2015 (HKLM\...\Bitdefender) (Version: 18.22.0.1521 - Bitdefender)
CCleaner (HKLM\...\CCleaner) (Version: 5.05 - Piriform)
CyberGhost 5 (HKLM\...\CyberGhost VPN 5_is1) (Version:  - CyberGhost S.R.L.)
DayZ (HKLM-x32\...\Steam App 221100) (Version:  - Bohemia Interactive)
Emsisoft Anti-Malware (HKLM-x32\...\{5502032C-88C1-4303-99FE-B5CBD7684CEA}_is1) (Version: 9.0 - Emsisoft Ltd.)
ETDWare PS/2-X64 11.6.16.003_WHQL (HKLM\...\Elantech) (Version: 11.6.16.003 - ELAN Microelectronic Corp.)
Free Studio version 6.5.0.219 (HKLM-x32\...\Free Studio_is1) (Version: 6.5.0.219 - DVDVideoSoft Ltd.)
Garry's Mod (HKLM-x32\...\Steam App 4000) (Version:  - Facepunch Studios)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3621 - Intel Corporation)
Java 7 Update 80 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217080FF}) (Version: 7.0.800 - Oracle)
Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4420.1017 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Mozilla Firefox 38.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 38.0.1 (x86 de)) (Version: 38.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 36.0 - Mozilla)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MyFreeCodec (HKU\S-1-5-21-704110784-328736849-532702743-1002\...\MyFreeCodec) (Version:  - )
No More Room in Hell (HKLM-x32\...\Steam App 224260) (Version:  - No More Room in Hell Team)
Portal (HKLM-x32\...\Steam App 400) (Version:  - Valve)
Portal 2 (HKLM-x32\...\Steam App 620) (Version:  - Valve)
Qualcomm Atheros Bluetooth Suite (64) (HKLM\...\{A84A4FB1-D703-48DB-89E0-68B6499D2801}) (Version: 8.0.1.305 - Qualcomm Atheros Communications)
Qualcomm Atheros WLAN and Bluetooth Client Installation Program (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 12.07 - Qualcomm Atheros)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6695 - Realtek Semiconductor Corp.)
Resident Evil / biohazard HD REMASTER (HKLM-x32\...\Steam App 304240) (Version:  - CAPCOM Co., Ltd.)
Rising World (HKLM-x32\...\Steam App 324080) (Version:  - JIW-Games)
Samsung Kies3 (HKLM-x32\...\InstallShield_{88547073-C566-4895-9005-EBE98EA3F7C7}) (Version: 3.2.15041.2 - Samsung Electronics Co., Ltd.)
Samsung Kies3 (x32 Version: 3.2.15041.2 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.49.0 - SAMSUNG Electronics Co., Ltd.)
Sniper Elite 3 (HKLM-x32\...\Steam App 238090) (Version:  - Rebellion)
Stranded Deep (HKLM-x32\...\Steam App 313120) (Version:  - Beam Team Games)
System Requirements Lab CYRI (HKLM-x32\...\{906B34E5-573C-445A-A5D3-40B6BF0A2EC4}) (Version: 6.0.21.0 - Husdawg, LLC)
TAP-Windows 9.9.2 (HKLM\...\TAP-Windows) (Version: 9.9.2 - )
Visual Studio 2005 Tools for Office Second Edition Runtime (HKLM-x32\...\Microsoft Visual Studio 2005 Tools for Office Runtime) (Version:  - Microsoft Corporation)
Visual Studio Tools for the Office system 3.0 Runtime (HKLM-x32\...\Visual Studio Tools for the Office system 3.0 Runtime) (Version:  - Microsoft Corporation)
Visual Studio Tools for the Office system 3.0 Runtime Service Pack 1 (KB949258) (HKLM-x32\...\{8FB53850-246A-3507-8ADE-0060093FFEA6}.KB949258) (Version: 1 - Microsoft Corporation)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.1 - VideoLAN)
WinRAR 5.21 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.21.0 - win.rar GmbH)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-704110784-328736849-532702743-1002_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\WINDOWS\system32\igfxEM.exe (Intel Corporation)

==================== Restore Points  =========================

22-04-2015 21:29:12 avast! antivirus system restore point
02-05-2015 17:33:22 Removed FlatOut2
07-05-2015 20:08:05 Wiederherstellungsvorgang
13-05-2015 16:59:20 Windows Update
16-05-2015 14:59:37 Removed Shredder.

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {080FB629-55D9-4AD3-A46A-FD916EBBED5E} - System32\Tasks\{31DDBD37-5DB7-4030-8064-10B0CAA806C3} => C:\Program Files\COMODO\COMODO Internet Security\cistray.exe
Task: {0B087CB7-4F31-477E-8D5E-F8C18D54180C} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-04-23] (Piriform Ltd)
Task: {2BF1BDE9-6FC4-4027-B638-E97D5F4FBF0A} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2015-04-10] (Oracle Corporation)
Task: {302D3EAD-291D-412A-8C8A-5841FFDB23A5} - System32\Tasks\ALU => C:\Program Files (x86)\Acer\Live Updater\updater.exe [2012-11-06] ()
Task: {3B608890-E66B-425F-B955-3328FDBCA029} - \Optimize Start Menu Cache Files-S-1-5-21-704110784-328736849-532702743-1002 No Task File <==== ATTENTION
Task: {4B042DAA-3E20-4F9A-9514-863E876D93AD} - System32\Tasks\DeviceDetector => C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe
Task: {4E7A3090-9FED-46F0-88EF-9617FC71C6A4} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-24] (Microsoft Corporation)
Task: {4F3912ED-1360-4E60-8BDB-7E1C1483D2CA} - \Optimize Start Menu Cache Files-S-1-5-21-704110784-328736849-532702743-500 No Task File <==== ATTENTION
Task: {5267CCD3-2130-4C4F-8253-6597C8A34B00} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-04-14] (Adobe Systems Incorporated)
Task: {5A47948A-236C-459B-9563-0F31A2CFF555} - System32\Tasks\Power Management => C:\Program Files\Acer\Acer Power Management\ePowerTray.exe [2012-10-23] (Acer Incorporated)
Task: {6D4610C5-7F46-4D1C-9462-45EB58424D12} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {720F237C-B6FC-400C-931A-3CCAB5DF0AD3} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxcontent => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-24] (Microsoft Corporation)
Task: {7926FA87-DA5C-4ECC-8267-781CFD8C0023} - System32\Tasks\ALUAgent => C:\Program Files (x86)\Acer\Live Updater\liveupdater_agent.exe [2012-06-21] ()
Task: {8ED5561B-AC38-4352-9653-1D29923F7389} - System32\Tasks\Microsoft\Windows\Setup\gwx\runappraiser => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-24] (Microsoft Corporation)
Task: {973D96C0-7F96-46B8-851D-CE82DB8767D2} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-05-13] (Microsoft Corporation)
Task: {B640284A-9443-485F-ACA4-EEA591BA44A3} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-03-24] (Microsoft Corporation)
Task: {D9F0462D-76DC-4445-AB75-8E1D0695B8FC} - System32\Tasks\PMMUpdate => C:\Program Files\EgisTec IPS\PMMUpdate.exe
Task: {EAC1663F-40B1-4CFE-9A44-FEAAB2C7E5CF} - System32\Tasks\EgisUpdate => C:\Program Files\EgisTec IPS\EgisUpdate.exe
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (Whitelisted) ==============

2013-09-05 03:36 - 2013-09-05 03:36 - 00013088 _____ () C:\Program Files\NVIDIA Corporation\CoProcManager\detoured.dll
2015-05-13 20:46 - 2014-08-27 16:31 - 00265080 _____ () C:\Program Files\Bitdefender\Bitdefender 2015\txmlutil.dll
2015-05-13 20:46 - 2013-09-03 14:29 - 00101328 _____ () C:\Program Files\Bitdefender\Bitdefender 2015\bdmetrics.dll
2015-05-13 20:46 - 2015-04-01 18:05 - 00003072 _____ () C:\Program Files\Bitdefender\Bitdefender 2015\UI\accessl.ui
2015-05-13 20:46 - 2012-10-29 14:22 - 00152816 _____ () C:\Program Files\Bitdefender\Bitdefender 2015\bdfwcore.dll
2015-05-13 20:54 - 2015-05-13 20:54 - 00790368 _____ () C:\Program Files\Bitdefender\Bitdefender 2015\otengines_00350_002\ashttpbr.mdl
2015-05-13 20:54 - 2015-05-13 20:54 - 00711064 _____ () C:\Program Files\Bitdefender\Bitdefender 2015\otengines_00350_002\ashttpdsp.mdl
2015-05-13 20:54 - 2015-05-13 20:54 - 02683520 _____ () C:\Program Files\Bitdefender\Bitdefender 2015\otengines_00350_002\ashttpph.mdl
2015-05-13 20:54 - 2015-05-13 20:54 - 01326504 _____ () C:\Program Files\Bitdefender\Bitdefender 2015\otengines_00350_002\ashttprbl.mdl
2013-09-07 02:48 - 2013-09-07 02:48 - 00011264 _____ () C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\Modules\ActivateDesktopDebugger\ActivateDesktopDebugger.dll
2013-09-07 02:45 - 2013-09-07 02:45 - 00086016 _____ () C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\Modules\Map\MAP.dll
2013-09-07 02:52 - 2013-09-07 02:52 - 00012928 _____ () C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe
2015-05-13 20:45 - 2014-08-27 16:30 - 00204280 _____ () C:\Program Files\Bitdefender\Bitdefender 2015\antispam32\bdwteff\components\txmlutil.dll
2015-05-13 20:45 - 2015-02-06 14:51 - 00067808 _____ () C:\Program Files\Bitdefender\Bitdefender 2015\antispam32\bdwteff\components\bdwtxff.dll
2013-02-24 23:45 - 2012-06-25 04:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\WINDOWS\system32\audiodg.exe:$CmdTcID
AlternateDataStreams: C:\WINDOWS\system32\AudioEndpointBuilder.dll:$CmdTcID
AlternateDataStreams: C:\WINDOWS\system32\AudioEng.dll:$CmdTcID
AlternateDataStreams: C:\WINDOWS\system32\AUDIOKSE.dll:$CmdTcID
AlternateDataStreams: C:\WINDOWS\system32\AudioSes.dll:$CmdTcID
AlternateDataStreams: C:\WINDOWS\system32\audiosrv.dll:$CmdTcID
AlternateDataStreams: C:\WINDOWS\system32\ci.dll:$CmdTcID
AlternateDataStreams: C:\WINDOWS\system32\EncDump.dll:$CmdTcID
AlternateDataStreams: C:\WINDOWS\system32\Faultrep.dll:$CmdTcID
AlternateDataStreams: C:\WINDOWS\system32\TSWbPrxy.exe:$CmdTcID
AlternateDataStreams: C:\WINDOWS\system32\wer.dll:$CmdTcID
AlternateDataStreams: C:\WINDOWS\system32\werdiagcontroller.dll:$CmdTcID
AlternateDataStreams: C:\WINDOWS\system32\WerFault.exe:$CmdTcID
AlternateDataStreams: C:\WINDOWS\system32\WerFaultSecure.exe:$CmdTcID
AlternateDataStreams: C:\WINDOWS\system32\wermgr.exe:$CmdTcID
AlternateDataStreams: C:\WINDOWS\SysWOW64\AudioEng.dll:$CmdTcID
AlternateDataStreams: C:\WINDOWS\SysWOW64\AUDIOKSE.dll:$CmdTcID
AlternateDataStreams: C:\WINDOWS\SysWOW64\AudioSes.dll:$CmdTcID
AlternateDataStreams: C:\WINDOWS\SysWOW64\Faultrep.dll:$CmdTcID
AlternateDataStreams: C:\WINDOWS\SysWOW64\wer.dll:$CmdTcID
AlternateDataStreams: C:\WINDOWS\SysWOW64\werdiagcontroller.dll:$CmdTcID
AlternateDataStreams: C:\WINDOWS\SysWOW64\WerFault.exe:$CmdTcID
AlternateDataStreams: C:\WINDOWS\SysWOW64\WerFaultSecure.exe:$CmdTcID
AlternateDataStreams: C:\WINDOWS\SysWOW64\wermgr.exe:$CmdTcID
AlternateDataStreams: C:\WINDOWS\system32\Drivers\browserMon.sys:$CmdTcID
AlternateDataStreams: C:\WINDOWS\system32\Drivers\ssudbus.sys:$CmdTcID
AlternateDataStreams: C:\WINDOWS\system32\Drivers\ssudmdm.sys:$CmdTcID
AlternateDataStreams: C:\Users\Christian\Desktop\AdwCleaner_4.204.exe:BDU
AlternateDataStreams: C:\Users\Christian\Desktop\FRST64.exe:BDU
AlternateDataStreams: C:\Users\Christian\Desktop\JRT.exe:BDU
AlternateDataStreams: C:\Users\Christian\Desktop\tdsskiller.exe:BDU
AlternateDataStreams: C:\Users\Christian\Downloads\Bitdefender Rescue CD - CHIP-Installer.exe:BDU
AlternateDataStreams: C:\Users\Christian\Downloads\ccsetup505_slim.exe:BDU
AlternateDataStreams: C:\Users\Christian\Downloads\Intel Turbo Boost Technology Monitor - CHIP-Installer.exe:$CmdTcID
AlternateDataStreams: C:\Users\Christian\Downloads\Intel Turbo Boost Technology Monitor - CHIP-Installer.exe:$CmdZnID
AlternateDataStreams: C:\Users\Christian\Downloads\JRT_6.7.0.exe:BDU

==================== Safe Mode (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, the associated entry will be removed from the registry.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-704110784-328736849-532702743-1001\Control Panel\Desktop\\Wallpaper ->
HKU\S-1-5-21-704110784-328736849-532702743-1002\Control Panel\Desktop\\Wallpaper -> C:\Users\Christian\Pictures\Wallpapers\467717_601845359835397_1112348978_o.jpg
DNS Servers: 192.168.178.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

HKLM\...\StartupApproved\Run32: => "SunJavaUpdateSched"
HKLM\...\StartupApproved\Run32: => "LManager"
HKLM\...\StartupApproved\Run32: => "KiesTrayAgent"
HKU\S-1-5-21-704110784-328736849-532702743-1002\...\StartupApproved\Run: => "DAEMON Tools Lite"
HKU\S-1-5-21-704110784-328736849-532702743-1002\...\StartupApproved\Run: => "Amazon Music"
HKU\S-1-5-21-704110784-328736849-532702743-1002\...\StartupApproved\Run: => "CCleaner Monitoring"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{8914F7EB-5C2D-479D-B142-B925A8BF5A2E}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{EAA8FA2C-25A5-4108-880D-3EB277DCEC37}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{27457105-AC88-4347-9B9D-D5A43633415B}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{7C3673CA-582A-4C53-A1A9-3738FAB25BB6}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{125D3783-B3FE-4854-9A03-1B54500F6EF9}] => (Block) C:\games\counter-strike\hl.exe
FirewallRules: [{61EA007C-BF96-428B-85DD-7A42BB91E5A5}] => (Block) C:\games\counter-strike\hl.exe
FirewallRules: [UDP Query User{BD89BFF8-0D9F-430E-A211-DF7ED21F536B}C:\games\counter-strike\hl.exe] => (Allow) C:\games\counter-strike\hl.exe
FirewallRules: [TCP Query User{D9AC218E-050C-496C-8301-F0F1033F14DD}C:\games\counter-strike\hl.exe] => (Allow) C:\games\counter-strike\hl.exe
FirewallRules: [{EB158327-2CD8-4786-8831-7ABD4BED50E5}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{F0D97D86-E00A-493E-AF46-2EE5F9EE855D}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{7F23D52C-3F8E-4A16-A7BD-87D7EB0EFBFB}] => (Allow) C:\Program Files (x86)\Acer\clear.fi SDK21\Video\VideoPlayer.exe
FirewallRules: [{F152C521-8465-42B8-8BF8-B667F1E2A063}] => (Allow) C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe
FirewallRules: [{F871B592-B65E-4D3E-B2C9-D2B98DCD8032}] => (Allow) C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe
FirewallRules: [{1928E3AD-0F76-46CA-A8D0-6ADB77113317}] => (Allow) C:\Program Files (x86)\Spotify\spotify.exe
FirewallRules: [{AA582F3A-F1E1-4698-86A5-962D3EC6DCAA}] => (Allow) C:\Program Files (x86)\Spotify\spotify.exe
FirewallRules: [{5F9A7A9C-78E4-441B-AE04-F4E2B1A1ACCB}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [{F02043A8-87CB-401C-8B94-A5B19A2F28C0}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [{2CCE4E60-ECB6-478B-8625-52E7796ECA9C}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\nmrih\sdk\hl2.exe
FirewallRules: [{47EF2E1C-8B6B-4B67-8D7E-1CD8B1469A21}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\nmrih\sdk\hl2.exe
FirewallRules: [{1774D4DE-9C7E-4982-AB47-25A7E2EF61DE}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\DayZ\DayZ.exe
FirewallRules: [{DF2EDA05-C720-41AE-8439-9D8931D9788C}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\DayZ\DayZ.exe
FirewallRules: [TCP Query User{EFE0391D-C338-49D6-B395-7668C5C820D7}C:\program files (x86)\tmnationsforever\tmforever.exe] => (Block) C:\program files (x86)\tmnationsforever\tmforever.exe
FirewallRules: [UDP Query User{3BD5EF1D-9519-4AC7-93B9-9FDE236FC4D8}C:\program files (x86)\tmnationsforever\tmforever.exe] => (Block) C:\program files (x86)\tmnationsforever\tmforever.exe
FirewallRules: [{D86477A0-F68D-40C1-A330-A2BAA874A994}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\DayZ\DayZ_BE.exe
FirewallRules: [{C6E9EDBD-CAC1-482A-A9D6-B40F706E7822}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\DayZ\DayZ_BE.exe
FirewallRules: [{0F74897A-69CD-45CE-9BB1-AC90CD3F117B}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Sniper Elite 3\Launcher\Sniper3Launcher.exe
FirewallRules: [{DAF9DFF3-63CF-4137-B09A-5E9842C967B7}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Sniper Elite 3\Launcher\Sniper3Launcher.exe
FirewallRules: [{2D7F0786-DB0B-46A5-A3AA-124EE5C92503}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{30589744-1C80-41A2-AA24-A2ADCDD78136}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{3DCD2A4F-ED6B-4AE7-A5C9-E0E109EDAAF8}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Resident Evil Biohazard HD REMASTER\bhd.exe
FirewallRules: [{47270464-A214-4C74-91A9-1BC9F1884D9D}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Resident Evil Biohazard HD REMASTER\bhd.exe
FirewallRules: [{71D62F29-EDC2-4BD2-A01C-E19E1F4C8B68}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\GarrysMod\hl2.exe
FirewallRules: [{A4DF7617-5674-4749-881E-FD7353D4CA12}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\GarrysMod\hl2.exe
FirewallRules: [{3B534B64-9921-4033-8511-653CDDCB7D0B}] => (Allow) C:\Program Files (x86)\DVDVideoSoft\Free Torrent Download\FreeTorrentDownload.exe
FirewallRules: [{19402204-D1A6-48BE-8345-13033241418A}] => (Allow) C:\Program Files (x86)\DVDVideoSoft\Free Torrent Download\FreeTorrentDownload.exe
FirewallRules: [{284847C8-D0A1-4705-9357-969C929FB4A9}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Stranded Deep\Stranded_Deep_x64.exe
FirewallRules: [{00A9EE9B-2CE3-49A7-BABD-A86BDA9A1031}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Stranded Deep\Stranded_Deep_x64.exe
FirewallRules: [TCP Query User{DE3DEE63-63F2-41B1-BC47-7DF852308F12}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{A8BF8E59-12E0-447D-87BE-D0E93613C1EE}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [{EAF2E745-5006-45A5-9D77-974A39042A7D}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Portal 2\portal2.exe
FirewallRules: [{D287467F-960E-474F-A846-624490942395}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Portal 2\portal2.exe
FirewallRules: [{D24A8E01-FA14-487B-855F-A8D4C6046D4C}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Portal\hl2.exe
FirewallRules: [{78362A2A-81CB-46A6-BBB3-70831E2432FF}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Portal\hl2.exe
FirewallRules: [TCP Query User{13EECDE0-D1D7-4BBB-BC95-8D948E2E0C03}C:\games\counter-strike\hltv.exe] => (Block) C:\games\counter-strike\hltv.exe
FirewallRules: [UDP Query User{CB8C579F-2423-4CF8-952D-CBA419E1E034}C:\games\counter-strike\hltv.exe] => (Block) C:\games\counter-strike\hltv.exe
FirewallRules: [{0E9E5F8F-61BA-49C8-A2B6-0589157BB26F}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\RisingWorld\risingworldx64.exe
FirewallRules: [{E92DDF0B-450E-4847-A243-9FE4E29C80AF}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\RisingWorld\risingworldx64.exe

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (05/17/2015 01:27:53 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: BITSC:\Windows\System32\bitsperf.dll8

Error: (05/17/2015 01:15:01 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: nvxdsync.exe, Version: 8.17.13.717, Zeitstempel: 0x5077ae57
Name des fehlerhaften Moduls: nvxdsync.exe, Version: 8.17.13.717, Zeitstempel: 0x5077ae57
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000041691
ID des fehlerhaften Prozesses: 0x520
Startzeit der fehlerhaften Anwendung: 0xnvxdsync.exe0
Pfad der fehlerhaften Anwendung: nvxdsync.exe1
Pfad des fehlerhaften Moduls: nvxdsync.exe2
Berichtskennung: nvxdsync.exe3
Vollständiger Name des fehlerhaften Pakets: nvxdsync.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: nvxdsync.exe5

Error: (05/16/2015 03:07:56 PM) (Source: Microsoft-Windows-RestartManager) (EventID: 10007) (User: Chris)
Description: Die Anwendung oder der Dienst "EgisUpdate Release Application" konnte nicht neu gestartet werden.

Error: (05/16/2015 03:07:37 PM) (Source: Microsoft-Windows-RestartManager) (EventID: 10006) (User: Chris)
Description: Die Anwendung oder der Dienst "PMM Update Application" konnte nicht heruntergefahren werden.

Error: (05/16/2015 02:59:56 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".


Details:
AddWin32ServiceFiles: Unable to back up image of service EgisTec Ticket Service since QueryServiceConfig API failed

System Error:
Das System kann die angegebene Datei nicht finden.
.

Error: (05/14/2015 09:50:28 AM) (Source: Microsoft-Windows-RestartManager) (EventID: 10007) (User: Chris)
Description: Die Anwendung oder der Dienst "CCDMonitorService" konnte nicht neu gestartet werden.

Error: (05/14/2015 09:50:25 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: EnableWakeUpOption.exe, Version: 0.0.0.0, Zeitstempel: 0x500e38f6
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.3.9600.17415, Zeitstempel: 0x54504ade
Ausnahmecode: 0xe0434f4d
Fehleroffset: 0x00014598
ID des fehlerhaften Prozesses: 0x%9
Startzeit der fehlerhaften Anwendung: 0xEnableWakeUpOption.exe0
Pfad der fehlerhaften Anwendung: EnableWakeUpOption.exe1
Pfad des fehlerhaften Moduls: EnableWakeUpOption.exe2
Berichtskennung: EnableWakeUpOption.exe3
Vollständiger Name des fehlerhaften Pakets: EnableWakeUpOption.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: EnableWakeUpOption.exe5

Error: (05/14/2015 09:40:44 AM) (Source: Microsoft-Windows-RestartManager) (EventID: 10007) (User: Chris)
Description: Die Anwendung oder der Dienst "NTI IScheduleSvc" konnte nicht neu gestartet werden.

Error: (05/13/2015 11:23:46 PM) (Source: MsiInstaller) (EventID: 1024) (User: Chris)
Description: Produkt: Adobe Reader XI (11.0.10) - Deutsch - Update "{AC76BA86-7AD7-0000-2550-7A8C40011011}" konnte nicht installiert werden. Fehlercode 1625. Windows Installer kann Protokolle erstellen, um bei der Problembehandlung betreffend der Installation von Softwarepaketen behilflich zu sein. Verwenden Sie folgenden Link, um Anweisungen zur Aktivierung der Protokollierungsunterstützung zu erhalten: hxxp://go.microsoft.com/fwlink/?LinkId=23127

Error: (05/13/2015 08:49:08 PM) (Source: Microsoft-Windows-LocationProvider) (EventID: 2006) (User: NT-AUTORITÄT)
Description: There was an error with the Windows Location Provider database


System errors:
=============
Error: (05/17/2015 01:42:06 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "NTI IScheduleSvc" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error: (05/17/2015 01:42:03 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "CCDMonitorService" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error: (05/17/2015 01:26:17 PM) (Source: DCOM) (EventID: 10010) (User: Chris)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}

Error: (05/17/2015 01:19:58 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Media Player-Netzwerkfreigabedienst" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (05/17/2015 01:19:58 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Intel(R) Management and Security Application User Notification Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (05/17/2015 01:19:57 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "NVIDIA Update Service Daemon" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (05/17/2015 01:19:57 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "IconMan_R" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (05/17/2015 01:19:55 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "ePower Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (05/17/2015 01:19:51 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Presentation Foundation-Schriftartcache 3.0.0.0" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 0 Millisekunden durchgeführt: Neustart des Diensts.

Error: (05/17/2015 01:19:49 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "CyberGhost VPN 5 Client Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.


Microsoft Office Sessions:
=========================
Error: (05/17/2015 01:27:53 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: BITSC:\Windows\System32\bitsperf.dll8

Error: (05/17/2015 01:15:01 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: nvxdsync.exe8.17.13.7175077ae57nvxdsync.exe8.17.13.7175077ae57c0000005000000000004169152001d09092a8406deaC:\Program Files\NVIDIA Corporation\Display\nvxdsync.exeC:\Program Files\NVIDIA Corporation\Display\nvxdsync.exef516d8c3-fc85-11e4-becf-2cd05a0e662f

Error: (05/16/2015 03:07:56 PM) (Source: Microsoft-Windows-RestartManager) (EventID: 10007) (User: Chris)
Description: 1C:\Program Files\EgisTec IPS\EgisUpdate.exeEgisUpdate Release Application0213447240

Error: (05/16/2015 03:07:37 PM) (Source: Microsoft-Windows-RestartManager) (EventID: 10006) (User: Chris)
Description: 1C:\Program Files\EgisTec IPS\PmmUpdate.exePMM Update Application0211742360

Error: (05/16/2015 02:59:56 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description:
Details:
AddWin32ServiceFiles: Unable to back up image of service EgisTec Ticket Service since QueryServiceConfig API failed

System Error:
Das System kann die angegebene Datei nicht finden.

Error: (05/14/2015 09:50:28 AM) (Source: Microsoft-Windows-RestartManager) (EventID: 10007) (User: Chris)
Description: 0CCDMonitorService.exeCCDMonitorService03026217824080

Error: (05/14/2015 09:50:25 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: EnableWakeUpOption.exe0.0.0.0500e38f6KERNELBASE.dll6.3.9600.1741554504adee0434f4d00014598

Error: (05/14/2015 09:40:44 AM) (Source: Microsoft-Windows-RestartManager) (EventID: 10007) (User: Chris)
Description: 0IScheduleSvc.exeNTI IScheduleSvc03026217827200

Error: (05/13/2015 11:23:46 PM) (Source: MsiInstaller) (EventID: 1024) (User: Chris)
Description: Adobe Reader XI (11.0.10) - Deutsch{AC76BA86-7AD7-0000-2550-7A8C40011011}1625(NULL)(NULL)(NULL)

Error: (05/13/2015 08:49:08 PM) (Source: Microsoft-Windows-LocationProvider) (EventID: 2006) (User: NT-AUTORITÄT)
Description: -2147024883


CodeIntegrity Errors:
===================================
  Date: 2015-05-13 23:56:45.402
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume4\Program Files (x86)\Emsisoft Anti-Malware\a2hooks64.dll that did not meet the Store signing level requirements.

  Date: 2015-05-13 23:56:45.401
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume4\Program Files (x86)\Emsisoft Anti-Malware\a2hooks64.dll that did not meet the Store signing level requirements.

  Date: 2015-05-13 23:56:45.399
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume4\Program Files (x86)\Emsisoft Anti-Malware\a2hooks64.dll that did not meet the Store signing level requirements.

  Date: 2015-05-11 14:48:42.679
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume4\Program Files (x86)\Emsisoft Anti-Malware\a2hooks64.dll that did not meet the Store signing level requirements.

  Date: 2015-05-11 14:48:42.679
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume4\Program Files (x86)\Emsisoft Anti-Malware\a2hooks64.dll that did not meet the Store signing level requirements.

  Date: 2015-01-31 13:51:47.962
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.

  Date: 2015-01-31 13:45:00.126
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.

  Date: 2015-01-31 13:31:35.632
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.

  Date: 2015-01-31 13:09:29.143
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.

  Date: 2015-01-31 12:38:57.223
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.


==================== Memory info ===========================

Processor: Intel(R) Core(TM) i7-3632QM CPU @ 2.20GHz
Percentage of memory in use: 22%
Total physical RAM: 8010.27 MB
Available physical RAM: 6189.18 MB
Total Pagefile: 9290.27 MB
Available Pagefile: 6891.23 MB
Total Virtual: 131072 MB
Available Virtual: 131071.77 MB

==================== Drives ================================

Drive c: (Acer) (Fixed) (Total:913.26 GB) (Free:697.43 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: 6CCEFCDC)

Partition: GPT Partition Type.

==================== End Of Log ============================

Bootsektor 17.05.2015 22:55
Hallo,

drei Antiviruses sind zwei zuviel ;), entscheide dich für eins.

Keine Verwendung von Registrycleanern, diese machen mehr kaputt als schneller.

Schritt 1
Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).


Schritt 2
Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad.
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Sollte die Benutzeroberfläche noch in Englisch sein, klicke auf Settings und wähle bei Language Deutsch aus.
  • Klicke im Anschluss auf Suchlauf, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf jetzt starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Aktionen anwenden.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Suchlauf-Protokoll aus und klicke auf Ansicht. Wähle Exportieren auf Textdatei (.txt) und speichere die Datei als mbam.txt auf dem Desktop ab.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Schritt 3
Starte noch einmal FRST.
  • Setze den Haken bei addition.txt und drücke auf Scan.
  • Wenn der Scan abgeschlossen ist, werden zwei neue Logfiles FRST.txt und addition.txt erstellt und auf dem Desktop (oder in dem Verzeichnis in dem FRST liegt) gespeichert.
  • Poste den Inhalt dieser Logfiles bitte hier in deinen Thread.

Chris2128 18.05.2015 17:08
Hi Sandra :)
Ja ich weiß ;) avast hab ich schon runter geschmissen :) wenn ich emsisoft deinstalliere muss ich denn vorher die quarantäne löschen bzw. kann ich den inhalt bedenkenlos löschen?

Code:
# AdwCleaner v4.204 - Bericht erstellt 18/05/2015 um 16:55:12
# Aktualisiert 12/05/2015 von Xplode
# Datenbank : 2015-05-12.2 [Server]
# Betriebssystem : Windows 8.1  (x64)
# Benutzername : Christian - CHRIS
# Gestarted von : C:\Users\Christian\Desktop\AdwCleaner_4.204.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****


***** [ Geplante Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****


***** [ Internetbrowser ] *****

-\\ Internet Explorer v11.0.9600.17416


-\\ Mozilla Firefox v38.0.1 (x86 de)


-\\ Comodo Dragon v


*************************

AdwCleaner[R0].txt - [7613 Bytes] - [17/05/2015 12:42:58]
AdwCleaner[R1].txt - [915 Bytes] - [18/05/2015 16:52:18]
AdwCleaner[S0].txt - [7261 Bytes] - [17/05/2015 12:46:11]
AdwCleaner[S1].txt - [836 Bytes] - [18/05/2015 16:55:12]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [894  Bytes] ##########
So hier noch das MBAM, FRST und Addition ;)

Code:
Malwarebytes Anti-Malware
www.malwarebytes.org

Suchlauf Datum: 18.05.2015
Suchlauf-Zeit: 17:12:47
Logdatei: MBAM.txt
Administrator: Ja

Version: 2.01.6.1022
Malware Datenbank: v2015.05.18.04
Rootkit Datenbank: v2015.05.16.01
Lizenz: Testversion
Malware Schutz: Aktiviert
Bösartiger Webseiten Schutz: Aktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 8.1
CPU: x64
Dateisystem: NTFS
Benutzer: Christian

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 415578
Verstrichene Zeit: 33 Min, 53 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(Keine schädliche Elemente gefunden)

Module: 0
(Keine schädliche Elemente gefunden)

Registrierungsschlüssel: 1
PUP.Optional.Babylon.A, HKU\S-1-5-18\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}, In Quarantäne, [001cf99cfe8c999d7c995402d92ae31d],

Registrierungswerte: 0
(Keine schädliche Elemente gefunden)

Registrierungsdaten: 0
(Keine schädliche Elemente gefunden)

Ordner: 3
PUP.Optional.CrossRider.A, C:\Program Files (x86)\CinemaPlus-3.2cV07.05, In Quarantäne, [96866e271d6dc96dbbdda72f0300dd23],
PUP.Optional.MultiPlug.A, C:\Users\Christian\AppData\Roaming\EB656F00-1431019934-815C-2C4C-7054D2E15182, In Quarantäne, [d943d7bed2b8162010fab0baea1bb14f],
PUP.Optional.EduApp.A, C:\Program Files (x86)\Edu App, In Quarantäne, [78a4870ed5b563d390eea62d6b981ce4],

Dateien: 3
PUP.Optional.CrossRider.A, C:\Program Files (x86)\CinemaPlus-3.2cV07.05\bgNova.html, In Quarantäne, [96866e271d6dc96dbbdda72f0300dd23],
PUP.Optional.MultiPlug.A, C:\Users\Christian\AppData\Roaming\EB656F00-1431019934-815C-2C4C-7054D2E15182\vnsg61F2.tmp, In Quarantäne, [d943d7bed2b8162010fab0baea1bb14f],
PUP.Optional.EduApp.A, C:\Program Files (x86)\Edu App\firefox@eduapphome.com.xpi, In Quarantäne, [78a4870ed5b563d390eea62d6b981ce4],

Physische Sektoren: 0
(Keine schädliche Elemente gefunden)


(end)

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 16-05-2015 02
Ran by Christian (administrator) on CHRIS on 18-05-2015 18:00:55
Running from C:\Users\Christian\Desktop
Loaded Profiles: UpdatusUser & Christian (Available profiles: UpdatusUser & Christian)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Bitdefender) C:\Program Files\Bitdefender\Bitdefender 2015\vsserv.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Emsisoft Ltd) C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe
(Windows (R) Win 7 DDK provider) C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\AdminService.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(Dritek System INC.) C:\Windows\RfBtnSvc64.exe
(Bitdefender) C:\Program Files\Bitdefender\Bitdefender 2015\updatesrv.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(CyberGhost S.R.L) C:\Program Files\CyberGhost 5\Service.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerTray.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Intel Corporation) C:\Windows\System32\igfxTray.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Atheros Communications) C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
() C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe
(Bitdefender) C:\Program Files\Bitdefender\Bitdefender 2015\bdagent.exe
(Bitdefender) C:\Program Files\Bitdefender\Bitdefender 2015\bdwtxag.exe
(Dolby Laboratories Inc.) C:\Dolby PCEE4\pcee4.exe
(Emsisoft Ltd) C:\Program Files (x86)\Emsisoft Anti-Malware\a2guard.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.3.9600.17709_none_fa7932f59afc2e40\TiWorker.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2873744 2012-11-20] (ELAN Microelectronics Corp.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12937872 2012-07-27] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1214608 2012-07-10] (Realtek Semiconductor)
HKLM\...\Run: [Bdagent] => C:\Program Files\Bitdefender\Bitdefender 2015\bdagent.exe [1691112 2015-03-12] (Bitdefender)
HKLM-x32\...\Run: [Dolby Home Theater v4] => C:\Dolby PCEE4\pcee4.exe [508656 2012-07-25] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [amd_dc_opt] => C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe [77824 2008-07-22] (AMD)
HKLM-x32\...\Run: [KiesTrayAgent] => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311616 2015-02-24] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [emsisoft anti-malware] => c:\program files (x86)\emsisoft anti-malware\a2guard.exe [4923832 2015-05-10] (Emsisoft Ltd)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [271744 2015-04-10] (Oracle Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
HKLM\...\Policies\Explorer\Run: [BtvStack] => C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe [132736 2013-09-07] (Atheros Communications)
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKU\S-1-5-21-704110784-328736849-532702743-1001\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [516608 2014-10-29] (Microsoft Corporation)
HKU\S-1-5-21-704110784-328736849-532702743-1002\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3672640 2013-03-14] (Disc Soft Ltd)
HKU\S-1-5-21-704110784-328736849-532702743-1002\...\Run: [Bitdefender-Geldbörse-Agent] => C:\Program Files\Bitdefender\Bitdefender 2015\bdwtxag.exe [790880 2015-01-15] (Bitdefender)
HKU\S-1-5-21-704110784-328736849-532702743-1002\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8204056 2015-04-23] (Piriform Ltd)
HKU\S-1-5-21-704110784-328736849-532702743-1002\...\MountPoints2: {cbf6e073-7ec8-11e2-be69-806e6f6e6963} - "D:\setup.exe"
HKU\S-1-5-21-704110784-328736849-532702743-1002\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\Ribbons.scr [132608 2014-10-29] (Microsoft Corporation)
AppInit_DLLs: c:\windows\system32\nvinitx.dll => c:\windows\system32\nvinitx.dll [168616 2013-09-05] (NVIDIA Corporation)
AppInit_DLLs: , C:\WINDOWS\system32\nvinitx.dll => C:\WINDOWS\system32\nvinitx.dll [168616 2013-09-05] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\WINDOWS\SysWOW64\nvinit.dll => C:\WINDOWS\SysWOW64\nvinit.dll [141336 2013-09-05] (NVIDIA Corporation)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-704110784-328736849-532702743-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://acer13.msn.com
HKU\S-1-5-21-704110784-328736849-532702743-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer13.msn.com
HKU\S-1-5-21-704110784-328736849-532702743-1002\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer13.msn.com
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-704110784-328736849-532702743-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Bitdefender-Geldbörse -> {1DAC0C53-7D23-4AB3-856A-B04D98CD982A} -> C:\Program Files\Bitdefender\Bitdefender 2015\pmbxie.dll [2015-01-28] (Bitdefender)
BHO-x32: Bitdefender-Geldbörse -> {1DAC0C53-7D23-4AB3-856A-B04D98CD982A} -> C:\Program Files\Bitdefender\Bitdefender 2015\Antispam32\pmbxie.dll [2015-01-28] (Bitdefender)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2015-05-11] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2015-05-11] (Oracle Corporation)
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  No File
Toolbar: HKLM - Bitdefender-Geldbörse - {1DAC0C53-7D23-4AB3-856A-B04D98CD982A} - C:\Program Files\Bitdefender\Bitdefender 2015\pmbxie.dll [2015-01-28] (Bitdefender)
Toolbar: HKLM-x32 - Bitdefender-Geldbörse - {1DAC0C53-7D23-4AB3-856A-B04D98CD982A} - C:\Program Files\Bitdefender\Bitdefender 2015\Antispam32\pmbxie.dll [2015-01-28] (Bitdefender)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Christian\AppData\Roaming\Mozilla\Firefox\Profiles\f1ovvaoh.default
FF DefaultSearchEngine: Google (avast)
FF DefaultSearchUrl: https://www.google.com/search/?trackid=sp-006
FF SearchEngineOrder.1: Google (avast)
FF SelectedSearchEngine: Google (avast)
FF Homepage: Goggle.de
FF Keyword.URL: https://www.google.com/search/?trackid=sp-006
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_17_0_0_169.dll [2015-04-14] ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-04-14] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-06-06] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-06-06] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.80.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll [2015-05-11] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.80.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2015-05-11] (Oracle Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.0 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-05-01] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-704110784-328736849-532702743-1002: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll No File
FF SearchPlugin: C:\Users\Christian\AppData\Roaming\Mozilla\Firefox\Profiles\f1ovvaoh.default\searchplugins\google-avast.xml [2015-05-08]
FF Extension: Adblock Plus Pop-up Addon - C:\Users\Christian\AppData\Roaming\Mozilla\Firefox\Profiles\f1ovvaoh.default\Extensions\adblockpopups@jessehakanen.net.xpi [2015-02-01]
FF HKLM\...\Thunderbird\Extensions: [bdThunderbird@bitdefender.com] - C:\Program Files\Bitdefender\Bitdefender 2015\bdtbext
FF Extension: Bitdefender Antispam Toolbar - C:\Program Files\Bitdefender\Bitdefender 2015\bdtbext [2015-05-13]
FF HKLM-x32\...\Firefox\Extensions: [bdwteff@bitdefender.com] - C:\Program Files\Bitdefender\Bitdefender 2015\antispam32\bdwteff
FF Extension: Bitdefender Wallet - C:\Program Files\Bitdefender\Bitdefender 2015\antispam32\bdwteff [2015-05-13]
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
FF HKLM-x32\...\Thunderbird\Extensions: [bdThunderbird@bitdefender.com] - C:\Program Files\Bitdefender\Bitdefender 2015\bdtbext

Chrome:
=======
CHR HKU\S-1-5-21-704110784-328736849-532702743-1002\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [cmaiofennmphjldldcpphcechfnnohja] - C:\Users\Christian\AppData\Local\AdTrustMedia\PrivDog\PrivDog_chrome.crx [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [fabcmochhfpldjekobfaaggijgohadih] - https://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 a2AntiMalware; C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe [5164328 2015-05-10] (Emsisoft Ltd)
R2 AtherosSvc; C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\adminservice.exe [312448 2013-09-07] (Windows (R) Win 7 DDK provider) [File not signed]
S3 BdDesktopParental; C:\Program Files\Bitdefender\Bitdefender 2015\bdparentalservice.exe [78144 2014-12-09] (Bitdefender)
S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [967040 2015-04-01] ()
S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-10-29] (Microsoft Corporation)
R2 CGVPNCliService; C:\Program Files\CyberGhost 5\Service.exe [64616 2014-11-03] (CyberGhost S.R.L)
S3 DeviceFastLaneService; C:\Program Files\Acer\Acer Device Fast-lane\DeviceFastLaneSvc.exe [469648 2012-11-17] (Acer Incorporated)
R2 DiagTrack; C:\Windows\system32\diagtrack.dll [1429504 2015-03-05] (Microsoft Corporation)
R3 ePowerSvc; C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe [658064 2012-10-23] (Acer Incorporated)
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [314696 2014-05-21] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-17] (Intel Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2015-04-14] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
R2 RfButtonDriverService; C:\Windows\RfBtnSvc64.exe [93296 2013-02-24] (Dritek System INC.)
R2 UPDATESRV; C:\Program Files\Bitdefender\Bitdefender 2015\updatesrv.exe [67320 2014-10-27] (Bitdefender)
R2 VSSERV; C:\Program Files\Bitdefender\Bitdefender 2015\vsserv.exe [1547936 2015-03-16] (Bitdefender)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-04] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-04] (Microsoft Corporation)
S2 CCDMonitorService; C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe [X]
S2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R0 avc3; C:\Windows\System32\DRIVERS\avc3.sys [1306464 2015-01-14] (BitDefender)
R3 avchv; C:\Windows\system32\DRIVERS\avchv.sys [262544 2015-01-23] (BitDefender)
R3 avckf; C:\Windows\System32\DRIVERS\avckf.sys [677104 2015-01-14] (BitDefender)
S0 bdelam; C:\Windows\System32\drivers\bdelam.sys [23568 2013-09-08] (Bitdefender)
R1 BdfNdisf; C:\Program Files\Common Files\Bitdefender\Bitdefender Firewall\bdfndisf6.sys [98768 2014-12-15] (BitDefender LLC)
R1 bdfwfpf; C:\Program Files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys [107008 2013-07-29] (BitDefender LLC)
S3 bdfwfpf_pc; C:\Program Files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf_pc.sys [121928 2013-07-02] (Bitdefender SRL)
S3 BDSandBox; C:\WINDOWS\system32\drivers\bdsandbox.sys [82824 2015-01-09] (BitDefender SRL)
R3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [77464 2013-09-07] (Qualcomm Atheros)
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-09-24] (Microsoft Corporation)
R3 dtsoftbus01; C:\Windows\System32\drivers\dtsoftbus01.sys [283200 2013-04-08] (DT Soft Ltd)
R1 epp64; C:\Windows\System32\DRIVERS\epp64.sys [135800 2015-03-23] (Emsisoft GmbH)
R0 gzflt; C:\Windows\System32\DRIVERS\gzflt.sys [160544 2015-02-24] (BitDefender LLC)
S3 Hamachi; C:\Windows\system32\DRIVERS\Hamdrv.sys [46136 2014-11-03] (LogMeIn Inc.)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [136408 2015-05-18] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2015-04-14] (Malwarebytes Corporation)
R3 Ps2Kb2Hid; C:\Windows\System32\drivers\aPs2Kb2Hid.sys [26736 2013-02-24] (Dritek System Inc.)
R0 trufos; C:\Windows\System32\DRIVERS\trufos.sys [452040 2014-10-15] (BitDefender S.R.L.)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-04] (Microsoft Corporation)
S3 EagleX64; \??\C:\WINDOWS\system32\drivers\EagleX64.sys [X]
S3 xhunter1; \??\C:\WINDOWS\xhunter1.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-05-18 18:00 - 2015-05-18 18:01 - 00017888 _____ () C:\Users\Christian\Desktop\FRST.txt
2015-05-18 17:57 - 2015-05-18 17:57 - 00002102 _____ () C:\Users\Christian\Desktop\MBAM.txt
2015-05-18 17:51 - 2015-05-18 17:51 - 00001936 _____ () C:\WINDOWS\PFRO.log
2015-05-18 17:17 - 2015-05-18 17:58 - 00003592 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-704110784-328736849-532702743-1002
2015-05-18 17:11 - 2015-05-18 17:53 - 00136408 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-05-18 17:11 - 2015-05-18 17:11 - 00001114 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-05-18 17:11 - 2015-05-18 17:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-05-18 17:11 - 2015-05-18 17:11 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-05-18 17:11 - 2015-05-18 17:11 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-05-18 17:11 - 2015-04-14 09:38 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2015-05-18 17:11 - 2015-04-14 09:37 - 00107736 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2015-05-18 17:11 - 2015-04-14 09:37 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2015-05-18 17:07 - 2015-05-18 17:08 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\Christian\Desktop\mbam-setup-2.1.6.1022.exe
2015-05-17 14:45 - 2015-05-17 14:45 - 00014728 _____ () C:\Users\Christian\Desktop\emsisoft quarantine.txt
2015-05-17 13:52 - 2015-05-18 18:01 - 00000000 ____D () C:\FRST
2015-05-17 13:45 - 2015-05-17 13:45 - 02107392 _____ (Farbar) C:\Users\Christian\Desktop\FRST64.exe
2015-05-17 13:42 - 2015-05-17 13:42 - 00000385 _____ () C:\Users\Christian\AppData\Roaminguser_gensett.xml
2015-05-17 13:36 - 2015-05-17 13:36 - 00001150 _____ () C:\Users\Christian\Desktop\JRT.txt
2015-05-17 13:16 - 2015-05-17 13:16 - 00000207 _____ () C:\WINDOWS\tweaking.com-regbackup-CHRIS-Windows-8.1-(64-bit).dat
2015-05-17 13:16 - 2015-05-17 13:16 - 00000000 ____D () C:\RegBackup
2015-05-17 12:55 - 2015-05-17 12:55 - 02719698 _____ (Thisisu) C:\Users\Christian\Desktop\JRT.exe
2015-05-17 12:42 - 2015-05-18 16:55 - 00000000 ____D () C:\AdwCleaner
2015-05-17 12:29 - 2015-05-17 12:29 - 02209792 _____ () C:\Users\Christian\Desktop\AdwCleaner_4.204.exe
2015-05-17 12:21 - 2015-05-17 14:10 - 00000146 _____ () C:\Users\Christian\Desktop\Neues Textdokument.txt
2015-05-17 12:14 - 2015-05-17 12:14 - 04197016 _____ (Kaspersky Lab ZAO) C:\Users\Christian\Desktop\tdsskiller.exe
2015-05-16 19:18 - 2015-05-16 19:18 - 02720307 _____ (Thisisu) C:\Users\Christian\Downloads\JRT_6.7.0.exe
2015-05-16 16:41 - 2015-05-18 17:52 - 00001796 _____ () C:\WINDOWS\setupact.log
2015-05-16 16:41 - 2015-05-16 16:41 - 00000000 _____ () C:\WINDOWS\setuperr.log
2015-05-16 15:53 - 2015-05-16 15:54 - 01203488 _____ () C:\Users\Christian\Downloads\Bitdefender Rescue CD - CHIP-Installer.exe
2015-05-16 14:37 - 2015-05-16 14:38 - 00360834 _____ () C:\Users\Christian\Documents\cc_20150516_143706.reg
2015-05-16 10:14 - 2015-05-05 19:59 - 00792568 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2015-05-16 10:14 - 2015-05-05 19:59 - 00178168 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2015-05-16 07:58 - 2014-04-16 01:35 - 00028352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aspnet_counters.dll
2015-05-16 07:58 - 2014-04-16 01:34 - 00029888 _____ (Microsoft Corporation) C:\WINDOWS\system32\aspnet_counters.dll
2015-05-16 07:48 - 2015-05-16 07:48 - 00000000 ____D () C:\Users\Christian\AppData\Temp
2015-05-15 14:01 - 2015-05-15 14:02 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-05-14 09:14 - 2015-05-14 09:14 - 00002792 _____ () C:\WINDOWS\System32\Tasks\CCleanerSkipUAC
2015-05-14 09:14 - 2015-05-14 09:14 - 00000838 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2015-05-14 09:13 - 2015-05-14 09:14 - 00000000 ____D () C:\Program Files\CCleaner
2015-05-14 09:11 - 2015-05-14 09:11 - 05248848 _____ (Piriform Ltd) C:\Users\Christian\Downloads\ccsetup505_slim.exe
2015-05-14 08:40 - 2015-05-14 08:40 - 00001144 _____ () C:\Users\Christian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Emsisoft Anti-Malware Guard.lnk
2015-05-13 21:19 - 2015-04-30 22:35 - 00124112 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 21:19 - 2015-04-30 22:35 - 00102608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 21:16 - 2015-05-13 21:16 - 00079192 _____ (BitDefender) C:\WINDOWS\system32\Drivers\bdvedisk.sys
2015-05-13 20:47 - 2015-05-13 20:47 - 00622119 _____ () C:\ProgramData\1431542459.bdinstall.bin
2015-05-13 20:47 - 2015-05-13 20:47 - 00000385 _____ () C:\WINDOWS\system32\user_gensett.xml
2015-05-13 20:46 - 2015-05-14 10:32 - 00000000 ____D () C:\ProgramData\BDLogging
2015-05-13 20:46 - 2015-05-13 20:46 - 00002213 _____ () C:\Users\Public\Desktop\Bitdefender Internet Security 2015.lnk
2015-05-13 20:46 - 2015-05-13 20:46 - 00000000 ____H () C:\WINDOWS\system32\Drivers\Msft_Kernel_avchv_01009.Wdf
2015-05-13 20:46 - 2015-05-13 20:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bitdefender 2015
2015-05-13 20:46 - 2015-01-23 16:30 - 00262544 _____ (BitDefender) C:\WINDOWS\system32\Drivers\avchv.sys
2015-05-13 20:46 - 2015-01-14 13:13 - 00677104 _____ (BitDefender) C:\WINDOWS\system32\Drivers\avckf.sys
2015-05-13 20:46 - 2015-01-14 13:07 - 01306464 _____ (BitDefender) C:\WINDOWS\system32\Drivers\avc3.sys
2015-05-13 20:46 - 2015-01-09 11:59 - 00082824 _____ (BitDefender SRL) C:\WINDOWS\system32\Drivers\bdsandbox.sys
2015-05-13 20:46 - 2015-01-09 11:44 - 00074000 _____ (BitDefender SRL) C:\WINDOWS\SysWOW64\bdsandboxuiskin32.dll
2015-05-13 20:46 - 2014-12-15 18:04 - 00098768 _____ (BitDefender LLC) C:\WINDOWS\system32\Drivers\bdfndisf6.sys
2015-05-13 20:46 - 2013-09-08 20:04 - 00023568 _____ (Bitdefender) C:\WINDOWS\system32\Drivers\bdelam.sys
2015-05-13 20:46 - 2007-04-11 11:11 - 00511328 _____ (Microsoft Corporation) C:\WINDOWS\capicom.dll
2015-05-13 20:45 - 2015-05-13 20:52 - 00000000 ____D () C:\Users\Christian\AppData\Roaming\Bitdefender
2015-05-13 20:41 - 2015-05-13 21:16 - 00074000 _____ (BitDefender SRL) C:\WINDOWS\system32\bdsandboxuiskin32.dll
2015-05-13 20:41 - 2015-05-13 20:47 - 00000000 ____D () C:\ProgramData\Bitdefender
2015-05-13 20:41 - 2015-05-13 20:41 - 00000000 ____D () C:\Program Files\Bitdefender
2015-05-13 20:41 - 2015-02-24 17:52 - 00160544 _____ (BitDefender LLC) C:\WINDOWS\system32\Drivers\gzflt.sys
2015-05-13 20:41 - 2015-01-09 11:44 - 00084848 _____ (BitDefender SRL) C:\WINDOWS\system32\BDSandBoxUISkin.dll
2015-05-13 20:41 - 2015-01-09 11:44 - 00033360 _____ (BitDefender SRL) C:\WINDOWS\system32\BDSandBoxUH.dll
2015-05-13 20:41 - 2014-10-15 17:14 - 00452040 _____ (BitDefender S.R.L.) C:\WINDOWS\system32\Drivers\trufos.sys
2015-05-13 20:40 - 2015-05-13 20:41 - 00000000 ____D () C:\Program Files\Common Files\Bitdefender
2015-05-13 17:01 - 2015-04-10 02:34 - 02256896 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll
2015-05-13 17:01 - 2015-04-10 02:11 - 01943040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll
2015-05-13 17:01 - 2015-03-17 19:26 - 00467776 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBHUB3.SYS
2015-05-13 17:01 - 2015-03-09 04:02 - 00057856 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthhfenum.sys
2015-05-13 17:00 - 2015-05-01 01:05 - 00429568 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll
2015-05-13 17:00 - 2015-05-01 00:48 - 00358912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll
2015-05-13 17:00 - 2015-04-24 23:32 - 00036864 _____ (Microsoft Corporation) C:\WINDOWS\system32\UtcResources.dll
2015-05-13 17:00 - 2015-04-09 00:55 - 00410128 _____ (Microsoft Corporation) C:\WINDOWS\system32\services.exe
2015-05-13 17:00 - 2015-04-02 00:22 - 02985984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbgeng.dll
2015-05-13 17:00 - 2015-04-02 00:20 - 04417536 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbgeng.dll
2015-05-13 17:00 - 2015-04-01 05:45 - 01491456 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbghelp.dll
2015-05-13 17:00 - 2015-04-01 04:31 - 01207296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbghelp.dll
2015-05-13 17:00 - 2015-03-30 07:47 - 00561928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2015-05-13 17:00 - 2015-03-27 05:27 - 00445440 _____ (Microsoft Corporation) C:\WINDOWS\system32\certcli.dll
2015-05-13 17:00 - 2015-03-27 04:50 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certcli.dll
2015-05-13 17:00 - 2015-03-27 04:48 - 01441792 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2015-05-13 17:00 - 2015-03-20 03:56 - 00080384 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ahcache.sys
2015-05-13 17:00 - 2015-03-13 06:03 - 00239424 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdbus.sys
2015-05-13 17:00 - 2015-03-13 06:03 - 00154432 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dumpsd.sys
2015-05-13 17:00 - 2015-03-13 03:11 - 02162176 _____ (Microsoft Corporation) C:\WINDOWS\system32\SRH.dll
2015-05-13 17:00 - 2015-03-13 02:39 - 01812992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SRH.dll
2015-05-13 17:00 - 2015-03-13 02:29 - 00410017 _____ () C:\WINDOWS\system32\ApnDatabase.xml
2015-05-13 17:00 - 2015-03-11 03:49 - 00024576 _____ (Microsoft Corporation) C:\WINDOWS\system32\sdbinst.exe
2015-05-13 17:00 - 2015-03-11 03:09 - 00021504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sdbinst.exe
2015-05-13 17:00 - 2015-03-06 05:08 - 02067968 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpdshext.dll
2015-05-13 17:00 - 2015-03-06 04:47 - 01696256 _____ (Microsoft Corporation) C:\WINDOWS\system32\wevtsvc.dll
2015-05-13 17:00 - 2015-03-06 04:43 - 01969664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wpdshext.dll
2015-05-13 17:00 - 2015-03-05 01:09 - 01429504 _____ (Microsoft Corporation) C:\WINDOWS\system32\diagtrack.dll
2015-05-13 17:00 - 2015-03-04 03:32 - 00172544 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Input.Inking.dll
2015-05-13 17:00 - 2015-03-04 03:12 - 00141824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Input.Inking.dll
2015-05-13 17:00 - 2015-01-30 02:53 - 02819584 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers.dll
2015-05-13 17:00 - 2014-11-14 08:58 - 00116736 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsDatabase.dll
2015-05-13 16:59 - 2015-04-21 19:14 - 24971776 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2015-05-13 16:59 - 2015-04-21 18:50 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2015-05-13 16:59 - 2015-04-21 18:50 - 00417792 _____ (Microsoft Corporation) C:\WINDOWS\system32\html.iec
2015-05-13 16:59 - 2015-04-21 18:49 - 02885120 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2015-05-13 16:59 - 2015-04-21 18:37 - 00633856 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieui.dll
2015-05-13 16:59 - 2015-04-21 18:35 - 00816640 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2015-05-13 16:59 - 2015-04-21 18:31 - 06025728 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2015-05-13 16:59 - 2015-04-21 18:24 - 19691008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2015-05-13 16:59 - 2015-04-21 18:13 - 00107520 _____ (Microsoft Corporation) C:\WINDOWS\system32\inseng.dll
2015-05-13 16:59 - 2015-04-21 18:11 - 00504320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2015-05-13 16:59 - 2015-04-21 18:09 - 00341504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\html.iec
2015-05-13 16:59 - 2015-04-21 18:08 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2015-05-13 16:59 - 2015-04-21 18:07 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll
2015-05-13 16:59 - 2015-04-21 18:05 - 00316928 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2015-05-13 16:59 - 2015-04-21 18:04 - 02278400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2015-05-13 16:59 - 2015-04-21 17:59 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2015-05-13 16:59 - 2015-04-21 17:58 - 00664576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2015-05-13 16:59 - 2015-04-21 17:52 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
2015-05-13 16:59 - 2015-04-21 17:49 - 00801280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2015-05-13 16:59 - 2015-04-21 17:49 - 00720384 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2015-05-13 16:59 - 2015-04-21 17:49 - 00374272 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2015-05-13 16:59 - 2015-04-21 17:46 - 02125824 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2015-05-13 16:59 - 2015-04-21 17:40 - 14401536 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2015-05-13 16:59 - 2015-04-21 17:38 - 00076288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
2015-05-13 16:59 - 2015-04-21 17:37 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll
2015-05-13 16:59 - 2015-04-21 17:36 - 00285696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2015-05-13 16:59 - 2015-04-21 17:32 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2015-05-13 16:59 - 2015-04-21 17:31 - 04305920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2015-05-13 16:59 - 2015-04-21 17:28 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll
2015-05-13 16:59 - 2015-04-21 17:27 - 02352128 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2015-05-13 16:59 - 2015-04-21 17:26 - 00688640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2015-05-13 16:59 - 2015-04-21 17:26 - 00327168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2015-05-13 16:59 - 2015-04-21 17:25 - 02052608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2015-05-13 16:59 - 2015-04-21 17:17 - 12828672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2015-05-13 16:59 - 2015-04-21 17:15 - 01547264 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2015-05-13 16:59 - 2015-04-21 17:03 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2015-05-13 16:59 - 2015-04-21 17:02 - 01882112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2015-05-13 16:59 - 2015-04-21 16:58 - 01310208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2015-05-13 16:59 - 2015-04-21 16:56 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2015-05-13 16:59 - 2015-04-14 00:48 - 04180480 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2015-05-13 16:59 - 2015-04-10 03:00 - 01996800 _____ (Microsoft Corporation) C:\WINDOWS\system32\DWrite.dll
2015-05-13 16:59 - 2015-04-10 02:50 - 01387008 _____ (Microsoft Corporation) C:\WINDOWS\system32\FntCache.dll
2015-05-13 16:59 - 2015-04-10 02:26 - 01560576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DWrite.dll
2015-05-13 16:59 - 2015-04-03 02:35 - 00445440 _____ (Microsoft Corporation) C:\WINDOWS\system32\PhotoMetadataHandler.dll
2015-05-13 16:59 - 2015-04-03 02:14 - 00364544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PhotoMetadataHandler.dll
2015-05-13 16:59 - 2015-03-13 04:02 - 00316416 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\udfs.sys
2015-05-13 16:59 - 2015-02-18 01:19 - 00186368 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpapisrv.dll
2015-05-12 13:46 - 2015-05-12 14:36 - 00000000 ____D () C:\Users\Christian\AppData\Roaming\QuickScan
2015-05-11 21:17 - 2015-05-11 21:16 - 00272808 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaws.exe
2015-05-11 21:16 - 2015-05-11 21:16 - 00176040 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaw.exe
2015-05-11 21:16 - 2015-05-11 21:16 - 00176040 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\java.exe
2015-05-11 21:16 - 2015-05-11 21:16 - 00098216 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll
2015-05-11 21:16 - 2015-05-11 21:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-05-11 21:16 - 2015-05-11 21:16 - 00000000 ____D () C:\Program Files (x86)\Java
2015-05-11 20:15 - 2015-05-11 20:15 - 02867656 _____ () C:\Users\Christian\Downloads\bitdefender_isecurity_v2015.exe
2015-05-10 21:02 - 2015-05-10 21:02 - 00000000 ____D () C:\ProgramData\Emsisoft
2015-05-10 20:54 - 2015-05-10 20:54 - 00001103 _____ () C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk
2015-05-10 20:54 - 2015-05-10 20:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Emsisoft Anti-Malware
2015-05-10 20:53 - 2015-05-18 17:53 - 00000000 ____D () C:\Program Files (x86)\Emsisoft Anti-Malware
2015-05-10 20:53 - 2015-03-23 23:17 - 00135800 _____ (Emsisoft GmbH) C:\WINDOWS\system32\Drivers\epp64.sys
2015-05-10 20:50 - 2015-05-10 20:50 - 01203488 _____ () C:\Users\Christian\Downloads\Emsisoft Anti Malware - CHIP-Installer.exe
2015-04-23 18:39 - 2015-04-23 18:47 - 00001985 _____ () C:\Users\Public\Desktop\Samsung Kies 3.lnk
2015-04-23 13:46 - 2015-04-23 13:46 - 00000000 ____D () C:\Users\Christian\AppData\Roaming\IsolatedStorage
2015-04-23 13:46 - 2015-04-23 13:46 - 00000000 ____D () C:\ProgramData\IsolatedStorage
2015-04-23 13:41 - 2015-04-23 13:41 - 00000000 ____D () C:\Spacekace
2015-04-18 08:53 - 2015-04-18 08:53 - 00000222 _____ () C:\Users\Christian\Desktop\Rising World.url

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-05-18 18:00 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2015-05-18 17:59 - 2014-10-26 16:35 - 01544698 _____ () C:\WINDOWS\WindowsUpdate.log
2015-05-18 17:52 - 2013-08-22 16:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2015-05-18 17:51 - 2013-08-22 16:45 - 00000000 ____D () C:\WINDOWS\Setup
2015-05-18 17:51 - 2013-08-22 15:25 - 00262144 ___SH () C:\WINDOWS\system32\config\BBI
2015-05-18 16:52 - 2013-04-07 20:41 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2015-05-18 16:38 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2015-05-17 18:12 - 2014-10-31 23:24 - 00003934 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{543C5195-C36C-452D-A5D5-B7493A999655}
2015-05-17 12:47 - 2013-08-22 16:44 - 00414016 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2015-05-17 12:13 - 2013-06-16 16:02 - 00904704 ___SH () C:\Users\Christian\Desktop\Thumbs.db
2015-05-16 19:58 - 2013-04-08 23:30 - 00000000 ____D () C:\Users\Christian\AppData\Roaming\vlc
2015-05-16 19:46 - 2014-09-24 08:17 - 02121430 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2015-05-16 19:46 - 2014-09-24 07:43 - 01021576 _____ () C:\WINDOWS\system32\perfh007.dat
2015-05-16 19:46 - 2014-09-24 07:43 - 00243696 _____ () C:\WINDOWS\system32\perfc007.dat
2015-05-16 15:17 - 2014-10-26 16:32 - 00000000 ___DC () C:\WINDOWS\Panther
2015-05-16 15:17 - 2014-07-07 23:08 - 00000000 ____D () C:\Program Files (x86)\Steam
2015-05-16 15:17 - 2013-04-09 00:05 - 00000000 ____D () C:\Users\Christian\AppData\Local\CrashDumps
2015-05-16 15:17 - 2013-04-08 00:45 - 00000000 ____D () C:\Users\Christian\AppData\Roaming\DAEMON Tools Lite
2015-05-16 15:00 - 2012-12-20 06:30 - 00000000 ____D () C:\ProgramData\EgisTec IPS
2015-05-16 10:12 - 2014-12-21 18:41 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-05-16 10:08 - 2013-08-22 17:36 - 00000000 ___RD () C:\WINDOWS\ImmersiveControlPanel
2015-05-16 08:02 - 2012-07-26 09:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
2015-05-14 10:45 - 2013-04-06 07:54 - 00000000 ____D () C:\Users\Christian\AppData\Local\Packages
2015-05-14 10:32 - 2014-12-16 17:56 - 00000000 ____D () C:\WINDOWS\Minidump
2015-05-14 10:32 - 2013-08-22 17:36 - 00000000 ___RD () C:\WINDOWS\Offline Web Pages
2015-05-14 09:50 - 2012-12-20 06:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acer
2015-05-14 09:50 - 2012-12-20 06:28 - 00000000 ____D () C:\Program Files (x86)\Acer
2015-05-14 09:37 - 2012-12-20 06:29 - 00000000 ____D () C:\Program Files\Acer
2015-05-13 23:46 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\rescache
2015-05-13 23:24 - 2015-04-03 15:38 - 00002457 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-05-13 21:18 - 2013-08-22 15:36 - 00000000 ____D () C:\WINDOWS\system32\AdvancedInstallers
2015-05-13 20:47 - 2013-08-22 15:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM
2015-05-13 19:36 - 2014-01-08 22:07 - 00000000 ____D () C:\WINDOWS\system32\MRT
2015-05-13 19:31 - 2013-04-08 00:02 - 140425016 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2015-05-13 18:23 - 2014-09-24 08:00 - 00000000 ____D () C:\Program Files\Windows Journal
2015-05-08 17:02 - 2014-12-21 18:41 - 00001147 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-05-07 20:36 - 2014-10-26 16:42 - 00000000 ____D () C:\Users\Christian
2015-05-07 20:34 - 2015-04-04 12:21 - 00000000 ___SD () C:\WINDOWS\system32\GWX
2015-05-07 20:34 - 2014-11-15 05:11 - 00000000 ____D () C:\Users\Christian\Documents\DayZ
2015-05-07 20:15 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\registration
2015-05-02 20:14 - 2013-04-14 01:12 - 00000000 ____D () C:\Users\Christian\Documents\TmForever
2015-04-23 18:47 - 2014-06-22 15:03 - 00000000 ____D () C:\Program Files (x86)\Samsung
2015-04-23 18:39 - 2014-06-22 15:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung
2015-04-23 18:39 - 2012-12-20 06:29 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-04-23 16:53 - 2013-04-14 18:19 - 00000000 ____D () C:\Users\Christian\AppData\Local\Downloaded Installations

==================== Files in the root of some directories =======

2015-05-13 20:47 - 2015-05-13 20:47 - 0622119 _____ () C:\ProgramData\1431542459.bdinstall.bin
2013-02-24 23:58 - 2013-02-24 23:58 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

Some content of TEMP:
====================
C:\Users\Christian\AppData\Local\Temp\Quarantine.exe
C:\Users\Christian\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-05-17 17:41

==================== End Of Log ============================
--- --- ---

--- --- ---


Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 16-05-2015 02
Ran by Christian at 2015-05-18 18:02:39
Running from C:\Users\Christian\Desktop
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-704110784-328736849-532702743-500 - Administrator - Disabled)
Christian (S-1-5-21-704110784-328736849-532702743-1002 - Administrator - Enabled) => C:\Users\Christian
Gast (S-1-5-21-704110784-328736849-532702743-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-704110784-328736849-532702743-1004 - Limited - Enabled)
UpdatusUser (S-1-5-21-704110784-328736849-532702743-1001 - Limited - Enabled) => C:\Users\UpdatusUser

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Bitdefender Antivirus (Enabled - Up to date) {9A0813D8-CED6-F86B-072E-28D2AF25A83D}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Emsisoft Anti-Malware (Enabled - Up to date) {2F44E1F9-850B-1C7A-0E56-EB2E0A3E20C9}
AS: Bitdefender Spyware-Schutz (Enabled - Up to date) {2169F23C-E8EC-F7E5-3D9E-13A0D4A2E280}
AS: Emsisoft Anti-Malware (Enabled - Up to date) {9425001D-A331-13F4-34E6-D05C71B96A74}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Bitdefender Firewall (Enabled) {A23392FD-84B9-F933-2C71-81E751F6EF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.11) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.11 - Adobe Systems Incorporated)
Bitdefender Internet Security 2015 (HKLM\...\Bitdefender) (Version: 18.22.0.1521 - Bitdefender)
CCleaner (HKLM\...\CCleaner) (Version: 5.05 - Piriform)
CyberGhost 5 (HKLM\...\CyberGhost VPN 5_is1) (Version:  - CyberGhost S.R.L.)
DayZ (HKLM-x32\...\Steam App 221100) (Version:  - Bohemia Interactive)
Emsisoft Anti-Malware (HKLM-x32\...\{5502032C-88C1-4303-99FE-B5CBD7684CEA}_is1) (Version: 9.0 - Emsisoft Ltd.)
ETDWare PS/2-X64 11.6.16.003_WHQL (HKLM\...\Elantech) (Version: 11.6.16.003 - ELAN Microelectronic Corp.)
Free Studio version 6.5.0.219 (HKLM-x32\...\Free Studio_is1) (Version: 6.5.0.219 - DVDVideoSoft Ltd.)
Garry's Mod (HKLM-x32\...\Steam App 4000) (Version:  - Facepunch Studios)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3621 - Intel Corporation)
Java 7 Update 80 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217080FF}) (Version: 7.0.800 - Oracle)
Malwarebytes Anti-Malware Version 2.1.6.1022 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)
Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4420.1017 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Mozilla Firefox 38.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 38.0.1 (x86 de)) (Version: 38.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 36.0 - Mozilla)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MyFreeCodec (HKU\S-1-5-21-704110784-328736849-532702743-1002\...\MyFreeCodec) (Version:  - )
No More Room in Hell (HKLM-x32\...\Steam App 224260) (Version:  - No More Room in Hell Team)
Portal (HKLM-x32\...\Steam App 400) (Version:  - Valve)
Portal 2 (HKLM-x32\...\Steam App 620) (Version:  - Valve)
Qualcomm Atheros Bluetooth Suite (64) (HKLM\...\{A84A4FB1-D703-48DB-89E0-68B6499D2801}) (Version: 8.0.1.305 - Qualcomm Atheros Communications)
Qualcomm Atheros WLAN and Bluetooth Client Installation Program (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 12.07 - Qualcomm Atheros)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6695 - Realtek Semiconductor Corp.)
Resident Evil / biohazard HD REMASTER (HKLM-x32\...\Steam App 304240) (Version:  - CAPCOM Co., Ltd.)
Rising World (HKLM-x32\...\Steam App 324080) (Version:  - JIW-Games)
Samsung Kies3 (HKLM-x32\...\InstallShield_{88547073-C566-4895-9005-EBE98EA3F7C7}) (Version: 3.2.15041.2 - Samsung Electronics Co., Ltd.)
Samsung Kies3 (x32 Version: 3.2.15041.2 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.49.0 - SAMSUNG Electronics Co., Ltd.)
Sniper Elite 3 (HKLM-x32\...\Steam App 238090) (Version:  - Rebellion)
Stranded Deep (HKLM-x32\...\Steam App 313120) (Version:  - Beam Team Games)
System Requirements Lab CYRI (HKLM-x32\...\{906B34E5-573C-445A-A5D3-40B6BF0A2EC4}) (Version: 6.0.21.0 - Husdawg, LLC)
TAP-Windows 9.9.2 (HKLM\...\TAP-Windows) (Version: 9.9.2 - )
Visual Studio 2005 Tools for Office Second Edition Runtime (HKLM-x32\...\Microsoft Visual Studio 2005 Tools for Office Runtime) (Version:  - Microsoft Corporation)
Visual Studio Tools for the Office system 3.0 Runtime (HKLM-x32\...\Visual Studio Tools for the Office system 3.0 Runtime) (Version:  - Microsoft Corporation)
Visual Studio Tools for the Office system 3.0 Runtime Service Pack 1 (KB949258) (HKLM-x32\...\{8FB53850-246A-3507-8ADE-0060093FFEA6}.KB949258) (Version: 1 - Microsoft Corporation)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.1 - VideoLAN)
WinRAR 5.21 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.21.0 - win.rar GmbH)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-704110784-328736849-532702743-1002_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\WINDOWS\system32\igfxEM.exe (Intel Corporation)

==================== Restore Points  =========================

22-04-2015 21:29:12 avast! antivirus system restore point
02-05-2015 17:33:22 Removed FlatOut2
07-05-2015 20:08:05 Wiederherstellungsvorgang
13-05-2015 16:59:20 Windows Update
16-05-2015 14:59:37 Removed Shredder.

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {080FB629-55D9-4AD3-A46A-FD916EBBED5E} - System32\Tasks\{31DDBD37-5DB7-4030-8064-10B0CAA806C3} => C:\Program Files\COMODO\COMODO Internet Security\cistray.exe
Task: {0B087CB7-4F31-477E-8D5E-F8C18D54180C} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-04-23] (Piriform Ltd)
Task: {2BF1BDE9-6FC4-4027-B638-E97D5F4FBF0A} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2015-04-10] (Oracle Corporation)
Task: {302D3EAD-291D-412A-8C8A-5841FFDB23A5} - System32\Tasks\ALU => C:\Program Files (x86)\Acer\Live Updater\updater.exe [2012-11-06] ()
Task: {4B042DAA-3E20-4F9A-9514-863E876D93AD} - System32\Tasks\DeviceDetector => C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe
Task: {4E7A3090-9FED-46F0-88EF-9617FC71C6A4} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-24] (Microsoft Corporation)
Task: {4F3912ED-1360-4E60-8BDB-7E1C1483D2CA} - \Optimize Start Menu Cache Files-S-1-5-21-704110784-328736849-532702743-500 No Task File <==== ATTENTION
Task: {5267CCD3-2130-4C4F-8253-6597C8A34B00} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-04-14] (Adobe Systems Incorporated)
Task: {5A47948A-236C-459B-9563-0F31A2CFF555} - System32\Tasks\Power Management => C:\Program Files\Acer\Acer Power Management\ePowerTray.exe [2012-10-23] (Acer Incorporated)
Task: {6D4610C5-7F46-4D1C-9462-45EB58424D12} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {720F237C-B6FC-400C-931A-3CCAB5DF0AD3} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxcontent => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-24] (Microsoft Corporation)
Task: {7926FA87-DA5C-4ECC-8267-781CFD8C0023} - System32\Tasks\ALUAgent => C:\Program Files (x86)\Acer\Live Updater\liveupdater_agent.exe [2012-06-21] ()
Task: {8ED5561B-AC38-4352-9653-1D29923F7389} - System32\Tasks\Microsoft\Windows\Setup\gwx\runappraiser => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-24] (Microsoft Corporation)
Task: {B5C96ED0-255E-4C65-BB30-70ADDA2C74B5} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-05-13] (Microsoft Corporation)
Task: {B640284A-9443-485F-ACA4-EEA591BA44A3} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-03-24] (Microsoft Corporation)
Task: {D9F0462D-76DC-4445-AB75-8E1D0695B8FC} - System32\Tasks\PMMUpdate => C:\Program Files\EgisTec IPS\PMMUpdate.exe
Task: {EAC1663F-40B1-4CFE-9A44-FEAAB2C7E5CF} - System32\Tasks\EgisUpdate => C:\Program Files\EgisTec IPS\EgisUpdate.exe
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (Whitelisted) ==============

2013-09-05 03:36 - 2013-09-05 03:36 - 00013088 _____ () C:\Program Files\NVIDIA Corporation\CoProcManager\detoured.dll
2015-05-13 20:46 - 2014-08-27 16:31 - 00265080 _____ () C:\Program Files\Bitdefender\Bitdefender 2015\txmlutil.dll
2015-05-13 20:46 - 2013-09-03 14:29 - 00101328 _____ () C:\Program Files\Bitdefender\Bitdefender 2015\bdmetrics.dll
2015-05-13 20:46 - 2015-04-01 18:05 - 00003072 _____ () C:\Program Files\Bitdefender\Bitdefender 2015\UI\accessl.ui
2015-05-13 20:46 - 2012-10-29 14:22 - 00152816 _____ () C:\Program Files\Bitdefender\Bitdefender 2015\bdfwcore.dll
2015-05-13 20:54 - 2015-05-13 20:54 - 00790368 _____ () C:\Program Files\Bitdefender\Bitdefender 2015\otengines_00350_002\ashttpbr.mdl
2015-05-13 20:54 - 2015-05-13 20:54 - 00711064 _____ () C:\Program Files\Bitdefender\Bitdefender 2015\otengines_00350_002\ashttpdsp.mdl
2015-05-13 20:54 - 2015-05-13 20:54 - 02683520 _____ () C:\Program Files\Bitdefender\Bitdefender 2015\otengines_00350_002\ashttpph.mdl
2015-05-13 20:54 - 2015-05-13 20:54 - 01326504 _____ () C:\Program Files\Bitdefender\Bitdefender 2015\otengines_00350_002\ashttprbl.mdl
2013-09-07 02:48 - 2013-09-07 02:48 - 00011264 _____ () C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\Modules\ActivateDesktopDebugger\ActivateDesktopDebugger.dll
2013-09-07 02:45 - 2013-09-07 02:45 - 00086016 _____ () C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\Modules\Map\MAP.dll
2013-09-07 02:52 - 2013-09-07 02:52 - 00012928 _____ () C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe
2013-02-24 23:45 - 2012-06-25 04:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\WINDOWS\system32\audiodg.exe:$CmdTcID
AlternateDataStreams: C:\WINDOWS\system32\AudioEndpointBuilder.dll:$CmdTcID
AlternateDataStreams: C:\WINDOWS\system32\AudioEng.dll:$CmdTcID
AlternateDataStreams: C:\WINDOWS\system32\AUDIOKSE.dll:$CmdTcID
AlternateDataStreams: C:\WINDOWS\system32\AudioSes.dll:$CmdTcID
AlternateDataStreams: C:\WINDOWS\system32\audiosrv.dll:$CmdTcID
AlternateDataStreams: C:\WINDOWS\system32\ci.dll:$CmdTcID
AlternateDataStreams: C:\WINDOWS\system32\EncDump.dll:$CmdTcID
AlternateDataStreams: C:\WINDOWS\system32\Faultrep.dll:$CmdTcID
AlternateDataStreams: C:\WINDOWS\system32\TSWbPrxy.exe:$CmdTcID
AlternateDataStreams: C:\WINDOWS\system32\wer.dll:$CmdTcID
AlternateDataStreams: C:\WINDOWS\system32\werdiagcontroller.dll:$CmdTcID
AlternateDataStreams: C:\WINDOWS\system32\WerFault.exe:$CmdTcID
AlternateDataStreams: C:\WINDOWS\system32\WerFaultSecure.exe:$CmdTcID
AlternateDataStreams: C:\WINDOWS\system32\wermgr.exe:$CmdTcID
AlternateDataStreams: C:\WINDOWS\SysWOW64\AudioEng.dll:$CmdTcID
AlternateDataStreams: C:\WINDOWS\SysWOW64\AUDIOKSE.dll:$CmdTcID
AlternateDataStreams: C:\WINDOWS\SysWOW64\AudioSes.dll:$CmdTcID
AlternateDataStreams: C:\WINDOWS\SysWOW64\Faultrep.dll:$CmdTcID
AlternateDataStreams: C:\WINDOWS\SysWOW64\wer.dll:$CmdTcID
AlternateDataStreams: C:\WINDOWS\SysWOW64\werdiagcontroller.dll:$CmdTcID
AlternateDataStreams: C:\WINDOWS\SysWOW64\WerFault.exe:$CmdTcID
AlternateDataStreams: C:\WINDOWS\SysWOW64\WerFaultSecure.exe:$CmdTcID
AlternateDataStreams: C:\WINDOWS\SysWOW64\wermgr.exe:$CmdTcID
AlternateDataStreams: C:\WINDOWS\system32\Drivers\browserMon.sys:$CmdTcID
AlternateDataStreams: C:\WINDOWS\system32\Drivers\ssudbus.sys:$CmdTcID
AlternateDataStreams: C:\WINDOWS\system32\Drivers\ssudmdm.sys:$CmdTcID
AlternateDataStreams: C:\Users\Christian\Desktop\AdwCleaner_4.204.exe:BDU
AlternateDataStreams: C:\Users\Christian\Desktop\FRST64.exe:BDU
AlternateDataStreams: C:\Users\Christian\Desktop\JRT.exe:BDU
AlternateDataStreams: C:\Users\Christian\Desktop\mbam-setup-2.1.6.1022.exe:BDU
AlternateDataStreams: C:\Users\Christian\Desktop\tdsskiller.exe:BDU
AlternateDataStreams: C:\Users\Christian\Downloads\Bitdefender Rescue CD - CHIP-Installer.exe:BDU
AlternateDataStreams: C:\Users\Christian\Downloads\ccsetup505_slim.exe:BDU
AlternateDataStreams: C:\Users\Christian\Downloads\Intel Turbo Boost Technology Monitor - CHIP-Installer.exe:$CmdTcID
AlternateDataStreams: C:\Users\Christian\Downloads\Intel Turbo Boost Technology Monitor - CHIP-Installer.exe:$CmdZnID
AlternateDataStreams: C:\Users\Christian\Downloads\JRT_6.7.0.exe:BDU

==================== Safe Mode (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, the associated entry will be removed from the registry.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-704110784-328736849-532702743-1001\Control Panel\Desktop\\Wallpaper ->
HKU\S-1-5-21-704110784-328736849-532702743-1002\Control Panel\Desktop\\Wallpaper -> C:\Users\Christian\Pictures\Wallpapers\467717_601845359835397_1112348978_o.jpg
DNS Servers: 192.168.178.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

HKLM\...\StartupApproved\Run32: => "SunJavaUpdateSched"
HKLM\...\StartupApproved\Run32: => "LManager"
HKLM\...\StartupApproved\Run32: => "KiesTrayAgent"
HKU\S-1-5-21-704110784-328736849-532702743-1002\...\StartupApproved\Run: => "DAEMON Tools Lite"
HKU\S-1-5-21-704110784-328736849-532702743-1002\...\StartupApproved\Run: => "Amazon Music"
HKU\S-1-5-21-704110784-328736849-532702743-1002\...\StartupApproved\Run: => "CCleaner Monitoring"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{8914F7EB-5C2D-479D-B142-B925A8BF5A2E}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{EAA8FA2C-25A5-4108-880D-3EB277DCEC37}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{27457105-AC88-4347-9B9D-D5A43633415B}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{7C3673CA-582A-4C53-A1A9-3738FAB25BB6}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{125D3783-B3FE-4854-9A03-1B54500F6EF9}] => (Block) C:\games\counter-strike\hl.exe
FirewallRules: [{61EA007C-BF96-428B-85DD-7A42BB91E5A5}] => (Block) C:\games\counter-strike\hl.exe
FirewallRules: [UDP Query User{BD89BFF8-0D9F-430E-A211-DF7ED21F536B}C:\games\counter-strike\hl.exe] => (Allow) C:\games\counter-strike\hl.exe
FirewallRules: [TCP Query User{D9AC218E-050C-496C-8301-F0F1033F14DD}C:\games\counter-strike\hl.exe] => (Allow) C:\games\counter-strike\hl.exe
FirewallRules: [{EB158327-2CD8-4786-8831-7ABD4BED50E5}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{F0D97D86-E00A-493E-AF46-2EE5F9EE855D}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{7F23D52C-3F8E-4A16-A7BD-87D7EB0EFBFB}] => (Allow) C:\Program Files (x86)\Acer\clear.fi SDK21\Video\VideoPlayer.exe
FirewallRules: [{F152C521-8465-42B8-8BF8-B667F1E2A063}] => (Allow) C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe
FirewallRules: [{F871B592-B65E-4D3E-B2C9-D2B98DCD8032}] => (Allow) C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe
FirewallRules: [{1928E3AD-0F76-46CA-A8D0-6ADB77113317}] => (Allow) C:\Program Files (x86)\Spotify\spotify.exe
FirewallRules: [{AA582F3A-F1E1-4698-86A5-962D3EC6DCAA}] => (Allow) C:\Program Files (x86)\Spotify\spotify.exe
FirewallRules: [{5F9A7A9C-78E4-441B-AE04-F4E2B1A1ACCB}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [{F02043A8-87CB-401C-8B94-A5B19A2F28C0}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [{2CCE4E60-ECB6-478B-8625-52E7796ECA9C}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\nmrih\sdk\hl2.exe
FirewallRules: [{47EF2E1C-8B6B-4B67-8D7E-1CD8B1469A21}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\nmrih\sdk\hl2.exe
FirewallRules: [{1774D4DE-9C7E-4982-AB47-25A7E2EF61DE}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\DayZ\DayZ.exe
FirewallRules: [{DF2EDA05-C720-41AE-8439-9D8931D9788C}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\DayZ\DayZ.exe
FirewallRules: [TCP Query User{EFE0391D-C338-49D6-B395-7668C5C820D7}C:\program files (x86)\tmnationsforever\tmforever.exe] => (Block) C:\program files (x86)\tmnationsforever\tmforever.exe
FirewallRules: [UDP Query User{3BD5EF1D-9519-4AC7-93B9-9FDE236FC4D8}C:\program files (x86)\tmnationsforever\tmforever.exe] => (Block) C:\program files (x86)\tmnationsforever\tmforever.exe
FirewallRules: [{D86477A0-F68D-40C1-A330-A2BAA874A994}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\DayZ\DayZ_BE.exe
FirewallRules: [{C6E9EDBD-CAC1-482A-A9D6-B40F706E7822}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\DayZ\DayZ_BE.exe
FirewallRules: [{0F74897A-69CD-45CE-9BB1-AC90CD3F117B}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Sniper Elite 3\Launcher\Sniper3Launcher.exe
FirewallRules: [{DAF9DFF3-63CF-4137-B09A-5E9842C967B7}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Sniper Elite 3\Launcher\Sniper3Launcher.exe
FirewallRules: [{2D7F0786-DB0B-46A5-A3AA-124EE5C92503}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{30589744-1C80-41A2-AA24-A2ADCDD78136}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{3DCD2A4F-ED6B-4AE7-A5C9-E0E109EDAAF8}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Resident Evil Biohazard HD REMASTER\bhd.exe
FirewallRules: [{47270464-A214-4C74-91A9-1BC9F1884D9D}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Resident Evil Biohazard HD REMASTER\bhd.exe
FirewallRules: [{71D62F29-EDC2-4BD2-A01C-E19E1F4C8B68}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\GarrysMod\hl2.exe
FirewallRules: [{A4DF7617-5674-4749-881E-FD7353D4CA12}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\GarrysMod\hl2.exe
FirewallRules: [{3B534B64-9921-4033-8511-653CDDCB7D0B}] => (Allow) C:\Program Files (x86)\DVDVideoSoft\Free Torrent Download\FreeTorrentDownload.exe
FirewallRules: [{19402204-D1A6-48BE-8345-13033241418A}] => (Allow) C:\Program Files (x86)\DVDVideoSoft\Free Torrent Download\FreeTorrentDownload.exe
FirewallRules: [{284847C8-D0A1-4705-9357-969C929FB4A9}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Stranded Deep\Stranded_Deep_x64.exe
FirewallRules: [{00A9EE9B-2CE3-49A7-BABD-A86BDA9A1031}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Stranded Deep\Stranded_Deep_x64.exe
FirewallRules: [TCP Query User{DE3DEE63-63F2-41B1-BC47-7DF852308F12}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{A8BF8E59-12E0-447D-87BE-D0E93613C1EE}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [{EAF2E745-5006-45A5-9D77-974A39042A7D}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Portal 2\portal2.exe
FirewallRules: [{D287467F-960E-474F-A846-624490942395}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Portal 2\portal2.exe
FirewallRules: [{D24A8E01-FA14-487B-855F-A8D4C6046D4C}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Portal\hl2.exe
FirewallRules: [{78362A2A-81CB-46A6-BBB3-70831E2432FF}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Portal\hl2.exe
FirewallRules: [TCP Query User{13EECDE0-D1D7-4BBB-BC95-8D948E2E0C03}C:\games\counter-strike\hltv.exe] => (Block) C:\games\counter-strike\hltv.exe
FirewallRules: [UDP Query User{CB8C579F-2423-4CF8-952D-CBA419E1E034}C:\games\counter-strike\hltv.exe] => (Block) C:\games\counter-strike\hltv.exe
FirewallRules: [{0E9E5F8F-61BA-49C8-A2B6-0589157BB26F}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\RisingWorld\risingworldx64.exe
FirewallRules: [{E92DDF0B-450E-4847-A243-9FE4E29C80AF}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\RisingWorld\risingworldx64.exe

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (05/18/2015 04:55:16 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: svchost.exe_DeviceAssociationService, Version: 6.3.9600.17415, Zeitstempel: 0x54504177
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.3.9600.17736, Zeitstempel: 0x550f4336
Ausnahmecode: 0xc0000374
Fehleroffset: 0x00000000000f0f20
ID des fehlerhaften Prozesses: 0x638
Startzeit der fehlerhaften Anwendung: 0xsvchost.exe_DeviceAssociationService0
Pfad der fehlerhaften Anwendung: svchost.exe_DeviceAssociationService1
Pfad des fehlerhaften Moduls: svchost.exe_DeviceAssociationService2
Berichtskennung: svchost.exe_DeviceAssociationService3
Vollständiger Name des fehlerhaften Pakets: svchost.exe_DeviceAssociationService4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: svchost.exe_DeviceAssociationService5

Error: (05/17/2015 01:27:53 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: BITSC:\Windows\System32\bitsperf.dll8

Error: (05/17/2015 01:15:01 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: nvxdsync.exe, Version: 8.17.13.717, Zeitstempel: 0x5077ae57
Name des fehlerhaften Moduls: nvxdsync.exe, Version: 8.17.13.717, Zeitstempel: 0x5077ae57
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000041691
ID des fehlerhaften Prozesses: 0x520
Startzeit der fehlerhaften Anwendung: 0xnvxdsync.exe0
Pfad der fehlerhaften Anwendung: nvxdsync.exe1
Pfad des fehlerhaften Moduls: nvxdsync.exe2
Berichtskennung: nvxdsync.exe3
Vollständiger Name des fehlerhaften Pakets: nvxdsync.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: nvxdsync.exe5

Error: (05/16/2015 03:07:56 PM) (Source: Microsoft-Windows-RestartManager) (EventID: 10007) (User: Chris)
Description: Die Anwendung oder der Dienst "EgisUpdate Release Application" konnte nicht neu gestartet werden.

Error: (05/16/2015 03:07:37 PM) (Source: Microsoft-Windows-RestartManager) (EventID: 10006) (User: Chris)
Description: Die Anwendung oder der Dienst "PMM Update Application" konnte nicht heruntergefahren werden.

Error: (05/16/2015 02:59:56 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".


Details:
AddWin32ServiceFiles: Unable to back up image of service EgisTec Ticket Service since QueryServiceConfig API failed

System Error:
Das System kann die angegebene Datei nicht finden.
.

Error: (05/14/2015 09:50:28 AM) (Source: Microsoft-Windows-RestartManager) (EventID: 10007) (User: Chris)
Description: Die Anwendung oder der Dienst "CCDMonitorService" konnte nicht neu gestartet werden.

Error: (05/14/2015 09:50:25 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: EnableWakeUpOption.exe, Version: 0.0.0.0, Zeitstempel: 0x500e38f6
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.3.9600.17415, Zeitstempel: 0x54504ade
Ausnahmecode: 0xe0434f4d
Fehleroffset: 0x00014598
ID des fehlerhaften Prozesses: 0x%9
Startzeit der fehlerhaften Anwendung: 0xEnableWakeUpOption.exe0
Pfad der fehlerhaften Anwendung: EnableWakeUpOption.exe1
Pfad des fehlerhaften Moduls: EnableWakeUpOption.exe2
Berichtskennung: EnableWakeUpOption.exe3
Vollständiger Name des fehlerhaften Pakets: EnableWakeUpOption.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: EnableWakeUpOption.exe5

Error: (05/14/2015 09:40:44 AM) (Source: Microsoft-Windows-RestartManager) (EventID: 10007) (User: Chris)
Description: Die Anwendung oder der Dienst "NTI IScheduleSvc" konnte nicht neu gestartet werden.

Error: (05/13/2015 11:23:46 PM) (Source: MsiInstaller) (EventID: 1024) (User: Chris)
Description: Produkt: Adobe Reader XI (11.0.10) - Deutsch - Update "{AC76BA86-7AD7-0000-2550-7A8C40011011}" konnte nicht installiert werden. Fehlercode 1625. Windows Installer kann Protokolle erstellen, um bei der Problembehandlung betreffend der Installation von Softwarepaketen behilflich zu sein. Verwenden Sie folgenden Link, um Anweisungen zur Aktivierung der Protokollierungsunterstützung zu erhalten: hxxp://go.microsoft.com/fwlink/?LinkId=23127


System errors:
=============
Error: (05/18/2015 05:52:26 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "NTI IScheduleSvc" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error: (05/18/2015 05:52:21 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "CCDMonitorService" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error: (05/18/2015 04:58:06 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "NTI IScheduleSvc" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error: (05/18/2015 04:58:03 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "CCDMonitorService" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error: (05/18/2015 04:57:31 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: Der Dienst "Bitdefender Virus Shield" wurde nicht richtig gestartet.

Error: (05/18/2015 04:55:45 PM) (Source: Service Control Manager) (EventID: 7032) (User: )
Description: Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden des Dienstes "Windows Search" Korrekturmaßnahmen (Neustart des Diensts) durchzuführen, ist fehlgeschlagen. Fehler:
%%1056

Error: (05/18/2015 04:55:44 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Automatische WLAN-Konfiguration" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (05/18/2015 04:55:44 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Diagnosesystemhost" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (05/18/2015 04:55:44 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Überwachung verteilter Verknüpfungen (Client)" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (05/18/2015 04:55:44 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Superfetch" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.


Microsoft Office Sessions:
=========================
Error: (05/18/2015 04:55:16 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: svchost.exe_DeviceAssociationService6.3.9600.1741554504177ntdll.dll6.3.9600.17736550f4336c000037400000000000f0f2063801d090967168769bC:\WINDOWS\System32\svchost.exeC:\WINDOWS\SYSTEM32\ntdll.dlle4a4420c-fd6d-11e4-bed0-2cd05a0e662f

Error: (05/17/2015 01:27:53 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: BITSC:\Windows\System32\bitsperf.dll8

Error: (05/17/2015 01:15:01 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: nvxdsync.exe8.17.13.7175077ae57nvxdsync.exe8.17.13.7175077ae57c0000005000000000004169152001d09092a8406deaC:\Program Files\NVIDIA Corporation\Display\nvxdsync.exeC:\Program Files\NVIDIA Corporation\Display\nvxdsync.exef516d8c3-fc85-11e4-becf-2cd05a0e662f

Error: (05/16/2015 03:07:56 PM) (Source: Microsoft-Windows-RestartManager) (EventID: 10007) (User: Chris)
Description: 1C:\Program Files\EgisTec IPS\EgisUpdate.exeEgisUpdate Release Application0213447240

Error: (05/16/2015 03:07:37 PM) (Source: Microsoft-Windows-RestartManager) (EventID: 10006) (User: Chris)
Description: 1C:\Program Files\EgisTec IPS\PmmUpdate.exePMM Update Application0211742360

Error: (05/16/2015 02:59:56 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description:
Details:
AddWin32ServiceFiles: Unable to back up image of service EgisTec Ticket Service since QueryServiceConfig API failed

System Error:
Das System kann die angegebene Datei nicht finden.

Error: (05/14/2015 09:50:28 AM) (Source: Microsoft-Windows-RestartManager) (EventID: 10007) (User: Chris)
Description: 0CCDMonitorService.exeCCDMonitorService03026217824080

Error: (05/14/2015 09:50:25 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: EnableWakeUpOption.exe0.0.0.0500e38f6KERNELBASE.dll6.3.9600.1741554504adee0434f4d00014598

Error: (05/14/2015 09:40:44 AM) (Source: Microsoft-Windows-RestartManager) (EventID: 10007) (User: Chris)
Description: 0IScheduleSvc.exeNTI IScheduleSvc03026217827200

Error: (05/13/2015 11:23:46 PM) (Source: MsiInstaller) (EventID: 1024) (User: Chris)
Description: Adobe Reader XI (11.0.10) - Deutsch{AC76BA86-7AD7-0000-2550-7A8C40011011}1625(NULL)(NULL)(NULL)


CodeIntegrity Errors:
===================================
  Date: 2015-05-13 23:56:45.402
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume4\Program Files (x86)\Emsisoft Anti-Malware\a2hooks64.dll that did not meet the Store signing level requirements.

  Date: 2015-05-13 23:56:45.401
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume4\Program Files (x86)\Emsisoft Anti-Malware\a2hooks64.dll that did not meet the Store signing level requirements.

  Date: 2015-05-13 23:56:45.399
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume4\Program Files (x86)\Emsisoft Anti-Malware\a2hooks64.dll that did not meet the Store signing level requirements.

  Date: 2015-05-11 14:48:42.679
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume4\Program Files (x86)\Emsisoft Anti-Malware\a2hooks64.dll that did not meet the Store signing level requirements.

  Date: 2015-05-11 14:48:42.679
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume4\Program Files (x86)\Emsisoft Anti-Malware\a2hooks64.dll that did not meet the Store signing level requirements.

  Date: 2015-01-31 13:51:47.962
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.

  Date: 2015-01-31 13:45:00.126
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.

  Date: 2015-01-31 13:31:35.632
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.

  Date: 2015-01-31 13:09:29.143
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.

  Date: 2015-01-31 12:38:57.223
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.


==================== Memory info ===========================

Processor: Intel(R) Core(TM) i7-3632QM CPU @ 2.20GHz
Percentage of memory in use: 24%
Total physical RAM: 8010.27 MB
Available physical RAM: 6016.6 MB
Total Pagefile: 9290.27 MB
Available Pagefile: 6841.29 MB
Total Virtual: 131072 MB
Available Virtual: 131071.83 MB

==================== Drives ================================

Drive c: (Acer) (Fixed) (Total:913.26 GB) (Free:697.29 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: 6CCEFCDC)

Partition: GPT Partition Type.

==================== End Of Log ============================
Liebe Grüße Christian

Bootsektor 18.05.2015 22:50
Hallo,

was willst du denn als AV behalten?

Hast du aktuell noch Probleme?

Schritt 1

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
Task: {4F3912ED-1360-4E60-8BDB-7E1C1483D2CA} - \Optimize Start Menu Cache Files-S-1-5-21-704110784-328736849-532702743-500 No Task File <==== ATTENTION

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.



Schritt 2
Da der Scan mit Eset sehr gründlich ist, kann er unter Umständen mehrere Stunden dauern :kaffee_reboot:

ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset



Schritt 3
Starte noch einmal FRST.
  • Setze den Haken bei addition.txt und drücke auf Scan.
  • Wenn der Scan abgeschlossen ist, werden zwei neue Logfiles FRST.txt und addition.txt erstellt und auf dem Desktop (oder in dem Verzeichnis in dem FRST liegt) gespeichert.
  • Poste den Inhalt dieser Logfiles bitte hier in deinen Thread.

Chris2128 19.05.2015 15:59
Hi
ja bin mir noch nicht sicher ob ich bitdefender oder eset kaufe was meinen sie sollte ich nehmen?
emsisoft will ich runter nehmen aber in der quarantäne sind ja noch n paar funde drin kann ich die löschen oder einfach emsisoft deinstallieren?

Ja also der bitdefender findet nach wie vor immernoch stündlich infizierte dateien mit JS Crossraider B und musste bitdefender auch deinstallieren für den eset scan da er sich nicht abschalten lässt, installiere ihn aber gleich wieder

so hier die logs

Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 16-05-2015 02
Ran by Christian at 2015-05-19 02:35:07 Run:1
Running from C:\Users\Christian\Desktop
Loaded Profiles: UpdatusUser & Christian (Available profiles: UpdatusUser & Christian)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
Task: {4F3912ED-1360-4E60-8BDB-7E1C1483D2CA} - \Optimize Start Menu Cache Files-S-1-5-21-704110784-328736849-532702743-500 No Task File <==== ATTENTION
       
*****************

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{4F3912ED-1360-4E60-8BDB-7E1C1483D2CA}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4F3912ED-1360-4E60-8BDB-7E1C1483D2CA}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Optimize Start Menu Cache Files-S-1-5-21-704110784-328736849-532702743-500" => Key deleted successfully.

==== End of Fixlog 02:35:09 ====
Code:
ESETSmartInstaller@High as downloader log:
all ok
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=b7c65a2888df854983d190a97a0439e4
# engine=23915
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-05-19 02:23:18
# local_time=2015-05-19 04:23:18 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.2.9200 NT
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 2314062 9127790 0 0
# scanned=300604
# found=6
# cleaned=0
# scan_time=14751
sh=1C88A7C4FD5E9BBE5F558AB731149EC1E59A67AC ft=0 fh=0000000000000000 vn="Win32/Toolbar.TNT2.I evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\ffsearch_toolbar!1.0.0.1031.xpi.vir"
sh=BC1EF47616D2E476C28291A35DA52DE580C88964 ft=1 fh=850fb2247fe7ff1d vn="Variante von Win32/Adware.PrivDog.A Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Christian\AppData\Local\AdTrustMedia\PrivDog\PrivDogSetup_3.0.97.0.exe.vir"
sh=9CE5F659BDD89907624541CB98681224CA75D886 ft=1 fh=9b9a5086efdbb0a1 vn="Variante von Win64/Systweak.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\WINDOWS\System32\roboot64.exe.vir"
sh=FE16135A2C30E10234FEC9761A6D65ED805A0BD9 ft=1 fh=2b509b96c57b135f vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Christian\Downloads\Bitdefender Rescue CD - CHIP-Installer.exe"
sh=7D1726FB5F387A728C7730ADED7A8350F5C1BDBD ft=1 fh=9dfe629e41c57771 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Christian\Downloads\Emsisoft Anti Malware - CHIP-Installer.exe"
sh=9302014CC5F86B897EAFCF237D3DD4ECD9C0C15C ft=1 fh=13be3589405effa0 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Christian\Downloads\Intel Turbo Boost Technology Monitor - CHIP-Installer.exe"

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 16-05-2015 02
Ran by Christian (administrator) on CHRIS on 19-05-2015 16:44:11
Running from C:\Users\Christian\Desktop
Loaded Profiles: UpdatusUser & Christian (Available profiles: UpdatusUser & Christian)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Emsisoft Ltd) C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Windows (R) Win 7 DDK provider) C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\AdminService.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(Dritek System INC.) C:\Windows\RfBtnSvc64.exe
(CyberGhost S.R.L) C:\Program Files\CyberGhost 5\Service.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerTray.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Intel Corporation) C:\Windows\System32\igfxTray.exe
(Atheros Communications) C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe
(Dolby Laboratories Inc.) C:\Dolby PCEE4\pcee4.exe
() C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Emsisoft Ltd) C:\Program Files (x86)\Emsisoft Anti-Malware\a2guard.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2873744 2012-11-20] (ELAN Microelectronics Corp.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12937872 2012-07-27] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1214608 2012-07-10] (Realtek Semiconductor)
HKLM\...\Run: [InstallerLauncher] => "C:\Program Files\Common Files\Bitdefender\SetupInformation\{6F57816A-791A-4159-A75F-CFD0C7EA4FBF}\setuplauncher.exe" /run:"C:\Program Files\Common Files\Bitdefender\SetupInformation\{6F57816A-791A-41 (the data entry has 36 more characters).
HKLM-x32\...\Run: [Dolby Home Theater v4] => C:\Dolby PCEE4\pcee4.exe [508656 2012-07-25] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [amd_dc_opt] => C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe [77824 2008-07-22] (AMD)
HKLM-x32\...\Run: [KiesTrayAgent] => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311616 2015-02-24] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [emsisoft anti-malware] => c:\program files (x86)\emsisoft anti-malware\a2guard.exe [4923832 2015-05-10] (Emsisoft Ltd)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [271744 2015-04-10] (Oracle Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
HKLM\...\Policies\Explorer\Run: [BtvStack] => C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe [132736 2013-09-07] (Atheros Communications)
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKU\S-1-5-21-704110784-328736849-532702743-1001\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [516608 2014-10-29] (Microsoft Corporation)
HKU\S-1-5-21-704110784-328736849-532702743-1002\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3672640 2013-03-14] (Disc Soft Ltd)
HKU\S-1-5-21-704110784-328736849-532702743-1002\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8204056 2015-04-23] (Piriform Ltd)
HKU\S-1-5-21-704110784-328736849-532702743-1002\...\MountPoints2: {cbf6e073-7ec8-11e2-be69-806e6f6e6963} - "D:\setup.exe"
HKU\S-1-5-21-704110784-328736849-532702743-1002\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\Ribbons.scr [132608 2014-10-29] (Microsoft Corporation)
AppInit_DLLs: c:\windows\system32\nvinitx.dll => c:\windows\system32\nvinitx.dll [168616 2013-09-05] (NVIDIA Corporation)
AppInit_DLLs: , C:\WINDOWS\system32\nvinitx.dll => C:\WINDOWS\system32\nvinitx.dll [168616 2013-09-05] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\WINDOWS\SysWOW64\nvinit.dll => C:\WINDOWS\SysWOW64\nvinit.dll [141336 2013-09-05] (NVIDIA Corporation)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-704110784-328736849-532702743-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://acer13.msn.com
HKU\S-1-5-21-704110784-328736849-532702743-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer13.msn.com
HKU\S-1-5-21-704110784-328736849-532702743-1002\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer13.msn.com
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-704110784-328736849-532702743-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2015-05-11] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2015-05-11] (Oracle Corporation)
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  No File
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Christian\AppData\Roaming\Mozilla\Firefox\Profiles\f1ovvaoh.default
FF DefaultSearchEngine: Google (avast)
FF DefaultSearchUrl: https://www.google.com/search/?trackid=sp-006
FF SearchEngineOrder.1: Google (avast)
FF SelectedSearchEngine: Google (avast)
FF Homepage: Goggle.de
FF Keyword.URL: https://www.google.com/search/?trackid=sp-006
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_17_0_0_169.dll [2015-04-14] ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-04-14] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-06-06] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-06-06] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.80.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll [2015-05-11] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.80.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2015-05-11] (Oracle Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.0 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-05-01] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-704110784-328736849-532702743-1002: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll No File
FF SearchPlugin: C:\Users\Christian\AppData\Roaming\Mozilla\Firefox\Profiles\f1ovvaoh.default\searchplugins\google-avast.xml [2015-05-08]
FF Extension: Adblock Plus Pop-up Addon - C:\Users\Christian\AppData\Roaming\Mozilla\Firefox\Profiles\f1ovvaoh.default\Extensions\adblockpopups@jessehakanen.net.xpi [2015-02-01]
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK

Chrome:
=======
CHR HKU\S-1-5-21-704110784-328736849-532702743-1002\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [cmaiofennmphjldldcpphcechfnnohja] - C:\Users\Christian\AppData\Local\AdTrustMedia\PrivDog\PrivDog_chrome.crx [Not Found]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 a2AntiMalware; C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe [5164328 2015-05-10] (Emsisoft Ltd)
R2 AtherosSvc; C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\adminservice.exe [312448 2013-09-07] (Windows (R) Win 7 DDK provider) [File not signed]
S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [967040 2015-04-01] ()
S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-10-29] (Microsoft Corporation)
R2 CGVPNCliService; C:\Program Files\CyberGhost 5\Service.exe [64616 2014-11-03] (CyberGhost S.R.L)
S3 DeviceFastLaneService; C:\Program Files\Acer\Acer Device Fast-lane\DeviceFastLaneSvc.exe [469648 2012-11-17] (Acer Incorporated)
R2 DiagTrack; C:\Windows\system32\diagtrack.dll [1429504 2015-03-05] (Microsoft Corporation)
R3 ePowerSvc; C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe [658064 2012-10-23] (Acer Incorporated)
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [314696 2014-05-21] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-17] (Intel Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2015-04-14] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
R2 RfButtonDriverService; C:\Windows\RfBtnSvc64.exe [93296 2013-02-24] (Dritek System INC.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-04] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-04] (Microsoft Corporation)
S2 CCDMonitorService; C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe [X]
S2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [77464 2013-09-07] (Qualcomm Atheros)
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-09-24] (Microsoft Corporation)
R3 dtsoftbus01; C:\Windows\System32\drivers\dtsoftbus01.sys [283200 2013-04-08] (DT Soft Ltd)
R1 epp64; C:\Windows\System32\DRIVERS\epp64.sys [135800 2015-03-23] (Emsisoft GmbH)
S3 Hamachi; C:\Windows\system32\DRIVERS\Hamdrv.sys [46136 2014-11-03] (LogMeIn Inc.)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [136408 2015-05-19] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2015-04-14] (Malwarebytes Corporation)
R3 Ps2Kb2Hid; C:\Windows\System32\drivers\aPs2Kb2Hid.sys [26736 2013-02-24] (Dritek System Inc.)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-04] (Microsoft Corporation)
S3 EagleX64; \??\C:\WINDOWS\system32\drivers\EagleX64.sys [X]
S3 xhunter1; \??\C:\WINDOWS\xhunter1.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-05-19 16:44 - 2015-05-19 16:44 - 00014894 _____ () C:\Users\Christian\Desktop\FRST.txt
2015-05-19 16:40 - 2015-05-19 16:40 - 00002083 _____ () C:\Users\Christian\Desktop\eset scan.txt
2015-05-19 12:09 - 2015-05-19 12:09 - 00266783 _____ () C:\ProgramData\1432030049.bdinstall.bin
2015-05-19 03:00 - 2015-05-19 03:00 - 00000000 ____D () C:\Program Files (x86)\ESET
2015-05-19 02:49 - 2015-05-19 02:49 - 02347384 _____ (ESET) C:\Users\Christian\Desktop\esetsmartinstaller_deu.exe
2015-05-18 17:57 - 2015-05-18 17:57 - 00002102 _____ () C:\Users\Christian\Desktop\MBAM.txt
2015-05-18 17:51 - 2015-05-19 12:10 - 00004558 _____ () C:\WINDOWS\PFRO.log
2015-05-18 17:17 - 2015-05-19 12:30 - 00003594 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-704110784-328736849-532702743-1002
2015-05-18 17:11 - 2015-05-19 16:12 - 00136408 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-05-18 17:11 - 2015-05-18 17:11 - 00001114 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-05-18 17:11 - 2015-05-18 17:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-05-18 17:11 - 2015-05-18 17:11 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-05-18 17:11 - 2015-05-18 17:11 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-05-18 17:11 - 2015-04-14 09:38 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2015-05-18 17:11 - 2015-04-14 09:37 - 00107736 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2015-05-18 17:11 - 2015-04-14 09:37 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2015-05-18 17:07 - 2015-05-18 17:08 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\Christian\Desktop\mbam-setup-2.1.6.1022.exe
2015-05-17 14:45 - 2015-05-17 14:45 - 00014728 _____ () C:\Users\Christian\Desktop\emsisoft quarantine.txt
2015-05-17 13:52 - 2015-05-19 16:44 - 00000000 ____D () C:\FRST
2015-05-17 13:45 - 2015-05-17 13:45 - 02107392 _____ (Farbar) C:\Users\Christian\Desktop\FRST64.exe
2015-05-17 13:42 - 2015-05-17 13:42 - 00000385 _____ () C:\Users\Christian\AppData\Roaminguser_gensett.xml
2015-05-17 13:36 - 2015-05-17 13:36 - 00001150 _____ () C:\Users\Christian\Desktop\JRT.txt
2015-05-17 13:16 - 2015-05-17 13:16 - 00000207 _____ () C:\WINDOWS\tweaking.com-regbackup-CHRIS-Windows-8.1-(64-bit).dat
2015-05-17 13:16 - 2015-05-17 13:16 - 00000000 ____D () C:\RegBackup
2015-05-17 12:55 - 2015-05-17 12:55 - 02719698 _____ (Thisisu) C:\Users\Christian\Desktop\JRT.exe
2015-05-17 12:42 - 2015-05-18 16:55 - 00000000 ____D () C:\AdwCleaner
2015-05-17 12:29 - 2015-05-17 12:29 - 02209792 _____ () C:\Users\Christian\Desktop\AdwCleaner_4.204.exe
2015-05-17 12:21 - 2015-05-17 14:10 - 00000146 _____ () C:\Users\Christian\Desktop\Neues Textdokument.txt
2015-05-17 12:14 - 2015-05-17 12:14 - 04197016 _____ (Kaspersky Lab ZAO) C:\Users\Christian\Desktop\tdsskiller.exe
2015-05-16 19:18 - 2015-05-16 19:18 - 02720307 _____ (Thisisu) C:\Users\Christian\Downloads\JRT_6.7.0.exe
2015-05-16 16:41 - 2015-05-19 16:38 - 00002643 _____ () C:\WINDOWS\setupact.log
2015-05-16 16:41 - 2015-05-16 16:41 - 00000000 _____ () C:\WINDOWS\setuperr.log
2015-05-16 15:53 - 2015-05-16 15:54 - 01203488 _____ () C:\Users\Christian\Downloads\Bitdefender Rescue CD - CHIP-Installer.exe
2015-05-16 14:37 - 2015-05-16 14:38 - 00360834 _____ () C:\Users\Christian\Documents\cc_20150516_143706.reg
2015-05-16 10:14 - 2015-05-05 19:59 - 00792568 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2015-05-16 10:14 - 2015-05-05 19:59 - 00178168 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2015-05-16 07:58 - 2014-04-16 01:35 - 00028352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aspnet_counters.dll
2015-05-16 07:58 - 2014-04-16 01:34 - 00029888 _____ (Microsoft Corporation) C:\WINDOWS\system32\aspnet_counters.dll
2015-05-16 07:48 - 2015-05-16 07:48 - 00000000 ____D () C:\Users\Christian\AppData\Temp
2015-05-15 14:01 - 2015-05-15 14:02 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-05-14 09:14 - 2015-05-14 09:14 - 00002792 _____ () C:\WINDOWS\System32\Tasks\CCleanerSkipUAC
2015-05-14 09:14 - 2015-05-14 09:14 - 00000838 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2015-05-14 09:13 - 2015-05-14 09:14 - 00000000 ____D () C:\Program Files\CCleaner
2015-05-14 09:11 - 2015-05-14 09:11 - 05248848 _____ (Piriform Ltd) C:\Users\Christian\Downloads\ccsetup505_slim.exe
2015-05-14 08:40 - 2015-05-14 08:40 - 00001144 _____ () C:\Users\Christian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Emsisoft Anti-Malware Guard.lnk
2015-05-13 21:19 - 2015-04-30 22:35 - 00124112 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 21:19 - 2015-04-30 22:35 - 00102608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 20:47 - 2015-05-13 20:47 - 00000385 _____ () C:\WINDOWS\system32\user_gensett.xml
2015-05-13 20:46 - 2015-05-14 10:32 - 00000000 ____D () C:\ProgramData\BDLogging
2015-05-13 20:46 - 2015-05-13 20:46 - 00000000 ____H () C:\WINDOWS\system32\Drivers\Msft_Kernel_avchv_01009.Wdf
2015-05-13 20:46 - 2015-01-09 11:44 - 00074000 _____ (BitDefender SRL) C:\WINDOWS\SysWOW64\bdsandboxuiskin32.dll
2015-05-13 20:46 - 2007-04-11 11:11 - 00511328 _____ (Microsoft Corporation) C:\WINDOWS\capicom.dll
2015-05-13 20:41 - 2015-05-19 12:10 - 00000000 ____D () C:\Program Files\Bitdefender
2015-05-13 20:41 - 2015-05-13 21:16 - 00074000 _____ (BitDefender SRL) C:\WINDOWS\system32\bdsandboxuiskin32.dll
2015-05-13 20:41 - 2015-01-09 11:44 - 00084848 _____ (BitDefender SRL) C:\WINDOWS\system32\BDSandBoxUISkin.dll
2015-05-13 20:41 - 2015-01-09 11:44 - 00033360 _____ (BitDefender SRL) C:\WINDOWS\system32\BDSandBoxUH.dll
2015-05-13 20:40 - 2015-05-19 12:09 - 00000000 ____D () C:\Program Files\Common Files\Bitdefender
2015-05-13 17:01 - 2015-04-10 02:34 - 02256896 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll
2015-05-13 17:01 - 2015-04-10 02:11 - 01943040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll
2015-05-13 17:01 - 2015-03-17 19:26 - 00467776 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBHUB3.SYS
2015-05-13 17:01 - 2015-03-09 04:02 - 00057856 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthhfenum.sys
2015-05-13 17:00 - 2015-05-01 01:05 - 00429568 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll
2015-05-13 17:00 - 2015-05-01 00:48 - 00358912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll
2015-05-13 17:00 - 2015-04-24 23:32 - 00036864 _____ (Microsoft Corporation) C:\WINDOWS\system32\UtcResources.dll
2015-05-13 17:00 - 2015-04-09 00:55 - 00410128 _____ (Microsoft Corporation) C:\WINDOWS\system32\services.exe
2015-05-13 17:00 - 2015-04-02 00:22 - 02985984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbgeng.dll
2015-05-13 17:00 - 2015-04-02 00:20 - 04417536 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbgeng.dll
2015-05-13 17:00 - 2015-04-01 05:45 - 01491456 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbghelp.dll
2015-05-13 17:00 - 2015-04-01 04:31 - 01207296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbghelp.dll
2015-05-13 17:00 - 2015-03-30 07:47 - 00561928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2015-05-13 17:00 - 2015-03-27 05:27 - 00445440 _____ (Microsoft Corporation) C:\WINDOWS\system32\certcli.dll
2015-05-13 17:00 - 2015-03-27 04:50 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certcli.dll
2015-05-13 17:00 - 2015-03-27 04:48 - 01441792 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2015-05-13 17:00 - 2015-03-20 03:56 - 00080384 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ahcache.sys
2015-05-13 17:00 - 2015-03-13 06:03 - 00239424 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdbus.sys
2015-05-13 17:00 - 2015-03-13 06:03 - 00154432 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dumpsd.sys
2015-05-13 17:00 - 2015-03-13 03:11 - 02162176 _____ (Microsoft Corporation) C:\WINDOWS\system32\SRH.dll
2015-05-13 17:00 - 2015-03-13 02:39 - 01812992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SRH.dll
2015-05-13 17:00 - 2015-03-13 02:29 - 00410017 _____ () C:\WINDOWS\system32\ApnDatabase.xml
2015-05-13 17:00 - 2015-03-11 03:49 - 00024576 _____ (Microsoft Corporation) C:\WINDOWS\system32\sdbinst.exe
2015-05-13 17:00 - 2015-03-11 03:09 - 00021504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sdbinst.exe
2015-05-13 17:00 - 2015-03-06 05:08 - 02067968 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpdshext.dll
2015-05-13 17:00 - 2015-03-06 04:47 - 01696256 _____ (Microsoft Corporation) C:\WINDOWS\system32\wevtsvc.dll
2015-05-13 17:00 - 2015-03-06 04:43 - 01969664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wpdshext.dll
2015-05-13 17:00 - 2015-03-05 01:09 - 01429504 _____ (Microsoft Corporation) C:\WINDOWS\system32\diagtrack.dll
2015-05-13 17:00 - 2015-03-04 03:32 - 00172544 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Input.Inking.dll
2015-05-13 17:00 - 2015-03-04 03:12 - 00141824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Input.Inking.dll
2015-05-13 17:00 - 2015-01-30 02:53 - 02819584 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers.dll
2015-05-13 17:00 - 2014-11-14 08:58 - 00116736 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsDatabase.dll
2015-05-13 16:59 - 2015-04-21 19:14 - 24971776 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2015-05-13 16:59 - 2015-04-21 18:50 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2015-05-13 16:59 - 2015-04-21 18:50 - 00417792 _____ (Microsoft Corporation) C:\WINDOWS\system32\html.iec
2015-05-13 16:59 - 2015-04-21 18:49 - 02885120 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2015-05-13 16:59 - 2015-04-21 18:37 - 00633856 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieui.dll
2015-05-13 16:59 - 2015-04-21 18:35 - 00816640 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2015-05-13 16:59 - 2015-04-21 18:31 - 06025728 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2015-05-13 16:59 - 2015-04-21 18:24 - 19691008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2015-05-13 16:59 - 2015-04-21 18:13 - 00107520 _____ (Microsoft Corporation) C:\WINDOWS\system32\inseng.dll
2015-05-13 16:59 - 2015-04-21 18:11 - 00504320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2015-05-13 16:59 - 2015-04-21 18:09 - 00341504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\html.iec
2015-05-13 16:59 - 2015-04-21 18:08 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2015-05-13 16:59 - 2015-04-21 18:07 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll
2015-05-13 16:59 - 2015-04-21 18:05 - 00316928 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2015-05-13 16:59 - 2015-04-21 18:04 - 02278400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2015-05-13 16:59 - 2015-04-21 17:59 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2015-05-13 16:59 - 2015-04-21 17:58 - 00664576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2015-05-13 16:59 - 2015-04-21 17:52 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
2015-05-13 16:59 - 2015-04-21 17:49 - 00801280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2015-05-13 16:59 - 2015-04-21 17:49 - 00720384 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2015-05-13 16:59 - 2015-04-21 17:49 - 00374272 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2015-05-13 16:59 - 2015-04-21 17:46 - 02125824 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2015-05-13 16:59 - 2015-04-21 17:40 - 14401536 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2015-05-13 16:59 - 2015-04-21 17:38 - 00076288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
2015-05-13 16:59 - 2015-04-21 17:37 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll
2015-05-13 16:59 - 2015-04-21 17:36 - 00285696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2015-05-13 16:59 - 2015-04-21 17:32 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2015-05-13 16:59 - 2015-04-21 17:31 - 04305920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2015-05-13 16:59 - 2015-04-21 17:28 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll
2015-05-13 16:59 - 2015-04-21 17:27 - 02352128 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2015-05-13 16:59 - 2015-04-21 17:26 - 00688640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2015-05-13 16:59 - 2015-04-21 17:26 - 00327168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2015-05-13 16:59 - 2015-04-21 17:25 - 02052608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2015-05-13 16:59 - 2015-04-21 17:17 - 12828672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2015-05-13 16:59 - 2015-04-21 17:15 - 01547264 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2015-05-13 16:59 - 2015-04-21 17:03 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2015-05-13 16:59 - 2015-04-21 17:02 - 01882112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2015-05-13 16:59 - 2015-04-21 16:58 - 01310208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2015-05-13 16:59 - 2015-04-21 16:56 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2015-05-13 16:59 - 2015-04-14 00:48 - 04180480 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2015-05-13 16:59 - 2015-04-10 03:00 - 01996800 _____ (Microsoft Corporation) C:\WINDOWS\system32\DWrite.dll
2015-05-13 16:59 - 2015-04-10 02:50 - 01387008 _____ (Microsoft Corporation) C:\WINDOWS\system32\FntCache.dll
2015-05-13 16:59 - 2015-04-10 02:26 - 01560576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DWrite.dll
2015-05-13 16:59 - 2015-04-03 02:35 - 00445440 _____ (Microsoft Corporation) C:\WINDOWS\system32\PhotoMetadataHandler.dll
2015-05-13 16:59 - 2015-04-03 02:14 - 00364544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PhotoMetadataHandler.dll
2015-05-13 16:59 - 2015-03-13 04:02 - 00316416 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\udfs.sys
2015-05-13 16:59 - 2015-02-18 01:19 - 00186368 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpapisrv.dll
2015-05-12 13:46 - 2015-05-12 14:36 - 00000000 ____D () C:\Users\Christian\AppData\Roaming\QuickScan
2015-05-11 21:17 - 2015-05-11 21:16 - 00272808 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaws.exe
2015-05-11 21:16 - 2015-05-11 21:16 - 00176040 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaw.exe
2015-05-11 21:16 - 2015-05-11 21:16 - 00176040 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\java.exe
2015-05-11 21:16 - 2015-05-11 21:16 - 00098216 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll
2015-05-11 21:16 - 2015-05-11 21:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-05-11 21:16 - 2015-05-11 21:16 - 00000000 ____D () C:\Program Files (x86)\Java
2015-05-11 20:15 - 2015-05-11 20:15 - 02867656 _____ () C:\Users\Christian\Downloads\bitdefender_isecurity_v2015.exe
2015-05-10 21:02 - 2015-05-10 21:02 - 00000000 ____D () C:\ProgramData\Emsisoft
2015-05-10 20:54 - 2015-05-10 20:54 - 00001103 _____ () C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk
2015-05-10 20:54 - 2015-05-10 20:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Emsisoft Anti-Malware
2015-05-10 20:53 - 2015-05-19 16:41 - 00000000 ____D () C:\Program Files (x86)\Emsisoft Anti-Malware
2015-05-10 20:53 - 2015-03-23 23:17 - 00135800 _____ (Emsisoft GmbH) C:\WINDOWS\system32\Drivers\epp64.sys
2015-05-10 20:50 - 2015-05-10 20:50 - 01203488 _____ () C:\Users\Christian\Downloads\Emsisoft Anti Malware - CHIP-Installer.exe
2015-04-23 18:39 - 2015-04-23 18:47 - 00001985 _____ () C:\Users\Public\Desktop\Samsung Kies 3.lnk
2015-04-23 13:46 - 2015-04-23 13:46 - 00000000 ____D () C:\Users\Christian\AppData\Roaming\IsolatedStorage
2015-04-23 13:46 - 2015-04-23 13:46 - 00000000 ____D () C:\ProgramData\IsolatedStorage
2015-04-23 13:41 - 2015-04-23 13:41 - 00000000 ____D () C:\Spacekace

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-05-19 16:37 - 2014-10-26 16:35 - 01845116 _____ () C:\WINDOWS\WindowsUpdate.log
2015-05-19 16:00 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2015-05-19 15:52 - 2013-04-07 20:41 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2015-05-19 12:10 - 2013-08-22 16:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2015-05-19 12:10 - 2012-07-26 10:12 - 00000000 ____D () C:\WINDOWS\ELAMBKUP
2015-05-19 11:57 - 2014-10-31 23:24 - 00003934 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{543C5195-C36C-452D-A5D5-B7493A999655}
2015-05-19 03:01 - 2014-09-24 08:17 - 02121430 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2015-05-19 03:01 - 2014-09-24 07:43 - 01021576 _____ () C:\WINDOWS\system32\perfh007.dat
2015-05-19 03:01 - 2014-09-24 07:43 - 00243696 _____ () C:\WINDOWS\system32\perfc007.dat
2015-05-19 02:35 - 2013-04-09 00:05 - 00000000 ____D () C:\Users\Christian\AppData\Local\CrashDumps
2015-05-18 18:56 - 2013-04-08 23:30 - 00000000 ____D () C:\Users\Christian\AppData\Roaming\vlc
2015-05-18 17:51 - 2013-08-22 16:45 - 00000000 ____D () C:\WINDOWS\Setup
2015-05-18 17:51 - 2013-08-22 15:25 - 00262144 ___SH () C:\WINDOWS\system32\config\BBI
2015-05-18 16:38 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2015-05-17 12:47 - 2013-08-22 16:44 - 00414016 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2015-05-17 12:13 - 2013-06-16 16:02 - 00904704 ___SH () C:\Users\Christian\Desktop\Thumbs.db
2015-05-16 15:17 - 2014-10-26 16:32 - 00000000 ___DC () C:\WINDOWS\Panther
2015-05-16 15:17 - 2014-07-07 23:08 - 00000000 ____D () C:\Program Files (x86)\Steam
2015-05-16 15:17 - 2013-04-08 00:45 - 00000000 ____D () C:\Users\Christian\AppData\Roaming\DAEMON Tools Lite
2015-05-16 15:00 - 2012-12-20 06:30 - 00000000 ____D () C:\ProgramData\EgisTec IPS
2015-05-16 10:12 - 2014-12-21 18:41 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-05-16 10:08 - 2013-08-22 17:36 - 00000000 ___RD () C:\WINDOWS\ImmersiveControlPanel
2015-05-16 08:02 - 2012-07-26 09:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
2015-05-14 10:45 - 2013-04-06 07:54 - 00000000 ____D () C:\Users\Christian\AppData\Local\Packages
2015-05-14 10:32 - 2014-12-16 17:56 - 00000000 ____D () C:\WINDOWS\Minidump
2015-05-14 10:32 - 2013-08-22 17:36 - 00000000 ___RD () C:\WINDOWS\Offline Web Pages
2015-05-14 09:50 - 2012-12-20 06:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acer
2015-05-14 09:50 - 2012-12-20 06:28 - 00000000 ____D () C:\Program Files (x86)\Acer
2015-05-14 09:37 - 2012-12-20 06:29 - 00000000 ____D () C:\Program Files\Acer
2015-05-13 23:46 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\rescache
2015-05-13 23:24 - 2015-04-03 15:38 - 00002457 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-05-13 21:18 - 2013-08-22 15:36 - 00000000 ____D () C:\WINDOWS\system32\AdvancedInstallers
2015-05-13 20:47 - 2013-08-22 15:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM
2015-05-13 19:36 - 2014-01-08 22:07 - 00000000 ____D () C:\WINDOWS\system32\MRT
2015-05-13 19:31 - 2013-04-08 00:02 - 140425016 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2015-05-13 18:23 - 2014-09-24 08:00 - 00000000 ____D () C:\Program Files\Windows Journal
2015-05-08 17:02 - 2014-12-21 18:41 - 00001147 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-05-07 20:36 - 2014-10-26 16:42 - 00000000 ____D () C:\Users\Christian
2015-05-07 20:34 - 2015-04-04 12:21 - 00000000 ___SD () C:\WINDOWS\system32\GWX
2015-05-07 20:34 - 2014-11-15 05:11 - 00000000 ____D () C:\Users\Christian\Documents\DayZ
2015-05-07 20:15 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\registration
2015-05-02 20:14 - 2013-04-14 01:12 - 00000000 ____D () C:\Users\Christian\Documents\TmForever
2015-04-23 18:47 - 2014-06-22 15:03 - 00000000 ____D () C:\Program Files (x86)\Samsung
2015-04-23 18:39 - 2014-06-22 15:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung
2015-04-23 18:39 - 2012-12-20 06:29 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-04-23 16:53 - 2013-04-14 18:19 - 00000000 ____D () C:\Users\Christian\AppData\Local\Downloaded Installations

==================== Files in the root of some directories =======

2015-05-19 12:09 - 2015-05-19 12:09 - 0266783 _____ () C:\ProgramData\1432030049.bdinstall.bin
2013-02-24 23:58 - 2013-02-24 23:58 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

Some content of TEMP:
====================
C:\Users\Christian\AppData\Local\Temp\Quarantine.exe
C:\Users\Christian\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-05-19 12:30

==================== End Of Log ============================
--- --- ---


Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 16-05-2015 02
Ran by Christian at 2015-05-19 16:45:16
Running from C:\Users\Christian\Desktop
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-704110784-328736849-532702743-500 - Administrator - Disabled)
Christian (S-1-5-21-704110784-328736849-532702743-1002 - Administrator - Enabled) => C:\Users\Christian
Gast (S-1-5-21-704110784-328736849-532702743-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-704110784-328736849-532702743-1004 - Limited - Enabled)
UpdatusUser (S-1-5-21-704110784-328736849-532702743-1001 - Limited - Enabled) => C:\Users\UpdatusUser

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Emsisoft Anti-Malware (Enabled - Up to date) {2F44E1F9-850B-1C7A-0E56-EB2E0A3E20C9}
AS: Emsisoft Anti-Malware (Enabled - Up to date) {9425001D-A331-13F4-34E6-D05C71B96A74}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.11) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.11 - Adobe Systems Incorporated)
CCleaner (HKLM\...\CCleaner) (Version: 5.05 - Piriform)
CyberGhost 5 (HKLM\...\CyberGhost VPN 5_is1) (Version:  - CyberGhost S.R.L.)
DayZ (HKLM-x32\...\Steam App 221100) (Version:  - Bohemia Interactive)
Emsisoft Anti-Malware (HKLM-x32\...\{5502032C-88C1-4303-99FE-B5CBD7684CEA}_is1) (Version: 9.0 - Emsisoft Ltd.)
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version:  - )
ETDWare PS/2-X64 11.6.16.003_WHQL (HKLM\...\Elantech) (Version: 11.6.16.003 - ELAN Microelectronic Corp.)
Free Studio version 6.5.0.219 (HKLM-x32\...\Free Studio_is1) (Version: 6.5.0.219 - DVDVideoSoft Ltd.)
Garry's Mod (HKLM-x32\...\Steam App 4000) (Version:  - Facepunch Studios)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3621 - Intel Corporation)
Java 7 Update 80 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217080FF}) (Version: 7.0.800 - Oracle)
Malwarebytes Anti-Malware Version 2.1.6.1022 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)
Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4420.1017 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Mozilla Firefox 38.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 38.0.1 (x86 de)) (Version: 38.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 36.0 - Mozilla)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MyFreeCodec (HKU\S-1-5-21-704110784-328736849-532702743-1002\...\MyFreeCodec) (Version:  - )
No More Room in Hell (HKLM-x32\...\Steam App 224260) (Version:  - No More Room in Hell Team)
Portal (HKLM-x32\...\Steam App 400) (Version:  - Valve)
Portal 2 (HKLM-x32\...\Steam App 620) (Version:  - Valve)
Qualcomm Atheros Bluetooth Suite (64) (HKLM\...\{A84A4FB1-D703-48DB-89E0-68B6499D2801}) (Version: 8.0.1.305 - Qualcomm Atheros Communications)
Qualcomm Atheros WLAN and Bluetooth Client Installation Program (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 12.07 - Qualcomm Atheros)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6695 - Realtek Semiconductor Corp.)
Resident Evil / biohazard HD REMASTER (HKLM-x32\...\Steam App 304240) (Version:  - CAPCOM Co., Ltd.)
Rising World (HKLM-x32\...\Steam App 324080) (Version:  - JIW-Games)
Samsung Kies3 (HKLM-x32\...\InstallShield_{88547073-C566-4895-9005-EBE98EA3F7C7}) (Version: 3.2.15041.2 - Samsung Electronics Co., Ltd.)
Samsung Kies3 (x32 Version: 3.2.15041.2 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.49.0 - SAMSUNG Electronics Co., Ltd.)
Sniper Elite 3 (HKLM-x32\...\Steam App 238090) (Version:  - Rebellion)
Stranded Deep (HKLM-x32\...\Steam App 313120) (Version:  - Beam Team Games)
System Requirements Lab CYRI (HKLM-x32\...\{906B34E5-573C-445A-A5D3-40B6BF0A2EC4}) (Version: 6.0.21.0 - Husdawg, LLC)
TAP-Windows 9.9.2 (HKLM\...\TAP-Windows) (Version: 9.9.2 - )
Visual Studio 2005 Tools for Office Second Edition Runtime (HKLM-x32\...\Microsoft Visual Studio 2005 Tools for Office Runtime) (Version:  - Microsoft Corporation)
Visual Studio Tools for the Office system 3.0 Runtime (HKLM-x32\...\Visual Studio Tools for the Office system 3.0 Runtime) (Version:  - Microsoft Corporation)
Visual Studio Tools for the Office system 3.0 Runtime Service Pack 1 (KB949258) (HKLM-x32\...\{8FB53850-246A-3507-8ADE-0060093FFEA6}.KB949258) (Version: 1 - Microsoft Corporation)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.1 - VideoLAN)
WinRAR 5.21 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.21.0 - win.rar GmbH)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-704110784-328736849-532702743-1002_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\WINDOWS\system32\igfxEM.exe (Intel Corporation)

==================== Restore Points  =========================

02-05-2015 17:33:22 Removed FlatOut2
07-05-2015 20:08:05 Wiederherstellungsvorgang
13-05-2015 16:59:20 Windows Update
16-05-2015 14:59:37 Removed Shredder.

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {080FB629-55D9-4AD3-A46A-FD916EBBED5E} - System32\Tasks\{31DDBD37-5DB7-4030-8064-10B0CAA806C3} => C:\Program Files\COMODO\COMODO Internet Security\cistray.exe
Task: {0B087CB7-4F31-477E-8D5E-F8C18D54180C} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-04-23] (Piriform Ltd)
Task: {12F6B738-A73A-4F44-842E-7AF406F73571} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-05-13] (Microsoft Corporation)
Task: {2BF1BDE9-6FC4-4027-B638-E97D5F4FBF0A} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2015-04-10] (Oracle Corporation)
Task: {302D3EAD-291D-412A-8C8A-5841FFDB23A5} - System32\Tasks\ALU => C:\Program Files (x86)\Acer\Live Updater\updater.exe [2012-11-06] ()
Task: {4B042DAA-3E20-4F9A-9514-863E876D93AD} - System32\Tasks\DeviceDetector => C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe
Task: {4E7A3090-9FED-46F0-88EF-9617FC71C6A4} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-24] (Microsoft Corporation)
Task: {5267CCD3-2130-4C4F-8253-6597C8A34B00} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-04-14] (Adobe Systems Incorporated)
Task: {5A47948A-236C-459B-9563-0F31A2CFF555} - System32\Tasks\Power Management => C:\Program Files\Acer\Acer Power Management\ePowerTray.exe [2012-10-23] (Acer Incorporated)
Task: {6D4610C5-7F46-4D1C-9462-45EB58424D12} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {720F237C-B6FC-400C-931A-3CCAB5DF0AD3} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxcontent => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-24] (Microsoft Corporation)
Task: {7926FA87-DA5C-4ECC-8267-781CFD8C0023} - System32\Tasks\ALUAgent => C:\Program Files (x86)\Acer\Live Updater\liveupdater_agent.exe [2012-06-21] ()
Task: {8ED5561B-AC38-4352-9653-1D29923F7389} - System32\Tasks\Microsoft\Windows\Setup\gwx\runappraiser => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-24] (Microsoft Corporation)
Task: {B640284A-9443-485F-ACA4-EEA591BA44A3} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-03-24] (Microsoft Corporation)
Task: {D9F0462D-76DC-4445-AB75-8E1D0695B8FC} - System32\Tasks\PMMUpdate => C:\Program Files\EgisTec IPS\PMMUpdate.exe
Task: {EAC1663F-40B1-4CFE-9A44-FEAAB2C7E5CF} - System32\Tasks\EgisUpdate => C:\Program Files\EgisTec IPS\EgisUpdate.exe
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (Whitelisted) ==============

2013-09-05 03:36 - 2013-09-05 03:36 - 00013088 _____ () C:\Program Files\NVIDIA Corporation\CoProcManager\detoured.dll
2013-09-07 02:48 - 2013-09-07 02:48 - 00011264 _____ () C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\Modules\ActivateDesktopDebugger\ActivateDesktopDebugger.dll
2013-09-07 02:45 - 2013-09-07 02:45 - 00086016 _____ () C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\Modules\Map\MAP.dll
2013-09-07 02:52 - 2013-09-07 02:52 - 00012928 _____ () C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe
2013-02-24 23:45 - 2012-06-25 04:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\WINDOWS\system32\audiodg.exe:$CmdTcID
AlternateDataStreams: C:\WINDOWS\system32\AudioEndpointBuilder.dll:$CmdTcID
AlternateDataStreams: C:\WINDOWS\system32\AudioEng.dll:$CmdTcID
AlternateDataStreams: C:\WINDOWS\system32\AUDIOKSE.dll:$CmdTcID
AlternateDataStreams: C:\WINDOWS\system32\AudioSes.dll:$CmdTcID
AlternateDataStreams: C:\WINDOWS\system32\audiosrv.dll:$CmdTcID
AlternateDataStreams: C:\WINDOWS\system32\ci.dll:$CmdTcID
AlternateDataStreams: C:\WINDOWS\system32\EncDump.dll:$CmdTcID
AlternateDataStreams: C:\WINDOWS\system32\Faultrep.dll:$CmdTcID
AlternateDataStreams: C:\WINDOWS\system32\TSWbPrxy.exe:$CmdTcID
AlternateDataStreams: C:\WINDOWS\system32\wer.dll:$CmdTcID
AlternateDataStreams: C:\WINDOWS\system32\werdiagcontroller.dll:$CmdTcID
AlternateDataStreams: C:\WINDOWS\system32\WerFault.exe:$CmdTcID
AlternateDataStreams: C:\WINDOWS\system32\WerFaultSecure.exe:$CmdTcID
AlternateDataStreams: C:\WINDOWS\system32\wermgr.exe:$CmdTcID
AlternateDataStreams: C:\WINDOWS\SysWOW64\AudioEng.dll:$CmdTcID
AlternateDataStreams: C:\WINDOWS\SysWOW64\AUDIOKSE.dll:$CmdTcID
AlternateDataStreams: C:\WINDOWS\SysWOW64\AudioSes.dll:$CmdTcID
AlternateDataStreams: C:\WINDOWS\SysWOW64\Faultrep.dll:$CmdTcID
AlternateDataStreams: C:\WINDOWS\SysWOW64\wer.dll:$CmdTcID
AlternateDataStreams: C:\WINDOWS\SysWOW64\werdiagcontroller.dll:$CmdTcID
AlternateDataStreams: C:\WINDOWS\SysWOW64\WerFault.exe:$CmdTcID
AlternateDataStreams: C:\WINDOWS\SysWOW64\WerFaultSecure.exe:$CmdTcID
AlternateDataStreams: C:\WINDOWS\SysWOW64\wermgr.exe:$CmdTcID
AlternateDataStreams: C:\WINDOWS\system32\Drivers\browserMon.sys:$CmdTcID
AlternateDataStreams: C:\WINDOWS\system32\Drivers\ssudbus.sys:$CmdTcID
AlternateDataStreams: C:\WINDOWS\system32\Drivers\ssudmdm.sys:$CmdTcID
AlternateDataStreams: C:\Users\Christian\Desktop\AdwCleaner_4.204.exe:BDU
AlternateDataStreams: C:\Users\Christian\Desktop\esetsmartinstaller_deu.exe:BDU
AlternateDataStreams: C:\Users\Christian\Desktop\FRST64.exe:BDU
AlternateDataStreams: C:\Users\Christian\Desktop\JRT.exe:BDU
AlternateDataStreams: C:\Users\Christian\Desktop\mbam-setup-2.1.6.1022.exe:BDU
AlternateDataStreams: C:\Users\Christian\Desktop\tdsskiller.exe:BDU
AlternateDataStreams: C:\Users\Christian\Downloads\Bitdefender Rescue CD - CHIP-Installer.exe:BDU
AlternateDataStreams: C:\Users\Christian\Downloads\ccsetup505_slim.exe:BDU
AlternateDataStreams: C:\Users\Christian\Downloads\Intel Turbo Boost Technology Monitor - CHIP-Installer.exe:$CmdTcID
AlternateDataStreams: C:\Users\Christian\Downloads\Intel Turbo Boost Technology Monitor - CHIP-Installer.exe:$CmdZnID
AlternateDataStreams: C:\Users\Christian\Downloads\JRT_6.7.0.exe:BDU

==================== Safe Mode (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, the associated entry will be removed from the registry.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-704110784-328736849-532702743-1001\Control Panel\Desktop\\Wallpaper ->
HKU\S-1-5-21-704110784-328736849-532702743-1002\Control Panel\Desktop\\Wallpaper -> C:\Users\Christian\Pictures\Wallpapers\467717_601845359835397_1112348978_o.jpg
DNS Servers: 192.168.178.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

HKLM\...\StartupApproved\Run: => "Bdagent"
HKLM\...\StartupApproved\Run32: => "SunJavaUpdateSched"
HKLM\...\StartupApproved\Run32: => "LManager"
HKLM\...\StartupApproved\Run32: => "KiesTrayAgent"
HKLM\...\StartupApproved\Run32: => "emsisoft anti-malware"
HKU\S-1-5-21-704110784-328736849-532702743-1002\...\StartupApproved\Run: => "DAEMON Tools Lite"
HKU\S-1-5-21-704110784-328736849-532702743-1002\...\StartupApproved\Run: => "Amazon Music"
HKU\S-1-5-21-704110784-328736849-532702743-1002\...\StartupApproved\Run: => "Bitdefender-Geldbörse-Agent"
HKU\S-1-5-21-704110784-328736849-532702743-1002\...\StartupApproved\Run: => "CCleaner Monitoring"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{8914F7EB-5C2D-479D-B142-B925A8BF5A2E}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{EAA8FA2C-25A5-4108-880D-3EB277DCEC37}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{27457105-AC88-4347-9B9D-D5A43633415B}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{7C3673CA-582A-4C53-A1A9-3738FAB25BB6}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{125D3783-B3FE-4854-9A03-1B54500F6EF9}] => (Block) C:\games\counter-strike\hl.exe
FirewallRules: [{61EA007C-BF96-428B-85DD-7A42BB91E5A5}] => (Block) C:\games\counter-strike\hl.exe
FirewallRules: [UDP Query User{BD89BFF8-0D9F-430E-A211-DF7ED21F536B}C:\games\counter-strike\hl.exe] => (Allow) C:\games\counter-strike\hl.exe
FirewallRules: [TCP Query User{D9AC218E-050C-496C-8301-F0F1033F14DD}C:\games\counter-strike\hl.exe] => (Allow) C:\games\counter-strike\hl.exe
FirewallRules: [{EB158327-2CD8-4786-8831-7ABD4BED50E5}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{F0D97D86-E00A-493E-AF46-2EE5F9EE855D}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{7F23D52C-3F8E-4A16-A7BD-87D7EB0EFBFB}] => (Allow) C:\Program Files (x86)\Acer\clear.fi SDK21\Video\VideoPlayer.exe
FirewallRules: [{F152C521-8465-42B8-8BF8-B667F1E2A063}] => (Allow) C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe
FirewallRules: [{F871B592-B65E-4D3E-B2C9-D2B98DCD8032}] => (Allow) C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe
FirewallRules: [{1928E3AD-0F76-46CA-A8D0-6ADB77113317}] => (Allow) C:\Program Files (x86)\Spotify\spotify.exe
FirewallRules: [{AA582F3A-F1E1-4698-86A5-962D3EC6DCAA}] => (Allow) C:\Program Files (x86)\Spotify\spotify.exe
FirewallRules: [{5F9A7A9C-78E4-441B-AE04-F4E2B1A1ACCB}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [{F02043A8-87CB-401C-8B94-A5B19A2F28C0}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [{2CCE4E60-ECB6-478B-8625-52E7796ECA9C}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\nmrih\sdk\hl2.exe
FirewallRules: [{47EF2E1C-8B6B-4B67-8D7E-1CD8B1469A21}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\nmrih\sdk\hl2.exe
FirewallRules: [{1774D4DE-9C7E-4982-AB47-25A7E2EF61DE}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\DayZ\DayZ.exe
FirewallRules: [{DF2EDA05-C720-41AE-8439-9D8931D9788C}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\DayZ\DayZ.exe
FirewallRules: [TCP Query User{EFE0391D-C338-49D6-B395-7668C5C820D7}C:\program files (x86)\tmnationsforever\tmforever.exe] => (Block) C:\program files (x86)\tmnationsforever\tmforever.exe
FirewallRules: [UDP Query User{3BD5EF1D-9519-4AC7-93B9-9FDE236FC4D8}C:\program files (x86)\tmnationsforever\tmforever.exe] => (Block) C:\program files (x86)\tmnationsforever\tmforever.exe
FirewallRules: [{D86477A0-F68D-40C1-A330-A2BAA874A994}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\DayZ\DayZ_BE.exe
FirewallRules: [{C6E9EDBD-CAC1-482A-A9D6-B40F706E7822}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\DayZ\DayZ_BE.exe
FirewallRules: [{0F74897A-69CD-45CE-9BB1-AC90CD3F117B}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Sniper Elite 3\Launcher\Sniper3Launcher.exe
FirewallRules: [{DAF9DFF3-63CF-4137-B09A-5E9842C967B7}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Sniper Elite 3\Launcher\Sniper3Launcher.exe
FirewallRules: [{2D7F0786-DB0B-46A5-A3AA-124EE5C92503}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{30589744-1C80-41A2-AA24-A2ADCDD78136}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{3DCD2A4F-ED6B-4AE7-A5C9-E0E109EDAAF8}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Resident Evil Biohazard HD REMASTER\bhd.exe
FirewallRules: [{47270464-A214-4C74-91A9-1BC9F1884D9D}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Resident Evil Biohazard HD REMASTER\bhd.exe
FirewallRules: [{71D62F29-EDC2-4BD2-A01C-E19E1F4C8B68}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\GarrysMod\hl2.exe
FirewallRules: [{A4DF7617-5674-4749-881E-FD7353D4CA12}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\GarrysMod\hl2.exe
FirewallRules: [{3B534B64-9921-4033-8511-653CDDCB7D0B}] => (Allow) C:\Program Files (x86)\DVDVideoSoft\Free Torrent Download\FreeTorrentDownload.exe
FirewallRules: [{19402204-D1A6-48BE-8345-13033241418A}] => (Allow) C:\Program Files (x86)\DVDVideoSoft\Free Torrent Download\FreeTorrentDownload.exe
FirewallRules: [{284847C8-D0A1-4705-9357-969C929FB4A9}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Stranded Deep\Stranded_Deep_x64.exe
FirewallRules: [{00A9EE9B-2CE3-49A7-BABD-A86BDA9A1031}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Stranded Deep\Stranded_Deep_x64.exe
FirewallRules: [TCP Query User{DE3DEE63-63F2-41B1-BC47-7DF852308F12}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{A8BF8E59-12E0-447D-87BE-D0E93613C1EE}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [{EAF2E745-5006-45A5-9D77-974A39042A7D}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Portal 2\portal2.exe
FirewallRules: [{D287467F-960E-474F-A846-624490942395}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Portal 2\portal2.exe
FirewallRules: [{D24A8E01-FA14-487B-855F-A8D4C6046D4C}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Portal\hl2.exe
FirewallRules: [{78362A2A-81CB-46A6-BBB3-70831E2432FF}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Portal\hl2.exe
FirewallRules: [TCP Query User{13EECDE0-D1D7-4BBB-BC95-8D948E2E0C03}C:\games\counter-strike\hltv.exe] => (Block) C:\games\counter-strike\hltv.exe
FirewallRules: [UDP Query User{CB8C579F-2423-4CF8-952D-CBA419E1E034}C:\games\counter-strike\hltv.exe] => (Block) C:\games\counter-strike\hltv.exe
FirewallRules: [{0E9E5F8F-61BA-49C8-A2B6-0589157BB26F}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\RisingWorld\risingworldx64.exe
FirewallRules: [{E92DDF0B-450E-4847-A243-9FE4E29C80AF}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\RisingWorld\risingworldx64.exe

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (05/19/2015 04:39:25 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest.

Error: (05/19/2015 00:55:52 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest.

Error: (05/19/2015 00:37:36 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest.

Error: (05/19/2015 00:13:42 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest.

Error: (05/19/2015 00:13:39 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest.

Error: (05/19/2015 03:10:40 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest.

Error: (05/19/2015 03:10:21 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest.

Error: (05/19/2015 03:00:53 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest.

Error: (05/19/2015 03:00:50 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest.

Error: (05/19/2015 03:00:45 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest.


System errors:
=============
Error: (05/19/2015 00:11:27 PM) (Source: DCOM) (EventID: 10016) (User: Chris)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}ChrisChristianS-1-5-21-704110784-328736849-532702743-1002LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar

Error: (05/19/2015 00:11:27 PM) (Source: DCOM) (EventID: 10016) (User: Chris)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}ChrisChristianS-1-5-21-704110784-328736849-532702743-1002LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar

Error: (05/19/2015 00:10:53 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "NTI IScheduleSvc" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error: (05/19/2015 00:10:44 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "CCDMonitorService" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error: (05/19/2015 03:09:41 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "NTI IScheduleSvc" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error: (05/19/2015 03:09:37 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "CCDMonitorService" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error: (05/19/2015 03:08:56 AM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: Der Dienst "Bitdefender Virus Shield" wurde nicht richtig gestartet.

Error: (05/19/2015 02:58:04 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "NTI IScheduleSvc" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error: (05/19/2015 02:57:59 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "CCDMonitorService" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error: (05/19/2015 02:57:16 AM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: Der Dienst "Bitdefender Virus Shield" wurde nicht richtig gestartet.


Microsoft Office Sessions:
=========================
Error: (05/19/2015 04:39:25 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifestC:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe

Error: (05/19/2015 00:55:52 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifestC:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe

Error: (05/19/2015 00:37:36 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifestC:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe

Error: (05/19/2015 00:13:42 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifestC:\Users\Christian\Desktop\esetsmartinstaller_deu.exe

Error: (05/19/2015 00:13:39 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifestC:\Users\Christian\Desktop\esetsmartinstaller_deu.exe

Error: (05/19/2015 03:10:40 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifestC:\Users\Christian\Desktop\esetsmartinstaller_deu.exe

Error: (05/19/2015 03:10:21 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifestC:\Users\Christian\Desktop\esetsmartinstaller_deu.exe

Error: (05/19/2015 03:00:53 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifestC:\Users\Christian\Desktop\esetsmartinstaller_deu.exe

Error: (05/19/2015 03:00:50 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifestC:\Users\Christian\Desktop\esetsmartinstaller_deu.exe

Error: (05/19/2015 03:00:45 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifestC:\Users\Christian\Desktop\esetsmartinstaller_deu.exe


CodeIntegrity Errors:
===================================
  Date: 2015-05-13 23:56:45.402
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume4\Program Files (x86)\Emsisoft Anti-Malware\a2hooks64.dll that did not meet the Store signing level requirements.

  Date: 2015-05-13 23:56:45.401
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume4\Program Files (x86)\Emsisoft Anti-Malware\a2hooks64.dll that did not meet the Store signing level requirements.

  Date: 2015-05-13 23:56:45.399
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume4\Program Files (x86)\Emsisoft Anti-Malware\a2hooks64.dll that did not meet the Store signing level requirements.

  Date: 2015-05-11 14:48:42.679
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume4\Program Files (x86)\Emsisoft Anti-Malware\a2hooks64.dll that did not meet the Store signing level requirements.

  Date: 2015-05-11 14:48:42.679
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume4\Program Files (x86)\Emsisoft Anti-Malware\a2hooks64.dll that did not meet the Store signing level requirements.

  Date: 2015-01-31 13:51:47.962
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.

  Date: 2015-01-31 13:45:00.126
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.

  Date: 2015-01-31 13:31:35.632
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.

  Date: 2015-01-31 13:09:29.143
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.

  Date: 2015-01-31 12:38:57.223
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.


==================== Memory info ===========================

Processor: Intel(R) Core(TM) i7-3632QM CPU @ 2.20GHz
Percentage of memory in use: 28%
Total physical RAM: 8010.27 MB
Available physical RAM: 5748.23 MB
Total Pagefile: 9290.27 MB
Available Pagefile: 5981.02 MB
Total Virtual: 131072 MB
Available Virtual: 131071.83 MB

==================== Drives ================================

Drive c: (Acer) (Fixed) (Total:913.26 GB) (Free:702.79 GB) NTFS
Drive e: (Maxtor) (Fixed) (Total:372.61 GB) (Free:346.17 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: 6CCEFCDC)

Partition: GPT Partition Type.

========================================================
Disk: 1 (Size: 372.6 GB) (Disk ID: 579306D9)
Partition 1: (Active) - (Size=372.6 GB) - (Type=07 NTFS)

==================== End Of Log ============================

Chris2128 21.05.2015 11:26
habe noch zwei brobleme jetzt :(

- wenn ich bitdefender jetzt wieder installieren will kommt die meldung: ,,sind sie sich sicher dass sie Malwarebytes Anti-Malware und ihre dazugehörigen Komponennten entfernen wollen?"

- Hab bluescreen bekommen mit fehlermeldung: ,,KERNEL_DATA_INPAGE_ERROR"

Lg Christian

Bootsektor 31.05.2015 22:21
Hallo,

trat der Fehler denn nun gehäuft auf, oder war das eine einmalige Geschichte?

Ich würd ESET kaufen, git auch Rabatt für TB-Mitglieder. ;)
Zitat:
C:\Users\Christian\Downloads\Bitdefender Rescue CD - CHIP-Installer.exe
Pass mit den Sachen von Chip.de auf.

Chip installiert gerne mit seinen Downloadern andere Programme. Wenn du dazu noch was lesen möchtest:
Hier
Hier
Hier
Auch versuchen sich immer mehr Programme durch Installationsroutinen auf den PC "durchzumogeln". Das klappt ganz gut, weil viele Anwender sich diese nicht genau durchlesen und schnell durchklicken. Manchmal steht auch in den Lizenzvereinbarungen, dass ein Programm, was eigentlich als Freeware angepriesen wird, nur genutzt werden kann, wenn man sich bestimmte Toolbars oder andere Programme mitinstallieren lässt.
Da hilft es nur aufmerksam zu sein.


Wo findet Bitdefender noch etwas?

Chris2128 31.05.2015 23:22
Hallöchen :)

Ja denke das war ne einmalige Geschichte hoffe ich :)

Das klingt gut denn entscheide ich mich für e set ;) ist auch Kosten günstiger

Gibts denn n sicheres portal für freeware? ja mit den toolbars und zusatz programmen passe ich schon immer auf :) ich weiß ja wohin ein falscher klick führen kann ;)

Also Bitdefender hat nach dem fix log immernoch cross raider gefunden glaub immer in Temp dateien, denn musste ich bitdefenden ja deinstallieren für den eset scanner (der auch was gefunden hat) da bitdefender sich nicht ausschalten lässt und als ich ihn wieder installieren wollte kam die meldung ob ich sicher bin dass ich Malwarebytes Anti-Malware mit allen dazugehörigen komponenten entfernen will da hab ich denn auf nein geklickt und dadurch hat er bitdefender ja nicht installiert. aber ist ja eigentlich nebensächlich will erstmal mein lappi hauptsächlich wieder clean kriegen.
unter C:/ hab ich auch immernoch den ordner Spacekace vorher nicht da war

Liebe Grße Christian :)

Bootsektor 02.06.2015 22:12
Hallo,

ich muss mich korrigieren, du bekommst auf AV's von Emsisoft Rabatt nicht ESET.

Zitat:
Gibts denn n sicheres portal für freeware?
Kommt drauf an, was du suchst. Filepony.de ist gut. :)

Schritt 1

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
C:\Spacekace
emptytemp:

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.



Sind jetzt noch Probleme vorhanden?

Chris2128 02.06.2015 23:02
Hi

ach so ja auch nicht so schlimm werde mir ESET Kaufen ;)

Code:
Fix result of Farbar Recovery Scan Tool (x64) Version: 29-05-2015
Ran by Christian at 2015-06-02 23:47:04 Run:2
Running from C:\Users\Christian\Desktop
Loaded Profiles: UpdatusUser & Christian (Available Profiles: UpdatusUser & Christian)
Boot Mode: Normal
==============================================

fixlist content:
*****************
C:\Spacekace
emptytemp:
*****************

C:\Spacekace => Moved successfully.
EmptyTemp: => Removed 411.3 MB temporary data.


The system needed a reboot.

==== End of Fixlog 23:47:43 ====

Ja probleme soweit nicht aber ne frage noch,
muss ich die funde von Malwarebytes Anti-Malware nicht noch irgendwie löschen?

also die hier

Code:
Malwarebytes Anti-Malware
www.malwarebytes.org

Suchlauf Datum: 18.05.2015
Suchlauf-Zeit: 17:12:47
Logdatei: MBAM.txt
Administrator: Ja

Version: 2.01.6.1022
Malware Datenbank: v2015.05.18.04
Rootkit Datenbank: v2015.05.16.01
Lizenz: Testversion
Malware Schutz: Aktiviert
Bösartiger Webseiten Schutz: Aktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 8.1
CPU: x64
Dateisystem: NTFS
Benutzer: Christian

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 415578
Verstrichene Zeit: 33 Min, 53 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(Keine schädliche Elemente gefunden)

Module: 0
(Keine schädliche Elemente gefunden)

Registrierungsschlüssel: 1
PUP.Optional.Babylon.A, HKU\S-1-5-18\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}, In Quarantäne, [001cf99cfe8c999d7c995402d92ae31d],

Registrierungswerte: 0
(Keine schädliche Elemente gefunden)

Registrierungsdaten: 0
(Keine schädliche Elemente gefunden)

Ordner: 3
PUP.Optional.CrossRider.A, C:\Program Files (x86)\CinemaPlus-3.2cV07.05, In Quarantäne, [96866e271d6dc96dbbdda72f0300dd23],
PUP.Optional.MultiPlug.A, C:\Users\Christian\AppData\Roaming\EB656F00-1431019934-815C-2C4C-7054D2E15182, In Quarantäne, [d943d7bed2b8162010fab0baea1bb14f],
PUP.Optional.EduApp.A, C:\Program Files (x86)\Edu App, In Quarantäne, [78a4870ed5b563d390eea62d6b981ce4],

Dateien: 3
PUP.Optional.CrossRider.A, C:\Program Files (x86)\CinemaPlus-3.2cV07.05\bgNova.html, In Quarantäne, [96866e271d6dc96dbbdda72f0300dd23],
PUP.Optional.MultiPlug.A, C:\Users\Christian\AppData\Roaming\EB656F00-1431019934-815C-2C4C-7054D2E15182\vnsg61F2.tmp, In Quarantäne, [d943d7bed2b8162010fab0baea1bb14f],
PUP.Optional.EduApp.A, C:\Program Files (x86)\Edu App\firefox@eduapphome.com.xpi, In Quarantäne, [78a4870ed5b563d390eea62d6b981ce4],

Physische Sektoren: 0
(Keine schädliche Elemente gefunden)


(end)

Bootsektor 07.06.2015 21:15
Hallo,

nö, die sind in Quarantäne.

Gut, dann

OK
So wie ich es sehe, haben wir damit alles Schadhafte entfernt. Deine Logs sind sauber.
Abschließend räumen wir noch etwas auf, führen Updates durch und dann bekommst du noch etwas Lesestoff von mir.

Schritt 1
Downloade dir bitte delfix auf deinen Desktop.
  • Schließe alle offenen Programme.
  • Starte die delfix.exe mit einem Doppelklick.
  • Setze vor jede Funktion ein Häkchen.
  • Klicke auf Start.
  • DelFix entfernt u. a. alle verwendeten Programme und löscht sich abschließend selbst.
Falls nach Delfix noch Programme aus unserer Bereinigung vorhanden sein sollten, kannst du diese nun bedenkenlos löschen.

Schritt 2

Falls Du Malwarebytes-Antimalware und den ESET-Onlinescan nicht mehr benötigst, kannst Du beide Programme einfach über die Programmdeinstallation deinstallieren.
Ich empfehle Dir aber zumindest Malwarebytes zu behalten, und damit einmal die Woche einen Kontrollscan zu machen.


Updates / Programme aktualisieren
  • Adobe Reader
Dein Adobe Reader ist veraltet.
Deinstalliere Deinen Reader und lade Dir die neueste Version von hier herunter. Schaue, ob sich noch etwas mit installieren möchte und entferne den Haken gegebenenfalls.
  • FlashPlayer
Deine FlashPlayer für Firefox und den Internet Explorer sind nicht mehr aktuell.
  • Deinstalliere die alten Versionen.
  • Öffne nacheinander mit beiden Browsern folgenden Link Adobe - Adobe Flash Player installieren und lade Dir von dort die neueste Version herunter.
  • Falls sich dort etwas anderes als der FlashPlayer noch zusätzlich mitinstallieren möchte, entferne den Haken dort.
Aktualisierung einstellen
Stelle sicher, dass dein FlashPlayer nach Updates sucht. Den FlashPlayer kann man direkt bei der Installation so konfigurieren, dass er nach Updates automatisch sucht, nachträglich kann man das über folgenden Link machen:
Adobe - Flash Player: Einstellungsmanager - Globale Benachrichtigungseinstellungen
  • Java
Dein Java ist nicht mehr aktuell.
Java ist eine große Sicherheitslücke auf deinem System, es werden immer wieder neue Schwachstellen entdeckt, die ausgenutzt werden um Rechner zu infizieren.
Sofern du Java nicht zwingend benötigst, solltest du es komplett deinstallieren.

Windows XP
Gehe auf:
Start --> Systemsteuerung --> Software --> Javaversionen auswählen --> entfernen
Windows Vista
Gehe auf:
Start --> Systemsteuerung -- > Programme --> Programme deinstallieren --> Javaversionen suchen --> entfernen
Windows 7
Dazu gehe auf:
den Windowsbutton in der Taskleiste --> Systemsteuerung --> Programme (Unterpunkt Programme deinstallieren) --> Javaversionen auswählen --> entfernen
Windows 8
Dazu drücke auf:
Windowstaste und X
dann:
Programme und Funktionen -->Javaversionen auswählen --> entfernen

Falls du Java doch unbedingt benötigst, dann
  • Downloade dir bitte die neueste Java-Version von hier
  • Speichere die jxpiinstall.exe
  • Schließe alle laufenden Programme. Speziell deinen Browser.
  • Starte die jxpiinstall.exe. Diese wird den Installer für die neueste Java Version ( Java 8 Update 45 ) herunter laden.
  • Entferne den Haken bei "Installieren Sie die Ask-Toolbar ..." während der Installation.
  • Wenn die Installation beendet wurde
    Start --> Systemsteuerung --> Programme und deinstalliere alle älteren Java Versionen.
  • Starte deinen Rechner neu sobald alle älteren Versionen deinstalliert wurden.
Nach dem Neustart
  • Öffne erneut die Systemsteuerung --> Programme und klicke auf das Java Symbol.
  • Im Reiter Allgemein, klicke unter Temporäre Internetdateien auf Einstellungen.
  • Klicke auf Dateien löschen....
  • Gehe sicher das überall ein Haken gesetzt ist und klicke OK.
  • Klicke erneut OK.

und sorge dafür, dass Java automatisch updated.
Dazu:
  • öffne Java
  • klicke auf den Reiter Update
  • klicke auf: Benachrichtung ausgeben: Vor dem Download setze den Haken bei Automatisch nach Updates suchen
  • klicke auf Erweitert
  • ändere das Intervall mindestens auf wöchentlich
und schalte das Browser-Plugin aus.
Hier findest du eine Anleitung dazu.

Nun zum Schluss noch ein paar Tipps zur Absicherung deines Systems.

Ändere regelmäßig alle deine Passwörter, jetzt, nach der Bereinigung ist ein idealer Zeitpunkt dafür
  • verwende für jede Anwendung und jeden Account ein anderes Passwort
  • ändere regelmäßig dein Passwort, vor allem bei Onlinebanking oder deinem Emailpostfach ist dieses sehr wichtig
  • speichere keine Passwörter auf deinem PC, gib diese nicht an dritte weiter
  • ein sicheres Passwort besteht aus mindestens 8 Zeichen und beinhaltet Groß- und Kleinbuchstaben, Zahlen, und Sonderzeichen
  • benutze keine Zahlen- oder Buchstabenkombinationen, ( zB 12345678, qwertzui) auch keine Zahlen oder Buchstabenmuster
  • verwende keine Passwörter die einen Bezug zu dir, deinem Wohnort, Familienmitglied oder Haustier (Geburtsdatum, Postleitzahl, Adresse, Name) haben


Aktualität des Systems
Es ist extrem wichtig, dass sowohl dein System als auch die darauf installierte sicherheitsrelevante Software (Flash Player, PDF-Reader und besonders Java, sofern vorhanden) aktuell sind.
  • Bitte überprüfe, ob dein System Windows Updates automatisch herunter lädt
  • Windows Updates
    • Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
    • Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
  • Gehe sicher das die automatischen Updates aktiviert sind.

Antivirensoftware
  • Gehe sicher immer eine Antiviren Software installiert zu haben und halte diese unbedingt aktuell.

Zusätzlicher Schutz
  • MalwareBytes Anti-Malware
    Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On-Demand Scantool welches viele aktuelle Malware erkennt und auch entfernt.
    Aktualisiere das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
    Ein Tutorial zur Verwendung findest Du hier.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der Internet Explorer, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
  • Opera
  • Mozilla Firefox.
    • Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
    • NoScript
      Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
    • AdblockPlus
      Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf einen Banner um diesen zu AdBlockPlus hinzuzufügen reicht und dieser wird nicht mehr geladen.
      Es spart ausserdem Downloadkapazität.


Systemleistung
Lösche regelmäßig deine temporären Dateien. Ich empfehle hierzu die Datenträgerbereinigung von Windows.
Windows Vista
  • Klicke unten links auf das Vistasymbol
  • Gehe auf Programme -> Zubehör -> Systemprogramme -> Datenträgerbereinigung
  • Wähle nun Dateien von allen Benutzern des Computers aus und bestätige mit OK
  • Setze den Haken bei den zu löschenden Dateien zusätzlich bei Temporäre Dateien
  • Bestätige mit OK
  • Bestätige dass du die Dateien unwiderruflich löschen möchtest

Windows 7
  • Gehe auf das Windowsstartsymbol
  • Gebe im Suchfeld Datenträgerrereinigung ein
  • Setze den Haken zusätzlich bei Temporäre Dateien
  • Bestätige mit OK

Windows 8
  • Rechtsklicke in die untere linke Ecke deines Bildschirms
  • Klicke auf Suchen
  • Klicke auf Einstellungen
  • Gebe im Suchfeld Datenträgerbereinigung ein
  • Klicke in den Einstellungen auf der linken Seite nun auf Speicherplatz durch Löschen nicht erforderlicher Dateien freigeben
  • Setze den Haken zusätzlich bei Temporäre Dateien
  • Bestätige mit OK
  • Bestätige dass du die Dateien unwiderruflich löschen möchtest

Halte dich fern von jeglichen Registry Cleanern.
Diese schaden deinem System mehr als dass sie es schneller machen.

Verhaltensregeln zum sichereren Surfen
  • Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
  • verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
  • Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
  • Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe
  • Achte besonders bei der Installation von Programmen darauf, ob sich weitere Software mitinstallieren möchte, wähle wo immer es geht die benutzerdefinierte Installation und wähle alles ab, was nichts mit dem Programm zu tun hat, welches du dir installieren möchtest.

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind.

Falls Du Lob oder Kritik abgeben möchtest, kannst Du das sehr gerne hier tun.

Wenn Du etwas für das Forum und unsere Arbeit spenden möchtest, so kannst Du das hier tun.

Chris2128 09.06.2015 18:06
Hi Sandra :)

Hab jetzt alle schritte abgearbeitet und kann dir gar nicht genug für alles danken

also Vielen vielen vielen vielen vielen vielen vielen vielen Dank für alles Sandra :)


Alle Zeitangaben in WEZ +1. Es ist jetzt 08:55 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131